@brainervirus/workit-opencode 8.36.0 → 8.37.0

package/dist/plugin.js

@@ -1,3 +1,181 @@
+// packages/workit-core/src/hooks/budget-signal.ts
+import { createHash as createHash2 } from "node:crypto";
+import fs2 from "node:fs";
+import path2 from "node:path";
+
+// packages/workit-core/src/hooks/standing-signal.ts
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+var gitStoreDir = (cwd) => {
+  try {
+    for (let dir = path.resolve(cwd);; dir = path.dirname(dir)) {
+      const dotGit = path.join(dir, ".git");
+      if (fs.existsSync(dotGit)) {
+        let gitDir = dotGit;
+        if (fs.statSync(dotGit).isFile()) {
+          const target = /^gitdir:\s*(.+)$/mu.exec(fs.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+          if (!target)
+            return null;
+          gitDir = path.resolve(dir, target);
+          const common = path.join(gitDir, "commondir");
+          if (fs.existsSync(common))
+            gitDir = path.resolve(gitDir, fs.readFileSync(common, "utf8").trim());
+        }
+        return path.join(gitDir, "workit");
+      }
+      if (path.dirname(dir) === dir)
+        return null;
+    }
+  } catch {
+    return null;
+  }
+};
+var standingRevFile = (store) => path.join(store, "standing", "rev");
+var standingSeenFile = (store, session, agentId) => path.join(store, "standing", "seen", `${createHash("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`);
+var readStandingRev = (store) => {
+  try {
+    return fs.readFileSync(standingRevFile(store), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+};
+var readStandingSeen = (file) => {
+  try {
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    return {
+      rev: typeof value.rev === "string" ? value.rev : null,
+      ids: Array.isArray(value.ids) ? value.ids.filter((id) => typeof id === "string") : []
+    };
+  } catch {
+    return { rev: null, ids: [] };
+  }
+};
+var writeStandingSeen = (file, seen) => {
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(seen));
+  } catch {}
+};
+
+// packages/workit-core/src/hooks/budget-signal.ts
+var hash = (text) => createHash2("sha256").update(text).digest("hex").slice(0, 32);
+var budgetDir = (store) => path2.join(store, "budget");
+var agentBase = (store, session, agentId) => path2.join(budgetDir(store), hash(`${session}\x00${agentId ?? ""}`));
+var spawnsFile = (store, session) => path2.join(budgetDir(store), `spawns-${hash(session)}.jsonl`);
+var spawnBudget = (prompt) => {
+  const found = /^TIMEBOX:[^\n]*?\b(\d+)\s+tool calls\b/mu.exec(prompt);
+  const n = found ? Number(found[1]) : NaN;
+  return Number.isInteger(n) && n > 0 ? n : null;
+};
+var noteSpawnBudget = (cwd, session, type, prompt) => {
+  try {
+    const store = session ? gitStoreDir(cwd) : null;
+    if (!store)
+      return;
+    fs2.mkdirSync(budgetDir(store), { recursive: true });
+    fs2.appendFileSync(spawnsFile(store, session), `${JSON.stringify({ type: type ?? "", n: spawnBudget(prompt) })}
+`);
+  } catch {}
+};
+var readBudget = (file) => {
+  try {
+    const { limit, told } = JSON.parse(fs2.readFileSync(file, "utf8"));
+    return typeof limit === "number" && limit > 0 ? { limit, told: Number(told) || 0 } : null;
+  } catch {
+    return null;
+  }
+};
+var claimSpawnBudget = (cwd, session, agentId, agentType) => {
+  try {
+    const store = session ? gitStoreDir(cwd) : null;
+    if (!store)
+      return null;
+    const file = spawnsFile(store, session);
+    const entries = fs2.readFileSync(file, "utf8").split(`
+`).filter(Boolean).map((line) => JSON.parse(line));
+    const at = entries.findIndex((entry) => entry.type === (agentType ?? ""));
+    if (at < 0)
+      return null;
+    const [{ n }] = entries.splice(at, 1);
+    fs2.writeFileSync(file, entries.map((entry) => `${JSON.stringify(entry)}
+`).join(""));
+    if (typeof n !== "number" || n <= 0)
+      return null;
+    startBudget(store, session, agentId, n);
+    return n;
+  } catch {
+    return null;
+  }
+};
+var startBudget = (store, session, agentId, n) => {
+  const dir = budgetDir(store);
+  fs2.mkdirSync(dir, { recursive: true });
+  const cutoff = Date.now() - 604800000;
+  for (const name of fs2.readdirSync(dir))
+    try {
+      if (fs2.statSync(path2.join(dir, name)).mtimeMs < cutoff)
+        fs2.rmSync(path2.join(dir, name));
+    } catch {}
+  const base = agentBase(store, session, agentId);
+  fs2.writeFileSync(`${base}.json`, JSON.stringify({ limit: n, told: 0 }));
+  fs2.rmSync(`${base}.calls`, { force: true });
+};
+var tickBudget = (cwd, session, agentId) => {
+  try {
+    const store = session ? gitStoreDir(cwd) : null;
+    if (!store)
+      return false;
+    const base = agentBase(store, session, agentId);
+    const budget = readBudget(`${base}.json`);
+    if (!budget)
+      return false;
+    fs2.appendFileSync(`${base}.calls`, ".");
+    return fs2.statSync(`${base}.calls`).size >= budget.limit * (budget.told + 1);
+  } catch {
+    return false;
+  }
+};
+var lineFor = (calls) => `Tool-call budget reached (${calls}): commit your work, write your report, stop.`;
+var reachedOf = (cwd, session, agentId) => {
+  const store = session ? gitStoreDir(cwd) : null;
+  const base = store && agentBase(store, session, agentId);
+  const budget = base && readBudget(`${base}.json`);
+  if (!budget)
+    return null;
+  return { base, budget, reached: Math.floor(fs2.statSync(`${base}.calls`).size / budget.limit) };
+};
+var budgetStanding = (cwd, session, agentId) => {
+  try {
+    const at = reachedOf(cwd, session, agentId);
+    return at && at.reached > 0 ? lineFor(at.budget.limit * at.reached) : null;
+  } catch {
+    return null;
+  }
+};
+var CODEX_GATED = new Set(["bash", "unifiedexec", "shell", "applypatch", "edit", "write"]);
+
+// packages/workit-opencode/src/v2/budget.ts
+var claimed = new Set;
+var observeBudget = (root, event, children) => {
+  try {
+    const parent = children.get(event.sessionID);
+    if (parent) {
+      if (!claimed.has(event.sessionID)) {
+        claimed.add(event.sessionID);
+        claimSpawnBudget(root, parent, event.sessionID, null);
+      }
+      tickBudget(root, parent, event.sessionID);
+      return;
+    }
+    if (event.tool !== "subagent")
+      return;
+    const fields = event.input && typeof event.input === "object" ? Object.values(event.input) : [];
+    const prompt = fields.find((field) => typeof field === "string" && field.includes("TIMEBOX:"));
+    noteSpawnBudget(root, event.sessionID, null, prompt ?? "");
+  } catch {}
+};
+
 // node_modules/@opencode/plugin/dist/promise/plugin.js
 function define(plugin) {
   return plugin;
@@ -6,10 +184,10 @@ function define(plugin) {
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync16 } from "node:child_process";
 import { existsSync as existsSync9, realpathSync as realpathSync5 } from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
-import { createHash, randomUUID } from "node:crypto";
+import { createHash as createHash3, randomUUID } from "node:crypto";
 
 // node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -6920,7 +7098,7 @@ function canonicalJson(value) {
 function sha256(value) {
   if (typeof value === "string" && invalidUnicode(value))
     throw new TypeError("invalid Unicode");
-  return createHash("sha256").update(typeof value === "string" ? value : canonicalJson(value), "utf8").digest("hex");
+  return createHash3("sha256").update(typeof value === "string" ? value : canonicalJson(value), "utf8").digest("hex");
 }
 function newId() {
   return randomUUID().toLowerCase();
@@ -7453,9 +7631,9 @@ function parseAdvertisedOperation(family, input, host) {
   return invalidOperation(family, request, parsed.error);
 }
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
-import * as fs10 from "node:fs";
-import path12 from "node:path";
+import { createHash as createHash11, randomUUID as randomUUID3 } from "node:crypto";
+import * as fs12 from "node:fs";
+import path14 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/errors.js
 var OPERATIONAL_CODES = new Set([
@@ -7506,10 +7684,10 @@ function sameFileIdentity(left, right, platform = process.platform) {
 // node_modules/@openclaw/fs-safe/dist/sidecar-lock-reclaim.js
 import { randomBytes } from "node:crypto";
 import fsSync from "node:fs";
-import path from "node:path";
+import path3 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/bounded-read.js
-import fs from "node:fs";
+import fs3 from "node:fs";
 
 // node_modules/@openclaw/fs-safe/dist/byte-budget.js
 function normalizeMaxBytes(value, options = {}) {
@@ -7546,7 +7724,7 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
   let total = 0;
   while (true) {
     const length = nextReadLength(total, maxBytes, scratch.length);
-    const bytesRead = fs.readSync(fd, scratch, 0, length, null);
+    const bytesRead = fs3.readSync(fd, scratch, 0, length, null);
     if (bytesRead === 0) {
       return Buffer.concat(chunks, total);
     }
@@ -7555,9 +7733,9 @@ function readFileDescriptorBoundedSync(fd, maxBytes) {
 }
 
 // node_modules/@openclaw/fs-safe/dist/read-open-flags.js
-import fs2 from "node:fs";
+import fs4 from "node:fs";
 function resolveReadOpenFlags(options) {
-  const constants = options?.constants ?? fs2.constants;
+  const constants = options?.constants ?? fs4.constants;
   const noFollow = process.platform !== "win32" && options?.followSymlinks !== true && typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
   const nonBlocking = process.platform !== "win32" && typeof constants.O_NONBLOCK === "number" ? constants.O_NONBLOCK : 0;
   return constants.O_RDONLY | noFollow | nonBlocking;
@@ -7596,13 +7774,13 @@ ${ownershipToken}
   return { raw, ownershipToken };
 }
 function relativeSidecarLockPath(lockRoot, lockPath) {
-  const resolved = path.resolve(lockPath);
-  const lexicalRelative = path.relative(lockRoot.rootDir, resolved);
-  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path.sep}`) && !path.isAbsolute(lexicalRelative) ? lexicalRelative : path.relative(lockRoot.rootReal, resolved);
-  if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  const resolved = path3.resolve(lockPath);
+  const lexicalRelative = path3.relative(lockRoot.rootDir, resolved);
+  const relative = lexicalRelative !== ".." && !lexicalRelative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(lexicalRelative) ? lexicalRelative : path3.relative(lockRoot.rootReal, resolved);
+  if (!relative || relative === ".." || relative.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock path is outside lockRoot");
   }
-  return relative.split(path.sep).join(path.posix.sep);
+  return relative.split(path3.sep).join(path3.posix.sep);
 }
 function parseSidecarLockPayload(raw, parser) {
   if (parser) {
@@ -7748,8 +7926,8 @@ function getFsSafeLockConfig() {
 }
 
 // node_modules/@openclaw/fs-safe/dist/file-lock-sync.js
-import fs3 from "node:fs";
-import path2 from "node:path";
+import fs5 from "node:fs";
+import path4 from "node:path";
 
 // node_modules/@openclaw/fs-safe/dist/timing.js
 function sleepSync(ms) {
@@ -7779,7 +7957,7 @@ function releaseAllSyncHeldLocks() {
     }
     try {
       if (held.fd !== undefined)
-        fs3.closeSync(held.fd);
+        fs5.closeSync(held.fd);
     } catch {}
     try {
       removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
@@ -7814,7 +7992,7 @@ function releaseSyncHeldLock(held) {
   if (held.fd !== undefined) {
     const fd = held.fd;
     held.fd = undefined;
-    fs3.closeSync(fd);
+    fs5.closeSync(fd);
   }
   removeSidecarLockIfUnchangedSync(held.lockPath, held.snapshot);
   heldLocks.delete(held.normalizedTargetPath);
@@ -7837,29 +8015,29 @@ function createSyncHeldLockHandle(held) {
   };
 }
 function canonicalLockParentSync(parent) {
-  return process.platform === "win32" ? fs3.realpathSync.native(parent) : fs3.realpathSync(parent);
+  return process.platform === "win32" ? fs5.realpathSync.native(parent) : fs5.realpathSync(parent);
 }
 function normalizeTargetPath(targetPath) {
-  const resolved = path2.resolve(targetPath);
-  fs3.mkdirSync(path2.dirname(resolved), { recursive: true });
+  const resolved = path4.resolve(targetPath);
+  fs5.mkdirSync(path4.dirname(resolved), { recursive: true });
   try {
-    return path2.join(canonicalLockParentSync(path2.dirname(resolved)), path2.basename(resolved));
+    return path4.join(canonicalLockParentSync(path4.dirname(resolved)), path4.basename(resolved));
   } catch {
     return resolved;
   }
 }
 function boundedLockPath(lockPath, lockRoot) {
-  const resolved = path2.resolve(lockPath);
+  const resolved = path4.resolve(lockPath);
   if (!lockRoot)
     return resolved;
   relativeSidecarLockPath(lockRoot, resolved);
-  const parent = path2.dirname(resolved);
+  const parent = path4.dirname(resolved);
   const parentReal = canonicalLockParentSync(parent);
-  const parentRelative = path2.relative(lockRoot.rootReal, parentReal);
-  if (parentRelative === ".." || parentRelative.startsWith(`..${path2.sep}`) || path2.isAbsolute(parentRelative)) {
+  const parentRelative = path4.relative(lockRoot.rootReal, parentReal);
+  if (parentRelative === ".." || parentRelative.startsWith(`..${path4.sep}`) || path4.isAbsolute(parentRelative)) {
     throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
   }
-  return path2.join(parentReal, path2.basename(resolved));
+  return path4.join(parentReal, path4.basename(resolved));
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
   const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -7869,7 +8047,7 @@ function defaultShouldReclaim(snapshot, staleMs, nowMs) {
 }
 function reclaimGuardExists(reclaimGuardPath) {
   try {
-    fs3.lstatSync(reclaimGuardPath);
+    fs5.lstatSync(reclaimGuardPath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT")
@@ -7933,19 +8111,19 @@ function acquireFileLockSync(targetPath, options) {
     const { raw, ownershipToken } = serializeSidecarLockPayload(payload);
     let lockFileCreateDenied = false;
     try {
-      const noFollow = process.platform !== "win32" && typeof fs3.constants.O_NOFOLLOW === "number" ? fs3.constants.O_NOFOLLOW : 0;
+      const noFollow = process.platform !== "win32" && typeof fs5.constants.O_NOFOLLOW === "number" ? fs5.constants.O_NOFOLLOW : 0;
       try {
-        fd = fs3.openSync(lockPath, fs3.constants.O_WRONLY | fs3.constants.O_CREAT | fs3.constants.O_EXCL | noFollow, 384);
+        fd = fs5.openSync(lockPath, fs5.constants.O_WRONLY | fs5.constants.O_CREAT | fs5.constants.O_EXCL | noFollow, 384);
       } catch (error) {
         lockFileCreateDenied = isTransientLockFileDenial(error, lockPath);
         throw error;
       }
-      fs3.writeFileSync(fd, raw, "utf8");
-      fs3.fsyncSync(fd);
+      fs5.writeFileSync(fd, raw, "utf8");
+      fs5.fsyncSync(fd);
       const snapshot = {
         raw,
         payload,
-        stat: fs3.fstatSync(fd),
+        stat: fs5.fstatSync(fd),
         ownershipToken
       };
       const createdHeld = {
@@ -7980,8 +8158,8 @@ function acquireFileLockSync(targetPath, options) {
       return returnedHandle;
     } catch (error) {
       if (fd !== undefined) {
-        const failed = { payload: null, stat: fs3.fstatSync(fd) };
-        fs3.closeSync(fd);
+        const failed = { payload: null, stat: fs5.fstatSync(fd) };
+        fs5.closeSync(fd);
         fd = undefined;
         removeSidecarLockIfUnchangedSync(lockPath, failed);
       }
@@ -8030,7 +8208,7 @@ function acquireFileLockSync(targetPath, options) {
         })) {
           let ownsReclaimGuard = false;
           try {
-            fs3.mkdirSync(reclaimGuardPath);
+            fs5.mkdirSync(reclaimGuardPath);
             ownsReclaimGuard = true;
             if (removeSidecarLockIfUnchangedSync(lockPath, snapshot))
               continue;
@@ -8043,7 +8221,7 @@ function acquireFileLockSync(targetPath, options) {
           } finally {
             if (ownsReclaimGuard) {
               try {
-                fs3.rmdirSync(reclaimGuardPath);
+                fs5.rmdirSync(reclaimGuardPath);
               } catch {}
             }
           }
@@ -8059,12 +8237,12 @@ function acquireFileLockSync(targetPath, options) {
   }
 }
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash7, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
-import fs7 from "node:fs";
-import path9 from "node:path";
+import { createHash as createHash9, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
+import fs9 from "node:fs";
+import path11 from "node:path";
 
 // packages/workit-core/src/core/branch.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 
 // packages/workit-core/src/core/branch-policy.ts
 import { spawnSync } from "node:child_process";
@@ -8080,7 +8258,7 @@ import {
   writeFileSync
 } from "node:fs";
 import os from "node:os";
-import path3 from "node:path";
+import path5 from "node:path";
 
 // packages/workit-core/src/core/boundary.ts
 import { statSync } from "node:fs";
@@ -8139,7 +8317,7 @@ var mergePreset = (preset, input = {}, current = {
     protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
   };
 };
-var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path3.join(process.env.XDG_CONFIG_HOME || path3.join(os.homedir(), ".config"), "workit");
+var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path5.join(process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config"), "workit");
 var migratedDir = null;
 var migrationFailed = false;
 var ensureConfigDir = (dir = resolveConfigDir()) => {
@@ -8149,7 +8327,7 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
     migratedDir = dir;
     return dir;
   }
-  const legacy = path3.join(process.env.XDG_CONFIG_HOME || path3.join(os.homedir(), ".config"), "workflow-toolkit");
+  const legacy = path5.join(process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config"), "workflow-toolkit");
   if (!existsSync(legacy)) {
     migratedDir = dir;
     return dir;
@@ -8162,8 +8340,8 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
   mkdirSync(dir, { recursive: true });
   diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
   for (const entry of readdirSync(legacy, { withFileTypes: true })) {
-    const src = path3.join(legacy, entry.name);
-    const dest = path3.join(dir, entry.name);
+    const src = path5.join(legacy, entry.name);
+    const dest = path5.join(dir, entry.name);
     if (existsSync(dest))
       continue;
     try {
@@ -8235,7 +8413,7 @@ var parseConfigResult = (raw, file) => {
   return { status: "valid", path: file, config };
 };
 var readConfigTyped = (dir) => {
-  const file = path3.join(dir ?? configDir(), "config.json");
+  const file = path5.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
 };
 var readConfig = () => {
@@ -8253,10 +8431,10 @@ var mergeConfigValues = (input, current) => ({
 var writeConfig = (config) => {
   const dir = configDir();
   mkdirSync(dir, { recursive: true });
-  writeFileSync(path3.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
+  writeFileSync(path5.join(dir, "config.json"), JSON.stringify(config, null, 2) + `
 `, "utf8");
 };
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path3.join(configDir(), "vcs.json");
+var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path5.join(configDir(), "vcs.json");
 var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
 var resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
@@ -8440,9 +8618,9 @@ var gitContext = (workspaceRoot, paths = []) => {
 
 // packages/workit-core/src/core/workspaces.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readFileSync as readFileSync2, realpathSync } from "node:fs";
-import path4 from "node:path";
+import path6 from "node:path";
 var nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
 var branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
 var commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
@@ -8504,7 +8682,7 @@ var releaseTrackSchema = object({
       });
     }
   }
-  if (track.versionSource?.kind === "package-json" && (path4.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path6.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -8575,7 +8753,7 @@ var workspacesFileSchema = object({
     names.add(workspace.name);
   }
 });
-var workspacesRevision = (contents) => createHash2("sha256").update(contents ?? "<missing>").digest("hex");
+var workspacesRevision = (contents) => createHash4("sha256").update(contents ?? "<missing>").digest("hex");
 var validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
     return {
@@ -8621,7 +8799,7 @@ var validateWorkspacesDocument = (parsed, file) => {
   };
 };
 var readWorkspacesResult = (dir = configDir()) => {
-  const file = path4.join(dir, "workspaces.json");
+  const file = path6.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync2(file, "utf8");
@@ -8740,9 +8918,9 @@ var mainCheckoutOf = (cwd) => {
   let main = null;
   const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
   const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path4.resolve(gitDir) !== path4.resolve(common)) {
+  if (gitDir && common && path6.resolve(gitDir) !== path6.resolve(common)) {
     const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path4.basename(common) === ".git" ? path4.dirname(common) : common);
+    main = listed?.trim() || (path6.basename(common) === ".git" ? path6.dirname(common) : common);
   }
   mainCheckouts.set(cwd, main);
   return main;
@@ -8833,7 +9011,7 @@ var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
 var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
-  const file = path4.join(dir, "workspaces.json");
+  const file = path6.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync2(file, "utf8");
@@ -8939,20 +9117,20 @@ function workspaceDefaultTarget(cwd, globalDefault) {
 }
 
 // packages/workit-core/src/core/vcs-config.ts
-import fs5 from "node:fs";
-import path6 from "node:path";
+import fs7 from "node:fs";
+import path8 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 
 // packages/workit-core/src/core/release-tracks.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { spawnSync as spawnSync4 } from "node:child_process";
 
 // packages/workit-core/src/git/rev.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import fs4 from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+import fs6 from "node:fs";
 import os2 from "node:os";
-import path5 from "node:path";
+import path7 from "node:path";
 var MAX_BUFFER = 256 * 1024 * 1024;
 var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
 var git = (cwd, args, options = {}) => {
@@ -9017,10 +9195,10 @@ function headSha(cwd) {
 var emptyTree = (cwd) => line(git(cwd, ["mktree"], { input: "" }));
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
 var seedIndex = (from, to) => {
-  fs4.copyFileSync(from, to);
-  const { atimeNs, mtimeNs } = fs4.statSync(from, { bigint: true });
+  fs6.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs6.statSync(from, { bigint: true });
   const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
-  fs4.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+  fs6.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
 };
 function worktreeTree(cwd, options = {}) {
   const top = line(git(cwd, ["rev-parse", "--show-toplevel"]));
@@ -9029,10 +9207,10 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs4.mkdtempSync(path5.join(os2.tmpdir(), "workit-tree-"));
+  const scratch = fs6.mkdtempSync(path7.join(os2.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path5.join(scratch, "index");
-    if (fs4.existsSync(indexPath))
+    const tempIndex = path7.join(scratch, "index");
+    if (fs6.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
     const untracked = git(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
@@ -9044,7 +9222,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs4.statSync(path5.join(top, file));
+        const stat = fs6.statSync(path7.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -9061,10 +9239,10 @@ function worktreeTree(cwd, options = {}) {
     if (!tree)
       return null;
     const base = line(git(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
-    const key = skipped.length ? `sha256:${createHash3("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    const key = skipped.length ? `sha256:${createHash5("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
     return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
   } finally {
-    fs4.rmSync(scratch, { recursive: true, force: true });
+    fs6.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function worktreeSignal(cwd, options = {}) {
@@ -9084,16 +9262,16 @@ function worktreeSignal(cwd, options = {}) {
   });
   if (!status.ok)
     return null;
-  const hash = createHash3("sha256");
+  const hash = createHash5("sha256");
   hash.update(`${headSha(top) ?? "unborn"}\x00`);
   for (const entry of status.stdout.split("\x00")) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path5.join(top, file);
+    const absolute = path7.join(top, file);
     let stat = "-";
     try {
-      const info = fs4.lstatSync(absolute, { bigint: true });
+      const info = fs6.lstatSync(absolute, { bigint: true });
       stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
       if (info.isDirectory())
         stat += `:${headSha(absolute) ?? "-"}`;
@@ -9724,7 +9902,7 @@ function resolveTrackFor(cwd, options) {
       ]) ?? "",
       git2(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
     ] : [];
-    key = createHash4("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    key = createHash6("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
     const hit = memo2.get(key);
     if (hit)
       return hit;
@@ -9739,7 +9917,7 @@ function resolveTrackFor(cwd, options) {
 }
 
 // packages/workit-core/src/core/vcs-config.ts
-var workspacesPath = () => path6.join(configDir(), "workspaces.json");
+var workspacesPath = () => path8.join(configDir(), "workspaces.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
   const r = spawnSync5("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
@@ -9829,7 +10007,7 @@ var readVcsConfig = () => {
   const file = vcsConfigPath();
   let raw;
   try {
-    raw = fs5.readFileSync(file, "utf8");
+    raw = fs7.readFileSync(file, "utf8");
   } catch {
     return { status: "missing", path: file, config: {} };
   }
@@ -9954,7 +10132,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const prov = cfg[provider] ?? {};
   const out = {
     ok: true,
-    configPath: path6.resolve(cfgPath),
+    configPath: path8.resolve(cfgPath),
     provider,
     defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
@@ -10185,7 +10363,7 @@ var branchPolicySnapshotFor = (workspaceRoot) => {
   const source = resolved.provenance.branchPolicy;
   const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
   const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash5("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  const fingerprint = createHash7("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
   return {
     branchPolicy,
     namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
@@ -10254,7 +10432,7 @@ var isProtectedTarget = (root, name) => {
 
 // packages/workit-core/src/core/logger.ts
 import os3 from "node:os";
-import path7 from "node:path";
+import path9 from "node:path";
 var SENSITIVE_WORDS = new Set([
   "token",
   "secret",
@@ -10299,23 +10477,23 @@ var resolveStateDir = () => {
     return override;
   const home = os3.homedir();
   if (process.env.XDG_STATE_HOME)
-    return path7.join(process.env.XDG_STATE_HOME, "workit");
+    return path9.join(process.env.XDG_STATE_HOME, "workit");
   switch (os3.platform()) {
     case "darwin":
-      return path7.join(home, "Library", "Application Support", "workit");
+      return path9.join(home, "Library", "Application Support", "workit");
     case "win32":
-      return path7.join(process.env.LOCALAPPDATA ?? path7.join(home, "AppData", "Local"), "workit");
+      return path9.join(process.env.LOCALAPPDATA ?? path9.join(home, "AppData", "Local"), "workit");
     default:
-      return path7.join(process.env.HOME ?? home, ".local", "state", "workit");
+      return path9.join(process.env.HOME ?? home, ".local", "state", "workit");
   }
 };
 var homePattern = new RegExp(`${escapeRegExp2(os3.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 
 // packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
-import fs6 from "node:fs";
-import path8 from "node:path";
+import { createHash as createHash8 } from "node:crypto";
+import fs8 from "node:fs";
+import path10 from "node:path";
 var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
 var gitRun = (cwd, args) => {
   const run = spawnSync6("git", args, {
@@ -10340,10 +10518,10 @@ var gitRun = (cwd, args) => {
     missing: error?.code === "ENOENT"
   };
 };
-var shortHash = (value) => createHash6("sha256").update(value).digest("hex").slice(0, 12);
+var shortHash = (value) => createHash8("sha256").update(value).digest("hex").slice(0, 12);
 var real = (file) => {
   try {
-    return fs6.realpathSync.native(file);
+    return fs8.realpathSync.native(file);
   } catch {
     return file;
   }
@@ -10357,14 +10535,14 @@ var DISCOVERY_ENV = [
 ];
 var isGitDir = (dir) => {
   try {
-    return fs6.statSync(path8.join(dir, "HEAD")).isFile() && fs6.statSync(path8.join(dir, "objects")).isDirectory() && fs6.statSync(path8.join(dir, "refs")).isDirectory();
+    return fs8.statSync(path10.join(dir, "HEAD")).isFile() && fs8.statSync(path10.join(dir, "objects")).isDirectory() && fs8.statSync(path10.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 };
 var reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs6.readFileSync(path8.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs8.readFileSync(path10.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
@@ -10377,17 +10555,17 @@ function fastGit(root) {
   for (;; ) {
     let stat;
     try {
-      stat = fs6.statSync(dir);
+      stat = fs8.statSync(dir);
     } catch {
       return null;
     }
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path8.join(dir, ".git");
+    const dotGit = path10.join(dir, ".git");
     let entry = null;
     try {
-      entry = fs6.statSync(dotGit);
+      entry = fs8.statSync(dotGit);
     } catch {}
     let gitDir = null;
     let top = null;
@@ -10398,26 +10576,26 @@ function fastGit(root) {
       else if (entry.isFile()) {
         let text = "";
         try {
-          text = fs6.readFileSync(dotGit, "utf8");
+          text = fs8.readFileSync(dotGit, "utf8");
         } catch {
           return null;
         }
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path8.resolve(dir, match[1].trim());
+        gitDir = path10.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs6.existsSync(path8.join(gitDir, "HEAD")))
+      if (!fs8.existsSync(path10.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path8.resolve(gitDir, fs6.readFileSync(path8.join(gitDir, "commondir"), "utf8").trim());
+        common = path10.resolve(gitDir, fs8.readFileSync(path10.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs6.existsSync(path8.join(common, "objects")))
+      if (!fs8.existsSync(path10.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -10427,26 +10605,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path8.dirname(dir);
+    const parent = path10.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path8.resolve(root);
+  root = path10.resolve(root);
   let directory = false;
   try {
-    directory = fs6.statSync(root).isDirectory();
+    directory = fs8.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path8.join(root, ".workit"), shared: false, top: null };
+    return { dir: path10.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path8.join(root, ".workit"), shared: false, top: null };
+    return { dir: path10.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path8.join(fast.common, "workit"),
+      dir: path10.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -10456,20 +10634,20 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path8.join(real(path8.resolve(root, common)), "workit"),
+      dir: path10.join(real(path10.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path8.join(root, ".workit"), shared: false, top: null };
+    return { dir: path10.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
 var rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs6.readFileSync(path8.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs8.readFileSync(path10.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -10484,7 +10662,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs6.readFileSync(path8.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs8.readFileSync(path10.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -10515,10 +10693,10 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path8.resolve(root);
+  const resolved = path10.resolve(root);
   let canonical = resolved;
   try {
-    canonical = fs6.realpathSync(resolved);
+    canonical = fs8.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -10528,7 +10706,7 @@ function checkoutRootOf(root, location) {
   if (real(canonical) === found.top)
     return canonical;
   try {
-    return fs6.realpathSync(found.top);
+    return fs8.realpathSync(found.top);
   } catch {
     return canonical;
   }
@@ -10540,25 +10718,25 @@ function branchRenames(location) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
+      entries = fs8.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path8.join(dir, entry.name));
+        walk(path10.join(dir, entry.name));
       else
-        files.push(path8.join(dir, entry.name));
+        files.push(path10.join(dir, entry.name));
   };
-  walk(path8.join(path8.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path10.join(path10.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path8.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path10.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
     let text = "";
     try {
-      text = fs6.readFileSync(file, "utf8");
+      text = fs8.readFileSync(file, "utf8");
     } catch {
       continue;
     }
@@ -10587,7 +10765,7 @@ var checkoutSlug = (root) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path8.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path10.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
 
@@ -10619,9 +10797,9 @@ function hostSessionFromEnv(env) {
   }
   return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
-var hash = (value) => createHash7("sha256").update(value).digest("hex").slice(0, 32);
-var userIssuedRoot = () => path9.join(resolveStateDir(), "issued");
-var userTokenRoot = () => path9.join(resolveStateDir(), "issued-tokens");
+var hash2 = (value) => createHash9("sha256").update(value).digest("hex").slice(0, 32);
+var userIssuedRoot = () => path11.join(resolveStateDir(), "issued");
+var userTokenRoot = () => path11.join(resolveStateDir(), "issued-tokens");
 function migrateRepoIssued(cwd) {
   if (cwd === undefined)
     return;
@@ -10630,27 +10808,27 @@ function migrateRepoIssued(cwd) {
     const location = resolveStore(cwd);
     if (location instanceof Error)
       return;
-    old = path9.join(location.dir, "hooks", "issued");
-    if (!fs7.existsSync(old))
+    old = path11.join(location.dir, "hooks", "issued");
+    if (!fs9.existsSync(old))
       return;
   } catch {
     return;
   }
   for (const lead of safeList(old)) {
     try {
-      const from = path9.join(old, lead);
-      if (!fs7.statSync(from).isDirectory())
+      const from = path11.join(old, lead);
+      if (!fs9.statSync(from).isDirectory())
         continue;
-      const to = path9.join(userIssuedRoot(), lead);
-      fs7.mkdirSync(to, { recursive: true, mode: 448 });
-      for (const id of fs7.readdirSync(from)) {
+      const to = path11.join(userIssuedRoot(), lead);
+      fs9.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs9.readdirSync(from)) {
         try {
-          fs7.copyFileSync(path9.join(from, id), path9.join(to, id), fs7.constants.COPYFILE_EXCL);
+          fs9.copyFileSync(path11.join(from, id), path11.join(to, id), fs9.constants.COPYFILE_EXCL);
         } catch (error) {
           if (error.code !== "EEXIST")
             throw error;
         }
-        fs7.rmSync(path9.join(from, id), { force: true });
+        fs9.rmSync(path11.join(from, id), { force: true });
       }
       removeIfEmpty(from);
     } catch {}
@@ -10659,14 +10837,14 @@ function migrateRepoIssued(cwd) {
 }
 var safeList = (dir) => {
   try {
-    return fs7.readdirSync(dir);
+    return fs9.readdirSync(dir);
   } catch {
     return [];
   }
 };
 var removeIfEmpty = (dir) => {
   try {
-    fs7.rmdirSync(dir);
+    fs9.rmdirSync(dir);
   } catch {}
 };
 function judgeBranch(cwd) {
@@ -10690,7 +10868,7 @@ var issuedRecord = (cwd, claimed) => {
     return null;
   migrateRepoIssued(cwd);
   try {
-    return fs7.readFileSync(path9.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
+    return fs9.readFileSync(path11.join(userIssuedRoot(), hash2(claimed.slice(0, cut)), hash2(claimed)), "utf8");
   } catch {
     return null;
   }
@@ -10700,9 +10878,9 @@ var issuedToken = (claimed) => {
   const cut = claimed.lastIndexOf(":");
   if (cut <= 0)
     return { stored: null, leadBound: false };
-  const dir = path9.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  const dir = path11.join(userTokenRoot(), hash2(claimed.slice(0, cut)));
   try {
-    const text = fs7.readFileSync(path9.join(dir, hash(claimed)), "utf8");
+    const text = fs9.readFileSync(path11.join(dir, hash2(claimed)), "utf8");
     return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
   } catch {
     return { stored: null, leadBound: safeList(dir).length > 0 };
@@ -10727,26 +10905,26 @@ function childSessionId(lead, child) {
 
 // packages/workit-core/src/core/package-root.ts
 import { existsSync as existsSync2 } from "node:fs";
-import path10 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path10.dirname(fileURLToPath(import.meta.url));
+  let dir = path12.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path10.dirname(dir);
-    if (existsSync2(path10.join(dir, "package.json")) || parent === dir)
+    const parent = path12.dirname(dir);
+    if (existsSync2(path12.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
 };
 var assetRoot = () => {
   const root = packageRoot();
-  const assets = path10.join(root, "assets");
+  const assets = path12.join(root, "assets");
   return existsSync2(assets) ? assets : root;
 };
 
 // packages/workit-core/src/core/store-lock.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import fs8 from "node:fs";
+import fs10 from "node:fs";
 import { hostname } from "node:os";
 var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
@@ -10790,7 +10968,7 @@ var parseProcStatStart = (stat) => {
 var processStartOf = (pid) => {
   if (process.platform === "linux") {
     try {
-      return parseProcStatStart(fs8.readFileSync(`/proc/${pid}/stat`, "utf8"));
+      return parseProcStatStart(fs10.readFileSync(`/proc/${pid}/stat`, "utf8"));
     } catch {
       return null;
     }
@@ -10811,7 +10989,7 @@ var processStartOf = (pid) => {
 };
 var readTrimmed = (file) => {
   try {
-    return fs8.readFileSync(file, "utf8").trim() || null;
+    return fs10.readFileSync(file, "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -10822,7 +11000,7 @@ var localLockHost = () => {
     return cachedLockHost;
   let pidns = null;
   try {
-    pidns = /\[(\d+)\]/.exec(fs8.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+    pidns = /\[(\d+)\]/.exec(fs10.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
   } catch {}
   const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
   cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
@@ -10868,7 +11046,7 @@ var classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options =
 };
 var ageOf = (file, nowMs) => {
   try {
-    return nowMs - fs8.lstatSync(file).mtimeMs;
+    return nowMs - fs10.lstatSync(file).mtimeMs;
   } catch {
     return null;
   }
@@ -10879,7 +11057,7 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
   if (age === null || age <= RECLAIM_GUARD_TTL_MS)
     return false;
   try {
-    fs8.rmdirSync(guard);
+    fs10.rmdirSync(guard);
     return true;
   } catch {
     return false;
@@ -10888,8 +11066,8 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
 
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs9 from "node:fs";
-import path11 from "node:path";
+import fs11 from "node:fs";
+import path13 from "node:path";
 var EVENT_VERSION = 1;
 
 class LogDamage extends Error {
@@ -10918,7 +11096,7 @@ var parseEvent = (line, file, offset) => {
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
-    fd = fs9.openSync(file, "r");
+    fd = fs11.openSync(file, "r");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -10927,13 +11105,13 @@ function readLog(file, from = 0, expectSeq = null) {
   let bytes;
   let size;
   try {
-    size = fs9.fstatSync(fd).size;
+    size = fs11.fstatSync(fd).size;
     if (from > size)
       throw new LogDamage(`${file}: shorter than its snapshot`);
     bytes = Buffer.alloc(size - from);
     let read = 0;
     while (read < bytes.length) {
-      const got = fs9.readSync(fd, bytes, read, bytes.length - read, from + read);
+      const got = fs11.readSync(fd, bytes, read, bytes.length - read, from + read);
       if (got === 0)
         break;
       read += got;
@@ -10941,7 +11119,7 @@ function readLog(file, from = 0, expectSeq = null) {
     bytes = bytes.subarray(0, read);
     size = from + read;
   } finally {
-    fs9.closeSync(fd);
+    fs11.closeSync(fd);
   }
   const events = [];
   let start = 0;
@@ -10966,11 +11144,11 @@ function readLog(file, from = 0, expectSeq = null) {
 }
 var fsyncDirectory = (dir) => {
   try {
-    const fd = fs9.openSync(dir, "r");
+    const fd = fs11.openSync(dir, "r");
     try {
-      fs9.fsyncSync(fd);
+      fs11.fsyncSync(fd);
     } finally {
-      fs9.closeSync(fd);
+      fs11.closeSync(fd);
     }
   } catch (error) {
     if (process.platform !== "win32")
@@ -10980,46 +11158,46 @@ var fsyncDirectory = (dir) => {
 function appendEvent(file, event, validEnd) {
   const line = Buffer.from(`${JSON.stringify(event)}
 `, "utf8");
-  const created = !fs9.existsSync(file);
-  if (!created && fs9.statSync(file).size !== validEnd) {
-    const cut = fs9.openSync(file, "r+");
+  const created = !fs11.existsSync(file);
+  if (!created && fs11.statSync(file).size !== validEnd) {
+    const cut = fs11.openSync(file, "r+");
     try {
-      fs9.ftruncateSync(cut, validEnd);
-      fs9.fsyncSync(cut);
+      fs11.ftruncateSync(cut, validEnd);
+      fs11.fsyncSync(cut);
     } finally {
-      fs9.closeSync(cut);
+      fs11.closeSync(cut);
     }
   }
-  const fd = fs9.openSync(file, "a", 384);
+  const fd = fs11.openSync(file, "a", 384);
   try {
     let written = 0;
     while (written < line.length)
-      written += fs9.writeSync(fd, line, written, line.length - written);
-    fs9.fsyncSync(fd);
+      written += fs11.writeSync(fd, line, written, line.length - written);
+    fs11.fsyncSync(fd);
   } finally {
-    fs9.closeSync(fd);
+    fs11.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path11.dirname(file));
+    fsyncDirectory(path13.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
   const temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
   try {
-    const fd = fs9.openSync(temporary, "wx", 384);
+    const fd = fs11.openSync(temporary, "wx", 384);
     try {
-      fs9.writeSync(fd, bytes);
+      fs11.writeSync(fd, bytes);
       if (durable)
-        fs9.fsyncSync(fd);
+        fs11.fsyncSync(fd);
     } finally {
-      fs9.closeSync(fd);
+      fs11.closeSync(fd);
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path11.dirname(file));
+      fsyncDirectory(path13.dirname(file));
   } catch (error) {
     try {
-      fs9.unlinkSync(temporary);
+      fs11.unlinkSync(temporary);
     } catch {}
     throw error;
   }
@@ -11044,7 +11222,7 @@ var retryTransient = (run) => {
     }
   }
 };
-var renameWithRetry = (from, to) => retryTransient(() => fs9.renameSync(from, to));
+var renameWithRetry = (from, to) => retryTransient(() => fs11.renameSync(from, to));
 
 // packages/workit-core/src/store/patch.ts
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11157,7 +11335,7 @@ var isPatch = (value) => Array.isArray(value) && value.every((op) => {
 });
 
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 var OPENING_TYPES = new Set([
   "task.opened",
   "task.imported",
@@ -11186,7 +11364,7 @@ var isObject4 = (value) => typeof value === "object" && value !== null && !Array
 var isKey = (value) => isObject4(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string");
 var BLOB_REF = "$blob";
 var blobRef = (value) => isObject4(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null;
-var blobDigest = (value) => createHash8("sha256").update(JSON.stringify(value)).digest("hex");
+var blobDigest = (value) => createHash10("sha256").update(JSON.stringify(value)).digest("hex");
 var toBlob = (value, blobs) => {
   if (!isObject4(value))
     return value;
@@ -11341,7 +11519,7 @@ var indexEntry = (task, key, legacy, file) => {
 };
 var fileSignature = (file) => {
   try {
-    const stat = fs10.statSync(file, { bigint: true });
+    const stat = fs12.statSync(file, { bigint: true });
     return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
   } catch {
     return null;
@@ -11359,7 +11537,7 @@ var cachedRuntimeVersion = null;
 var runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs10.readFileSync(path12.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs12.readFileSync(path14.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -11385,14 +11563,14 @@ var isNewerVersion = (candidate, current) => {
 var validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
 var readText = (file) => {
   try {
-    return fs10.readFileSync(file, "utf8");
+    return fs12.readFileSync(file, "utf8");
   } catch {
     return "";
   }
 };
 var REFLOG_LINE = /^[0-9a-f]+ ([0-9a-f]+) .* (\d+) [+-]\d{4}\t(.*)$/u;
 var branchStart = (location, branch, aliases) => {
-  const first = readText(path12.join(path12.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path14.join(path14.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -11402,7 +11580,7 @@ var branchStart = (location, branch, aliases) => {
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path12.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path14.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -11412,23 +11590,23 @@ var branchStart = (location, branch, aliases) => {
   }
   return null;
 };
-var refExists = (common, ref) => fs10.existsSync(path12.join(common, ref)) || readText(path12.join(common, "packed-refs")).includes(` ${ref}
+var refExists = (common, ref) => fs12.existsSync(path14.join(common, ref)) || readText(path14.join(common, "packed-refs")).includes(` ${ref}
 `);
 var origins = new Map;
 var sameDirectoryIdentity = (left, right) => {
-  if (!path12.isAbsolute(left) || !path12.isAbsolute(right))
+  if (!path14.isAbsolute(left) || !path14.isAbsolute(right))
     return false;
-  const normalizedLeft = path12.resolve(left);
-  const normalizedRight = path12.resolve(right);
+  const normalizedLeft = path14.resolve(left);
+  const normalizedRight = path14.resolve(right);
   try {
-    const a = fs10.statSync(normalizedLeft, { bigint: true });
-    const b = fs10.statSync(normalizedRight, { bigint: true });
+    const a = fs12.statSync(normalizedLeft, { bigint: true });
+    const b = fs12.statSync(normalizedRight, { bigint: true });
     if (!a.isDirectory() || !b.isDirectory())
       return false;
     if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
       return true;
-    const canonicalLeft = fs10.realpathSync(normalizedLeft);
-    const canonicalRight = fs10.realpathSync(normalizedRight);
+    const canonicalLeft = fs12.realpathSync(normalizedLeft);
+    const canonicalRight = fs12.realpathSync(normalizedRight);
     if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
       return true;
     return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
@@ -11465,8 +11643,8 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path12.resolve(root);
-    this.origin = fs10.existsSync(resolved) ? fs10.realpathSync(resolved) : resolved;
+    const resolved = path14.resolve(root);
+    this.origin = fs12.existsSync(resolved) ? fs12.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
     this.lockTimeoutMs = options.lockTimeoutMs ?? defaultLockTimeout();
@@ -11474,7 +11652,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs10.existsSync(path12.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs12.existsSync(path14.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -11538,7 +11716,7 @@ class TaskStore {
     const tasksDir = this.paths().tasks;
     let names;
     try {
-      names = fs10.existsSync(tasksDir) ? fs10.readdirSync(tasksDir).filter((name) => validId(name)) : [];
+      names = fs12.existsSync(tasksDir) ? fs12.readdirSync(tasksDir).filter((name) => validId(name)) : [];
     } catch (error) {
       return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: tasksDir
@@ -11579,7 +11757,7 @@ class TaskStore {
     const file = this.paths().workspace;
     let bytes;
     try {
-      bytes = retryTransient(() => fs10.readFileSync(file, "utf8"));
+      bytes = retryTransient(() => fs12.readFileSync(file, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT")
         return success(null, null, null);
@@ -11630,7 +11808,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path12.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path14.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -11696,14 +11874,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path12.dirname(location.data.dir);
-    const heads = path12.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path12.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path14.dirname(location.data.dir);
+    const heads = path14.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path14.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path12.join(heads, branch),
+      path14.join(heads, branch),
       headLog,
       heads,
-      path12.join(common, "packed-refs")
+      path14.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -11715,7 +11893,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path12.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path14.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -11953,13 +12131,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path12.join(this.root, ".workit", "recovery");
-    if (fs10.existsSync(recovery)) {
+    const recovery = path14.join(this.root, ".workit", "recovery");
+    if (fs12.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
-        for (const name of fs10.readdirSync(recovery)) {
-          const stat = fs10.lstatSync(path12.join(recovery, name));
+        for (const name of fs12.readdirSync(recovery)) {
+          const stat = fs12.lstatSync(path14.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -11968,17 +12146,17 @@ class TaskStore {
       } catch {}
       const remove = options.pruneRecovery === true && !dryRun;
       if (remove)
-        fs10.rmSync(recovery, { recursive: true, force: true });
+        fs12.rmSync(recovery, { recursive: true, force: true });
       report.legacyRecovery = { path: recovery, files, bytes, removed: remove };
     }
-    if (!fs10.existsSync(dirs.tasks))
+    if (!fs12.existsSync(dirs.tasks))
       return success(null, null, report);
-    const names = fs10.readdirSync(dirs.tasks).filter((name) => validId(name));
+    const names = fs12.readdirSync(dirs.tasks).filter((name) => validId(name));
     for (const name of names) {
       const file = this.eventsPath(name);
       let size = 0;
       try {
-        size = fs10.statSync(file).size;
+        size = fs12.statSync(file).size;
       } catch {
         continue;
       }
@@ -12006,16 +12184,16 @@ class TaskStore {
       const references = new Set;
       for (const name of names)
         try {
-          for (const match of fs10.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
+          for (const match of fs12.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
             references.add(match[1]);
         } catch {}
-      if (fs10.existsSync(dirs.blobs))
-        for (const name of fs10.readdirSync(dirs.blobs)) {
+      if (fs12.existsSync(dirs.blobs))
+        for (const name of fs12.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path12.join(dirs.blobs, name);
+          const file = path14.join(dirs.blobs, name);
           let stat;
           try {
-            stat = fs10.lstatSync(file);
+            stat = fs12.lstatSync(file);
           } catch {
             continue;
           }
@@ -12026,11 +12204,11 @@ class TaskStore {
           report.blobs.removed += 1;
           report.blobs.removedBytes += stat.size;
           if (!dryRun)
-            fs10.rmSync(file, { force: true });
+            fs12.rmSync(file, { force: true });
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path12.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path14.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -12038,17 +12216,17 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path12.join(dirs.tasks, name))
+      ...names.map((name) => path14.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
-      if (!fs10.existsSync(directory))
+      if (!fs12.existsSync(directory))
         continue;
-      for (const name of fs10.readdirSync(directory)) {
+      for (const name of fs12.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path12.join(directory, name);
+        const file = path14.join(directory, name);
         try {
-          const stat = fs10.lstatSync(file);
+          const stat = fs12.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
             continue;
         } catch {
@@ -12056,37 +12234,37 @@ class TaskStore {
         }
         report.temporary.removed += 1;
         if (!dryRun)
-          fs10.rmSync(file, { force: true });
+          fs12.rmSync(file, { force: true });
       }
     }
     return success(null, null, report);
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path12.join(this.root, ".workit");
-    const checkout = path12.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path14.join(this.root, ".workit");
+    const checkout = path14.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path12.join(dir, "store.json"),
+      marker: path14.join(dir, "store.json"),
       checkout,
-      workspace: path12.join(checkout, "workspace.json"),
-      checkoutLock: path12.join(checkout, "metadata.lock"),
-      tasks: path12.join(dir, "tasks"),
-      index: path12.join(dir, "task-index.json"),
-      blobs: path12.join(dir, "blobs", "candidates"),
-      legacy: path12.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path12.join(this.root, ".workit")
+      workspace: path14.join(checkout, "workspace.json"),
+      checkoutLock: path14.join(checkout, "metadata.lock"),
+      tasks: path14.join(dir, "tasks"),
+      index: path14.join(dir, "task-index.json"),
+      blobs: path14.join(dir, "blobs", "candidates"),
+      legacy: path14.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path14.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path12.join(this.paths().tasks, taskId, "events.jsonl");
+    return path14.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path12.join(this.paths().tasks, taskId, "snapshot.json");
+    return path14.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path12.join(this.paths().tasks, taskId, "lock");
+    return path14.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -12096,7 +12274,7 @@ class TaskStore {
       return success(null, null, null);
     const dirs = this.paths();
     try {
-      const marker = JSON.parse(fs10.readFileSync(dirs.marker, "utf8"));
+      const marker = JSON.parse(fs12.readFileSync(dirs.marker, "utf8"));
       if (typeof marker.version === "number" && marker.version > STORE_FORMAT)
         return failure2("recovery_required", `the workit store at ${dirs.dir} has format ${marker.version}; upgrade Workit to use it`, { path: dirs.marker });
     } catch {}
@@ -12125,21 +12303,21 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs10.readFileSync(path12.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs12.readFileSync(path14.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path12.join(dir, `${digest}.json`);
-        if (fs10.existsSync(file)) {
+        const file = path14.join(dir, `${digest}.json`);
+        if (fs12.existsSync(file)) {
           const stamp = new Date;
           try {
-            fs10.utimesSync(file, stamp, stamp);
+            fs12.utimesSync(file, stamp, stamp);
             return;
           } catch {}
         }
-        fs10.mkdirSync(dir, { recursive: true });
+        fs12.mkdirSync(dir, { recursive: true });
         replaceFile(file, JSON.stringify(value), true);
       }
     };
@@ -12221,7 +12399,7 @@ class TaskStore {
   }
   readSnapshot(taskId) {
     try {
-      const value = JSON.parse(fs10.readFileSync(this.snapshotPath(taskId), "utf8"));
+      const value = JSON.parse(fs12.readFileSync(this.snapshotPath(taskId), "utf8"));
       if (!isObject5(value) || value.v !== 1 || value.task !== taskId || typeof value.seq !== "number" || typeof value.lastId !== "string" || typeof value.lastStart !== "number" || typeof value.end !== "number" || !isObject5(value.record))
         return null;
       return value;
@@ -12323,8 +12501,8 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path12.join(this.paths().tasks, record.id);
-    fs10.mkdirSync(dir, { recursive: true });
+    const dir = path14.join(this.paths().tasks, record.id);
+    fs12.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
     const event = this.event(record.id, 1, type, {
@@ -12376,11 +12554,11 @@ class TaskStore {
         } catch {}
         if (!latest || latest.events[0]?.id !== last.id)
           return failure2("busy", "the task log changed during compaction; retry", { taskId });
-        const appended = fs10.readFileSync(file).subarray(log.end, latest.end);
+        const appended = fs12.readFileSync(file).subarray(log.end, latest.end);
         const bytes = Buffer.concat([Buffer.from(prefix, "utf8"), appended]);
         replaceFile(file, bytes.toString("utf8"), true);
         try {
-          fs10.rmSync(this.snapshotPath(taskId), { force: true });
+          fs12.rmSync(this.snapshotPath(taskId), { force: true });
         } catch {}
         const reloaded = this.load(taskId);
         if (reloaded.ok && reloaded.data)
@@ -12393,7 +12571,7 @@ class TaskStore {
   }
   countEvents(file) {
     try {
-      const bytes = fs10.readFileSync(file);
+      const bytes = fs12.readFileSync(file);
       let count = 0;
       for (let index = bytes.indexOf(10);index >= 0; index = bytes.indexOf(10, index + 1))
         count += 1;
@@ -12415,8 +12593,8 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash9("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path12.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    const digest = createHash11("sha256").update(key).digest("hex").slice(0, 32);
+    return this.withLock(path14.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -12557,7 +12735,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs10.mkdirSync(path12.dirname(file), { recursive: true });
+      fs12.mkdirSync(path14.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -12567,7 +12745,7 @@ class TaskStore {
   }
   readIndex() {
     try {
-      const value = JSON.parse(fs10.readFileSync(this.paths().index, "utf8"));
+      const value = JSON.parse(fs12.readFileSync(this.paths().index, "utf8"));
       if (!isObject5(value) || value.version !== INDEX_VERSION || !isObject5(value.tasks))
         return {};
       const tasks = {};
@@ -12581,7 +12759,7 @@ class TaskStore {
   }
   writeIndex(entries) {
     try {
-      fs10.mkdirSync(this.paths().tasks, { recursive: true });
+      fs12.mkdirSync(this.paths().tasks, { recursive: true });
       replaceFile(this.paths().index, JSON.stringify({
         version: INDEX_VERSION,
         tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
@@ -12635,23 +12813,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path12.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path14.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path12.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path14.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path12.join(v2, "workspace.json");
-    const v2Tasks = path12.join(v2, "tasks");
-    const legacy = path12.join(dirs.dir, "legacy", checkoutSlug(path12.dirname(v2)), "v2");
+    const v2Workspace = path14.join(v2, "workspace.json");
+    const v2Tasks = path14.join(v2, "tasks");
+    const legacy = path14.join(dirs.dir, "legacy", checkoutSlug(path14.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path12.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path14.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -12660,7 +12838,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs10.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path12.join(v2Tasks, name)));
+        files = fs12.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path14.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -12678,22 +12856,22 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs10.mkdirSync(path12.join(legacy, "tasks"), { recursive: true });
+        fs12.mkdirSync(path14.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs10.existsSync(path12.join(v2, name)))
-            fs10.copyFileSync(path12.join(v2, name), path12.join(legacy, name));
+          if (fs12.existsSync(path14.join(v2, name)))
+            fs12.copyFileSync(path14.join(v2, name), path14.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path12.join(v2Tasks, name);
-          const bytes = fs10.readFileSync(file, "utf8");
+          const file = path14.join(v2Tasks, name);
+          const bytes = fs12.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs10.writeFileSync(path12.join(legacy, "tasks", name), bytes);
+          fs12.writeFileSync(path14.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path12.join(legacy, "tasks", name), digest };
-          if (!fs10.existsSync(this.eventsPath(id))) {
+          const origin = { path: path14.join(legacy, "tasks", name), digest };
+          if (!fs12.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
           } else {
@@ -12728,8 +12906,8 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path12.join(v2Tasks, name);
-          if (sha256(fs10.readFileSync(file, "utf8")) !== digest) {
+          const file = path14.join(v2Tasks, name);
+          if (sha256(fs12.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
           }
@@ -12739,7 +12917,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs10.rmSync(path12.join(v2, "index.json"), { force: true });
+        fs12.rmSync(path14.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -12759,45 +12937,45 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path12.join(dirs.v2, "store.json");
-    if (!dirs.shared || !fs10.existsSync(marker))
+    const marker = path14.join(dirs.v2, "store.json");
+    if (!dirs.shared || !fs12.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
-      if (!fs10.existsSync(marker))
+      if (!fs12.existsSync(marker))
         return success(null, null, null);
       let tasks = 0;
       try {
         const merge = (from, to) => {
-          if (!fs10.existsSync(to)) {
-            fs10.mkdirSync(path12.dirname(to), { recursive: true });
+          if (!fs12.existsSync(to)) {
+            fs12.mkdirSync(path14.dirname(to), { recursive: true });
             try {
-              fs10.renameSync(from, to);
+              fs12.renameSync(from, to);
             } catch {
-              fs10.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
-              fs10.rmSync(from, { recursive: true, force: true });
+              fs12.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+              fs12.rmSync(from, { recursive: true, force: true });
             }
             return;
           }
-          if (fs10.lstatSync(from).isDirectory() && fs10.lstatSync(to).isDirectory())
-            for (const name of fs10.readdirSync(from))
-              merge(path12.join(from, name), path12.join(to, name));
+          if (fs12.lstatSync(from).isDirectory() && fs12.lstatSync(to).isDirectory())
+            for (const name of fs12.readdirSync(from))
+              merge(path14.join(from, name), path14.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path12.join(dirs.v2, sub);
-          if (!fs10.existsSync(from))
+          const from = path14.join(dirs.v2, sub);
+          if (!fs12.existsSync(from))
             continue;
           if (sub === "tasks") {
-            for (const name of fs10.readdirSync(from))
-              if (validId(name) && !fs10.existsSync(path12.join(dirs.dir, sub, name)))
+            for (const name of fs12.readdirSync(from))
+              if (validId(name) && !fs12.existsSync(path14.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path12.join(dirs.dir, sub));
+          merge(from, path14.join(dirs.dir, sub));
         }
-        const ledger = path12.join(dirs.v2, "ledger");
-        if (fs10.existsSync(ledger) && !fs10.existsSync(path12.join(dirs.dir, "ledger")))
-          merge(ledger, path12.join(dirs.dir, "ledger"));
-        fs10.rmSync(path12.join(dirs.v2, "task-index.json"), { force: true });
-        fs10.renameSync(marker, path12.join(dirs.v2, "store.moved.json"));
+        const ledger = path14.join(dirs.v2, "ledger");
+        if (fs12.existsSync(ledger) && !fs12.existsSync(path14.join(dirs.dir, "ledger")))
+          merge(ledger, path14.join(dirs.dir, "ledger"));
+        fs12.rmSync(path14.join(dirs.v2, "task-index.json"), { force: true });
+        fs12.renameSync(marker, path14.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -12817,7 +12995,7 @@ class TaskStore {
   readV2Workspace(file) {
     let bytes;
     try {
-      bytes = fs10.readFileSync(file, "utf8");
+      bytes = fs12.readFileSync(file, "utf8");
     } catch {
       return null;
     }
@@ -12835,7 +13013,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path12.dirname(v2),
+      root: path14.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -12846,12 +13024,12 @@ class TaskStore {
       },
       critical: ["store"]
     };
-    fs10.mkdirSync(v2, { recursive: true });
-    const ignore = path12.join(v2, ".gitignore");
-    if (!fs10.existsSync(ignore))
-      fs10.writeFileSync(ignore, `*
+    fs12.mkdirSync(v2, { recursive: true });
+    const ignore = path14.join(v2, ".gitignore");
+    if (!fs12.existsSync(ignore))
+      fs12.writeFileSync(ignore, `*
 `);
-    replaceFile(path12.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path14.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -12867,7 +13045,7 @@ class TaskStore {
   }
   isStub(file) {
     try {
-      const value = JSON.parse(fs10.readFileSync(file, "utf8"));
+      const value = JSON.parse(fs12.readFileSync(file, "utf8"));
       return isObject5(value) && isObject5(value.store) && value.store.format === "workit-store";
     } catch {
       return false;
@@ -12875,32 +13053,32 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path12.join(this.root, ".workit");
-      if (fs10.existsSync(path12.join(v2, "workspace.json")))
+      const v2 = path14.join(this.root, ".workit");
+      if (fs12.existsSync(path14.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
-        id = JSON.parse(fs10.readFileSync(this.paths().workspace, "utf8")).id ?? null;
+        id = JSON.parse(fs12.readFileSync(this.paths().workspace, "utf8")).id ?? null;
       } catch {}
       this.writeTombstone(v2, id);
     } catch {}
   }
   initializeStorage() {
     const dirs = this.paths();
-    retryTransient(() => fs10.mkdirSync(dirs.checkout, { recursive: true }));
-    retryTransient(() => fs10.mkdirSync(dirs.tasks, { recursive: true }));
-    if (!fs10.existsSync(dirs.marker))
+    retryTransient(() => fs12.mkdirSync(dirs.checkout, { recursive: true }));
+    retryTransient(() => fs12.mkdirSync(dirs.tasks, { recursive: true }));
+    if (!fs12.existsSync(dirs.marker))
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path12.join(dirs.dir, ".gitignore");
+      const ignore = path14.join(dirs.dir, ".gitignore");
       let current = null;
       try {
-        current = fs10.readFileSync(ignore, "utf8");
+        current = fs12.readFileSync(ignore, "utf8");
       } catch {}
       if (current !== `*
 `)
-        retryTransient(() => fs10.writeFileSync(ignore, `*
+        retryTransient(() => fs12.writeFileSync(ignore, `*
 `));
     }
     this.writeTombstoneIfMissing();
@@ -12916,7 +13094,7 @@ class TaskStore {
       shouldReclaim: ({ payload, nowMs }) => {
         let ageMs = null;
         try {
-          ageMs = nowMs - fs10.lstatSync(lockPath).mtimeMs;
+          ageMs = nowMs - fs12.lstatSync(lockPath).mtimeMs;
         } catch {}
         return classifyLockOwner(payload, ageMs, localLockHost(), TASK_STORE_LOCK).state === "stale";
       },
@@ -12953,7 +13131,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs10.mkdirSync(path12.dirname(lockPath), { recursive: true });
+      fs12.mkdirSync(path14.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -12993,18 +13171,18 @@ class TaskStore {
   lockDirWritable(lockPath) {
     const probe = `${lockPath}.${process.pid}.${randomUUID3()}.probe`;
     try {
-      fs10.closeSync(fs10.openSync(probe, "wx", 384));
+      fs12.closeSync(fs12.openSync(probe, "wx", 384));
     } catch {
       return false;
     }
     try {
-      fs10.rmSync(probe, { force: true });
+      fs12.rmSync(probe, { force: true });
     } catch {}
     return true;
   }
   lockHolderPresent(lockPath) {
     try {
-      fs10.lstatSync(lockPath);
+      fs12.lstatSync(lockPath);
       return true;
     } catch (error) {
       return error?.code !== "ENOENT";
@@ -13016,12 +13194,12 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path12.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path14.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
       try {
-        lock = parseMetadataLockOrNull(fs10.readFileSync(lockPath, "utf8"));
+        lock = parseMetadataLockOrNull(fs12.readFileSync(lockPath, "utf8"));
       } catch {}
       return failure2("busy", `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
         outcome: "not_started",
@@ -13040,26 +13218,26 @@ var workerBlocksTransition = (transition, state) => transition === "pause" ? fal
 var holdsLiveState = (state, dirty) => state === "running" || dirty === true;
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash12 } from "node:crypto";
-import * as fs14 from "node:fs";
+import { createHash as createHash13 } from "node:crypto";
+import * as fs15 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import fs11 from "node:fs";
-import path13 from "node:path";
+import fs13 from "node:fs";
+import path15 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = ".workit/checks.json";
 var LEGACY_CHECKS_FILE = "workit.checks.json";
 function checksConfigFile(root) {
-  const current = path13.join(root, CHECKS_FILE);
-  const legacy = path13.join(root, LEGACY_CHECKS_FILE);
-  return !fs11.existsSync(current) && fs11.existsSync(legacy) ? legacy : current;
+  const current = path15.join(root, CHECKS_FILE);
+  const legacy = path15.join(root, LEGACY_CHECKS_FILE);
+  return !fs13.existsSync(current) && fs13.existsSync(legacy) ? legacy : current;
 }
 function repoHeavyCommands(root) {
   try {
-    const value = JSON.parse(fs11.readFileSync(checksConfigFile(root), "utf8"));
+    const value = JSON.parse(fs13.readFileSync(checksConfigFile(root), "utf8"));
     const resources = isRecord2(value) ? value.resources : undefined;
     const list = isRecord2(resources) ? resources.heavyCommands : undefined;
     return Array.isArray(list) ? list.filter((item) => typeof item === "string") : [];
@@ -13117,10 +13295,10 @@ var git3 = (cwd, args) => {
   return value || null;
 };
 function checkRoot(cwd) {
-  return path13.resolve(git3(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path15.resolve(git3(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 var packageManager = (root) => {
-  const has = (file) => fs11.existsSync(path13.join(root, file));
+  const has = (file) => fs13.existsSync(path15.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -13140,7 +13318,7 @@ var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs11.readFileSync(path13.join(root, file), "utf8");
+      return fs13.readFileSync(path15.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -13179,21 +13357,21 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function configFileFor(root) {
   const own = checksConfigFile(root);
-  if (fs11.existsSync(own))
+  if (fs13.existsSync(own))
     return own;
   const common = git3(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-  if (!common || path13.basename(common) !== ".git")
+  if (!common || path15.basename(common) !== ".git")
     return own;
-  const main = path13.dirname(common);
-  if (path13.resolve(main) === path13.resolve(root))
+  const main = path15.dirname(common);
+  if (path15.resolve(main) === path15.resolve(root))
     return own;
   const shared = checksConfigFile(main);
-  return fs11.existsSync(shared) ? shared : own;
+  return fs13.existsSync(shared) ? shared : own;
 }
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = configFileFor(root);
-  const legacy = path13.basename(file) === LEGACY_CHECKS_FILE;
+  const legacy = path15.basename(file) === LEGACY_CHECKS_FILE;
   const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
   const note = legacy ? {
     note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
@@ -13208,7 +13386,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs11.readFileSync(file, "utf8");
+    text = fs13.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${label}: ${error.message}`);
@@ -13271,10 +13449,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path13.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path15.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs11.statSync(path13.join(dir, `workit${ext}`)).isFile();
+      return fs13.statSync(path15.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -13287,17 +13465,17 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path17 from "node:path";
+import path18 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash11, randomBytes as randomBytes3 } from "node:crypto";
-import fs13 from "node:fs";
-import path16 from "node:path";
+import { createHash as createHash12, randomBytes as randomBytes3 } from "node:crypto";
+import fs14 from "node:fs";
+import path17 from "node:path";
 
 // packages/workit-core/src/core/policy/lane.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import path14 from "node:path";
+import path16 from "node:path";
 
 // packages/workit-core/src/git/default-base.ts
 var safeRef = (value) => value.length > 0 && !value.startsWith("-");
@@ -13882,7 +14060,7 @@ function computeLane(input) {
 }
 function untrackedStat(cwd, file) {
   try {
-    const bytes = readFileSync4(path14.join(cwd, file));
+    const bytes = readFileSync4(path16.join(cwd, file));
     if (bytes.includes(0))
       return { path: file, added: 0, deleted: 0, binary: true };
     const text = bytes.toString("utf8");
@@ -13913,7 +14091,7 @@ function cosmeticFiles(cwd, fork, head) {
     let after = blobs.get(entry.newBlob);
     if (!after && head === null && ABSENT.test(entry.newBlob))
       try {
-        after = readFileSync4(path14.join(cwd, entry.path));
+        after = readFileSync4(path16.join(cwd, entry.path));
       } catch {
         after = undefined;
       }
@@ -14036,61 +14214,6 @@ function verdictDrift(cwd, input) {
   return stale(lane.reasons[0] ?? `lane ${lane.lane}`, paths, lane.lane === "self");
 }
 
-// packages/workit-core/src/hooks/standing-signal.ts
-import { createHash as createHash10 } from "node:crypto";
-import fs12 from "node:fs";
-import path15 from "node:path";
-var gitStoreDir = (cwd) => {
-  try {
-    for (let dir = path15.resolve(cwd);; dir = path15.dirname(dir)) {
-      const dotGit = path15.join(dir, ".git");
-      if (fs12.existsSync(dotGit)) {
-        let gitDir = dotGit;
-        if (fs12.statSync(dotGit).isFile()) {
-          const target = /^gitdir:\s*(.+)$/mu.exec(fs12.readFileSync(dotGit, "utf8"))?.[1]?.trim();
-          if (!target)
-            return null;
-          gitDir = path15.resolve(dir, target);
-          const common = path15.join(gitDir, "commondir");
-          if (fs12.existsSync(common))
-            gitDir = path15.resolve(gitDir, fs12.readFileSync(common, "utf8").trim());
-        }
-        return path15.join(gitDir, "workit");
-      }
-      if (path15.dirname(dir) === dir)
-        return null;
-    }
-  } catch {
-    return null;
-  }
-};
-var standingRevFile = (store) => path15.join(store, "standing", "rev");
-var standingSeenFile = (store, session, agentId) => path15.join(store, "standing", "seen", `${createHash10("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`);
-var readStandingRev = (store) => {
-  try {
-    return fs12.readFileSync(standingRevFile(store), "utf8").trim() || null;
-  } catch {
-    return null;
-  }
-};
-var readStandingSeen = (file) => {
-  try {
-    const value = JSON.parse(fs12.readFileSync(file, "utf8"));
-    return {
-      rev: typeof value.rev === "string" ? value.rev : null,
-      ids: Array.isArray(value.ids) ? value.ids.filter((id) => typeof id === "string") : []
-    };
-  } catch {
-    return { rev: null, ids: [] };
-  }
-};
-var writeStandingSeen = (file, seen) => {
-  try {
-    fs12.mkdirSync(path15.dirname(file), { recursive: true });
-    fs12.writeFileSync(file, JSON.stringify(seen));
-  } catch {}
-};
-
 // packages/workit-core/src/ledger.ts
 var LEDGER_VERSION = 1;
 var MAX_LINE_BYTES = 4096;
@@ -14168,7 +14291,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash11("sha256");
+  const hash = createHash12("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -14192,14 +14315,14 @@ function cleanRebase(cwd, range) {
   return Boolean(tree) && tree === git4(cwd, ["rev-parse", "--verify", "-q", `${range.to}^{tree}`]);
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path16.resolve(cwd));
+  const location = resolveStore(path17.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path16.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path17.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
@@ -14219,7 +14342,7 @@ var onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs13.statfsSync(dir).type);
+    return isNetworkFsType(fs14.statfsSync(dir).type);
   } catch {
     return false;
   }
@@ -14229,15 +14352,15 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs13.readFileSync(path16.join(lock, LOCK_OWNER), "utf8");
+    return fs14.readFileSync(path17.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 };
 var lockAgeMs = (lock) => {
-  for (const target of [path16.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path17.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs13.statSync(target).mtimeMs;
+      return Date.now() - fs14.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
@@ -14245,14 +14368,14 @@ var lockAgeMs = (lock) => {
 var ledgerLock = {
   acquire(lock) {
     try {
-      fs13.mkdirSync(lock);
+      fs14.mkdirSync(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         return null;
       throw error;
     }
     const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
-    fs13.writeFileSync(path16.join(lock, LOCK_OWNER), token);
+    fs14.writeFileSync(path17.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
@@ -14260,35 +14383,35 @@ var ledgerLock = {
       return false;
     const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
     try {
-      fs13.renameSync(lock, tomb);
+      fs14.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) !== token) {
       try {
-        fs13.renameSync(tomb, lock);
+        fs14.renameSync(tomb, lock);
       } catch {}
       return false;
     }
-    fs13.rmSync(tomb, { recursive: true, force: true });
+    fs14.rmSync(tomb, { recursive: true, force: true });
     return true;
   },
   token: lockToken,
   reap(lock, observed) {
     const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
     try {
-      fs13.renameSync(lock, tomb);
+      fs14.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) === observed) {
-      fs13.rmSync(tomb, { recursive: true, force: true });
+      fs14.rmSync(tomb, { recursive: true, force: true });
       return true;
     }
     try {
-      fs13.renameSync(tomb, lock);
+      fs14.renameSync(tomb, lock);
     } catch {
-      fs13.rmSync(tomb, { recursive: true, force: true });
+      fs14.rmSync(tomb, { recursive: true, force: true });
     }
     return false;
   }
@@ -14315,14 +14438,14 @@ function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
     ledgerLock.release(lock, token);
   }
 }
-var sha2562 = (text) => createHash11("sha256").update(text).digest("hex");
+var sha2562 = (text) => createHash12("sha256").update(text).digest("hex");
 var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`);
 var TAIL_BYTES = 64 * 1024;
 var lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs13.readSync(fd, buffer, 0, span, size - span);
+    fs14.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -14353,21 +14476,21 @@ var lastLine = (fd, size) => {
 };
 var tighten = (fd) => {
   try {
-    if ((fs13.fstatSync(fd).mode & 63) !== 0)
-      fs13.fchmodSync(fd, 384);
+    if ((fs14.fstatSync(fd).mode & 63) !== 0)
+      fs14.fchmodSync(fd, 384);
   } catch {}
 };
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs13.openSync(file, "a+", 384);
+    const fd = fs14.openSync(file, "a+", 384);
     try {
       if (process.platform !== "win32")
         tighten(fd);
-      const size = fs13.fstatSync(fd).size;
+      const size = fs14.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs13.readSync(fd, last, 0, 1, size - 1);
+        fs14.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -14376,17 +14499,17 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs13.writeSync(fd, bytes);
+      const written = fs14.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs13.closeSync(fd);
+      fs14.closeSync(fd);
     }
   };
   try {
-    fs13.mkdirSync(path16.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path16.dirname(file)))
+    fs14.mkdirSync(path17.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path17.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -14459,8 +14582,8 @@ function readLedger(cwd, options = {}) {
   let text = "";
   let stat = null;
   try {
-    stat = fs13.statSync(file.value);
-    text = fs13.readFileSync(file.value, "utf8");
+    stat = fs14.statSync(file.value);
+    text = fs14.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -14600,7 +14723,7 @@ function ledgerTampering(cwd) {
   if (!file.ok)
     return [];
   try {
-    const stat = fs13.statSync(file.value);
+    const stat = fs14.statSync(file.value);
     const cached = tamperCache.get(file.value);
     if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
       return cached.breaks;
@@ -15204,7 +15327,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync5(path17.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync5(path18.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -15281,15 +15404,15 @@ function writeBlockers(task, root) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes = (value) => createHash12("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path18.sep}`);
-var relative = (root, candidate) => path18.relative(root, candidate).split(path18.sep).join("/") || ".";
+var digestBytes = (value) => createHash13("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path19.sep}`);
+var relative = (root, candidate) => path19.relative(root, candidate).split(path19.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path18.posix.normalize(value);
+  const normalized = path19.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -15337,21 +15460,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path18.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path19.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path18.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path19.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs14.readdirSync(directory);
+    names = fs15.readdirSync(directory);
   } catch {
     return true;
   }
@@ -15359,10 +15482,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path18.join(directory, name);
+    const target = path19.join(directory, name);
     let stat;
     try {
-      stat = fs14.lstatSync(target);
+      stat = fs15.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15377,14 +15500,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path18.resolve(root, item);
+    const target = path19.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs14.existsSync(ancestor) && ancestor !== root)
-      ancestor = path18.dirname(ancestor);
+    while (!fs15.existsSync(ancestor) && ancestor !== root)
+      ancestor = path19.dirname(ancestor);
     try {
-      if (!inside(root, fs14.realpathSync(ancestor)))
+      if (!inside(root, fs15.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -15396,7 +15519,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs14.realpathSync(root);
+    checkout = fs15.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -15414,11 +15537,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs14.existsSync(target))
+    if (!fs15.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs14.lstatSync(target);
+      stat = fs15.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15434,17 +15557,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path18.join(checkout, item);
+    const target = path19.join(checkout, item);
     try {
-      const stat = fs14.lstatSync(target);
+      const stat = fs15.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs14.readlinkSync(target);
+        const link = fs15.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs14.readFileSync(target)),
+          digest: digestBytes(fs15.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -15609,7 +15732,7 @@ var findingVerificationPasses = (findingCandidateId, evidence) => evidence.statu
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs14.realpathSync(checkoutRoot);
+    root = fs15.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -15618,23 +15741,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path18.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path18.sep}`))
+    const target = path19.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path19.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path18.relative(root, target);
+      const below = path19.relative(root, target);
       let current = root;
-      for (const segment of below.split(path18.sep)) {
+      for (const segment of below.split(path19.sep)) {
         if (!segment)
           continue;
-        current = path18.join(current, segment);
-        const stat = fs14.lstatSync(current);
-        const real = fs14.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path18.sep}`))
+        current = path19.join(current, segment);
+        const stat = fs15.lstatSync(current);
+        const real = fs15.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path19.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -15650,7 +15773,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs14.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs15.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -16232,19 +16355,19 @@ var exportDigest = (bundle) => sha256({
 // packages/workit-core/src/core/route-intent.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 import { existsSync as existsSync7 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 
 // packages/workit-core/src/hooks/raw-git.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
-import fs16 from "node:fs";
+import { createHash as createHash15 } from "node:crypto";
+import fs17 from "node:fs";
 import os4 from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 
 // packages/workit-core/src/hooks/session-marker.ts
-import { createHash as createHash13 } from "node:crypto";
-import fs15 from "node:fs";
-import path19 from "node:path";
+import { createHash as createHash14 } from "node:crypto";
+import fs16 from "node:fs";
+import path20 from "node:path";
 var sessionMarkerFile = (input, session, store) => {
   let dir = store;
   if (dir === undefined) {
@@ -16253,8 +16376,8 @@ var sessionMarkerFile = (input, session, store) => {
       return null;
     dir = location.dir;
   }
-  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path19.join(dir, "hooks", `skills-${name}.json`);
+  const name = createHash14("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path20.join(dir, "hooks", `skills-${name}.json`);
 };
 var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 var EMPTY = {
@@ -16267,7 +16390,7 @@ var EMPTY = {
 };
 var readRaw = (file) => {
   try {
-    return fs15.readFileSync(file, "utf8");
+    return fs16.readFileSync(file, "utf8");
   } catch {
     return "";
   }
@@ -16289,13 +16412,13 @@ var parseMarker = (text) => {
 };
 var readSessionMarker = (file) => parseMarker(readRaw(file));
 var writeAtomic = (file, marker) => {
-  fs15.mkdirSync(path19.dirname(file), { recursive: true });
+  fs16.mkdirSync(path20.dirname(file), { recursive: true });
   const temp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
-    fs15.writeFileSync(temp, JSON.stringify(marker));
-    fs15.renameSync(temp, file);
+    fs16.writeFileSync(temp, JSON.stringify(marker));
+    fs16.renameSync(temp, file);
   } catch (error) {
-    fs15.rmSync(temp, { force: true });
+    fs16.rmSync(temp, { force: true });
     throw error;
   }
 };
@@ -16837,14 +16960,14 @@ var GIT_CONFIG_ENV = /^GIT_(?:CONFIG\w*|DIR|COMMON_DIR|WORK_TREE)$/;
 var ASSIGNMENT = /^([A-Za-z_]\w*)=([\s\S]*)$/;
 var MAX_DEPTH = 4;
 var MAX_EXPANSIONS = 16;
-var isAbsolute = (value) => path20.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+var isAbsolute = (value) => path21.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 var HERE = /^(?:\$PWD|\$\{PWD\}|\$\(\s*pwd\s*\)|`pwd`|\$\(\s*git\s+rev-parse\s+--show-toplevel\s*\))(?=$|[\\/])/;
 var joinDir = (base, raw) => {
   const next = raw.replace(HERE, ".");
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
-  const expanded = next === "~" || next.startsWith("~/") ? path20.join(os4.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path20.join(base, expanded);
+  const expanded = next === "~" || next.startsWith("~/") ? path21.join(os4.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path21.join(base, expanded);
 };
 var rebase = (base, inner) => inner === null ? base : inner === undefined ? undefined : joinDir(base, inner);
 var cdTarget = (words) => {
@@ -17702,7 +17825,7 @@ var repoAt = (dir) => {
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 };
 var isWorkitWorkspace = (repo) => {
-  if (fs16.existsSync(repo.location.dir))
+  if (fs17.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -17723,17 +17846,17 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs16.readFileSync(path20.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs17.readFileSync(path21.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path20.dirname(repo.location.dir);
+    const common = path21.dirname(repo.location.dir);
     try {
-      return fs16.readFileSync(path20.join(common, ref), "utf8").trim() || null;
+      return fs17.readFileSync(path21.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs16.readFileSync(path20.join(common, "packed-refs"), "utf8");
+    const packed = fs17.readFileSync(path21.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -17821,8 +17944,8 @@ var expandGitAliases = (root, invocation, cache = new Map, depth = 0) => {
   const sub = invocation.args[0];
   if (invocation.tool !== "git" || invocation.dir === undefined || !sub || sub.startsWith("-") || GIT_COMMANDS.has(sub) || depth >= MAX_DEPTH)
     return [invocation];
-  const dir = path20.resolve(root, invocation.dir ?? ".");
-  if (!fs16.existsSync(dir))
+  const dir = path21.resolve(root, invocation.dir ?? ".");
+  if (!fs17.existsSync(dir))
     return [invocation];
   const config = gitConfig(dir, invocation, cache);
   const alias = configValue(config, `alias.${sub.toLowerCase()}`);
@@ -17844,11 +17967,11 @@ var expandGitAliases = (root, invocation, cache = new Map, depth = 0) => {
 var normalizedUrl = (url, dir) => {
   const trimmed = url.trim();
   if (/^file:\/\//i.test(trimmed))
-    return path20.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path21.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
   const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(trimmed);
   const scp = !scheme && /^(?:[^@/\\]+@)?[^/\\:]{2,}:/.test(trimmed);
   if (!scheme && !scp)
-    return path20.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path21.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
   const value = scheme ? trimmed.slice(scheme[0].length).replace(/^[^@/]*@/, "").replace(/^([^/:]+):\d+(?=\/)/, "$1") : trimmed.replace(/^[^@/]*@/, "").replace(":", "/");
   return value.toLowerCase().replace(/\/{2,}/g, "/").replace(/^www\./, "").replace(/\/+$/, "").replace(/\.git$/, "");
 };
@@ -18071,7 +18194,7 @@ var actionsIn = (cwd, command, dialect, cache = new Map) => {
   const out = [];
   const repos = new Map;
   const repoFor = (relative) => {
-    const dir = path20.resolve(cwd, relative ?? ".");
+    const dir = path21.resolve(cwd, relative ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -18156,8 +18279,8 @@ var analysisDenial = (error) => ({
   unblock: SPLIT_IT
 });
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path20.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
-var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`;
+var markerFile = (repo, session, key) => path21.join(repo.location.dir, "hooks", `commit-${createHash15("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash15("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
     if (!input.session.id || !/\bcommit\b/.test(command))
@@ -18167,8 +18290,8 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs16.mkdirSync(path20.dirname(file), { recursive: true });
-      fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs17.mkdirSync(path21.dirname(file), { recursive: true });
+      fs17.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
@@ -18191,11 +18314,11 @@ var headCommit = (dir) => {
 var settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs16.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs17.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs16.rmSync(file, { force: true });
+  fs17.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -18386,7 +18509,7 @@ var judgedDir = (root, dir) => {
     return null;
   if (dir === null)
     return root;
-  const resolved = path21.resolve(root, dir);
+  const resolved = path22.resolve(root, dir);
   return existsSync7(resolved) && inWorkitWorkspace(resolved) ? resolved : null;
 };
 var shellBranchPolicyViolation = (root, command, dialect = "posix") => {
@@ -18622,7 +18745,7 @@ var judgeInputSummary = (raw) => {
 
 // packages/workit-core/src/autonomy.ts
 import os5 from "node:os";
-import path22 from "node:path";
+import path23 from "node:path";
 
 // packages/workit-core/src/core/safe-write.ts
 import {
@@ -18656,10 +18779,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path22.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path23.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path22.resolve(resolveConfigDir());
-  return configured === path22.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path22.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path23.resolve(resolveConfigDir());
+  return configured === path23.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path23.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -20470,7 +20593,7 @@ class WorkitCore {
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync4 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -20604,7 +20727,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path23.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path24.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -20635,7 +20758,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path23.join(cwd, "package.json");
+  const pkgPath = path24.join(cwd, "package.json");
   if (!existsSync8(pkgPath))
     return [];
   try {
@@ -20661,9 +20784,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path23.join(dir, entry.name), depth + 1);
+        walk(path24.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path23.relative(cwd, path23.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path24.relative(cwd, path24.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -20679,7 +20802,7 @@ var readTrimmed2 = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path23.resolve(repoRoot(root));
+  const cwd = path24.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -20737,7 +20860,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed2(path23.join(cwd, template), 220);
+    stdout += readTrimmed2(path24.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -20747,7 +20870,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync8(path23.join(cwd, "package.json"))) {
+  if (existsSync8(path24.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -20756,7 +20879,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync8(path23.join(cwd, "Cargo.toml")) || existsSync8(path23.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync8(path24.join(cwd, "Cargo.toml")) || existsSync8(path24.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -20789,7 +20912,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path23.resolve(repoRoot(root));
+  const cwd = path24.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -20807,7 +20930,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path23.join(cwd, "CHANGELOG.md");
+  const changelogPath = path24.join(cwd, "CHANGELOG.md");
   if (existsSync8(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
@@ -20827,7 +20950,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path23.resolve(repoRoot(root));
+  const cwd = path24.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -20849,7 +20972,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path23.join(cwd, "README.md");
+  const readme = path24.join(cwd, "README.md");
   if (existsSync8(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
@@ -20858,7 +20981,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path23.join(cwd, "package.json");
+  const pkgPath = path24.join(cwd, "package.json");
   if (existsSync8(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
@@ -20872,7 +20995,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path23.resolve(repoRoot(root));
+  const cwd = path24.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -20910,7 +21033,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync8(path23.join(cwd, rel)))
+    if (existsSync8(path24.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -20941,8 +21064,8 @@ function releaseNotesContext(root, rangeOrTag) {
 import { spawnSync as spawnSync15 } from "node:child_process";
 
 // packages/workit-core/src/core/pr-create.ts
-import fs17 from "node:fs";
-import path24 from "node:path";
+import fs18 from "node:fs";
+import path25 from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 // packages/workit-core/src/forge/pr-body.ts
@@ -20954,13 +21077,13 @@ function parseGhIssue(value) {
 // packages/workit-core/src/core/pr-create.ts
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path24.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path25.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path24.join(dir, name);
+      const candidate = path25.join(dir, name);
       try {
-        fs17.accessSync(candidate, fs17.constants.X_OK);
+        fs18.accessSync(candidate, fs18.constants.X_OK);
         return candidate;
       } catch {}
     }
@@ -20980,7 +21103,7 @@ var pushRemote = (cwd) => {
 };
 var safePushUrl = (remote) => {
   const raw = remote.trim();
-  if (path24.isAbsolute(raw))
+  if (path25.isAbsolute(raw))
     return pathToFileURL(raw).href;
   if (!raw.includes("://")) {
     const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
@@ -21111,8 +21234,8 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 };
 
 // packages/workit-core/src/core/youtrack.ts
-import fs18 from "node:fs";
-import path25 from "node:path";
+import fs19 from "node:fs";
+import path26 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -21125,22 +21248,22 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path25.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path25.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path26.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path26.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs18.statSync(p).mode & 511;
+  const mode = fs19.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs18.existsSync(cfgPath)) {
+  if (!fs19.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs18.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs19.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -21151,11 +21274,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs18.existsSync(cfgPath))
+  if (!fs19.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs18.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs19.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -21194,12 +21317,12 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path25.isAbsolute(tokenFile) ? path25.resolve(tokenFile) : path25.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs18.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path26.isAbsolute(tokenFile) ? path26.resolve(tokenFile) : path26.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs19.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs18.readFileSync(tokenPath, "utf8").trim();
+  const token = fs19.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
   if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
@@ -21245,7 +21368,7 @@ function youTrackTokenCreateUrl() {
   const desc = String(defaults.description ?? "OpenCode workit — /wk-issue-update and /wk-meetings");
   const scopes = Array.isArray(defaults.scopes) ? defaults.scopes : ["YouTrack"];
   const base = String(config.baseUrl ?? "").replace(/\/+$/, "");
-  const tokenFile = String(config.tokenFile ?? path25.join(path25.dirname(loaded.path), "youtrack.token"));
+  const tokenFile = String(config.tokenFile ?? path26.join(path26.dirname(loaded.path), "youtrack.token"));
   const tab = String(defaults.profileTab ?? "account-security");
   const createUrl = base ? `${base}/users/me?${new URLSearchParams({ tab })}` : null;
   const docsUrl = "https://www.jetbrains.com/help/youtrack/cloud/manage-permanent-token.html";
@@ -21254,7 +21377,7 @@ function youTrackTokenCreateUrl() {
       tokenName: name,
       tokenDescription: desc,
       scopes,
-      tokenFile: path25.resolve(tokenFile),
+      tokenFile: path26.resolve(tokenFile),
       createUrl,
       docsUrl,
       prefillSupported: false,
@@ -21300,9 +21423,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs18.existsSync(full))
+    if (!fs19.existsSync(full))
       continue;
-    const text = fs18.readFileSync(full, "utf8");
+    const text = fs19.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -21594,15 +21717,15 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path26.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path26.sep)) {
+  const target = path27.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path27.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync9(ancestor))
-    ancestor = path26.dirname(ancestor);
+    ancestor = path27.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path26.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path27.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -21646,7 +21769,7 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import path27 from "node:path";
+import path28 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
 var migrationPending = (result) => !result.ok && result.code === "needs_input" && (result.error ?? "").startsWith(MIGRATION_PENDING);
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
@@ -21734,7 +21857,7 @@ function entryCompactContext(store, entry, session, context) {
     current: () => recentSignal(store.root)
   };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path27.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path28.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -21816,13 +21939,13 @@ var isAllowedWorkitCommand = (command) => {
   return segments.length > 0 && segments.every((s) => !s.unanalyzable && !s.group && !s.subs?.length && !s.stdin?.length && !s.redirects.length && isAllowedWorkitCall(s.words, s.expands));
 };
 // packages/workit-core/src/core/heavy-rules.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 import os6 from "node:os";
-import path28 from "node:path";
+import path29 from "node:path";
 var EMPTY2 = () => ({ deny: [], allow: [] });
 var readText2 = (file) => {
   try {
-    return fs19.readFileSync(file, "utf8");
+    return fs20.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -21859,19 +21982,19 @@ function parseJsonc(text) {
   return JSON.parse(out.replace(/,(\s*[}\]])/gu, "$1"));
 }
 function gitTop(cwd) {
-  for (let dir = path28.resolve(cwd);; dir = path28.dirname(dir)) {
-    if (fs19.existsSync(path28.join(dir, ".git")))
+  for (let dir = path29.resolve(cwd);; dir = path29.dirname(dir)) {
+    if (fs20.existsSync(path29.join(dir, ".git")))
       return dir;
-    if (path28.dirname(dir) === dir)
+    if (path29.dirname(dir) === dir)
       return null;
   }
 }
 var projectDirs = (cwd) => {
   const top = gitTop(cwd);
   const dirs = [];
-  for (let dir = path28.resolve(cwd);; dir = path28.dirname(dir)) {
+  for (let dir = path29.resolve(cwd);; dir = path29.dirname(dir)) {
     dirs.push(dir);
-    if (!top || dir === top || path28.dirname(dir) === dir)
+    if (!top || dir === top || path29.dirname(dir) === dir)
       return dirs;
   }
 };
@@ -21883,12 +22006,12 @@ var CLAUDE_MANAGED = {
 };
 function claudeSettingsFiles(cwd, env, platform = process.platform) {
   const project = env.CLAUDE_PROJECT_DIR || gitTop(cwd) || cwd;
-  const user = env.CLAUDE_CONFIG_DIR || path28.join(homeOf(env), ".claude");
+  const user = env.CLAUDE_CONFIG_DIR || path29.join(homeOf(env), ".claude");
   return [
     ...CLAUDE_MANAGED[platform] ? [CLAUDE_MANAGED[platform]] : [],
-    path28.join(user, "settings.json"),
-    path28.join(project, ".claude", "settings.json"),
-    path28.join(project, ".claude", "settings.local.json")
+    path29.join(user, "settings.json"),
+    path29.join(project, ".claude", "settings.json"),
+    path29.join(project, ".claude", "settings.local.json")
   ];
 }
 var bashPattern = (entry) => {
@@ -21978,10 +22101,10 @@ var opencodeConfig = (value, rules) => {
 function opencodeRules(cwd, env = process.env) {
   const rules = EMPTY2();
   try {
-    const config = env.XDG_CONFIG_HOME || path28.join(homeOf(env), ".config");
+    const config = env.XDG_CONFIG_HOME || path29.join(homeOf(env), ".config");
     const files = [
-      ...OPENCODE_NAMES.map((name) => path28.join(config, "opencode", name)),
-      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path28.join(dir, name), path28.join(dir, ".opencode", name)])),
+      ...OPENCODE_NAMES.map((name) => path29.join(config, "opencode", name)),
+      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path29.join(dir, name), path29.join(dir, ".opencode", name)])),
       ...env.OPENCODE_CONFIG ? [env.OPENCODE_CONFIG] : []
     ];
     for (const file of files) {
@@ -22025,19 +22148,19 @@ var codexRule = (body) => {
 function codexRules(cwd, env = process.env) {
   const rules = EMPTY2();
   try {
-    const home = env.CODEX_HOME || path28.join(homeOf(env), ".codex");
+    const home = env.CODEX_HOME || path29.join(homeOf(env), ".codex");
     const top = gitTop(cwd) ?? cwd;
-    for (const dir of [path28.join(home, "rules"), path28.join(top, ".codex", "rules")]) {
+    for (const dir of [path29.join(home, "rules"), path29.join(top, ".codex", "rules")]) {
       let files;
       try {
-        files = fs19.readdirSync(dir).filter((name) => name.endsWith(".rules"));
+        files = fs20.readdirSync(dir).filter((name) => name.endsWith(".rules"));
       } catch (error) {
         if (error.code === "ENOENT")
           continue;
         return "unreadable";
       }
       for (const name of files) {
-        const text = readText2(path28.join(dir, name)) ?? "";
+        const text = readText2(path29.join(dir, name)) ?? "";
         for (const part of text.split(/\bprefix_rule\s*\(/u).slice(1)) {
           const rule = codexRule(part);
           if (!rule)
@@ -22056,8 +22179,8 @@ function cursorRules(cwd, env = process.env) {
   try {
     const top = gitTop(cwd) ?? cwd;
     for (const file of [
-      path28.join(homeOf(env), ".cursor", "cli-config.json"),
-      path28.join(top, ".cursor", "cli.json")
+      path29.join(homeOf(env), ".cursor", "cli-config.json"),
+      path29.join(top, ".cursor", "cli.json")
     ]) {
       const text = readText2(file);
       if (text === null)
@@ -22131,23 +22254,23 @@ function wrapAllowed(read, words, command, options = {}) {
 }
 
 // packages/workit-core/src/core/heavy.ts
-import fs20 from "node:fs";
+import fs21 from "node:fs";
 import os7 from "node:os";
-import path29 from "node:path";
+import path30 from "node:path";
 function stateDir(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path29.join(env.XDG_STATE_HOME, "workit");
+    return path30.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os7.homedir();
   if (platform === "darwin")
-    return path29.join(home, "Library", "Application Support", "workit");
+    return path30.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path29.join(env.LOCALAPPDATA ?? path29.join(home, "AppData", "Local"), "workit");
-  return path29.join(home, ".local", "state", "workit");
+    return path30.join(env.LOCALAPPDATA ?? path30.join(home, "AppData", "Local"), "workit");
+  return path30.join(home, ".local", "state", "workit");
 }
 var HEAVY_COMMANDS_FILE = "heavy-commands.json";
-var heavyCommandsFile = (env) => path29.join(stateDir(env), HEAVY_COMMANDS_FILE);
+var heavyCommandsFile = (env) => path30.join(stateDir(env), HEAVY_COMMANDS_FILE);
 var HEAVY_SCRIPT = /^(?:test|tests|t|tst|unit|integration|e2e|coverage|cov|lint|eslint|typecheck|type-check|types|tsc|check|verify|validate|build|compile|bundle|ci|sonar|cypress|playwright|jest|vitest|mocha|bench|benchmark|all)(?:$|[:_.-])/iu;
 var INFO_FLAGS = new Set(["--version", "-v", "-V", "--help", "-h", "help", "version"]);
 var WATCH_FLAG = /^(?:--watch(?:All)?(?:=.*)?|-w|--serve)$/u;
@@ -22410,7 +22533,7 @@ function parsePattern(pattern) {
 var matches = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index]));
 var readJson = (file) => {
   try {
-    return JSON.parse(fs20.readFileSync(file, "utf8"));
+    return JSON.parse(fs21.readFileSync(file, "utf8"));
   } catch {
     return;
   }
@@ -22422,7 +22545,7 @@ function machinePatterns(env) {
   return isRecord5(value) ? stringList(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path29.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path30.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -22500,12 +22623,12 @@ function heavyPlan(command, options) {
 }
 function workitOnPath2(env = process.env) {
   const names = process.platform === "win32" ? ["workit.exe", "workit.cmd", "workit"] : ["workit"];
-  for (const dir of (env.PATH ?? "").split(path29.delimiter))
+  for (const dir of (env.PATH ?? "").split(path30.delimiter))
     for (const name of names) {
       if (!dir)
         continue;
       try {
-        fs20.accessSync(path29.join(dir, name), fs20.constants.X_OK);
+        fs21.accessSync(path30.join(dir, name), fs21.constants.X_OK);
         return true;
       } catch {}
     }
@@ -22522,41 +22645,41 @@ function leaseRewrite(command) {
 }
 
 // packages/workit-core/src/core/heavy-words.ts
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 import os8 from "node:os";
-import path30 from "node:path";
+import path31 from "node:path";
 var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
 var wordsOf = (command) => command.split(/[\s;&|()<>`'"]+/u).map((word) => (word.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat)$/u, "")).filter(Boolean);
 var stateDir2 = (env) => {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path30.join(env.XDG_STATE_HOME, "workit");
+    return path31.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os8.homedir();
   if (process.platform === "darwin")
-    return path30.join(home, "Library", "Application Support", "workit");
+    return path31.join(home, "Library", "Application Support", "workit");
   if (process.platform === "win32")
-    return path30.join(env.LOCALAPPDATA ?? path30.join(home, "AppData", "Local"), "workit");
-  return path30.join(home, ".local", "state", "workit");
+    return path31.join(env.LOCALAPPDATA ?? path31.join(home, "AppData", "Local"), "workit");
+  return path31.join(home, ".local", "state", "workit");
 };
 var readJson2 = (file) => {
   try {
-    return JSON.parse(fs21.readFileSync(file, "utf8"));
+    return JSON.parse(fs22.readFileSync(file, "utf8"));
   } catch {
     return;
   }
 };
 var patternWords = (cwd, env) => {
   const patterns = [];
-  const machine = readJson2(path30.join(stateDir2(env), "heavy-commands.json"));
+  const machine = readJson2(path31.join(stateDir2(env), "heavy-commands.json"));
   if (Array.isArray(machine?.patterns))
     patterns.push(...machine.patterns);
-  for (let dir = path30.resolve(cwd);; dir = path30.dirname(dir)) {
-    if (fs21.existsSync(path30.join(dir, ".git"))) {
+  for (let dir = path31.resolve(cwd);; dir = path31.dirname(dir)) {
+    if (fs22.existsSync(path31.join(dir, ".git"))) {
       patterns.push(...repoHeavyCommands(dir));
       break;
     }
-    if (path30.dirname(dir) === dir)
+    if (path31.dirname(dir) === dir)
       break;
   }
   const words = new Set;
@@ -22617,14 +22740,14 @@ function heavyGate(cwd, command, options) {
 // packages/workit-core/src/hooks/write-gate.ts
 import { existsSync as existsSync10, realpathSync as realpathSync6 } from "node:fs";
 import os10 from "node:os";
-import path32 from "node:path";
+import path33 from "node:path";
 
 // packages/workit-core/src/core/live-session.ts
 import { spawnSync as spawnSync17 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
-import fs22 from "node:fs";
+import { createHash as createHash16 } from "node:crypto";
+import fs23 from "node:fs";
 import os9 from "node:os";
-import path31 from "node:path";
+import path32 from "node:path";
 var LIVE_SESSION_TTL_MS = 15 * 60000;
 var HEARTBEAT_EVERY_MS = 30000;
 var liveProbe = {
@@ -22645,9 +22768,9 @@ var processAlive = (pid) => {
 var processInfo = (pid) => {
   try {
     if (liveProbe.platform === "linux") {
-      const stat = fs22.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const stat = fs23.readFileSync(`/proc/${pid}/stat`, "utf8");
       const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-      const command = fs22.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      const command = fs23.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
       return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
     }
     if (liveProbe.platform === "win32")
@@ -22698,35 +22821,35 @@ var liveOwner = (input, transport, env = process.env) => {
   };
 };
 var checkoutOf = (target) => {
-  let dir = path31.resolve(target);
-  while (!fs22.existsSync(dir) && path31.dirname(dir) !== dir)
-    dir = path31.dirname(dir);
-  if (fs22.existsSync(dir) && !fs22.statSync(dir).isDirectory())
-    dir = path31.dirname(dir);
-  const parts = dir.split(path31.sep);
+  let dir = path32.resolve(target);
+  while (!fs23.existsSync(dir) && path32.dirname(dir) !== dir)
+    dir = path32.dirname(dir);
+  if (fs23.existsSync(dir) && !fs23.statSync(dir).isDirectory())
+    dir = path32.dirname(dir);
+  const parts = dir.split(path32.sep);
   const dotGit = parts.lastIndexOf(".git");
   if (dotGit > 0)
-    dir = parts.slice(0, dotGit).join(path31.sep) || path31.sep;
+    dir = parts.slice(0, dotGit).join(path32.sep) || path32.sep;
   const location = resolveStore(dir);
   if (location instanceof Error || !location.shared || !location.top)
     return null;
   let top = location.top;
   try {
-    top = fs22.realpathSync.native(top);
+    top = fs23.realpathSync.native(top);
   } catch {}
   return top;
 };
-var markerFile2 = (top) => path31.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
+var markerFile2 = (top) => path32.join(resolveStateDir(), "live-sessions", `${createHash16("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
 var checkoutKey = (top, platform = process.platform) => {
-  let key = path31.resolve(top);
+  let key = path32.resolve(top);
   try {
-    key = fs22.realpathSync.native(key);
+    key = fs23.realpathSync.native(key);
   } catch {}
   return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
 };
 var readMarker = (file) => {
   try {
-    const value = JSON.parse(fs22.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs23.readFileSync(file, "utf8"));
     if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
       return null;
     return {
@@ -22813,10 +22936,10 @@ var claimLiveSession = (target, owner, deps = {}) => {
       checkout,
       heartbeatAt: now.toISOString()
     };
-    fs22.mkdirSync(path31.dirname(file), { recursive: true });
+    fs23.mkdirSync(path32.dirname(file), { recursive: true });
     const temp = `${file}.${process.pid}.tmp`;
-    fs22.writeFileSync(temp, JSON.stringify(marker));
-    fs22.renameSync(temp, file);
+    fs23.writeFileSync(temp, JSON.stringify(marker));
+    fs23.renameSync(temp, file);
   } catch {}
 };
 
@@ -22825,22 +22948,22 @@ var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path32.resolve(file);; dir = path32.dirname(dir)) {
+  for (let dir = path33.resolve(file);; dir = path33.dirname(dir)) {
     try {
-      return path32.join(realpathSync6.native(dir), rest);
+      return path33.join(realpathSync6.native(dir), rest);
     } catch {
-      if (path32.dirname(dir) === dir)
-        return path32.resolve(file);
-      rest = rest ? path32.join(path32.basename(dir), rest) : path32.basename(dir);
+      if (path33.dirname(dir) === dir)
+        return path33.resolve(file);
+      rest = rest ? path33.join(path33.basename(dir), rest) : path33.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path32.relative(fold(canonical2(root)), fold(canonical2(path32.resolve(cwd, file))));
-  if (relative.startsWith("..") || path32.isAbsolute(relative))
+  const relative = path33.relative(fold(canonical2(root)), fold(canonical2(path33.resolve(cwd, file))));
+  if (relative.startsWith("..") || path33.isAbsolute(relative))
     return true;
-  const posix = relative.split(path32.sep).join("/");
+  const posix = relative.split(path33.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -23017,10 +23140,10 @@ var linkSources = (args, at) => {
   const sources = names.filter((name, index) => into >= 0 ? name !== dest : index < names.length - 1 || names.length === 1);
   const target = dest === undefined ? null : at(dest);
   const symbolic = args.some((arg) => /^-[a-zA-Z]*s|^--symbolic$/.test(arg));
-  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync10(target) || /[\\/]$/.test(dest ?? "") ? target : path32.dirname(target);
+  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync10(target) || /[\\/]$/.test(dest ?? "") ? target : path33.dirname(target);
   return sources.flatMap((source) => {
-    if (symbolic && base !== null && !path32.isAbsolute(homeExpanded(source)))
-      return [path32.resolve(base, source)];
+    if (symbolic && base !== null && !path33.isAbsolute(homeExpanded(source)))
+      return [path33.resolve(base, source)];
     const resolved = at(source);
     return resolved ? [resolved] : [];
   });
@@ -23049,7 +23172,7 @@ var shellWrites = (command, depth = 0) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path32.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path33.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -23128,13 +23251,13 @@ var gitMutationDirs = (cwd, command, dialect) => {
       return [];
     if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
       return [];
-    return [path32.resolve(cwd, invocation.dir ?? ".")];
+    return [path33.resolve(cwd, invocation.dir ?? ".")];
   });
 };
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var UNKNOWN_DIR = path32.resolve(path32.parse(process.cwd()).root, ".workit-unknown-dir");
+var UNKNOWN_DIR = path33.resolve(path33.parse(process.cwd()).root, ".workit-unknown-dir");
 var cdInto = (dir, words, strict = false) => {
   const lost = strict ? UNKNOWN_DIR : undefined;
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
@@ -23143,7 +23266,7 @@ var cdInto = (dir, words, strict = false) => {
     return lost;
   if (dir === undefined)
     return lost;
-  return target === undefined ? os10.homedir() : path32.resolve(dir, target);
+  return target === undefined ? os10.homedir() : path33.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
 var homeExpanded = (file) => {
@@ -23157,7 +23280,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
   const groups = [];
   const at = (file) => {
     const home = homeExpanded(file);
-    return path32.isAbsolute(home) ? home : dir === undefined ? null : path32.resolve(dir, home);
+    return path33.isAbsolute(home) ? home : dir === undefined ? null : path33.resolve(dir, home);
   };
   for (const segment of segmentsOf(command, dialect)) {
     if (segment.group === "open") {
@@ -23197,7 +23320,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
       for (const file of opaque ?? []) {
         const resolved = at(file);
         if (resolved)
-          targets.push(file === "." ? path32.join(resolved, DIR_TARGET) : resolved);
+          targets.push(file === "." ? path33.join(resolved, DIR_TARGET) : resolved);
       }
       const ln = words.findIndex((word) => /^ln$/i.test(word.split(/[\\/]/).at(-1) ?? ""));
       if (ln >= 0 && words.slice(0, ln).every((word) => PREFIXES2.has(word)))
@@ -23212,7 +23335,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
     const edits = editsOf(segment.words);
     if (edits === null) {
       if (dir !== undefined)
-        targets.push(path32.join(dir, DIR_TARGET));
+        targets.push(path33.join(dir, DIR_TARGET));
     } else
       for (const file of edits) {
         const resolved = at(file);
@@ -23223,7 +23346,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
       for (const invocation of workitInvocations(segment.words.map(quoteWord2).join(" "), "posix")) {
         const { at: runsIn, args } = workitCwd(dir, invocation);
         if (args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), ""))
-          targets.push(path32.join(runsIn, DIR_TARGET));
+          targets.push(path33.join(runsIn, DIR_TARGET));
       }
   }
   return targets;
@@ -23238,13 +23361,13 @@ var workitRunDir = (dir, words) => {
 };
 var workitCwd = (dir, args) => {
   const { rest, cwd } = skipWorkitGlobals(args);
-  return { at: cwd === null ? dir : path32.resolve(dir, homeExpanded(cwd)), args: rest };
+  return { at: cwd === null ? dir : path33.resolve(dir, homeExpanded(cwd)), args: rest };
 };
 var shellMutationTargets = (cwd, command, dialect = "posix", strict = false) => {
   try {
     return [
       ...segmentTargets(cwd, command, dialect, 0, strict),
-      ...gitMutationDirs(cwd, command, dialect).map((dir) => path32.join(dir, DIR_TARGET))
+      ...gitMutationDirs(cwd, command, dialect).map((dir) => path33.join(dir, DIR_TARGET))
     ];
   } catch {
     return [];
@@ -23281,7 +23404,7 @@ var liveDeny = ({ marker, checkout, ageMs, file }) => {
 var guarded = (targets) => {
   const seen = new Set;
   return targets.filter((target) => {
-    const dir = path32.dirname(target);
+    const dir = path33.dirname(target);
     if (seen.has(dir))
       return false;
     seen.add(dir);
@@ -23302,7 +23425,7 @@ var claimAll = (owner, targets, deps) => {
   for (const target of guarded(targets))
     claimLiveSession(target, owner, deps);
 };
-var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path32.resolve(cwd, file)) : [path32.join(cwd, DIR_TARGET)];
+var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path33.resolve(cwd, file)) : [path33.join(cwd, DIR_TARGET)];
 var issuedTarget = (cwd, targets) => {
   const state = resolveStateDir();
   const found = targets.find((target) => underIssued(state, cwd, homeExpanded(target), process.platform, canonical2));
@@ -23310,7 +23433,7 @@ var issuedTarget = (cwd, targets) => {
 };
 var underIssued = (state, cwd, target, platform = process.platform, real = (file) => file) => {
   const win = platform === "win32";
-  const p = win ? path32.win32 : path32.posix;
+  const p = win ? path33.win32 : path33.posix;
   const fold = (value) => win || platform === "darwin" ? value.toLowerCase() : value;
   const named = win ? target.replace(/^\/([a-zA-Z])(?=\/|$)/, "$1:") : target;
   const relative = p.relative(fold(real(p.resolve(state))), fold(real(p.resolve(cwd, named))));
@@ -23852,20 +23975,20 @@ var WRITE_TOOLS = new Set([
   "writefile"
 ]);
 // packages/workit-core/src/hooks/standing.ts
-import fs23 from "node:fs";
-import path33 from "node:path";
+import fs24 from "node:fs";
+import path34 from "node:path";
 var readPlans = (store) => {
-  const dir = path33.join(store, "fanouts");
+  const dir = path34.join(store, "fanouts");
   let names;
   try {
-    names = fs23.readdirSync(dir).filter((name) => name.endsWith(".json"));
+    names = fs24.readdirSync(dir).filter((name) => name.endsWith(".json"));
   } catch {
     return [];
   }
   const plans = [];
   for (const name of names) {
     try {
-      const raw = JSON.parse(fs23.readFileSync(path33.join(dir, name), "utf8"));
+      const raw = JSON.parse(fs24.readFileSync(path34.join(dir, name), "utf8"));
       if (typeof raw.name !== "string" || !Array.isArray(raw.slices))
         continue;
       const texts = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
@@ -24103,11 +24226,11 @@ var OPENCODE_DESCRIPTOR = {
   ]
 };
 // packages/workit-opencode/src/shared/init-apply.ts
-import path38 from "node:path";
+import path39 from "node:path";
 
 // packages/workit-core/src/core/gitignore.ts
 import { existsSync as existsSync11, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import path34 from "node:path";
+import path35 from "node:path";
 var GITIGNORE_ENTRIES = [
   "# workit: SDD working state (never commit)",
   "docs/*/sdd/",
@@ -24127,7 +24250,7 @@ var GITIGNORE_ENTRIES = [
 var ensureProjectGitignore = (workspaceRoot, confirmed) => {
   if (!confirmed)
     return { ok: false, error: "confirmed: true required" };
-  const file = path34.join(workspaceRoot, ".gitignore");
+  const file = path35.join(workspaceRoot, ".gitignore");
   const existing = existsSync11(file) ? readFileSync7(file, "utf8") : "";
   const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
@@ -24155,25 +24278,25 @@ var ensureProjectGitignore = (workspaceRoot, confirmed) => {
 
 // packages/workit-core/src/core/hygiene.ts
 import { existsSync as existsSync12, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 var repoRoot3 = assetRoot();
-var templatesDir = () => path35.join(repoRoot3, "templates", "hygiene");
+var templatesDir = () => path36.join(repoRoot3, "templates", "hygiene");
 var packageJson = (root) => {
-  if (!existsSync12(path35.join(root, "package.json")))
+  if (!existsSync12(path36.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync8(path35.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync8(path36.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
 };
 var isOpenSource = (root) => {
-  if (existsSync12(path35.join(root, "LICENSE")))
+  if (existsSync12(path36.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
     return true;
-  return path35.basename(root) === "workflow-toolkit";
+  return path36.basename(root) === "workflow-toolkit";
 };
 var licenseHolder = (root) => {
   const pkg = packageJson(root);
@@ -24196,13 +24319,13 @@ var planHygieneFiles = (root, opts = {}) => {
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync12(path35.join(root, file)))
+    if (existsSync12(path36.join(root, file)))
       continue;
-    const tpl = path35.join(templatesDir(), file);
+    const tpl = path36.join(templatesDir(), file);
     if (!existsSync12(tpl))
       continue;
-    const content = readFileSync8(tpl, "utf8").replace(/<PROJECT>/g, path35.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path35.join(root, file), content });
+    const content = readFileSync8(tpl, "utf8").replace(/<PROJECT>/g, path36.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path36.join(root, file), content });
   }
   return planned;
 };
@@ -24212,19 +24335,19 @@ var ensureHygieneFiles = (root, opts) => {
   const created = [];
   for (const planned of planHygieneFiles(root, opts)) {
     writeFileSync5(planned.path, planned.content, "utf8");
-    created.push(path35.basename(planned.path));
+    created.push(path36.basename(planned.path));
   }
   return { ok: true, created };
 };
 
 // packages/workit-core/src/core/init.ts
-import fs24 from "node:fs";
-import path37 from "node:path";
+import fs25 from "node:fs";
+import path38 from "node:path";
 import { spawnSync as spawnSync19 } from "node:child_process";
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync9, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import path36 from "node:path";
+import path37 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var readFileSafe = (p) => {
   try {
@@ -24235,7 +24358,7 @@ var readFileSafe = (p) => {
 };
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path36.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path37.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const {
     status,
     path: wsPath,
@@ -24247,7 +24370,7 @@ function applyWorkspaceBranchPolicy(opts) {
   if (status === "malformed" || status === "invalid")
     return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path36.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path37.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -24296,7 +24419,7 @@ function applyWorkspaceBranchPolicy(opts) {
       ok: false,
       error: `workspaces.json changed while applying the branch policy: ${wsPath}`
     };
-  mkdirSync4(path36.dirname(wsPath), { recursive: true });
+  mkdirSync4(path37.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
     writeFileSync6(tmp, JSON.stringify({ ...document, workspaces: next }, null, 2) + `
@@ -24331,7 +24454,7 @@ function applyWorkspaceBranchPolicy(opts) {
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE";
 var readJson3 = (p) => {
   try {
-    const parsed = JSON.parse(fs24.readFileSync(p, "utf8"));
+    const parsed = JSON.parse(fs25.readFileSync(p, "utf8"));
     return isConfigObject(parsed) ? parsed : null;
   } catch {
     return null;
@@ -24361,7 +24484,7 @@ var youtrackJsonContent = (dir) => {
   const meetingIssue = process.env.WORKFLOW_YT_MEETING_ISSUE;
   return {
     baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://youtrack.example.com",
-    tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path37.join(dir, "youtrack.token"),
+    tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path38.join(dir, "youtrack.token"),
     ...meetingIssue ? {
       meetingIssue,
       meetingIssues: { general: { issue: meetingIssue, label: "General meetings" } }
@@ -24391,19 +24514,19 @@ var vcsJsonContent = () => {
 };
 function initApplyData(action, env = process.env) {
   const dir = String(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
-  fs24.mkdirSync(dir, { recursive: true });
+  fs25.mkdirSync(dir, { recursive: true });
   switch (action) {
     case "youtrack_json": {
-      const out = path37.join(dir, "youtrack.json");
-      fs24.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
+      const out = path38.join(dir, "youtrack.json");
+      fs25.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       return { action, ok: true, path: out };
     }
     case "youtrack_token_placeholder": {
-      const p = path37.join(dir, "youtrack.token");
+      const p = path38.join(dir, "youtrack.token");
       const preserved = writeFileExclusive(p, TOKEN_PLACEHOLDER2 + `
 `, 384) === "preserved";
-      const abs = path37.resolve(p);
+      const abs = path38.resolve(p);
       return {
         action,
         ok: true,
@@ -24415,14 +24538,14 @@ function initApplyData(action, env = process.env) {
       };
     }
     case "youtrack_scaffold": {
-      const jsonOut = path37.join(dir, "youtrack.json");
-      const tokenOut = path37.join(dir, "youtrack.token");
-      fs24.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
+      const jsonOut = path38.join(dir, "youtrack.json");
+      const tokenOut = path38.join(dir, "youtrack.token");
+      fs25.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER2 + `
 `, 384) === "preserved";
-      const configPath = path37.resolve(jsonOut);
-      const tokenPath = path37.resolve(tokenOut);
+      const configPath = path38.resolve(jsonOut);
+      const tokenPath = path38.resolve(tokenOut);
       const prev = process.env.WORKFLOW_YOUTRACK_CONFIG;
       process.env.WORKFLOW_YOUTRACK_CONFIG = configPath;
       let tokenCreate = {};
@@ -24474,10 +24597,10 @@ function initApplyData(action, env = process.env) {
       }
     }
     case "vcs_scaffold": {
-      const jsonOut = path37.join(dir, "vcs.json");
-      fs24.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(), null, 2) + `
+      const jsonOut = path38.join(dir, "vcs.json");
+      fs25.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(), null, 2) + `
 `, "utf8");
-      const configPath = path37.resolve(jsonOut);
+      const configPath = path38.resolve(jsonOut);
       const prev = process.env.WORKFLOW_VCS_CONFIG;
       process.env.WORKFLOW_VCS_CONFIG = configPath;
       try {
@@ -24596,7 +24719,7 @@ var executeInitApply = (args, directory, runtime) => {
       protectedNames: args.branch_policy_protected
     }, current);
     writeConfig(next);
-    return output(ok({ action: "config", path: path38.join(configDir(), "config.json"), ...next }));
+    return output(ok({ action: "config", path: path39.join(configDir(), "config.json"), ...next }));
   }
   const env = Object.fromEntries(Object.entries({
     WORKFLOW_YT_BASE_URL: args.base_url,
@@ -24613,14 +24736,14 @@ var executeInitApply = (args, directory, runtime) => {
 
 // packages/workit-opencode/src/shared/session.ts
 import { realpathSync as realpathSync7 } from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 var sameWorkspace = (expected, observed) => {
   if (typeof observed !== "string" || !observed)
     return false;
   try {
     return realpathSync7(expected) === realpathSync7(observed);
   } catch {
-    return path39.resolve(expected) === path39.resolve(observed);
+    return path40.resolve(expected) === path40.resolve(observed);
   }
 };
 
@@ -24692,7 +24815,7 @@ var workitFamilyOf = (toolName) => {
 
 // packages/workit-opencode/src/tools/context.ts
 import { realpathSync as realpathSync8 } from "node:fs";
-import path40 from "node:path";
+import path41 from "node:path";
 var createContextTool = () => ({
   description: "Read Git, pull request, YouTrack, issue, changelog, release, or affected-file context.",
   execute: async (args, context) => {
@@ -24702,7 +24825,7 @@ var createContextTool = () => ({
     let root;
     try {
       const cwd = parsed.data.cwd;
-      root = realpathSync8(cwd ? path40.resolve(context.directory, cwd) : context.directory);
+      root = realpathSync8(cwd ? path41.resolve(context.directory, cwd) : context.directory);
     } catch {
       return JSON.stringify(failure2("invalid_input", "context target directory cannot be resolved"), null, 2);
     }
@@ -24732,20 +24855,20 @@ var workerCoordinatorFor = (task, worker) => {
 };
 
 // packages/workit-core/src/fanout.ts
-import { createHash as createHash17 } from "node:crypto";
-import fs26 from "node:fs";
-import path43 from "node:path";
+import { createHash as createHash18 } from "node:crypto";
+import fs27 from "node:fs";
+import path44 from "node:path";
 
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync21 } from "node:child_process";
-import { createHash as createHash16, randomBytes as randomBytes4 } from "node:crypto";
-import fs25 from "node:fs";
-import path42 from "node:path";
+import { createHash as createHash17, randomBytes as randomBytes4 } from "node:crypto";
+import fs26 from "node:fs";
+import path43 from "node:path";
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
 import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 
 // packages/workit-core/src/forge/redact.ts
 var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
@@ -24789,18 +24912,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path41.resolve(cwd, line.trim()));
+`).map((line) => path42.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
     if (!marker || !existsSync13(marker))
       continue;
-    if (index === 1 && existsSync13(path41.join(marker, "applying")))
+    if (index === 1 && existsSync13(path42.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync13(path41.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync13(path42.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync10(path41.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync10(path42.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -24912,7 +25035,7 @@ function rebasingBranch2(dir) {
     if (!found.ok)
       continue;
     try {
-      return fs25.readFileSync(found.stdout.trim(), "utf8").trim();
+      return fs26.readFileSync(found.stdout.trim(), "utf8").trim();
     } catch {}
   }
   return null;
@@ -24920,14 +25043,14 @@ function rebasingBranch2(dir) {
 function rebaseInProgress(dir) {
   for (const name of ["rebase-merge", "rebase-apply"]) {
     const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
-    if (found.ok && fs25.existsSync(found.stdout.trim()))
+    if (found.ok && fs26.existsSync(found.stdout.trim()))
       return true;
   }
   return false;
 }
 var scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path42.join(dir.data, "worktrees") : null;
+  return dir.ok ? path43.join(dir.data, "worktrees") : null;
 };
 function gitRestack(cwd, input) {
   const owner = worktreeOf(cwd, input.branch);
@@ -24941,8 +25064,8 @@ function gitRestack(cwd, input) {
         worktree: cwd,
         error: "no store root"
       };
-    fs25.mkdirSync(scratch, { recursive: true });
-    dir = path42.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    fs26.mkdirSync(scratch, { recursive: true });
+    dir = path43.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return {
@@ -24996,12 +25119,12 @@ function gitRestack(cwd, input) {
 var firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300);
-var stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash16("sha256").update(name).digest("hex").slice(0, 12)}.json`;
+var stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash17("sha256").update(name).digest("hex").slice(0, 12)}.json`;
 function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path42.join(root.value.root, "stacks") };
+  return { ok: true, data: path43.join(root.value.root, "stacks") };
 }
 var HEARTBEAT_STALE_MS = 2 * 60000;
 
@@ -25106,13 +25229,13 @@ function sliceHash(slice) {
     issues: _issues,
     ...definition
   } = slice;
-  return createHash17("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+  return createHash18("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
 }
 function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path43.join(root.value.root, "fanouts") };
+  return { ok: true, data: path44.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord7(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -25180,10 +25303,10 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, stackFileName(name));
+  const file = path44.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
-    parsed = parseStored(JSON.parse(fs26.readFileSync(file, "utf8")));
+    parsed = parseStored(JSON.parse(fs27.readFileSync(file, "utf8")));
   } catch (error) {
     if (error.code === "ENOENT")
       return { ok: true, data: null };
@@ -25197,7 +25320,7 @@ function listFanouts(cwd) {
     return dir;
   let names = [];
   try {
-    names = fs26.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
+    names = fs27.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
   } catch {
     return { ok: true, data: [] };
   }
@@ -25205,7 +25328,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs26.readFileSync(path43.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs27.readFileSync(path44.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -25786,7 +25909,11 @@ var injectAgentContext = (root, session, directChildren, system) => {
   const verdict = session.parentID ? judgeVerdictText(root, session, workerContext) : null;
   if (verdict && !hasMarker(system, "<workit-verdict-line>"))
     system.push(textPart(`<workit-verdict-line>${verdict}</workit-verdict-line>`));
-  const standing = session.parentID ? standingFor2(root, session) : null;
+  const standing = session.parentID ? [
+    standingFor2(root, session),
+    budgetStanding(session.directory ?? root, session.parentID, session.id)
+  ].filter(Boolean).join(`
+`) || null : null;
   if (standing && !hasMarker(system, "<workit-standing>"))
     system.push(textPart(`<workit-standing>${standing}</workit-standing>`));
 };
@@ -25915,14 +26042,14 @@ var childTaskMissing = (store, input) => {
 var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only inspect the task summary (workit_task action "inspect") or record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
 
 // packages/workit-opencode/src/v2/shell.ts
-import path44 from "node:path";
+import path45 from "node:path";
 
 // packages/workit-core/src/hooks/repeat-failure.ts
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 var SAME_CALL_FAILED = "Same call failed twice:";
 var MAX_SESSIONS = 256;
 var stable = (value) => JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).toSorted(([a], [b]) => a.localeCompare(b))) : entry) ?? "null";
-var hashOf = (call) => createHash18("sha256").update(call).digest("hex").slice(0, 32);
+var hashOf = (call) => createHash19("sha256").update(call).digest("hex").slice(0, 32);
 var record3 = (memo, sessionId, call, failed, next) => {
   const previous = memo.get(sessionId);
   memo.delete(sessionId);
@@ -25978,7 +26105,7 @@ var commandOf = (input) => {
 };
 var hookInput = (root, sessionID, id, shell) => ({
   host: "opencode",
-  cwd: shell.workdir ? path44.resolve(root, shell.workdir) : root,
+  cwd: shell.workdir ? path45.resolve(root, shell.workdir) : root,
   session: { id: sessionID, agentId: null, agentType: null, parentId: null },
   permissionMode: null,
   transcriptPath: null,
@@ -26187,37 +26314,37 @@ var createStopControl = (root, port) => {
 
 // packages/workit-opencode/src/v2/registry.ts
 import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 
 // packages/workit-opencode/src/shared/assets.ts
 import { existsSync as existsSync14, realpathSync as realpathSync9 } from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir = () => {
   try {
-    return realpathSync9(path45.dirname(fileURLToPath2(import.meta.url)));
+    return realpathSync9(path46.dirname(fileURLToPath2(import.meta.url)));
   } catch {
-    return path45.dirname(fileURLToPath2(import.meta.url));
+    return path46.dirname(fileURLToPath2(import.meta.url));
   }
 };
 var packageRoot2 = () => {
   const dir = moduleDir();
   for (const candidate of [
-    path45.resolve(dir, ".."),
-    path45.resolve(dir, "..", ".."),
-    path45.resolve(dir, "..", "..", "..")
+    path46.resolve(dir, ".."),
+    path46.resolve(dir, "..", ".."),
+    path46.resolve(dir, "..", "..", "..")
   ]) {
-    if (existsSync14(path45.join(candidate, "package.json")))
+    if (existsSync14(path46.join(candidate, "package.json")))
       return candidate;
   }
-  return path45.resolve(dir, "..");
+  return path46.resolve(dir, "..");
 };
 var skillsRoot = () => {
   const root = packageRoot2();
-  const canonical = path45.resolve(root, "..", "workit-core", "skills");
-  if (existsSync14(path45.join(root, "src")) && existsSync14(canonical))
+  const canonical = path46.resolve(root, "..", "workit-core", "skills");
+  if (existsSync14(path46.join(root, "src")) && existsSync14(canonical))
     return canonical;
-  return path45.join(root, "assets", "skills");
+  return path46.join(root, "assets", "skills");
 };
 
 // packages/workit-opencode/src/v2/registry.ts
@@ -26244,11 +26371,11 @@ var registerSkills = async (ctx) => {
   if (!existsSync15(skillsDir))
     return new Set;
   const listed = await ctx.skill.list().catch(() => ({ data: [] }));
-  const own = (skill) => typeof skill.path === "string" && path46.resolve(skill.path).startsWith(skillsDir + path46.sep);
+  const own = (skill) => typeof skill.path === "string" && path47.resolve(skill.path).startsWith(skillsDir + path47.sep);
   const userSkills = new Set((listed?.data ?? []).filter((skill) => !own(skill)).map((skill) => skill.id));
   const packaged = new Map;
   for (const id of WORKIT_METHOD_SKILLS) {
-    const file = path46.join(skillsDir, id, "SKILL.md");
+    const file = path47.join(skillsDir, id, "SKILL.md");
     if (!userSkills.has(id) && existsSync15(file))
       packaged.set(id, file);
   }
@@ -26296,22 +26423,22 @@ var registerCommands = async (ctx, registeredSkills) => {
 
 // packages/workit-opencode/src/stale-sources.ts
 import { existsSync as existsSync16, readdirSync as readdirSync6 } from "node:fs";
-import path47 from "node:path";
+import path48 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var typescriptFiles = (directory) => {
   if (!existsSync16(directory))
     return [];
   return readdirSync6(directory, { withFileTypes: true }).flatMap((entry) => {
-    const file = path47.join(directory, entry.name);
+    const file = path48.join(directory, entry.name);
     return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
   });
 };
 var pluginSourceFiles = [
   ...new Set([
     fileURLToPath3(import.meta.url),
-    ...typescriptFiles(path47.join(packageRoot2(), "src")),
-    path47.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
-    ...typescriptFiles(path47.join(packageRoot2(), "..", "workit-core", "src", "core"))
+    ...typescriptFiles(path48.join(packageRoot2(), "src")),
+    path48.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path48.join(packageRoot2(), "..", "workit-core", "src", "core"))
   ])
 ].filter((file) => existsSync16(file)).toSorted();
 
@@ -26452,6 +26579,13 @@ var setup = async (ctx) => {
   const shellWorkdirs = new Map;
   const pendingShells = new Map;
   await ctx.tool.hook("execute.before", async (event) => {
+    const budgetEvent = {
+      tool: event.tool,
+      sessionID: String(event.sessionID),
+      input: event.input
+    };
+    if (event.tool !== "subagent")
+      observeBudget(root, budgetEvent, lifecycle.directChildren);
     if (event.tool === "shell") {
       observeShellBefore(root, event, shellWorkdirs);
       return noteShellCall(pendingShells, {
@@ -26469,6 +26603,7 @@ var setup = async (ctx) => {
       id: String(event.id),
       input: event.input
     });
+    observeBudget(root, budgetEvent, lifecycle.directChildren);
   });
   const shellDomain = ctx.shell;
   if (shellDomain)