@brainervirus/workit-pi 8.19.2 → 8.21.0

package/dist/workit.js

@@ -5,7 +5,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync16 } from "node:child_process";
 import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -14381,10 +14381,10 @@ var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash11 } from "node:crypto";
-import * as fs13 from "node:fs";
+import { createHash as createHash12 } from "node:crypto";
+import * as fs14 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
@@ -14615,13 +14615,70 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash10, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash11, randomBytes as randomBytes3 } from "node:crypto";
+import fs13 from "node:fs";
+import path15 from "node:path";
+
+// packages/workit-core/src/hooks/standing-signal.ts
+import { createHash as createHash10 } from "node:crypto";
 import fs12 from "node:fs";
 import path14 from "node:path";
+var gitStoreDir = (cwd) => {
+  try {
+    for (let dir = path14.resolve(cwd);; dir = path14.dirname(dir)) {
+      const dotGit = path14.join(dir, ".git");
+      if (fs12.existsSync(dotGit)) {
+        let gitDir = dotGit;
+        if (fs12.statSync(dotGit).isFile()) {
+          const target = /^gitdir:\s*(.+)$/mu.exec(fs12.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+          if (!target)
+            return null;
+          gitDir = path14.resolve(dir, target);
+          const common = path14.join(gitDir, "commondir");
+          if (fs12.existsSync(common))
+            gitDir = path14.resolve(gitDir, fs12.readFileSync(common, "utf8").trim());
+        }
+        return path14.join(gitDir, "workit");
+      }
+      if (path14.dirname(dir) === dir)
+        return null;
+    }
+  } catch {
+    return null;
+  }
+};
+var standingRevFile = (store) => path14.join(store, "standing", "rev");
+var standingSeenFile = (store, session, agentId) => path14.join(store, "standing", "seen", `${createHash10("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`);
+var readStandingRev = (store) => {
+  try {
+    return fs12.readFileSync(standingRevFile(store), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+};
+var readStandingSeen = (file) => {
+  try {
+    const value = JSON.parse(fs12.readFileSync(file, "utf8"));
+    return {
+      rev: typeof value.rev === "string" ? value.rev : null,
+      ids: Array.isArray(value.ids) ? value.ids.filter((id) => typeof id === "string") : []
+    };
+  } catch {
+    return { rev: null, ids: [] };
+  }
+};
+var writeStandingSeen = (file, seen) => {
+  try {
+    fs12.mkdirSync(path14.dirname(file), { recursive: true });
+    fs12.writeFileSync(file, JSON.stringify(seen));
+  } catch {}
+};
+
+// packages/workit-core/src/ledger.ts
 var LEDGER_VERSION = 1;
 var MAX_LINE_BYTES = 4096;
 var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
@@ -14731,7 +14788,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash10("sha256");
+  const hash = createHash11("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -14743,14 +14800,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path14.resolve(cwd));
+  const location = resolveStore(path15.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path15.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
@@ -14770,7 +14827,7 @@ var onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs12.statfsSync(dir).type);
+    return isNetworkFsType(fs13.statfsSync(dir).type);
   } catch {
     return false;
   }
@@ -14780,15 +14837,15 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs12.readFileSync(path14.join(lock, LOCK_OWNER), "utf8");
+    return fs13.readFileSync(path15.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 };
 var lockAgeMs = (lock) => {
-  for (const target of [path14.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path15.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs12.statSync(target).mtimeMs;
+      return Date.now() - fs13.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
@@ -14796,14 +14853,14 @@ var lockAgeMs = (lock) => {
 var ledgerLock = {
   acquire(lock) {
     try {
-      fs12.mkdirSync(lock);
+      fs13.mkdirSync(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         return null;
       throw error;
     }
     const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
-    fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
+    fs13.writeFileSync(path15.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
@@ -14811,35 +14868,35 @@ var ledgerLock = {
       return false;
     const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
     try {
-      fs12.renameSync(lock, tomb);
+      fs13.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) !== token) {
       try {
-        fs12.renameSync(tomb, lock);
+        fs13.renameSync(tomb, lock);
       } catch {}
       return false;
     }
-    fs12.rmSync(tomb, { recursive: true, force: true });
+    fs13.rmSync(tomb, { recursive: true, force: true });
     return true;
   },
   token: lockToken,
   reap(lock, observed) {
     const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
     try {
-      fs12.renameSync(lock, tomb);
+      fs13.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) === observed) {
-      fs12.rmSync(tomb, { recursive: true, force: true });
+      fs13.rmSync(tomb, { recursive: true, force: true });
       return true;
     }
     try {
-      fs12.renameSync(tomb, lock);
+      fs13.renameSync(tomb, lock);
     } catch {
-      fs12.rmSync(tomb, { recursive: true, force: true });
+      fs13.rmSync(tomb, { recursive: true, force: true });
     }
     return false;
   }
@@ -14866,14 +14923,14 @@ function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
     ledgerLock.release(lock, token);
   }
 }
-var sha2562 = (text) => createHash10("sha256").update(text).digest("hex");
+var sha2562 = (text) => createHash11("sha256").update(text).digest("hex");
 var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`);
 var TAIL_BYTES = 64 * 1024;
 var lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs12.readSync(fd, buffer, 0, span, size - span);
+    fs13.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -14904,21 +14961,21 @@ var lastLine = (fd, size) => {
 };
 var tighten = (fd) => {
   try {
-    if ((fs12.fstatSync(fd).mode & 63) !== 0)
-      fs12.fchmodSync(fd, 384);
+    if ((fs13.fstatSync(fd).mode & 63) !== 0)
+      fs13.fchmodSync(fd, 384);
   } catch {}
 };
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs12.openSync(file, "a+", 384);
+    const fd = fs13.openSync(file, "a+", 384);
     try {
       if (process.platform !== "win32")
         tighten(fd);
-      const size = fs12.fstatSync(fd).size;
+      const size = fs13.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs12.readSync(fd, last, 0, 1, size - 1);
+        fs13.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -14927,17 +14984,17 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs12.writeSync(fd, bytes);
+      const written = fs13.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs12.closeSync(fd);
+      fs13.closeSync(fd);
     }
   };
   try {
-    fs12.mkdirSync(path14.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path14.dirname(file)))
+    fs13.mkdirSync(path15.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path15.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -15010,8 +15067,8 @@ function readLedger(cwd, options = {}) {
   let text = "";
   let stat = null;
   try {
-    stat = fs12.statSync(file.value);
-    text = fs12.readFileSync(file.value, "utf8");
+    stat = fs13.statSync(file.value);
+    text = fs13.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -15146,7 +15203,7 @@ function ledgerTampering(cwd) {
   if (!file.ok)
     return [];
   try {
-    const stat = fs12.statSync(file.value);
+    const stat = fs13.statSync(file.value);
     const cached = tamperCache.get(file.value);
     if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
       return cached.breaks;
@@ -15477,6 +15534,28 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     warnings
   };
 }
+var fromLead = (row, leads) => leads === null || row.actor.session !== null && leads.includes(row.actor.session);
+function activeStanding(rows, fanout, leads = null) {
+  const active = [];
+  for (const row of rows) {
+    if (row.fanout !== fanout || !fromLead(row, leads))
+      continue;
+    if (row.type === "standing" && typeof row.what === "string" && row.what.trim()) {
+      if (!row.superseded)
+        active.push(row);
+    } else if (row.type === "standing.cleared") {
+      const target = str2(row.target);
+      if (target === null)
+        active.length = 0;
+      else {
+        const index = active.findIndex((order) => order.id === target);
+        if (index >= 0)
+          active.splice(index, 1);
+      }
+    }
+  }
+  return active;
+}
 var OBSERVED_ONLY = new Set([
   "check",
   "merge.unverified",
@@ -15625,7 +15704,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path15.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path16.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -15684,15 +15763,15 @@ function writeBlockers(task, root) {
 }
 
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes = (value) => createHash11("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`);
-var relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".";
+var digestBytes = (value) => createHash12("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`);
+var relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path16.posix.normalize(value);
+  const normalized = path17.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -15740,21 +15819,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs13.readdirSync(directory);
+    names = fs14.readdirSync(directory);
   } catch {
     return true;
   }
@@ -15762,10 +15841,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path16.join(directory, name);
+    const target = path17.join(directory, name);
     let stat;
     try {
-      stat = fs13.lstatSync(target);
+      stat = fs14.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15780,14 +15859,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path16.resolve(root, item);
+    const target = path17.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs13.existsSync(ancestor) && ancestor !== root)
-      ancestor = path16.dirname(ancestor);
+    while (!fs14.existsSync(ancestor) && ancestor !== root)
+      ancestor = path17.dirname(ancestor);
     try {
-      if (!inside(root, fs13.realpathSync(ancestor)))
+      if (!inside(root, fs14.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -15799,7 +15878,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs13.realpathSync(root);
+    checkout = fs14.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -15817,11 +15896,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs13.existsSync(target))
+    if (!fs14.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs13.lstatSync(target);
+      stat = fs14.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15837,17 +15916,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path16.join(checkout, item);
+    const target = path17.join(checkout, item);
     try {
-      const stat = fs13.lstatSync(target);
+      const stat = fs14.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs13.readlinkSync(target);
+        const link = fs14.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs13.readFileSync(target)),
+          digest: digestBytes(fs14.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -16012,7 +16091,7 @@ var findingVerificationPasses = (findingCandidateId, evidence) => evidence.statu
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs13.realpathSync(checkoutRoot);
+    root = fs14.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -16021,23 +16100,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path16.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
+    const target = path17.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path16.relative(root, target);
+      const below = path17.relative(root, target);
       let current = root;
-      for (const segment of below.split(path16.sep)) {
+      for (const segment of below.split(path17.sep)) {
         if (!segment)
           continue;
-        current = path16.join(current, segment);
-        const stat = fs13.lstatSync(current);
-        const real = fs13.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
+        current = path17.join(current, segment);
+        const stat = fs14.lstatSync(current);
+        const real = fs14.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -16053,7 +16132,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs13.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs14.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -16637,19 +16716,19 @@ var exportDigest = (bundle) => sha256({
 // packages/workit-core/src/core/route-intent.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 
 // packages/workit-core/src/hooks/raw-git.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
-import fs15 from "node:fs";
+import { createHash as createHash14 } from "node:crypto";
+import fs16 from "node:fs";
 import os4 from "node:os";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // packages/workit-core/src/hooks/session-marker.ts
-import { createHash as createHash12 } from "node:crypto";
-import fs14 from "node:fs";
-import path17 from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+import fs15 from "node:fs";
+import path18 from "node:path";
 var sessionMarkerFile = (input, session, store) => {
   let dir = store;
   if (dir === undefined) {
@@ -16658,13 +16737,13 @@ var sessionMarkerFile = (input, session, store) => {
       return null;
     dir = location.dir;
   }
-  const name = createHash12("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path17.join(dir, "hooks", `skills-${name}.json`);
+  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path18.join(dir, "hooks", `skills-${name}.json`);
 };
 var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 var readSessionMarker = (file) => {
   try {
-    const value = JSON.parse(fs14.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs15.readFileSync(file, "utf8"));
     return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
   } catch {
     return { nudged: [], loaded: [], raw: [] };
@@ -16672,8 +16751,8 @@ var readSessionMarker = (file) => {
 };
 var writeSessionMarker = (file, marker) => {
   try {
-    fs14.mkdirSync(path17.dirname(file), { recursive: true });
-    fs14.writeFileSync(file, JSON.stringify(marker));
+    fs15.mkdirSync(path18.dirname(file), { recursive: true });
+    fs15.writeFileSync(file, JSON.stringify(marker));
   } catch {}
 };
 
@@ -17170,14 +17249,14 @@ var GIT_CONFIG_ENV = /^GIT_(?:CONFIG\w*|DIR|COMMON_DIR|WORK_TREE)$/;
 var ASSIGNMENT = /^([A-Za-z_]\w*)=([\s\S]*)$/;
 var MAX_DEPTH = 4;
 var MAX_EXPANSIONS = 16;
-var isAbsolute = (value) => path18.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+var isAbsolute = (value) => path19.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 var HERE = /^(?:\$PWD|\$\{PWD\}|\$\(\s*pwd\s*\)|`pwd`|\$\(\s*git\s+rev-parse\s+--show-toplevel\s*\))(?=$|[\\/])/;
 var joinDir = (base, raw) => {
   const next = raw.replace(HERE, ".");
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
-  const expanded = next === "~" || next.startsWith("~/") ? path18.join(os4.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path18.join(base, expanded);
+  const expanded = next === "~" || next.startsWith("~/") ? path19.join(os4.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path19.join(base, expanded);
 };
 var rebase = (base, inner) => inner === null ? base : inner === undefined ? undefined : joinDir(base, inner);
 var cdTarget = (words) => {
@@ -17989,7 +18068,7 @@ var repoAt = (dir) => {
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 };
 var isWorkitWorkspace = (repo) => {
-  if (fs15.existsSync(repo.location.dir))
+  if (fs16.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -18010,17 +18089,17 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs15.readFileSync(path18.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs16.readFileSync(path19.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path18.dirname(repo.location.dir);
+    const common = path19.dirname(repo.location.dir);
     try {
-      return fs15.readFileSync(path18.join(common, ref), "utf8").trim() || null;
+      return fs16.readFileSync(path19.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs15.readFileSync(path18.join(common, "packed-refs"), "utf8");
+    const packed = fs16.readFileSync(path19.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -18108,8 +18187,8 @@ var expandGitAliases = (root, invocation, cache = new Map, depth = 0) => {
   const sub = invocation.args[0];
   if (invocation.tool !== "git" || invocation.dir === undefined || !sub || sub.startsWith("-") || GIT_COMMANDS.has(sub) || depth >= MAX_DEPTH)
     return [invocation];
-  const dir = path18.resolve(root, invocation.dir ?? ".");
-  if (!fs15.existsSync(dir))
+  const dir = path19.resolve(root, invocation.dir ?? ".");
+  if (!fs16.existsSync(dir))
     return [invocation];
   const config = gitConfig(dir, invocation, cache);
   const alias = configValue(config, `alias.${sub.toLowerCase()}`);
@@ -18131,11 +18210,11 @@ var expandGitAliases = (root, invocation, cache = new Map, depth = 0) => {
 var normalizedUrl = (url, dir) => {
   const trimmed = url.trim();
   if (/^file:\/\//i.test(trimmed))
-    return path18.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path19.resolve(dir, trimmed.slice(7)).replace(/\/+$/, "").replace(/\.git$/, "");
   const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(trimmed);
   const scp = !scheme && /^(?:[^@/\\]+@)?[^/\\:]{2,}:/.test(trimmed);
   if (!scheme && !scp)
-    return path18.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
+    return path19.resolve(dir, trimmed).replace(/\/+$/, "").replace(/\.git$/, "");
   const value = scheme ? trimmed.slice(scheme[0].length).replace(/^[^@/]*@/, "").replace(/^([^/:]+):\d+(?=\/)/, "$1") : trimmed.replace(/^[^@/]*@/, "").replace(":", "/");
   return value.toLowerCase().replace(/\/{2,}/g, "/").replace(/^www\./, "").replace(/\/+$/, "").replace(/\.git$/, "");
 };
@@ -18359,7 +18438,7 @@ var actionsIn = (cwd, command, dialect, cache = new Map) => {
   const out = [];
   const repos = new Map;
   const repoFor = (relative) => {
-    const dir = path18.resolve(cwd, relative ?? ".");
+    const dir = path19.resolve(cwd, relative ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -18445,8 +18524,8 @@ var analysisDenial = (error) => ({
 });
 var NEXT_COMMAND = "next";
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path18.join(repo.location.dir, "hooks", `commit-${createHash13("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
-var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash13("sha256").update(command).digest("hex")}`;
+var markerFile = (repo, session, key) => path19.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
     if (!input.session.id || !/\bcommit\b/.test(command))
@@ -18456,8 +18535,8 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs15.mkdirSync(path18.dirname(file), { recursive: true });
-      fs15.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs16.mkdirSync(path19.dirname(file), { recursive: true });
+      fs16.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
@@ -18480,11 +18559,11 @@ var headCommit = (dir) => {
 var settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs15.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs16.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs15.rmSync(file, { force: true });
+  fs16.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -18533,7 +18612,7 @@ function settlePendingCommit(input) {
     if (!repo)
       return;
     const file = markerFile(repo, input.session.id, NEXT_COMMAND);
-    if (fs15.existsSync(file))
+    if (fs16.existsSync(file))
       settle2(input, repo, file);
   } catch {}
 }
@@ -18687,7 +18766,7 @@ var judgedDir = (root, dir) => {
     return null;
   if (dir === null)
     return root;
-  const resolved = path19.resolve(root, dir);
+  const resolved = path20.resolve(root, dir);
   return existsSync6(resolved) && inWorkitWorkspace(resolved) ? resolved : null;
 };
 var shellBranchPolicyViolation = (root, command, dialect = "posix") => {
@@ -18923,7 +19002,7 @@ var judgeInputSummary = (raw) => {
 
 // packages/workit-core/src/autonomy.ts
 import os5 from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 var accountHome = () => {
   try {
     return os5.userInfo().homedir;
@@ -18932,10 +19011,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path20.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path21.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path20.resolve(resolveConfigDir());
-  return configured === path20.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path20.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path21.resolve(resolveConfigDir());
+  return configured === path21.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path21.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -20738,7 +20817,7 @@ class WorkitCore {
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -20872,7 +20951,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path21.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path22.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -20903,7 +20982,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path21.join(cwd, "package.json");
+  const pkgPath = path22.join(cwd, "package.json");
   if (!existsSync7(pkgPath))
     return [];
   try {
@@ -20929,9 +21008,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path21.join(dir, entry.name), depth + 1);
+        walk(path22.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path21.relative(cwd, path21.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path22.relative(cwd, path22.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -20947,7 +21026,7 @@ var readTrimmed2 = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path21.resolve(repoRoot(root));
+  const cwd = path22.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -21005,7 +21084,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 
 `;
-    stdout += readTrimmed2(path21.join(cwd, template), 220);
+    stdout += readTrimmed2(path22.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
 
@@ -21015,7 +21094,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync7(path21.join(cwd, "package.json"))) {
+  if (existsSync7(path22.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -21024,7 +21103,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync7(path21.join(cwd, "Cargo.toml")) || existsSync7(path21.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync7(path22.join(cwd, "Cargo.toml")) || existsSync7(path22.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -21057,7 +21136,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path21.resolve(repoRoot(root));
+  const cwd = path22.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -21075,7 +21154,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path21.join(cwd, "CHANGELOG.md");
+  const changelogPath = path22.join(cwd, "CHANGELOG.md");
   if (existsSync7(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
@@ -21095,7 +21174,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path21.resolve(repoRoot(root));
+  const cwd = path22.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -21117,7 +21196,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path21.join(cwd, "README.md");
+  const readme = path22.join(cwd, "README.md");
   if (existsSync7(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
@@ -21126,7 +21205,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path21.join(cwd, "package.json");
+  const pkgPath = path22.join(cwd, "package.json");
   if (existsSync7(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
@@ -21140,7 +21219,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path21.resolve(repoRoot(root));
+  const cwd = path22.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -21178,7 +21257,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync7(path21.join(cwd, rel)))
+    if (existsSync7(path22.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -21209,8 +21288,8 @@ function releaseNotesContext(root, rangeOrTag) {
 import { spawnSync as spawnSync15 } from "node:child_process";
 
 // packages/workit-core/src/core/pr-create.ts
-import fs16 from "node:fs";
-import path22 from "node:path";
+import fs17 from "node:fs";
+import path23 from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
@@ -21221,13 +21300,13 @@ function parseGhIssue(value) {
 // packages/workit-core/src/core/pr-create.ts
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path22.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path23.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path22.join(dir, name);
+      const candidate = path23.join(dir, name);
       try {
-        fs16.accessSync(candidate, fs16.constants.X_OK);
+        fs17.accessSync(candidate, fs17.constants.X_OK);
         return candidate;
       } catch {}
     }
@@ -21345,8 +21424,8 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 };
 
 // packages/workit-core/src/core/youtrack.ts
-import fs17 from "node:fs";
-import path23 from "node:path";
+import fs18 from "node:fs";
+import path24 from "node:path";
 
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -21359,22 +21438,22 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path23.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path23.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path24.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path24.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs17.statSync(p).mode & 511;
+  const mode = fs18.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs17.existsSync(cfgPath)) {
+  if (!fs18.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs17.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs18.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -21385,11 +21464,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs17.existsSync(cfgPath))
+  if (!fs18.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs17.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs18.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -21428,12 +21507,12 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path23.isAbsolute(tokenFile) ? path23.resolve(tokenFile) : path23.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs17.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path24.isAbsolute(tokenFile) ? path24.resolve(tokenFile) : path24.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs18.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs17.readFileSync(tokenPath, "utf8").trim();
+  const token = fs18.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
   if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
@@ -21498,9 +21577,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs17.existsSync(full))
+    if (!fs18.existsSync(full))
       continue;
-    const text = fs17.readFileSync(full, "utf8");
+    const text = fs18.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -21785,15 +21864,15 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path24.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path24.sep)) {
+  const target = path25.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path25.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync8(ancestor))
-    ancestor = path24.dirname(ancestor);
+    ancestor = path25.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path24.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path25.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -21837,9 +21916,9 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash14 } from "node:crypto";
-import fs18 from "node:fs";
-import path25 from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+import fs19 from "node:fs";
+import path26 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
 var migrationPending = (result) => !result.ok && result.code === "needs_input" && (result.error ?? "").startsWith(MIGRATION_PENDING);
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
@@ -21924,7 +22003,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path25.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path26.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -21993,7 +22072,7 @@ var turnContextText = (input, descriptor) => {
   }
 };
 var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-var digestOf = (text) => createHash14("sha256").update(text).digest("hex");
+var digestOf = (text) => createHash15("sha256").update(text).digest("hex");
 var turnMarker = (input) => {
   if (!input.session.id)
     return null;
@@ -22002,32 +22081,32 @@ var turnMarker = (input) => {
     if (location instanceof Error)
       return null;
     const session = [input.host, input.session.id, input.session.agentId ?? ""].join("\x00");
-    return path25.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
+    return path26.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
   } catch {
     return null;
   }
 };
 var writeTurnDigest = (file, digest) => {
   try {
-    fs18.mkdirSync(path25.dirname(file), { recursive: true });
-    fs18.writeFileSync(file, `${JSON.stringify({ digest })}
+    fs19.mkdirSync(path26.dirname(file), { recursive: true });
+    fs19.writeFileSync(file, `${JSON.stringify({ digest })}
 `);
   } catch {}
 };
 var clearTurnDigest = (file) => {
   try {
-    fs18.rmSync(file, { force: true });
+    fs19.rmSync(file, { force: true });
   } catch {}
 };
 var pruneTurnDigests = (dir, now) => {
   try {
-    for (const name of fs18.readdirSync(dir)) {
+    for (const name of fs19.readdirSync(dir)) {
       if (!name.startsWith("turn-"))
         continue;
-      const file = path25.join(dir, name);
+      const file = path26.join(dir, name);
       try {
-        if (now - fs18.statSync(file).mtimeMs > TURN_TTL_MS)
-          fs18.rmSync(file, { force: true });
+        if (now - fs19.statSync(file).mtimeMs > TURN_TTL_MS)
+          fs19.rmSync(file, { force: true });
       } catch {}
     }
   } catch {}
@@ -22043,7 +22122,7 @@ var changedTurnContext = (input, text) => {
     return text;
   const digest = digestOf(text);
   try {
-    const previous = JSON.parse(fs18.readFileSync(file, "utf8"));
+    const previous = JSON.parse(fs19.readFileSync(file, "utf8"));
     if (previous.digest === digest)
       return null;
   } catch {}
@@ -22054,7 +22133,7 @@ var seedTurnContext = (input, descriptor, text = turnContextText(input, descript
   const file = turnMarker(input);
   if (!file)
     return;
-  pruneTurnDigests(path25.dirname(file), Date.now());
+  pruneTurnDigests(path26.dirname(file), Date.now());
   if (text)
     writeTurnDigest(file, digestOf(text));
   else
@@ -22073,13 +22152,13 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
   return policy && !policy.ok ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null } : { kind: "none" };
 };
 // packages/workit-core/src/core/heavy-rules.ts
-import fs19 from "node:fs";
+import fs20 from "node:fs";
 import os6 from "node:os";
-import path26 from "node:path";
+import path27 from "node:path";
 var EMPTY = () => ({ deny: [], allow: [] });
 var readText2 = (file) => {
   try {
-    return fs19.readFileSync(file, "utf8");
+    return fs20.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -22116,19 +22195,19 @@ function parseJsonc(text) {
   return JSON.parse(out.replace(/,(\s*[}\]])/gu, "$1"));
 }
 function gitTop(cwd) {
-  for (let dir = path26.resolve(cwd);; dir = path26.dirname(dir)) {
-    if (fs19.existsSync(path26.join(dir, ".git")))
+  for (let dir = path27.resolve(cwd);; dir = path27.dirname(dir)) {
+    if (fs20.existsSync(path27.join(dir, ".git")))
       return dir;
-    if (path26.dirname(dir) === dir)
+    if (path27.dirname(dir) === dir)
       return null;
   }
 }
 var projectDirs = (cwd) => {
   const top = gitTop(cwd);
   const dirs = [];
-  for (let dir = path26.resolve(cwd);; dir = path26.dirname(dir)) {
+  for (let dir = path27.resolve(cwd);; dir = path27.dirname(dir)) {
     dirs.push(dir);
-    if (!top || dir === top || path26.dirname(dir) === dir)
+    if (!top || dir === top || path27.dirname(dir) === dir)
       return dirs;
   }
 };
@@ -22140,12 +22219,12 @@ var CLAUDE_MANAGED = {
 };
 function claudeSettingsFiles(cwd, env, platform = process.platform) {
   const project = env.CLAUDE_PROJECT_DIR || gitTop(cwd) || cwd;
-  const user = env.CLAUDE_CONFIG_DIR || path26.join(homeOf(env), ".claude");
+  const user = env.CLAUDE_CONFIG_DIR || path27.join(homeOf(env), ".claude");
   return [
     ...CLAUDE_MANAGED[platform] ? [CLAUDE_MANAGED[platform]] : [],
-    path26.join(user, "settings.json"),
-    path26.join(project, ".claude", "settings.json"),
-    path26.join(project, ".claude", "settings.local.json")
+    path27.join(user, "settings.json"),
+    path27.join(project, ".claude", "settings.json"),
+    path27.join(project, ".claude", "settings.local.json")
   ];
 }
 var bashPattern = (entry) => {
@@ -22235,10 +22314,10 @@ var opencodeConfig = (value, rules) => {
 function opencodeRules(cwd, env = process.env) {
   const rules = EMPTY();
   try {
-    const config = env.XDG_CONFIG_HOME || path26.join(homeOf(env), ".config");
+    const config = env.XDG_CONFIG_HOME || path27.join(homeOf(env), ".config");
     const files = [
-      ...OPENCODE_NAMES.map((name) => path26.join(config, "opencode", name)),
-      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path26.join(dir, name), path26.join(dir, ".opencode", name)])),
+      ...OPENCODE_NAMES.map((name) => path27.join(config, "opencode", name)),
+      ...projectDirs(cwd).flatMap((dir) => OPENCODE_NAMES.flatMap((name) => [path27.join(dir, name), path27.join(dir, ".opencode", name)])),
       ...env.OPENCODE_CONFIG ? [env.OPENCODE_CONFIG] : []
     ];
     for (const file of files) {
@@ -22282,19 +22361,19 @@ var codexRule = (body) => {
 function codexRules(cwd, env = process.env) {
   const rules = EMPTY();
   try {
-    const home = env.CODEX_HOME || path26.join(homeOf(env), ".codex");
+    const home = env.CODEX_HOME || path27.join(homeOf(env), ".codex");
     const top = gitTop(cwd) ?? cwd;
-    for (const dir of [path26.join(home, "rules"), path26.join(top, ".codex", "rules")]) {
+    for (const dir of [path27.join(home, "rules"), path27.join(top, ".codex", "rules")]) {
       let files;
       try {
-        files = fs19.readdirSync(dir).filter((name) => name.endsWith(".rules"));
+        files = fs20.readdirSync(dir).filter((name) => name.endsWith(".rules"));
       } catch (error) {
         if (error.code === "ENOENT")
           continue;
         return "unreadable";
       }
       for (const name of files) {
-        const text = readText2(path26.join(dir, name)) ?? "";
+        const text = readText2(path27.join(dir, name)) ?? "";
         for (const part of text.split(/\bprefix_rule\s*\(/u).slice(1)) {
           const rule = codexRule(part);
           if (!rule)
@@ -22313,8 +22392,8 @@ function cursorRules(cwd, env = process.env) {
   try {
     const top = gitTop(cwd) ?? cwd;
     for (const file of [
-      path26.join(homeOf(env), ".cursor", "cli-config.json"),
-      path26.join(top, ".cursor", "cli.json")
+      path27.join(homeOf(env), ".cursor", "cli-config.json"),
+      path27.join(top, ".cursor", "cli.json")
     ]) {
       const text = readText2(file);
       if (text === null)
@@ -22388,23 +22467,23 @@ function wrapAllowed(read, words, command, options = {}) {
 }
 
 // packages/workit-core/src/core/heavy.ts
-import fs20 from "node:fs";
+import fs21 from "node:fs";
 import os7 from "node:os";
-import path27 from "node:path";
+import path28 from "node:path";
 function stateDir(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path27.join(env.XDG_STATE_HOME, "workit");
+    return path28.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os7.homedir();
   if (platform === "darwin")
-    return path27.join(home, "Library", "Application Support", "workit");
+    return path28.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path27.join(env.LOCALAPPDATA ?? path27.join(home, "AppData", "Local"), "workit");
-  return path27.join(home, ".local", "state", "workit");
+    return path28.join(env.LOCALAPPDATA ?? path28.join(home, "AppData", "Local"), "workit");
+  return path28.join(home, ".local", "state", "workit");
 }
 var HEAVY_COMMANDS_FILE = "heavy-commands.json";
-var heavyCommandsFile = (env) => path27.join(stateDir(env), HEAVY_COMMANDS_FILE);
+var heavyCommandsFile = (env) => path28.join(stateDir(env), HEAVY_COMMANDS_FILE);
 var HEAVY_SCRIPT = /^(?:test|tests|t|tst|unit|integration|e2e|coverage|cov|lint|eslint|typecheck|type-check|types|tsc|check|verify|validate|build|compile|bundle|ci|sonar|cypress|playwright|jest|vitest|mocha|bench|benchmark|all)(?:$|[:_.-])/iu;
 var INFO_FLAGS = new Set(["--version", "-v", "-V", "--help", "-h", "help", "version"]);
 var WATCH_FLAG = /^(?:--watch(?:All)?(?:=.*)?|-w|--serve)$/u;
@@ -22667,7 +22746,7 @@ function parsePattern(pattern) {
 var matches = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index]));
 var readJson = (file) => {
   try {
-    return JSON.parse(fs20.readFileSync(file, "utf8"));
+    return JSON.parse(fs21.readFileSync(file, "utf8"));
   } catch {
     return;
   }
@@ -22679,7 +22758,7 @@ function machinePatterns(env) {
   return isRecord5(value) ? stringList(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path27.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path28.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -22757,12 +22836,12 @@ function heavyPlan(command, options) {
 }
 function workitOnPath2(env = process.env) {
   const names = process.platform === "win32" ? ["workit.exe", "workit.cmd", "workit"] : ["workit"];
-  for (const dir of (env.PATH ?? "").split(path27.delimiter))
+  for (const dir of (env.PATH ?? "").split(path28.delimiter))
     for (const name of names) {
       if (!dir)
         continue;
       try {
-        fs20.accessSync(path27.join(dir, name), fs20.constants.X_OK);
+        fs21.accessSync(path28.join(dir, name), fs21.constants.X_OK);
         return true;
       } catch {}
     }
@@ -22779,41 +22858,41 @@ function leaseRewrite(command) {
 }
 
 // packages/workit-core/src/core/heavy-words.ts
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 import os8 from "node:os";
-import path28 from "node:path";
+import path29 from "node:path";
 var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
 var wordsOf = (command) => command.split(/[\s;&|()<>`'"]+/u).map((word) => (word.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat)$/u, "")).filter(Boolean);
 var stateDir2 = (env) => {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path28.join(env.XDG_STATE_HOME, "workit");
+    return path29.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os8.homedir();
   if (process.platform === "darwin")
-    return path28.join(home, "Library", "Application Support", "workit");
+    return path29.join(home, "Library", "Application Support", "workit");
   if (process.platform === "win32")
-    return path28.join(env.LOCALAPPDATA ?? path28.join(home, "AppData", "Local"), "workit");
-  return path28.join(home, ".local", "state", "workit");
+    return path29.join(env.LOCALAPPDATA ?? path29.join(home, "AppData", "Local"), "workit");
+  return path29.join(home, ".local", "state", "workit");
 };
 var readJson2 = (file) => {
   try {
-    return JSON.parse(fs21.readFileSync(file, "utf8"));
+    return JSON.parse(fs22.readFileSync(file, "utf8"));
   } catch {
     return;
   }
 };
 var patternWords = (cwd, env) => {
   const patterns = [];
-  const machine = readJson2(path28.join(stateDir2(env), "heavy-commands.json"));
+  const machine = readJson2(path29.join(stateDir2(env), "heavy-commands.json"));
   if (Array.isArray(machine?.patterns))
     patterns.push(...machine.patterns);
-  for (let dir = path28.resolve(cwd);; dir = path28.dirname(dir)) {
-    if (fs21.existsSync(path28.join(dir, ".git"))) {
+  for (let dir = path29.resolve(cwd);; dir = path29.dirname(dir)) {
+    if (fs22.existsSync(path29.join(dir, ".git"))) {
       patterns.push(...repoHeavyCommands(dir));
       break;
     }
-    if (path28.dirname(dir) === dir)
+    if (path29.dirname(dir) === dir)
       break;
   }
   const words = new Set;
@@ -22885,14 +22964,14 @@ var splitDenial = (plan) => ({
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync6 } from "node:fs";
 import os10 from "node:os";
-import path30 from "node:path";
+import path31 from "node:path";
 
 // packages/workit-core/src/core/live-session.ts
 import { spawnSync as spawnSync17 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
-import fs22 from "node:fs";
+import { createHash as createHash16 } from "node:crypto";
+import fs23 from "node:fs";
 import os9 from "node:os";
-import path29 from "node:path";
+import path30 from "node:path";
 var LIVE_SESSION_TTL_MS = 15 * 60000;
 var HEARTBEAT_EVERY_MS = 30000;
 var liveProbe = {
@@ -22913,9 +22992,9 @@ var processAlive = (pid) => {
 var processInfo = (pid) => {
   try {
     if (liveProbe.platform === "linux") {
-      const stat = fs22.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const stat = fs23.readFileSync(`/proc/${pid}/stat`, "utf8");
       const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-      const command = fs22.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      const command = fs23.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
       return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
     }
     if (liveProbe.platform === "win32")
@@ -22966,35 +23045,35 @@ var liveOwner = (input, transport, env = process.env) => {
   };
 };
 var checkoutOf = (target) => {
-  let dir = path29.resolve(target);
-  while (!fs22.existsSync(dir) && path29.dirname(dir) !== dir)
-    dir = path29.dirname(dir);
-  if (fs22.existsSync(dir) && !fs22.statSync(dir).isDirectory())
-    dir = path29.dirname(dir);
-  const parts = dir.split(path29.sep);
+  let dir = path30.resolve(target);
+  while (!fs23.existsSync(dir) && path30.dirname(dir) !== dir)
+    dir = path30.dirname(dir);
+  if (fs23.existsSync(dir) && !fs23.statSync(dir).isDirectory())
+    dir = path30.dirname(dir);
+  const parts = dir.split(path30.sep);
   const dotGit = parts.lastIndexOf(".git");
   if (dotGit > 0)
-    dir = parts.slice(0, dotGit).join(path29.sep) || path29.sep;
+    dir = parts.slice(0, dotGit).join(path30.sep) || path30.sep;
   const location = resolveStore(dir);
   if (location instanceof Error || !location.shared || !location.top)
     return null;
   let top = location.top;
   try {
-    top = fs22.realpathSync.native(top);
+    top = fs23.realpathSync.native(top);
   } catch {}
   return top;
 };
-var markerFile2 = (top) => path29.join(resolveStateDir(), "live-sessions", `${createHash15("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
+var markerFile2 = (top) => path30.join(resolveStateDir(), "live-sessions", `${createHash16("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
 var checkoutKey = (top, platform = process.platform) => {
-  let key = path29.resolve(top);
+  let key = path30.resolve(top);
   try {
-    key = fs22.realpathSync.native(key);
+    key = fs23.realpathSync.native(key);
   } catch {}
   return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
 };
 var readMarker = (file) => {
   try {
-    const value = JSON.parse(fs22.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs23.readFileSync(file, "utf8"));
     if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
       return null;
     return {
@@ -23081,10 +23160,10 @@ var claimLiveSession = (target, owner, deps = {}) => {
       checkout,
       heartbeatAt: now.toISOString()
     };
-    fs22.mkdirSync(path29.dirname(file), { recursive: true });
+    fs23.mkdirSync(path30.dirname(file), { recursive: true });
     const temp = `${file}.${process.pid}.tmp`;
-    fs22.writeFileSync(temp, JSON.stringify(marker));
-    fs22.renameSync(temp, file);
+    fs23.writeFileSync(temp, JSON.stringify(marker));
+    fs23.renameSync(temp, file);
   } catch {}
 };
 
@@ -23093,22 +23172,22 @@ var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path30.resolve(file);; dir = path30.dirname(dir)) {
+  for (let dir = path31.resolve(file);; dir = path31.dirname(dir)) {
     try {
-      return path30.join(realpathSync6.native(dir), rest);
+      return path31.join(realpathSync6.native(dir), rest);
     } catch {
-      if (path30.dirname(dir) === dir)
-        return path30.resolve(file);
-      rest = rest ? path30.join(path30.basename(dir), rest) : path30.basename(dir);
+      if (path31.dirname(dir) === dir)
+        return path31.resolve(file);
+      rest = rest ? path31.join(path31.basename(dir), rest) : path31.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path30.relative(fold(canonical2(root)), fold(canonical2(path30.resolve(cwd, file))));
-  if (relative.startsWith("..") || path30.isAbsolute(relative))
+  const relative = path31.relative(fold(canonical2(root)), fold(canonical2(path31.resolve(cwd, file))));
+  if (relative.startsWith("..") || path31.isAbsolute(relative))
     return true;
-  const posix = relative.split(path30.sep).join("/");
+  const posix = relative.split(path31.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -23229,7 +23308,7 @@ var shellWrites = (command, depth = 0) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path30.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path31.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -23308,7 +23387,7 @@ var gitMutationDirs = (cwd, command, dialect) => {
       return [];
     if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
       return [];
-    return [path30.resolve(cwd, invocation.dir ?? ".")];
+    return [path31.resolve(cwd, invocation.dir ?? ".")];
   });
 };
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
@@ -23319,7 +23398,7 @@ var cdInto = (dir, words) => {
   const target = named === undefined ? undefined : homeExpanded(named);
   if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
     return;
-  return target === undefined ? os10.homedir() : path30.resolve(dir, target);
+  return target === undefined ? os10.homedir() : path31.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
 var homeExpanded = (file) => {
@@ -23333,7 +23412,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
   const groups = [];
   const at = (file) => {
     const home = homeExpanded(file);
-    return path30.isAbsolute(home) ? home : dir === undefined ? null : path30.resolve(dir, home);
+    return path31.isAbsolute(home) ? home : dir === undefined ? null : path31.resolve(dir, home);
   };
   for (const segment of segmentsOf(command, dialect)) {
     if (segment.group === "open") {
@@ -23374,7 +23453,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
     const edits = editsOf(segment.words);
     if (edits === null) {
       if (dir !== undefined)
-        targets.push(path30.join(dir, DIR_TARGET));
+        targets.push(path31.join(dir, DIR_TARGET));
     } else
       for (const file of edits) {
         const resolved = at(file);
@@ -23382,7 +23461,7 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
           targets.push(resolved);
       }
     if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path30.join(dir, DIR_TARGET));
+      targets.push(path31.join(dir, DIR_TARGET));
   }
   return targets;
 };
@@ -23417,7 +23496,7 @@ var liveDeny = ({ marker, checkout, ageMs, file }) => {
 var guarded = (targets) => {
   const seen = new Set;
   return targets.filter((target) => {
-    const dir = path30.dirname(target);
+    const dir = path31.dirname(target);
     if (seen.has(dir))
       return false;
     seen.add(dir);
@@ -23438,7 +23517,7 @@ var claimAll = (owner, targets, deps) => {
   for (const target of guarded(targets))
     claimLiveSession(target, owner, deps);
 };
-var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path30.resolve(cwd, file)) : [path30.join(cwd, DIR_TARGET)];
+var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path31.resolve(cwd, file)) : [path31.join(cwd, DIR_TARGET)];
 var issuedTarget = (cwd, targets) => {
   const state = resolveStateDir();
   const found = targets.find((target) => underIssued(state, cwd, homeExpanded(target), process.platform, canonical2));
@@ -23446,7 +23525,7 @@ var issuedTarget = (cwd, targets) => {
 };
 var underIssued = (state, cwd, target, platform = process.platform, real = (file) => file) => {
   const win = platform === "win32";
-  const p = win ? path30.win32 : path30.posix;
+  const p = win ? path31.win32 : path31.posix;
   const fold = (value) => win || platform === "darwin" ? value.toLowerCase() : value;
   const named = win ? target.replace(/^\/([a-zA-Z])(?=\/|$)/, "$1:") : target;
   const relative = p.relative(fold(real(p.resolve(state))), fold(real(p.resolve(cwd, named))));
@@ -23495,7 +23574,7 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
     try {
       targets = [
         ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path30.join(dir, DIR_TARGET))
+        ...gitMutationDirs(cwd, command, dialect).map((dir) => path31.join(dir, DIR_TARGET))
       ];
     } catch {
       targets = [];
@@ -23963,6 +24042,109 @@ var writePaths = (input) => {
         paths.push(match[1].trim());
   return [...new Set(paths)];
 };
+// packages/workit-core/src/hooks/standing.ts
+import fs24 from "node:fs";
+import path32 from "node:path";
+var readPlans = (store) => {
+  const dir = path32.join(store, "fanouts");
+  let names;
+  try {
+    names = fs24.readdirSync(dir).filter((name) => name.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  const plans = [];
+  for (const name of names) {
+    try {
+      const raw = JSON.parse(fs24.readFileSync(path32.join(dir, name), "utf8"));
+      if (typeof raw.name !== "string" || !Array.isArray(raw.slices))
+        continue;
+      const texts = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
+      plans.push({
+        name: raw.name,
+        leads: texts([raw.leadSession, ...texts(raw.formerLeads)]),
+        branches: texts(raw.slices.map((slice) => slice && typeof slice === "object" ? slice.branch : null))
+      });
+    } catch {}
+  }
+  return plans;
+};
+var leadOf2 = (input) => input.session.parentId ?? (input.session.agentId ? input.session.id : null) ?? (input.session.id.includes(":") ? input.session.id.split(":")[0] : null);
+var worksFor = (plan, input, branch) => {
+  const session = input.session.id;
+  if (plan.leads.includes(session) && !input.session.agentId)
+    return false;
+  const lead = leadOf2(input);
+  if (lead && plan.leads.includes(lead))
+    return true;
+  if (plan.leads.some((each) => session.startsWith(`${each}-w-`)))
+    return true;
+  const current = branch();
+  return current !== null && plan.branches.includes(current);
+};
+var standingFor = (input, store, rev) => {
+  const orders = new Map;
+  const ledger = readLedger(input.cwd);
+  const rows = ledger.ok ? ledger.value.rows : [];
+  let branch;
+  const lazyBranch = () => branch === undefined ? branch = currentBranch(input.cwd) : branch;
+  for (const plan of readPlans(store))
+    if (worksFor(plan, input, lazyBranch))
+      for (const row of activeStanding(rows, plan.name, plan.leads.length ? plan.leads : null))
+        orders.set(row.id, row);
+  return { rev, orders, rows };
+};
+var located = (input) => {
+  const store = input.session.id ? gitStoreDir(input.cwd) : null;
+  const rev = store ? readStandingRev(store) : null;
+  if (!store || rev === null)
+    return null;
+  return { store, rev, file: standingSeenFile(store, input.session.id, input.session.agentId) };
+};
+var seedStanding = (input) => {
+  try {
+    const where = located(input);
+    if (!where)
+      return;
+    const now = standingFor(input, where.store, where.rev);
+    writeStandingSeen(where.file, { rev: where.rev, ids: [...now.orders.keys()] });
+  } catch {}
+};
+var fanoutOf = (row) => typeof row.fanout === "string" ? row.fanout : "?";
+var changedSince = (now, ids) => {
+  const known = new Set(ids);
+  const added = [...now.orders.values()].filter((row) => !known.has(row.id));
+  const byId = new Map(now.rows.map((row) => [row.id, row]));
+  const dropped = ids.filter((id) => !now.orders.has(id)).map((id) => byId.get(id)).filter((row) => row !== undefined);
+  if (!added.length && !dropped.length)
+    return null;
+  const fanouts = [...new Set([...added, ...dropped].map(fanoutOf))].join(", ");
+  const lines = [
+    `Workit: the lead changed the standing orders for fanout ${fanouts} while you run. They apply to you now and override your brief's STANDING list.`,
+    ...added.map((row) => `  - new: ${String(row.what)}`),
+    ...dropped.map((row) => `  - no longer in force: ${String(row.what)}${row.stop ? " (the stop is lifted: continue your brief)" : ""}`)
+  ];
+  if (added.some((row) => row.stop === true))
+    lines.push("Stop now: make no further changes, close what you opened, and report to the lead with your branch, head SHA, what is done and what is not.");
+  return lines.join(`
+`);
+};
+var standingDelta = (input) => {
+  try {
+    const where = located(input);
+    if (!where)
+      return null;
+    const seen = readStandingSeen(where.file);
+    if (seen.rev === where.rev)
+      return null;
+    const now = standingFor(input, where.store, where.rev);
+    writeStandingSeen(where.file, { rev: where.rev, ids: [...now.orders.keys()] });
+    return changedSince(now, seen.ids);
+  } catch {
+    return null;
+  }
+};
+var sinceStart = new Map;
 // packages/workit-core/src/hooks/handle.ts
 var usable2 = (value) => value === "native" || value === "partial";
 var NONE5 = { kind: "none" };
@@ -24007,7 +24189,18 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
+var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
 function handleHook(input, deps) {
+  const decision = decide(input, deps);
+  if (deps.descriptor.transport !== "hook-process" || !PRE_TOOL.has(input.event.kind) || decision.kind === "deny")
+    return decision;
+  const delta = standingDelta(input);
+  if (!delta)
+    return decision;
+  return decision.kind === "rewrite" ? { ...decision, text: [decision.text, delta].filter(Boolean).join(`
+`) } : withContextLine(decision, delta);
+}
+function decide(input, deps) {
   const { descriptor } = deps;
   const event = input.event;
   switch (event.kind) {
@@ -24084,6 +24277,7 @@ function handleHook(input, deps) {
     case "write.pre":
       return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
     case "subagent.start":
+      seedStanding({ ...input, session: { ...input.session, agentId: event.agentId } });
       return {
         kind: "context",
         text: subagentStartText(input, descriptor, event)
@@ -24243,6 +24437,13 @@ var turnInput = (ctx) => ({
   transcriptPath: null,
   event: { kind: "context.turn" }
 });
+var standingNotice = (ctx) => {
+  if (!ctx.isProjectTrusted())
+    return null;
+  const worker = process.env.WORKIT_PI_WORKER_SESSION && process.env.WORKIT_SESSION_ID?.trim();
+  const input = turnInput(ctx);
+  return standingDelta(worker ? { ...input, session: { ...input.session, id: worker } } : input);
+};
 var workitContext = (ctx, taskContext = turnContext(ctx)) => {
   const session = ctx.sessionManager.getSessionId();
   if (!ctx.isProjectTrusted())
@@ -24403,12 +24604,12 @@ var skillPromptNudge = (prompt, ctx) => process.env.WORKIT_PI_WORKER_SESSION ? n
 // packages/workit-pi/src/launches.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync as readdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import os11 from "node:os";
-import path31 from "node:path";
+import path33 from "node:path";
 var launchDir = (root) => {
   const location = resolveStore(root);
-  return location instanceof Error ? null : path31.join(location.dir, "pi-launches");
+  return location instanceof Error ? null : path33.join(location.dir, "pi-launches");
 };
-var fileFor = (dir, workerId) => path31.join(dir, `${workerId.replace(/[^A-Za-z0-9-]/g, "_")}.json`);
+var fileFor = (dir, workerId) => path33.join(dir, `${workerId.replace(/[^A-Za-z0-9-]/g, "_")}.json`);
 var recordLaunch = (root, attempt) => {
   const dir = launchDir(root);
   if (!dir)
@@ -24454,7 +24655,7 @@ var abandonedLaunches = (root) => {
   const found = [];
   for (const name of names) {
     try {
-      const attempt = JSON.parse(readFileSync6(path31.join(dir, name), "utf8"));
+      const attempt = JSON.parse(readFileSync6(path33.join(dir, name), "utf8"));
       if (typeof attempt.workerId === "string" && typeof attempt.session === "string") {
         if (!alive(attempt))
           found.push(attempt);
@@ -24632,6 +24833,14 @@ function launchWorker(assignment, options) {
     WORKIT_PI_WORKER_ROLE: assignment.role,
     WORKIT_PI_WORKER_SCOPE: JSON.stringify(assignment.scope)
   };
+  seedStanding({
+    host: "pi",
+    cwd: spec.cwd,
+    session: { id: env.WORKIT_SESSION_ID, agentId: null, agentType: null, parentId: null },
+    permissionMode: null,
+    transcriptPath: null,
+    event: { kind: "session.start", source: "startup" }
+  });
   try {
     const spawn = options.spawn ?? ((command, args, spawnOptions) => nodeSpawn(command, args, spawnOptions));
     handle.spec = { ...spec, env };
@@ -25361,6 +25570,16 @@ ${nudge}` : content) };
   });
   pi.on("tool_call", (event, ctx) => enforceToolPolicy(event, ctx));
   pi.on("tool_result", (event, ctx) => {
+    const observed = observeResult(event, ctx);
+    let standing = null;
+    try {
+      standing = standingNotice(ctx);
+    } catch {}
+    if (!standing)
+      return observed;
+    return { content: [...observed?.content ?? event.content, { type: "text", text: standing }] };
+  });
+  const observeResult = (event, ctx) => {
     if (childWorker && event.toolName === "workit_worker") {
       const details = event.details;
       const report = typeof details === "object" && details !== null && "data" in details && typeof details.data === "object" && details.data.data?.report;
@@ -25382,7 +25601,7 @@ ${nudge}` : content) };
       isError: event.isError
     });
     return observeToolResult(event, ctx);
-  });
+  };
   pi.on("session_shutdown", (_event, ctx) => {
     sessions.delete(ctx.sessionManager.getSessionId());
   });