@brainervirus/workit-pi 8.24.0 → 8.26.0

package/dist/worker.js

@@ -6669,6 +6669,41 @@ var ENVELOPE = new Set([
   "judgment"
 ]);
 // packages/workit-core/src/core/config.ts
+import {
+  copyFileSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  writeFileSync
+} from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// packages/workit-core/src/core/boundary.ts
+var EVENT = {
+  initialization: "initialization",
+  provenance: "provenance",
+  assets: "assets",
+  configurationSource: "configuration_source",
+  hooks: "hooks",
+  mcpConnection: "mcp_connection",
+  migration: "migration",
+  installSteps: "install_steps",
+  uncaughtFailure: "uncaught_failure",
+  toolsFailed: "tools_failed",
+  doctor: "doctor"
+};
+var errorDetail = (err) => {
+  if (err instanceof Error) {
+    return { error_name: err.name, error: err.message };
+  }
+  return { error_name: "unknown", error: String(err) };
+};
+
+// packages/workit-core/src/core/config.ts
+var diagnosticLogger;
 var PRESETS = {
   gitflow: {
     allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
@@ -6678,6 +6713,49 @@ var PRESETS = {
   "trunk-based": { allowed: ["*"], protected: ["main"] },
   custom: { allowed: [], protected: [] }
 };
+var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "workit");
+var migratedDir = null;
+var migrationFailed = false;
+var ensureConfigDir = (dir = resolveConfigDir()) => {
+  if (migratedDir === dir)
+    return dir;
+  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
+    migratedDir = dir;
+    return dir;
+  }
+  const legacy = path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "workflow-toolkit");
+  if (!existsSync(legacy)) {
+    migratedDir = dir;
+    return dir;
+  }
+  if (!migrationFailed && existsSync(dir)) {
+    migratedDir = dir;
+    return dir;
+  }
+  migrationFailed = false;
+  mkdirSync(dir, { recursive: true });
+  diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
+  for (const entry of readdirSync(legacy, { withFileTypes: true })) {
+    const src = path.join(legacy, entry.name);
+    const dest = path.join(dir, entry.name);
+    if (existsSync(dest))
+      continue;
+    try {
+      if (entry.isDirectory())
+        cpSync(src, dest, { recursive: true });
+      else if (entry.isFile())
+        copyFileSync(src, dest);
+    } catch (err) {
+      migrationFailed = true;
+      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
+      console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
+    }
+  }
+  if (!migrationFailed)
+    migratedDir = dir;
+  return dir;
+};
+var configDir = () => ensureConfigDir();
 var DEFAULTS = {
   locale: "en",
   localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
@@ -6699,7 +6777,9 @@ var COMMIT_PRESETS = [
 ];
 
 // packages/workit-core/src/core/workspaces.ts
-import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import path2 from "node:path";
 var nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
 var branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
 var commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
@@ -6757,7 +6837,7 @@ var releaseTrackSchema = object({
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource?.kind === "package-json" && (path.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path2.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -6781,6 +6861,7 @@ var workspaceConfigSchema = object({
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
   fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -6807,7 +6888,10 @@ var workspaceConfigSchema = object({
     });
   }
 });
-var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+var workspacesFileSchema = object({
+  workspaces: array(workspaceConfigSchema).optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional()
+}).passthrough().superRefine((file, context) => {
   const names = new Set;
   for (const [index, workspace] of (file.workspaces ?? []).entries()) {
     if (names.has(workspace.name)) {
@@ -6820,10 +6904,213 @@ var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).opt
     names.add(workspace.name);
   }
 });
+var globToRegExp = (glob) => {
+  let out = "";
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          if (out === "")
+            out += "/?";
+          out += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          if (i + 2 >= glob.length) {
+            if (out.endsWith("/")) {
+              out = out.slice(0, -1);
+              out += "(?:/.*)?";
+            } else {
+              out += ".*";
+            }
+          } else {
+            out += ".*";
+          }
+          i++;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else {
+      out += c.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${out}$`);
+};
+var matchWorkspace = (glob, target) => globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/"));
+var UNSUPPORTED_GLOB = /[?[\]{}]/;
+var UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+var validateWorkspaceGlob = (glob) => {
+  const trimmed = glob.trim();
+  if (!trimmed)
+    return { ok: false, error: "workspace pattern is required" };
+  const m = UNSUPPORTED_GLOB.exec(trimmed);
+  if (m) {
+    return {
+      ok: false,
+      error: `unsupported glob character ${JSON.stringify(m[0])} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
+  }
+  const ext = UNSUPPORTED_EXTGLOB.exec(trimmed);
+  if (ext) {
+    const token = ext[0];
+    const kind = token === "!" ? "negation (!)" : `extglob (${token})`;
+    return {
+      ok: false,
+      error: `unsupported glob ${kind} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`
+    };
+  }
+  return { ok: true };
+};
+
+class WorkspaceConfigError extends Error {
+  name = "WorkspaceConfigError";
+}
 var mainCheckouts = new Map;
+var mainCheckoutOf = (cwd) => {
+  const cached = mainCheckouts.get(cwd);
+  if (cached !== undefined)
+    return cached;
+  const env = { ...process.env };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
+    delete env[name];
+  const git = (args) => {
+    const run = spawnSync("git", args, {
+      cwd,
+      env,
+      encoding: "utf8",
+      timeout: 5000,
+      windowsHide: true
+    });
+    return run.status === 0 ? run.stdout : null;
+  };
+  let main = null;
+  const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
+  const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
+  if (gitDir && common && path2.resolve(gitDir) !== path2.resolve(common)) {
+    const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
+    main = listed?.trim() || (path2.basename(common) === ".git" ? path2.dirname(common) : common);
+  }
+  mainCheckouts.set(cwd, main);
+  return main;
+};
+var matchingEntries = (cwd, entries) => {
+  const match = (where) => {
+    const targets = [where, realpathOf(where)].map((value) => value.replaceAll("\\", "/"));
+    return entries.filter((entry) => {
+      const glob = entry.glob.replaceAll("\\", "/");
+      const canonical = canonicalGlob(glob);
+      return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
+    });
+  };
+  const direct = match(cwd);
+  if (direct.length)
+    return direct;
+  const main = mainCheckoutOf(cwd);
+  return main ? match(main) : direct;
+};
+var realpathOf = (p) => {
+  const real = realpathSync.native ?? realpathSync;
+  try {
+    return real(p);
+  } catch {
+    return p;
+  }
+};
+var canonicalGlob = (glob) => {
+  const m = /[*?[\]{]/.exec(glob);
+  const prefix = m ? glob.slice(0, m.index) : glob;
+  const rest = m ? glob.slice(m.index) : "";
+  if (!prefix)
+    return glob;
+  const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
+  return real + (prefix.endsWith("/") ? "/" : "") + rest;
+};
+var globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length;
+var selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+  if (workspaceName !== undefined) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      return named[0];
+    if (named.length > 1)
+      throw new WorkspaceConfigError(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    if (matches.length > 0) {
+      throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    }
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  }
+  if (matches.length < 2)
+    return matches[0];
+  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
+  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
+  if (mostSpecific.length > 1) {
+    throw new WorkspaceConfigError(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+  }
+  return mostSpecific[0];
+};
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
+var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path2.join(dir, "workspaces.json");
+  let raw;
+  try {
+    raw = readFileSync2(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new WorkspaceConfigError(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new WorkspaceConfigError(`${file} is not valid JSON`);
+  }
+  const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
+  if (!validated.success) {
+    const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
+    throw new WorkspaceConfigError(`${file} has invalid workspace matching data: ${detail}`);
+  }
+  const entries = validated.data.workspaces;
+  for (const entry of entries ?? []) {
+    const glob = validateWorkspaceGlob(entry.glob);
+    if (!glob.ok)
+      throw new WorkspaceConfigError(`${file} workspace ${entry.name}: ${glob.error}`);
+  }
+  const matches = matchingEntries(cwd, entries ?? []);
+  const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
+  return selected ? { file, selected, matches } : null;
+};
+var modelSources = (cwd, dir) => {
+  const out = [];
+  try {
+    const matched = matchRuntimeWorkspace(cwd, dir);
+    if (matched) {
+      const enclosing = matched.matches.filter((entry) => entry !== matched.selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+      for (const entry of [matched.selected, ...enclosing])
+        out.push({
+          name: entry.name,
+          global: false,
+          models: entry.models,
+          tierModels: entry.fanout?.tierModels
+        });
+    }
+  } catch {}
+  try {
+    const document = JSON.parse(readFileSync2(path2.join(dir ?? configDir(), "workspaces.json"), "utf8"));
+    if (document && typeof document === "object" && !Array.isArray(document))
+      out.push({
+        name: "global",
+        global: true,
+        models: document.models,
+        tierModels: undefined
+      });
+  } catch {}
+  return out;
+};
+var hostFamily = (host) => host.replace(/_(?:cli|desktop)$/u, "");
 var TIER_KEYS = new Set(["mundane", "standard", "hard"]);
 var TIER_HOSTS = new Set([
   "claude_code",
@@ -6837,11 +7124,11 @@ var TIER_HOSTS = new Set([
 ]);
 
 // packages/workit-core/src/git/rev.ts
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 var MAX_BUFFER = 256 * 1024 * 1024;
 var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
 var git = (cwd, args, options = {}) => {
-  const result = spawnSync("git", args, {
+  const result = spawnSync2("git", args, {
     cwd,
     encoding: "utf8",
     env: options.env ?? process.env,
@@ -6890,7 +7177,7 @@ var memo2 = new Map;
 var TRACKERS = new Set(["github", "gitlab", "youtrack"]);
 
 // packages/workit-core/src/core/logger.ts
-import os from "node:os";
+import os2 from "node:os";
 var SENSITIVE_WORDS = new Set([
   "token",
   "secret",
@@ -6929,15 +7216,15 @@ var SENSITIVE_WORDS = new Set([
 ]);
 var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
 var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-var homePattern = new RegExp(`${escapeRegExp(os.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+var homePattern = new RegExp(`${escapeRegExp(os2.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 
 // packages/workit-core/src/store/paths.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import fs from "node:fs";
-import path2 from "node:path";
+import path3 from "node:path";
 var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
 var gitRun = (cwd, args) => {
-  const run = spawnSync2("git", args, {
+  const run = spawnSync3("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
@@ -6975,14 +7262,14 @@ var DISCOVERY_ENV = [
 ];
 var isGitDir = (dir) => {
   try {
-    return fs.statSync(path2.join(dir, "HEAD")).isFile() && fs.statSync(path2.join(dir, "objects")).isDirectory() && fs.statSync(path2.join(dir, "refs")).isDirectory();
+    return fs.statSync(path3.join(dir, "HEAD")).isFile() && fs.statSync(path3.join(dir, "objects")).isDirectory() && fs.statSync(path3.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 };
 var reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs.readFileSync(path2.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs.readFileSync(path3.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
@@ -7002,7 +7289,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path2.join(dir, ".git");
+    const dotGit = path3.join(dir, ".git");
     let entry = null;
     try {
       entry = fs.statSync(dotGit);
@@ -7023,19 +7310,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path2.resolve(dir, match[1].trim());
+        gitDir = path3.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs.existsSync(path2.join(gitDir, "HEAD")))
+      if (!fs.existsSync(path3.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path2.resolve(gitDir, fs.readFileSync(path2.join(gitDir, "commondir"), "utf8").trim());
+        common = path3.resolve(gitDir, fs.readFileSync(path3.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs.existsSync(path2.join(common, "objects")))
+      if (!fs.existsSync(path3.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -7045,26 +7332,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path2.dirname(dir);
+    const parent = path3.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path2.resolve(root);
+  root = path3.resolve(root);
   let directory = false;
   try {
     directory = fs.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path2.join(fast.common, "workit"),
+      dir: path3.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -7074,13 +7361,13 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path2.join(real(path2.resolve(root, common)), "workit"),
+      dir: path3.join(real(path3.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path2.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
@@ -7095,22 +7382,22 @@ function childSessionId(lead, child) {
 }
 
 // packages/workit-core/src/core/package-root.ts
-import { existsSync } from "node:fs";
-import path3 from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import path4 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path3.dirname(fileURLToPath(import.meta.url));
+  let dir = path4.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path3.dirname(dir);
-    if (existsSync(path3.join(dir, "package.json")) || parent === dir)
+    const parent = path4.dirname(dir);
+    if (existsSync2(path4.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
 };
 var assetRoot = () => {
   const root = packageRoot();
-  const assets = path3.join(root, "assets");
-  return existsSync(assets) ? assets : root;
+  const assets = path4.join(root, "assets");
+  return existsSync2(assets) ? assets : root;
 };
 
 // packages/workit-core/src/core/store-lock.ts
@@ -7162,41 +7449,139 @@ var STALE_TEMPORARY_MS = 60 * 60000;
 var origins = new Map;
 var heldInProcess = new Map;
 // packages/workit-core/src/ledger.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash3, randomBytes } from "node:crypto";
 import fs3 from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
+
+// packages/workit-core/src/core/policy/substance.ts
+var SLASH_BLOCK = [["/*", "*/"]];
+var C_LIKE = { line: ["//"], block: SLASH_BLOCK, quotes: `"'` };
+var SYNTAXES = Object.fromEntries([
+  ...["ts", "mts", "cts", "js", "mjs", "cjs"].map((ext) => [ext, { ...C_LIKE, js: true }]),
+  ...["java", "kt", "kts", "scala", "swift", "dart", "groovy"].map((ext) => [
+    ext,
+    { ...C_LIKE, triple: true }
+  ]),
+  ["go", { ...C_LIKE, rawBacktick: true }],
+  ...["css", "scss", "less"].map((ext) => [
+    ext,
+    { line: [], block: SLASH_BLOCK, quotes: `"'`, cssUrl: true }
+  ]),
+  ...["py", "pyi"].map((ext) => [
+    ext,
+    { line: ["#"], block: [], quotes: `"'`, triple: true, indented: true, fstring: true }
+  ]),
+  ["toml", { line: ["#"], block: [], quotes: `"`, literal: "'", triple: true }],
+  ...["html", "htm", "xml", "svg", "xhtml"].map((ext) => [
+    ext,
+    { line: [], block: [["<!--", "-->"]], quotes: "", indented: true }
+  ])
+]);
+var REGEX_KEYWORDS = new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "case",
+  "do",
+  "else",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "throw",
+  "yield",
+  "await"
+]);
+var decoder = new TextDecoder("utf-8", { fatal: true });
+
+// packages/workit-core/src/core/policy/lane.ts
+var RISK_TOKENS = new Set([
+  "auth",
+  "authn",
+  "authz",
+  "oauth",
+  "security",
+  "permission",
+  "permissions",
+  "secret",
+  "secrets",
+  "crypto",
+  "gate",
+  "gates",
+  "policy",
+  "policies",
+  "hook",
+  "hooks",
+  "husky",
+  "lefthook",
+  "release",
+  "releases",
+  "migration",
+  "migrations",
+  "migrate",
+  "workflows"
+]);
+var RISK_FILES = new Set([
+  ".gitlab-ci.yml",
+  "Jenkinsfile",
+  "azure-pipelines.yml",
+  ".pre-commit-config.yaml",
+  ".workit/risk-paths"
+]);
+var RISK_NAMES = new Set([".gitattributes"]);
+var LOCKFILES = new Set([
+  "bun.lock",
+  "bun.lockb",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "Cargo.lock",
+  "go.sum",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Gemfile.lock",
+  "composer.lock"
+]);
+var globCache = new Map;
+var REGULAR = new Set(["100644", "100755"]);
+
+// packages/workit-core/src/core/policy/carry.ts
+var TEST_ONLY_KINDS = new Set(["doc", "cosmetic", "generated", "test"]);
 
 // packages/workit-core/src/hooks/standing-signal.ts
 import { createHash as createHash2 } from "node:crypto";
 import fs2 from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 var gitStoreDir = (cwd) => {
   try {
-    for (let dir = path4.resolve(cwd);; dir = path4.dirname(dir)) {
-      const dotGit = path4.join(dir, ".git");
+    for (let dir = path5.resolve(cwd);; dir = path5.dirname(dir)) {
+      const dotGit = path5.join(dir, ".git");
       if (fs2.existsSync(dotGit)) {
         let gitDir = dotGit;
         if (fs2.statSync(dotGit).isFile()) {
           const target = /^gitdir:\s*(.+)$/mu.exec(fs2.readFileSync(dotGit, "utf8"))?.[1]?.trim();
           if (!target)
             return null;
-          gitDir = path4.resolve(dir, target);
-          const common = path4.join(gitDir, "commondir");
+          gitDir = path5.resolve(dir, target);
+          const common = path5.join(gitDir, "commondir");
           if (fs2.existsSync(common))
-            gitDir = path4.resolve(gitDir, fs2.readFileSync(common, "utf8").trim());
+            gitDir = path5.resolve(gitDir, fs2.readFileSync(common, "utf8").trim());
         }
-        return path4.join(gitDir, "workit");
+        return path5.join(gitDir, "workit");
       }
-      if (path4.dirname(dir) === dir)
+      if (path5.dirname(dir) === dir)
         return null;
     }
   } catch {
     return null;
   }
 };
-var standingRevFile = (store) => path4.join(store, "standing", "rev");
-var standingSeenFile = (store, session, agentId) => path4.join(store, "standing", "seen", `${createHash2("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`);
+var standingRevFile = (store) => path5.join(store, "standing", "rev");
+var standingSeenFile = (store, session, agentId) => path5.join(store, "standing", "seen", `${createHash2("sha256").update(`${session}\x00${agentId ?? ""}`).digest("hex").slice(0, 32)}.json`);
 var readStandingRev = (store) => {
   try {
     return fs2.readFileSync(standingRevFile(store), "utf8").trim() || null;
@@ -7206,7 +7591,7 @@ var readStandingRev = (store) => {
 };
 var writeStandingSeen = (file, seen) => {
   try {
-    fs2.mkdirSync(path4.dirname(file), { recursive: true });
+    fs2.mkdirSync(path5.dirname(file), { recursive: true });
     fs2.writeFileSync(file, JSON.stringify(seen));
   } catch {}
 };
@@ -7229,7 +7614,7 @@ var err = (code, error, unblock) => ({
   ...unblock ? { unblock } : {}
 });
 var gitRun2 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync3("git", args, {
+  const run = spawnSync4("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -7257,14 +7642,14 @@ var git2 = (cwd, args) => {
 };
 var safeRef = (value) => value.length > 0 && !value.startsWith("-");
 function storeRoot(cwd) {
-  const location = resolveStore(path5.resolve(cwd));
+  const location = resolveStore(path6.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path5.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path6.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 var NETWORK_FS_TYPES = new Set([
   26985,
@@ -7506,6 +7891,7 @@ var SHELL_VOUCHED_HOSTS = new Set([
   "codex_cli",
   "codex_desktop"
 ]);
+var restackExact = new WeakMap;
 var fromLead = (row, leads) => leads === null || row.actor.session !== null && leads.includes(row.actor.session);
 function activeStanding(rows, fanout, leads = null) {
   const active = [];
@@ -7534,109 +7920,6 @@ var OBSERVED_ONLY = new Set([
   "policy.judged",
   ...PR_ROW_TYPES
 ]);
-// packages/workit-core/src/forge/redact.ts
-var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
-var ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
-var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
-var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
-
-// packages/workit-core/src/git/ops.ts
-var COMMIT_TIMEOUT_MS = 10 * 60000;
-
-// packages/workit-core/src/core/policy/substance.ts
-var SLASH_BLOCK = [["/*", "*/"]];
-var C_LIKE = { line: ["//"], block: SLASH_BLOCK, quotes: `"'` };
-var SYNTAXES = Object.fromEntries([
-  ...["ts", "mts", "cts", "js", "mjs", "cjs"].map((ext) => [ext, { ...C_LIKE, js: true }]),
-  ...["java", "kt", "kts", "scala", "swift", "dart", "groovy"].map((ext) => [
-    ext,
-    { ...C_LIKE, triple: true }
-  ]),
-  ["go", { ...C_LIKE, rawBacktick: true }],
-  ...["css", "scss", "less"].map((ext) => [
-    ext,
-    { line: [], block: SLASH_BLOCK, quotes: `"'`, cssUrl: true }
-  ]),
-  ...["py", "pyi"].map((ext) => [
-    ext,
-    { line: ["#"], block: [], quotes: `"'`, triple: true, indented: true, fstring: true }
-  ]),
-  ["toml", { line: ["#"], block: [], quotes: `"`, literal: "'", triple: true }],
-  ...["html", "htm", "xml", "svg", "xhtml"].map((ext) => [
-    ext,
-    { line: [], block: [["<!--", "-->"]], quotes: "", indented: true }
-  ])
-]);
-var REGEX_KEYWORDS = new Set([
-  "return",
-  "typeof",
-  "instanceof",
-  "case",
-  "do",
-  "else",
-  "in",
-  "of",
-  "new",
-  "delete",
-  "void",
-  "throw",
-  "yield",
-  "await"
-]);
-var decoder = new TextDecoder("utf-8", { fatal: true });
-
-// packages/workit-core/src/core/policy/lane.ts
-var RISK_TOKENS = new Set([
-  "auth",
-  "authn",
-  "authz",
-  "oauth",
-  "security",
-  "permission",
-  "permissions",
-  "secret",
-  "secrets",
-  "crypto",
-  "gate",
-  "gates",
-  "policy",
-  "policies",
-  "hook",
-  "hooks",
-  "husky",
-  "lefthook",
-  "release",
-  "releases",
-  "migration",
-  "migrations",
-  "migrate",
-  "workflows"
-]);
-var RISK_FILES = new Set([
-  ".gitlab-ci.yml",
-  "Jenkinsfile",
-  "azure-pipelines.yml",
-  ".pre-commit-config.yaml",
-  ".workit/risk-paths"
-]);
-var RISK_NAMES = new Set([".gitattributes"]);
-var LOCKFILES = new Set([
-  "bun.lock",
-  "bun.lockb",
-  "package-lock.json",
-  "npm-shrinkwrap.json",
-  "yarn.lock",
-  "pnpm-lock.yaml",
-  "Cargo.lock",
-  "go.sum",
-  "poetry.lock",
-  "uv.lock",
-  "Pipfile.lock",
-  "Gemfile.lock",
-  "composer.lock"
-]);
-var globCache = new Map;
-var REGULAR = new Set(["100644", "100755"]);
 // packages/workit-core/src/hooks/raw-git.ts
 var SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "mksh", "yash", "fish"]);
 var POWERSHELLS = new Set(["pwsh", "powershell"]);
@@ -7825,11 +8108,97 @@ var contextReadSchema = object({
   planPath: string2().optional(),
   cwd: string2().min(1).optional()
 }).strict();
+// packages/workit-core/src/core/role-models.ts
+var MODEL_ROLES = [
+  "decider",
+  "implementer",
+  "verifier",
+  "reviewer",
+  "explore",
+  "babysit"
+];
+var MODEL_TIERS = ["mundane", "standard", "hard"];
+var HOST_KEYS = new Set([
+  "claude_code",
+  "opencode",
+  "codex",
+  "codex_cli",
+  "codex_desktop",
+  "cursor",
+  "pi",
+  "default"
+]);
+var BUILT_IN_CLAUDE_CODE = {
+  decider: { model: "fable", effort: "high" },
+  "implementer.hard": { model: "opus" },
+  "implementer.standard": { model: "sonnet" },
+  "implementer.mundane": { model: "haiku" },
+  verifier: { model: "sonnet" },
+  reviewer: { model: "opus" },
+  explore: { model: "haiku" },
+  babysit: { model: "haiku" }
+};
+var isObject2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var name = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+var leaf = (value) => {
+  const text = name(value);
+  if (text)
+    return { model: text, effort: null };
+  if (!isObject2(value))
+    return null;
+  const model = name(value.model);
+  return model ? { model, effort: name(value.effort) } : null;
+};
+var isFlat = (value) => typeof value === "string" || isObject2(value) && Object.hasOwn(value, "model");
+var forHost = (value, host) => {
+  if (isFlat(value))
+    return leaf(value);
+  if (!isObject2(value))
+    return null;
+  const family = host ? hostFamily(host) : null;
+  for (const key of [family, host, "default"])
+    if (key && Object.hasOwn(value, key)) {
+      const found = leaf(value[key]);
+      if (found)
+        return found;
+    }
+  return null;
+};
+var rolesOf = (models) => isObject2(models) && isObject2(models.roles) ? models.roles : null;
+var resolveRoleModel = (cwd, selector, host, dir) => {
+  const { role, tier } = selector;
+  for (const source of modelSources(cwd, dir)) {
+    const where = source.global ? "the global default" : `workspace ${source.name}`;
+    const roles = rolesOf(source.models);
+    const configured = roles && Object.hasOwn(roles, role) ? roles[role] : undefined;
+    const fromRoles = role === "implementer" ? tier && isObject2(configured) && Object.hasOwn(configured, tier) ? forHost(configured[tier], host) : null : forHost(configured, host);
+    if (fromRoles)
+      return { ...fromRoles, source: `models.roles in ${where}` };
+    if (role === "implementer" && tier && isObject2(source.tierModels)) {
+      const fromTiers = Object.hasOwn(source.tierModels, tier) ? forHost(source.tierModels[tier], host) : null;
+      if (fromTiers)
+        return { model: fromTiers.model, effort: null, source: `fanout.tierModels in ${where}` };
+    }
+  }
+  if (host && hostFamily(host) === "claude_code") {
+    const builtIn = BUILT_IN_CLAUDE_CODE[tier ? `${role}.${tier}` : role];
+    if (builtIn)
+      return { model: builtIn.model, effort: builtIn.effort ?? null, source: "built-in" };
+  }
+  return null;
+};
+var uniformImplementerModel = (cwd, host, dir) => {
+  const tiers = MODEL_TIERS.map((tier) => resolveRoleModel(cwd, { role: "implementer", tier }, host, dir));
+  const [first] = tiers;
+  return first && tiers.every((t) => t?.model === first.model && t.effort === first.effort) ? first : null;
+};
+var ROLE_SELECTORS = MODEL_ROLES.flatMap((role) => role === "implementer" ? MODEL_TIERS.map((tier) => ({ role, tier })) : [{ role }]);
+
 // packages/workit-core/src/hooks/standing.ts
 import fs4 from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 var readPlans = (store) => {
-  const dir = path6.join(store, "fanouts");
+  const dir = path7.join(store, "fanouts");
   let names;
   try {
     names = fs4.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -7839,7 +8208,7 @@ var readPlans = (store) => {
   const plans = [];
   for (const name of names) {
     try {
-      const raw = JSON.parse(fs4.readFileSync(path6.join(dir, name), "utf8"));
+      const raw = JSON.parse(fs4.readFileSync(path7.join(dir, name), "utf8"));
       if (typeof raw.name !== "string" || !Array.isArray(raw.slices))
         continue;
       const texts = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
@@ -7966,7 +8335,9 @@ var roleTools = (role) => {
     return [...readOnly, "write", "edit", ...familyTools];
   return [...readOnly, ...familyTools];
 };
+var roleModel = (cwd, role) => role === "implementer" ? uniformImplementerModel(cwd, "pi") : resolveRoleModel(cwd, { role: role === "investigator" ? "explore" : "reviewer" }, "pi");
 function workerCommand(runtime, assignment) {
+  const configured = roleModel(runtime.root, assignment.role);
   return {
     command: runtime.node,
     args: [
@@ -7977,6 +8348,8 @@ function workerCommand(runtime, assignment) {
       ...runtime.sessionId ? ["--session-id", runtime.sessionId] : [],
       "--approve",
       "--offline",
+      ...configured ? ["--model", configured.model] : [],
+      ...configured?.effort ? ["--thinking", configured.effort] : [],
       "--no-context-files",
       "--tools",
       roleTools(assignment.role).join(","),