npm - @brainervirus/workit-pi - Versions diffs - 8.9.1 → 8.10.0 - Mend

@brainervirus/workit-pi 8.9.1 → 8.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/worker.js +10 -1
package/dist/workit.js +514 -464
package/package.json +1 -1
package/skills/workit-fanout/references/brief.md +1 -1
package/skills/workit-fanout/references/orchestration.md +16 -6
package/skills/workit-implement/SKILL.md +3 -2
package/skills/workit-review/SKILL.md +4 -2

package/dist/workit.js CHANGED Viewed

@@ -5,7 +5,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 // packages/workit-core/src/core.ts
 import { spawnSync as spawnSync14 } from "node:child_process";
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -8991,9 +8991,9 @@ function parseAdvertisedOperation(family, input, host) {
   });
 }
 // packages/workit-core/src/core/task-store.ts
-import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
-import * as fs7 from "node:fs";
-import path6 from "node:path";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
+import * as fs8 from "node:fs";
+import path7 from "node:path";
 // node_modules/@openclaw/fs-safe/dist/errors.js
 var OPERATIONAL_CODES = new Set([
@@ -9597,63 +9597,15 @@ function acquireFileLockSync(targetPath, options) {
   }
 }
 // packages/workit-core/src/host-session.ts
-var HOST_SESSION_VARS = [
-  ["OPENCODE_SESSION_ID", () => "opencode"],
-  ["PI_SESSION_ID", () => "pi"],
-  [
-    "CODEX_THREAD_ID",
-    (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
-  ]
-];
-var family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
-function hostSessionFromEnv(env) {
-  const value = (key) => env[key]?.trim() || null;
-  let inner = null;
-  for (const [key, host] of HOST_SESSION_VARS) {
-    const session = value(key);
-    if (session) {
-      inner = { host: host(env), session };
-      break;
-    }
-  }
-  const declared = value("WORKIT_HOST");
-  if (env.WORKIT_SESSION_ID !== undefined) {
-    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
-    if (!inherited)
-      return { host: declared, session: value("WORKIT_SESSION_ID") };
-  }
-  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
-}
-// packages/workit-core/src/core/package-root.ts
-import { existsSync } from "node:fs";
-import path3 from "node:path";
-import { fileURLToPath } from "node:url";
-var packageRoot = () => {
-  let dir = path3.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const parent = path3.dirname(dir);
-    if (existsSync(path3.join(dir, "package.json")) || parent === dir)
-      return dir;
-    dir = parent;
-  }
-};
-var assetRoot = () => {
-  const root = packageRoot();
-  const assets = path3.join(root, "assets");
-  return existsSync(assets) ? assets : root;
-};
-// packages/workit-core/src/core/store-lock.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
 import fs5 from "node:fs";
-import { hostname } from "node:os";
+import path4 from "node:path";
 // packages/workit-core/src/store/paths.ts
 import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import fs4 from "node:fs";
-import path4 from "node:path";
+import path3 from "node:path";
 var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
 var gitRun = (cwd, args) => {
   const run = spawnSync("git", args, {
@@ -9695,14 +9647,14 @@ var DISCOVERY_ENV = [
 ];
 var isGitDir = (dir) => {
   try {
-    return fs4.statSync(path4.join(dir, "HEAD")).isFile() && fs4.statSync(path4.join(dir, "objects")).isDirectory() && fs4.statSync(path4.join(dir, "refs")).isDirectory();
+    return fs4.statSync(path3.join(dir, "HEAD")).isFile() && fs4.statSync(path3.join(dir, "objects")).isDirectory() && fs4.statSync(path3.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 };
 var reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs4.readFileSync(path4.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs4.readFileSync(path3.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
@@ -9722,7 +9674,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path4.join(dir, ".git");
+    const dotGit = path3.join(dir, ".git");
     let entry = null;
     try {
       entry = fs4.statSync(dotGit);
@@ -9743,19 +9695,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path4.resolve(dir, match[1].trim());
+        gitDir = path3.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs4.existsSync(path4.join(gitDir, "HEAD")))
+      if (!fs4.existsSync(path3.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path4.resolve(gitDir, fs4.readFileSync(path4.join(gitDir, "commondir"), "utf8").trim());
+        common = path3.resolve(gitDir, fs4.readFileSync(path3.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs4.existsSync(path4.join(common, "objects")))
+      if (!fs4.existsSync(path3.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -9765,26 +9717,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path4.dirname(dir);
+    const parent = path3.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path4.resolve(root);
+  root = path3.resolve(root);
   let directory = false;
   try {
     directory = fs4.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path4.join(fast.common, "workit"),
+      dir: path3.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -9794,20 +9746,20 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path4.join(real(path4.resolve(root, common)), "workit"),
+      dir: path3.join(real(path3.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
 var rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs4.readFileSync(path4.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs4.readFileSync(path3.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -9822,7 +9774,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs4.readFileSync(path4.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs4.readFileSync(path3.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -9853,7 +9805,7 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path4.resolve(root);
+  const resolved = path3.resolve(root);
   let canonical = resolved;
   try {
     canonical = fs4.realpathSync(resolved);
@@ -9884,13 +9836,13 @@ function branchRenames(location) {
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path4.join(dir, entry.name));
+        walk(path3.join(dir, entry.name));
       else
-        files.push(path4.join(dir, entry.name));
+        files.push(path3.join(dir, entry.name));
   };
-  walk(path4.join(path4.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path3.join(path3.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path4.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path3.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
@@ -9925,11 +9877,96 @@ var checkoutSlug = (root) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path4.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path3.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
+// packages/workit-core/src/host-session.ts
+var HOST_SESSION_VARS = [
+  ["OPENCODE_SESSION_ID", () => "opencode"],
+  ["PI_SESSION_ID", () => "pi"],
+  [
+    "CODEX_THREAD_ID",
+    (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
+  ]
+];
+var family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
+function hostSessionFromEnv(env) {
+  const value = (key) => env[key]?.trim() || null;
+  let inner = null;
+  for (const [key, host] of HOST_SESSION_VARS) {
+    const session = value(key);
+    if (session) {
+      inner = { host: host(env), session };
+      break;
+    }
+  }
+  const declared = value("WORKIT_HOST");
+  if (env.WORKIT_SESSION_ID !== undefined) {
+    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
+    if (!inherited)
+      return { host: declared, session: value("WORKIT_SESSION_ID") };
+  }
+  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
+}
+var ISSUED_PER_LEAD = 64;
+var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/1";
+var hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32);
+var issuedRoot = (cwd) => {
+  const location = resolveStore(cwd);
+  return location instanceof Error ? null : path4.join(location.dir, "hooks", "issued");
+};
+var issuedDir = (cwd, lead) => {
+  const root = issuedRoot(cwd);
+  return root === null ? null : path4.join(root, hash(lead));
+};
+function recordIssuedSession(cwd, lead, issued) {
+  try {
+    const dir = issuedDir(cwd, lead);
+    if (!dir)
+      return;
+    fs5.mkdirSync(dir, { recursive: true });
+    const own = hash(issued);
+    fs5.writeFileSync(path4.join(dir, own), ISSUED_SESSIONS_MARKER);
+    const entries = fs5.readdirSync(dir);
+    if (entries.length <= ISSUED_PER_LEAD)
+      return;
+    const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs5.statSync(path4.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
+      fs5.rmSync(path4.join(dir, name), { force: true });
+  } catch {}
+}
+var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
+var SESSION_UNSAFE = /[^A-Za-z0-9_.:@/+-]/g;
+function childSessionId(lead, child) {
+  const leaf = child.replace(SESSION_UNSAFE, "-").slice(-120);
+  const prefix = lead.replace(SESSION_UNSAFE, "-").slice(0, 127 - leaf.length);
+  return prefix ? `${prefix}:${leaf}` : leaf;
+}
+// packages/workit-core/src/core/package-root.ts
+import { existsSync } from "node:fs";
+import path5 from "node:path";
+import { fileURLToPath } from "node:url";
+var packageRoot = () => {
+  let dir = path5.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const parent = path5.dirname(dir);
+    if (existsSync(path5.join(dir, "package.json")) || parent === dir)
+      return dir;
+    dir = parent;
+  }
+};
+var assetRoot = () => {
+  const root = packageRoot();
+  const assets = path5.join(root, "assets");
+  return existsSync(assets) ? assets : root;
+};
 // packages/workit-core/src/core/store-lock.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import fs6 from "node:fs";
+import { hostname } from "node:os";
 var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
   processStart: string2().nullable(),
@@ -9970,7 +10007,7 @@ var parseProcStatStart = (stat) => {
 var processStartOf = (pid) => {
   if (process.platform === "linux") {
     try {
-      return parseProcStatStart(fs5.readFileSync(`/proc/${pid}/stat`, "utf8"));
+      return parseProcStatStart(fs6.readFileSync(`/proc/${pid}/stat`, "utf8"));
     } catch {
       return null;
     }
@@ -9991,7 +10028,7 @@ var processStartOf = (pid) => {
 };
 var readTrimmed = (file) => {
   try {
-    return fs5.readFileSync(file, "utf8").trim() || null;
+    return fs6.readFileSync(file, "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -10002,7 +10039,7 @@ var localLockHost = () => {
     return cachedLockHost;
   let pidns = null;
   try {
-    pidns = /\[(\d+)\]/.exec(fs5.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
+    pidns = /\[(\d+)\]/.exec(fs6.readlinkSync("/proc/self/ns/pid"))?.[1] ?? null;
   } catch {}
   const boot = readTrimmed("/proc/sys/kernel/random/boot_id");
   cachedLockHost = pidns || boot ? `${hostname()}#${pidns ?? "?"}:${boot ?? "?"}` : hostname();
@@ -10048,7 +10085,7 @@ var classifyLockOwner = (payload, ageMs, localHost = localLockHost(), options =
 };
 var ageOf = (file, nowMs) => {
   try {
-    return nowMs - fs5.lstatSync(file).mtimeMs;
+    return nowMs - fs6.lstatSync(file).mtimeMs;
   } catch {
     return null;
   }
@@ -10059,7 +10096,7 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
   if (age === null || age <= RECLAIM_GUARD_TTL_MS)
     return false;
   try {
-    fs5.rmdirSync(guard);
+    fs6.rmdirSync(guard);
     return true;
   } catch {
     return false;
@@ -10068,8 +10105,8 @@ var clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs6 from "node:fs";
-import path5 from "node:path";
+import fs7 from "node:fs";
+import path6 from "node:path";
 var EVENT_VERSION = 1;
 class LogDamage extends Error {
@@ -10098,7 +10135,7 @@ var parseEvent = (line, file, offset) => {
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
-    fd = fs6.openSync(file, "r");
+    fd = fs7.openSync(file, "r");
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
@@ -10107,13 +10144,13 @@ function readLog(file, from = 0, expectSeq = null) {
   let bytes;
   let size;
   try {
-    size = fs6.fstatSync(fd).size;
+    size = fs7.fstatSync(fd).size;
     if (from > size)
       throw new LogDamage(`${file}: shorter than its snapshot`);
     bytes = Buffer.alloc(size - from);
     let read = 0;
     while (read < bytes.length) {
-      const got = fs6.readSync(fd, bytes, read, bytes.length - read, from + read);
+      const got = fs7.readSync(fd, bytes, read, bytes.length - read, from + read);
       if (got === 0)
         break;
       read += got;
@@ -10121,7 +10158,7 @@ function readLog(file, from = 0, expectSeq = null) {
     bytes = bytes.subarray(0, read);
     size = from + read;
   } finally {
-    fs6.closeSync(fd);
+    fs7.closeSync(fd);
   }
   const events = [];
   let start = 0;
@@ -10146,11 +10183,11 @@ function readLog(file, from = 0, expectSeq = null) {
 }
 var fsyncDirectory = (dir) => {
   try {
-    const fd = fs6.openSync(dir, "r");
+    const fd = fs7.openSync(dir, "r");
     try {
-      fs6.fsyncSync(fd);
+      fs7.fsyncSync(fd);
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
   } catch (error) {
     if (process.platform !== "win32")
@@ -10160,46 +10197,46 @@ var fsyncDirectory = (dir) => {
 function appendEvent(file, event, validEnd) {
   const line = Buffer.from(`${JSON.stringify(event)}
 `, "utf8");
-  const created = !fs6.existsSync(file);
-  if (!created && fs6.statSync(file).size !== validEnd) {
-    const cut = fs6.openSync(file, "r+");
+  const created = !fs7.existsSync(file);
+  if (!created && fs7.statSync(file).size !== validEnd) {
+    const cut = fs7.openSync(file, "r+");
     try {
-      fs6.ftruncateSync(cut, validEnd);
-      fs6.fsyncSync(cut);
+      fs7.ftruncateSync(cut, validEnd);
+      fs7.fsyncSync(cut);
     } finally {
-      fs6.closeSync(cut);
+      fs7.closeSync(cut);
     }
   }
-  const fd = fs6.openSync(file, "a", 384);
+  const fd = fs7.openSync(file, "a", 384);
   try {
     let written = 0;
     while (written < line.length)
-      written += fs6.writeSync(fd, line, written, line.length - written);
-    fs6.fsyncSync(fd);
+      written += fs7.writeSync(fd, line, written, line.length - written);
+    fs7.fsyncSync(fd);
   } finally {
-    fs6.closeSync(fd);
+    fs7.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path5.dirname(file));
+    fsyncDirectory(path6.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
   const temporary = `${file}.${process.pid}.${randomUUID2()}.tmp`;
   try {
-    const fd = fs6.openSync(temporary, "wx", 384);
+    const fd = fs7.openSync(temporary, "wx", 384);
     try {
-      fs6.writeSync(fd, bytes);
+      fs7.writeSync(fd, bytes);
       if (durable)
-        fs6.fsyncSync(fd);
+        fs7.fsyncSync(fd);
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path5.dirname(file));
+      fsyncDirectory(path6.dirname(file));
   } catch (error) {
     try {
-      fs6.unlinkSync(temporary);
+      fs7.unlinkSync(temporary);
     } catch {}
     throw error;
   }
@@ -10224,7 +10261,7 @@ var retryTransient = (run) => {
     }
   }
 };
-var renameWithRetry = (from, to) => retryTransient(() => fs6.renameSync(from, to));
+var renameWithRetry = (from, to) => retryTransient(() => fs7.renameSync(from, to));
 // packages/workit-core/src/store/patch.ts
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -10337,7 +10374,7 @@ var isPatch = (value) => Array.isArray(value) && value.every((op) => {
 });
 // packages/workit-core/src/store/reduce.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var OPENING_TYPES = new Set([
   "task.opened",
   "task.imported",
@@ -10366,7 +10403,7 @@ var isObject4 = (value) => typeof value === "object" && value !== null && !Array
 var isKey = (value) => isObject4(value) && typeof value.key === "string" && (value.kind === "branch" || value.kind === "detached" || value.kind === "dir") && (value.branch === null || typeof value.branch === "string");
 var BLOB_REF = "$blob";
 var blobRef = (value) => isObject4(value) && Object.keys(value).length === 1 && typeof value[BLOB_REF] === "string" && /^[0-9a-f]{64}$/.test(value[BLOB_REF]) ? value[BLOB_REF] : null;
-var blobDigest = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+var blobDigest = (value) => createHash4("sha256").update(JSON.stringify(value)).digest("hex");
 var toBlob = (value, blobs) => {
   if (!isObject4(value))
     return value;
@@ -10521,7 +10558,7 @@ var indexEntry = (task, key, legacy, file) => {
 };
 var fileSignature = (file) => {
   try {
-    const stat = fs7.statSync(file, { bigint: true });
+    const stat = fs8.statSync(file, { bigint: true });
     return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
   } catch {
     return null;
@@ -10539,7 +10576,7 @@ var cachedRuntimeVersion = null;
 var runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs7.readFileSync(path6.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs8.readFileSync(path7.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -10565,14 +10602,14 @@ var isNewerVersion = (candidate, current) => {
 var validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
 var readText = (file) => {
   try {
-    return fs7.readFileSync(file, "utf8");
+    return fs8.readFileSync(file, "utf8");
   } catch {
     return "";
   }
 };
 var REFLOG_LINE = /^[0-9a-f]+ ([0-9a-f]+) .* (\d+) [+-]\d{4}\t(.*)$/u;
 var branchStart = (location, branch, aliases) => {
-  const first = readText(path6.join(path6.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path7.join(path7.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -10582,7 +10619,7 @@ var branchStart = (location, branch, aliases) => {
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path6.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path7.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -10592,23 +10629,23 @@ var branchStart = (location, branch, aliases) => {
   }
   return null;
 };
-var refExists = (common, ref) => fs7.existsSync(path6.join(common, ref)) || readText(path6.join(common, "packed-refs")).includes(` ${ref}
+var refExists = (common, ref) => fs8.existsSync(path7.join(common, ref)) || readText(path7.join(common, "packed-refs")).includes(` ${ref}
 `);
 var origins = new Map;
 var sameDirectoryIdentity = (left, right) => {
-  if (!path6.isAbsolute(left) || !path6.isAbsolute(right))
+  if (!path7.isAbsolute(left) || !path7.isAbsolute(right))
     return false;
-  const normalizedLeft = path6.resolve(left);
-  const normalizedRight = path6.resolve(right);
+  const normalizedLeft = path7.resolve(left);
+  const normalizedRight = path7.resolve(right);
   try {
-    const a = fs7.statSync(normalizedLeft, { bigint: true });
-    const b = fs7.statSync(normalizedRight, { bigint: true });
+    const a = fs8.statSync(normalizedLeft, { bigint: true });
+    const b = fs8.statSync(normalizedRight, { bigint: true });
     if (!a.isDirectory() || !b.isDirectory())
       return false;
     if (process.platform === "win32" ? normalizedLeft.toLowerCase() === normalizedRight.toLowerCase() : normalizedLeft === normalizedRight)
       return true;
-    const canonicalLeft = fs7.realpathSync(normalizedLeft);
-    const canonicalRight = fs7.realpathSync(normalizedRight);
+    const canonicalLeft = fs8.realpathSync(normalizedLeft);
+    const canonicalRight = fs8.realpathSync(normalizedRight);
     if (process.platform === "win32" ? canonicalLeft.toLowerCase() === canonicalRight.toLowerCase() : canonicalLeft === canonicalRight)
       return true;
     return a.dev === b.dev && a.ino !== 0n && a.ino === b.ino;
@@ -10645,8 +10682,8 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path6.resolve(root);
-    this.origin = fs7.existsSync(resolved) ? fs7.realpathSync(resolved) : resolved;
+    const resolved = path7.resolve(root);
+    this.origin = fs8.existsSync(resolved) ? fs8.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
     this.lockTimeoutMs = options.lockTimeoutMs ?? defaultLockTimeout();
@@ -10654,7 +10691,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs7.existsSync(path6.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs8.existsSync(path7.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -10718,7 +10755,7 @@ class TaskStore {
     const tasksDir = this.paths().tasks;
     let names;
     try {
-      names = fs7.existsSync(tasksDir) ? fs7.readdirSync(tasksDir).filter((name) => validId(name)) : [];
+      names = fs8.existsSync(tasksDir) ? fs8.readdirSync(tasksDir).filter((name) => validId(name)) : [];
     } catch (error) {
       return failure2("storage_error", `unable to list tasks: ${String(error)}`, {
         path: tasksDir
@@ -10759,7 +10796,7 @@ class TaskStore {
     const file = this.paths().workspace;
     let bytes;
     try {
-      bytes = retryTransient(() => fs7.readFileSync(file, "utf8"));
+      bytes = retryTransient(() => fs8.readFileSync(file, "utf8"));
     } catch (error) {
       if (error.code === "ENOENT")
         return success(null, null, null);
@@ -10810,7 +10847,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path6.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path7.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -10870,14 +10907,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path6.dirname(location.data.dir);
-    const heads = path6.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path6.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path7.dirname(location.data.dir);
+    const heads = path7.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path7.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path6.join(heads, branch),
+      path7.join(heads, branch),
       headLog,
       heads,
-      path6.join(common, "packed-refs")
+      path7.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -10889,7 +10926,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path6.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path7.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -11127,13 +11164,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path6.join(this.root, ".workit", "recovery");
-    if (fs7.existsSync(recovery)) {
+    const recovery = path7.join(this.root, ".workit", "recovery");
+    if (fs8.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
-        for (const name of fs7.readdirSync(recovery)) {
-          const stat = fs7.lstatSync(path6.join(recovery, name));
+        for (const name of fs8.readdirSync(recovery)) {
+          const stat = fs8.lstatSync(path7.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -11142,17 +11179,17 @@ class TaskStore {
       } catch {}
       const remove = options.pruneRecovery === true && !dryRun;
       if (remove)
-        fs7.rmSync(recovery, { recursive: true, force: true });
+        fs8.rmSync(recovery, { recursive: true, force: true });
       report.legacyRecovery = { path: recovery, files, bytes, removed: remove };
     }
-    if (!fs7.existsSync(dirs.tasks))
+    if (!fs8.existsSync(dirs.tasks))
       return success(null, null, report);
-    const names = fs7.readdirSync(dirs.tasks).filter((name) => validId(name));
+    const names = fs8.readdirSync(dirs.tasks).filter((name) => validId(name));
     for (const name of names) {
       const file = this.eventsPath(name);
       let size = 0;
       try {
-        size = fs7.statSync(file).size;
+        size = fs8.statSync(file).size;
       } catch {
         continue;
       }
@@ -11180,16 +11217,16 @@ class TaskStore {
       const references = new Set;
       for (const name of names)
         try {
-          for (const match of fs7.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
+          for (const match of fs8.readFileSync(this.eventsPath(name), "utf8").matchAll(/"\$blob":"([0-9a-f]{64})"/g))
             references.add(match[1]);
         } catch {}
-      if (fs7.existsSync(dirs.blobs))
-        for (const name of fs7.readdirSync(dirs.blobs)) {
+      if (fs8.existsSync(dirs.blobs))
+        for (const name of fs8.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path6.join(dirs.blobs, name);
+          const file = path7.join(dirs.blobs, name);
           let stat;
           try {
-            stat = fs7.lstatSync(file);
+            stat = fs8.lstatSync(file);
           } catch {
             continue;
           }
@@ -11200,11 +11237,11 @@ class TaskStore {
           report.blobs.removed += 1;
           report.blobs.removedBytes += stat.size;
           if (!dryRun)
-            fs7.rmSync(file, { force: true });
+            fs8.rmSync(file, { force: true });
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path6.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path7.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -11212,17 +11249,17 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path6.join(dirs.tasks, name))
+      ...names.map((name) => path7.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
-      if (!fs7.existsSync(directory))
+      if (!fs8.existsSync(directory))
         continue;
-      for (const name of fs7.readdirSync(directory)) {
+      for (const name of fs8.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path6.join(directory, name);
+        const file = path7.join(directory, name);
         try {
-          const stat = fs7.lstatSync(file);
+          const stat = fs8.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
             continue;
         } catch {
@@ -11230,37 +11267,37 @@ class TaskStore {
         }
         report.temporary.removed += 1;
         if (!dryRun)
-          fs7.rmSync(file, { force: true });
+          fs8.rmSync(file, { force: true });
       }
     }
     return success(null, null, report);
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path6.join(this.root, ".workit");
-    const checkout = path6.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path7.join(this.root, ".workit");
+    const checkout = path7.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path6.join(dir, "store.json"),
+      marker: path7.join(dir, "store.json"),
       checkout,
-      workspace: path6.join(checkout, "workspace.json"),
-      checkoutLock: path6.join(checkout, "metadata.lock"),
-      tasks: path6.join(dir, "tasks"),
-      index: path6.join(dir, "task-index.json"),
-      blobs: path6.join(dir, "blobs", "candidates"),
-      legacy: path6.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path6.join(this.root, ".workit")
+      workspace: path7.join(checkout, "workspace.json"),
+      checkoutLock: path7.join(checkout, "metadata.lock"),
+      tasks: path7.join(dir, "tasks"),
+      index: path7.join(dir, "task-index.json"),
+      blobs: path7.join(dir, "blobs", "candidates"),
+      legacy: path7.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path7.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path6.join(this.paths().tasks, taskId, "events.jsonl");
+    return path7.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path6.join(this.paths().tasks, taskId, "snapshot.json");
+    return path7.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path6.join(this.paths().tasks, taskId, "lock");
+    return path7.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -11270,7 +11307,7 @@ class TaskStore {
       return success(null, null, null);
     const dirs = this.paths();
     try {
-      const marker = JSON.parse(fs7.readFileSync(dirs.marker, "utf8"));
+      const marker = JSON.parse(fs8.readFileSync(dirs.marker, "utf8"));
       if (typeof marker.version === "number" && marker.version > STORE_FORMAT)
         return failure2("recovery_required", `the workit store at ${dirs.dir} has format ${marker.version}; upgrade Workit to use it`, { path: dirs.marker });
     } catch {}
@@ -11299,21 +11336,21 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs7.readFileSync(path6.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs8.readFileSync(path7.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path6.join(dir, `${digest}.json`);
-        if (fs7.existsSync(file)) {
+        const file = path7.join(dir, `${digest}.json`);
+        if (fs8.existsSync(file)) {
           const stamp = new Date;
           try {
-            fs7.utimesSync(file, stamp, stamp);
+            fs8.utimesSync(file, stamp, stamp);
             return;
           } catch {}
         }
-        fs7.mkdirSync(dir, { recursive: true });
+        fs8.mkdirSync(dir, { recursive: true });
         replaceFile(file, JSON.stringify(value), true);
       }
     };
@@ -11395,7 +11432,7 @@ class TaskStore {
   }
   readSnapshot(taskId) {
     try {
-      const value = JSON.parse(fs7.readFileSync(this.snapshotPath(taskId), "utf8"));
+      const value = JSON.parse(fs8.readFileSync(this.snapshotPath(taskId), "utf8"));
       if (!isObject5(value) || value.v !== 1 || value.task !== taskId || typeof value.seq !== "number" || typeof value.lastId !== "string" || typeof value.lastStart !== "number" || typeof value.end !== "number" || !isObject5(value.record))
         return null;
       return value;
@@ -11497,8 +11534,8 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path6.join(this.paths().tasks, record.id);
-    fs7.mkdirSync(dir, { recursive: true });
+    const dir = path7.join(this.paths().tasks, record.id);
+    fs8.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
     const event = this.event(record.id, 1, type, {
@@ -11550,11 +11587,11 @@ class TaskStore {
         } catch {}
         if (!latest || latest.events[0]?.id !== last.id)
           return failure2("busy", "the task log changed during compaction; retry", { taskId });
-        const appended = fs7.readFileSync(file).subarray(log.end, latest.end);
+        const appended = fs8.readFileSync(file).subarray(log.end, latest.end);
         const bytes = Buffer.concat([Buffer.from(prefix, "utf8"), appended]);
         replaceFile(file, bytes.toString("utf8"), true);
         try {
-          fs7.rmSync(this.snapshotPath(taskId), { force: true });
+          fs8.rmSync(this.snapshotPath(taskId), { force: true });
         } catch {}
         const reloaded = this.load(taskId);
         if (reloaded.ok && reloaded.data)
@@ -11567,7 +11604,7 @@ class TaskStore {
   }
   countEvents(file) {
     try {
-      const bytes = fs7.readFileSync(file);
+      const bytes = fs8.readFileSync(file);
       let count = 0;
       for (let index = bytes.indexOf(10);index >= 0; index = bytes.indexOf(10, index + 1))
         count += 1;
@@ -11589,8 +11626,8 @@ class TaskStore {
     return bound.ok ? success(null, null, bound.data[0] ?? null) : bound;
   }
   withKeyLock(key, operation) {
-    const digest = createHash4("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path6.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    const digest = createHash5("sha256").update(key).digest("hex").slice(0, 32);
+    return this.withLock(path7.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -11731,7 +11768,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs7.mkdirSync(path6.dirname(file), { recursive: true });
+      fs8.mkdirSync(path7.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -11741,7 +11778,7 @@ class TaskStore {
   }
   readIndex() {
     try {
-      const value = JSON.parse(fs7.readFileSync(this.paths().index, "utf8"));
+      const value = JSON.parse(fs8.readFileSync(this.paths().index, "utf8"));
       if (!isObject5(value) || value.version !== INDEX_VERSION || !isObject5(value.tasks))
         return {};
       const tasks = {};
@@ -11755,7 +11792,7 @@ class TaskStore {
   }
   writeIndex(entries) {
     try {
-      fs7.mkdirSync(this.paths().tasks, { recursive: true });
+      fs8.mkdirSync(this.paths().tasks, { recursive: true });
       replaceFile(this.paths().index, JSON.stringify({
         version: INDEX_VERSION,
         tasks: Object.fromEntries(entries.map((entry) => [entry.id, entry]))
@@ -11809,23 +11846,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path6.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path7.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path6.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path7.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path6.join(v2, "workspace.json");
-    const v2Tasks = path6.join(v2, "tasks");
-    const legacy = path6.join(dirs.dir, "legacy", checkoutSlug(path6.dirname(v2)), "v2");
+    const v2Workspace = path7.join(v2, "workspace.json");
+    const v2Tasks = path7.join(v2, "tasks");
+    const legacy = path7.join(dirs.dir, "legacy", checkoutSlug(path7.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path6.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path7.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -11834,7 +11871,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs7.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path6.join(v2Tasks, name)));
+        files = fs8.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path7.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -11852,22 +11889,22 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs7.mkdirSync(path6.join(legacy, "tasks"), { recursive: true });
+        fs8.mkdirSync(path7.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs7.existsSync(path6.join(v2, name)))
-            fs7.copyFileSync(path6.join(v2, name), path6.join(legacy, name));
+          if (fs8.existsSync(path7.join(v2, name)))
+            fs8.copyFileSync(path7.join(v2, name), path7.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path6.join(v2Tasks, name);
-          const bytes = fs7.readFileSync(file, "utf8");
+          const file = path7.join(v2Tasks, name);
+          const bytes = fs8.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs7.writeFileSync(path6.join(legacy, "tasks", name), bytes);
+          fs8.writeFileSync(path7.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path6.join(legacy, "tasks", name), digest };
-          if (!fs7.existsSync(this.eventsPath(id))) {
+          const origin = { path: path7.join(legacy, "tasks", name), digest };
+          if (!fs8.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
           } else {
@@ -11902,8 +11939,8 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path6.join(v2Tasks, name);
-          if (sha256(fs7.readFileSync(file, "utf8")) !== digest) {
+          const file = path7.join(v2Tasks, name);
+          if (sha256(fs8.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
           }
@@ -11913,7 +11950,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs7.rmSync(path6.join(v2, "index.json"), { force: true });
+        fs8.rmSync(path7.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -11933,45 +11970,45 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path6.join(dirs.v2, "store.json");
-    if (!dirs.shared || !fs7.existsSync(marker))
+    const marker = path7.join(dirs.v2, "store.json");
+    if (!dirs.shared || !fs8.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
-      if (!fs7.existsSync(marker))
+      if (!fs8.existsSync(marker))
         return success(null, null, null);
       let tasks = 0;
       try {
         const merge = (from, to) => {
-          if (!fs7.existsSync(to)) {
-            fs7.mkdirSync(path6.dirname(to), { recursive: true });
+          if (!fs8.existsSync(to)) {
+            fs8.mkdirSync(path7.dirname(to), { recursive: true });
             try {
-              fs7.renameSync(from, to);
+              fs8.renameSync(from, to);
             } catch {
-              fs7.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
-              fs7.rmSync(from, { recursive: true, force: true });
+              fs8.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });
+              fs8.rmSync(from, { recursive: true, force: true });
             }
             return;
           }
-          if (fs7.lstatSync(from).isDirectory() && fs7.lstatSync(to).isDirectory())
-            for (const name of fs7.readdirSync(from))
-              merge(path6.join(from, name), path6.join(to, name));
+          if (fs8.lstatSync(from).isDirectory() && fs8.lstatSync(to).isDirectory())
+            for (const name of fs8.readdirSync(from))
+              merge(path7.join(from, name), path7.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path6.join(dirs.v2, sub);
-          if (!fs7.existsSync(from))
+          const from = path7.join(dirs.v2, sub);
+          if (!fs8.existsSync(from))
             continue;
           if (sub === "tasks") {
-            for (const name of fs7.readdirSync(from))
-              if (validId(name) && !fs7.existsSync(path6.join(dirs.dir, sub, name)))
+            for (const name of fs8.readdirSync(from))
+              if (validId(name) && !fs8.existsSync(path7.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path6.join(dirs.dir, sub));
+          merge(from, path7.join(dirs.dir, sub));
         }
-        const ledger = path6.join(dirs.v2, "ledger");
-        if (fs7.existsSync(ledger) && !fs7.existsSync(path6.join(dirs.dir, "ledger")))
-          merge(ledger, path6.join(dirs.dir, "ledger"));
-        fs7.rmSync(path6.join(dirs.v2, "task-index.json"), { force: true });
-        fs7.renameSync(marker, path6.join(dirs.v2, "store.moved.json"));
+        const ledger = path7.join(dirs.v2, "ledger");
+        if (fs8.existsSync(ledger) && !fs8.existsSync(path7.join(dirs.dir, "ledger")))
+          merge(ledger, path7.join(dirs.dir, "ledger"));
+        fs8.rmSync(path7.join(dirs.v2, "task-index.json"), { force: true });
+        fs8.renameSync(marker, path7.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -11991,7 +12028,7 @@ class TaskStore {
   readV2Workspace(file) {
     let bytes;
     try {
-      bytes = fs7.readFileSync(file, "utf8");
+      bytes = fs8.readFileSync(file, "utf8");
     } catch {
       return null;
     }
@@ -12009,7 +12046,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path6.dirname(v2),
+      root: path7.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -12020,12 +12057,12 @@ class TaskStore {
       },
       critical: ["store"]
     };
-    fs7.mkdirSync(v2, { recursive: true });
-    const ignore = path6.join(v2, ".gitignore");
-    if (!fs7.existsSync(ignore))
-      fs7.writeFileSync(ignore, `*
+    fs8.mkdirSync(v2, { recursive: true });
+    const ignore = path7.join(v2, ".gitignore");
+    if (!fs8.existsSync(ignore))
+      fs8.writeFileSync(ignore, `*
 `);
-    replaceFile(path6.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path7.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -12041,7 +12078,7 @@ class TaskStore {
   }
   isStub(file) {
     try {
-      const value = JSON.parse(fs7.readFileSync(file, "utf8"));
+      const value = JSON.parse(fs8.readFileSync(file, "utf8"));
       return isObject5(value) && isObject5(value.store) && value.store.format === "workit-store";
     } catch {
       return false;
@@ -12049,32 +12086,32 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path6.join(this.root, ".workit");
-      if (fs7.existsSync(path6.join(v2, "workspace.json")))
+      const v2 = path7.join(this.root, ".workit");
+      if (fs8.existsSync(path7.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
-        id = JSON.parse(fs7.readFileSync(this.paths().workspace, "utf8")).id ?? null;
+        id = JSON.parse(fs8.readFileSync(this.paths().workspace, "utf8")).id ?? null;
       } catch {}
       this.writeTombstone(v2, id);
     } catch {}
   }
   initializeStorage() {
     const dirs = this.paths();
-    retryTransient(() => fs7.mkdirSync(dirs.checkout, { recursive: true }));
-    retryTransient(() => fs7.mkdirSync(dirs.tasks, { recursive: true }));
-    if (!fs7.existsSync(dirs.marker))
+    retryTransient(() => fs8.mkdirSync(dirs.checkout, { recursive: true }));
+    retryTransient(() => fs8.mkdirSync(dirs.tasks, { recursive: true }));
+    if (!fs8.existsSync(dirs.marker))
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path6.join(dirs.dir, ".gitignore");
+      const ignore = path7.join(dirs.dir, ".gitignore");
       let current = null;
       try {
-        current = fs7.readFileSync(ignore, "utf8");
+        current = fs8.readFileSync(ignore, "utf8");
       } catch {}
       if (current !== `*
 `)
-        retryTransient(() => fs7.writeFileSync(ignore, `*
+        retryTransient(() => fs8.writeFileSync(ignore, `*
 `));
     }
     this.writeTombstoneIfMissing();
@@ -12090,7 +12127,7 @@ class TaskStore {
       shouldReclaim: ({ payload, nowMs }) => {
         let ageMs = null;
         try {
-          ageMs = nowMs - fs7.lstatSync(lockPath).mtimeMs;
+          ageMs = nowMs - fs8.lstatSync(lockPath).mtimeMs;
         } catch {}
         return classifyLockOwner(payload, ageMs, localLockHost(), TASK_STORE_LOCK).state === "stale";
       },
@@ -12127,7 +12164,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs7.mkdirSync(path6.dirname(lockPath), { recursive: true });
+      fs8.mkdirSync(path7.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -12167,18 +12204,18 @@ class TaskStore {
   lockDirWritable(lockPath) {
     const probe = `${lockPath}.${process.pid}.${randomUUID3()}.probe`;
     try {
-      fs7.closeSync(fs7.openSync(probe, "wx", 384));
+      fs8.closeSync(fs8.openSync(probe, "wx", 384));
     } catch {
       return false;
     }
     try {
-      fs7.rmSync(probe, { force: true });
+      fs8.rmSync(probe, { force: true });
     } catch {}
     return true;
   }
   lockHolderPresent(lockPath) {
     try {
-      fs7.lstatSync(lockPath);
+      fs8.lstatSync(lockPath);
       return true;
     } catch (error) {
       return error?.code !== "ENOENT";
@@ -12190,12 +12227,12 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path6.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path7.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
       try {
-        lock = parseMetadataLockOrNull(fs7.readFileSync(lockPath, "utf8"));
+        lock = parseMetadataLockOrNull(fs8.readFileSync(lockPath, "utf8"));
       } catch {}
       return failure2("busy", `workit lock is held by another Workit call${lock ? ` (pid ${lock.pid} on ${lock.host})` : ""}; retry shortly`, {
         outcome: "not_started",
@@ -12213,15 +12250,15 @@ var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
 // packages/workit-core/src/core/task-evaluation.ts
-import { createHash as createHash9 } from "node:crypto";
-import * as fs12 from "node:fs";
+import { createHash as createHash10 } from "node:crypto";
+import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path14 from "node:path";
+import path15 from "node:path";
 // packages/workit-core/src/check-config.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import fs8 from "node:fs";
-import path7 from "node:path";
+import fs9 from "node:fs";
+import path8 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
 var CHECKS_FILE = "workit.checks.json";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -12274,10 +12311,10 @@ var git = (cwd, args) => {
   return value || null;
 };
 function checkRoot(cwd) {
-  return path7.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+  return path8.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
 }
 var packageManager = (root) => {
-  const has = (file) => fs8.existsSync(path7.join(root, file));
+  const has = (file) => fs9.existsSync(path8.join(root, file));
   if (has("bun.lock") || has("bun.lockb"))
     return "bun";
   if (has("pnpm-lock.yaml"))
@@ -12297,7 +12334,7 @@ var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
 function detectedChecks(root) {
   const read = (file) => {
     try {
-      return fs8.readFileSync(path7.join(root, file), "utf8");
+      return fs9.readFileSync(path8.join(root, file), "utf8");
     } catch {
       return null;
     }
@@ -12336,7 +12373,7 @@ function detectedChecks(root) {
 var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = path7.join(root, CHECKS_FILE);
+  const file = path8.join(root, CHECKS_FILE);
   const none = (error = null) => ({
     source: error ? CHECKS_FILE : "none",
     root,
@@ -12346,7 +12383,7 @@ function loadCheckConfig(cwd) {
   });
   let text = null;
   try {
-    text = fs8.readFileSync(file, "utf8");
+    text = fs9.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
       return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
@@ -12409,10 +12446,10 @@ function workitAvailable(env = process.env) {
     return workitOnPath;
   const windows = process.platform === "win32";
   const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
-  const dirs = (env.PATH ?? env.Path ?? "").split(path7.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path8.delimiter).filter(Boolean);
   workitOnPath = dirs.some((dir) => exts.some((ext) => {
     try {
-      return fs8.statSync(path7.join(dir, `workit${ext}`)).isFile();
+      return fs9.statSync(path8.join(dir, `workit${ext}`)).isFile();
     } catch {
       return false;
     }
@@ -12425,10 +12462,10 @@ function checkCommand(args, version, onPath = workitAvailable()) {
 // packages/workit-core/src/git/rev.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import fs9 from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+import fs10 from "node:fs";
 import os from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 var MAX_BUFFER = 256 * 1024 * 1024;
 var GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
 var git2 = (cwd, args, options = {}) => {
@@ -12463,10 +12500,10 @@ function headSha(cwd) {
 var emptyTree = (cwd) => line(git2(cwd, ["mktree"], { input: "" }));
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
 var seedIndex = (from, to) => {
-  fs9.copyFileSync(from, to);
-  const { atimeNs, mtimeNs } = fs9.statSync(from, { bigint: true });
+  fs10.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs10.statSync(from, { bigint: true });
   const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
-  fs9.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+  fs10.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
 };
 function worktreeTree(cwd, options = {}) {
   const top = line(git2(cwd, ["rev-parse", "--show-toplevel"]));
@@ -12475,10 +12512,10 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs9.mkdtempSync(path8.join(os.tmpdir(), "workit-tree-"));
+  const scratch = fs10.mkdtempSync(path9.join(os.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path8.join(scratch, "index");
-    if (fs9.existsSync(indexPath))
+    const tempIndex = path9.join(scratch, "index");
+    if (fs10.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
     const untracked = git2(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
@@ -12490,7 +12527,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs9.statSync(path8.join(top, file));
+        const stat = fs10.statSync(path9.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -12507,10 +12544,10 @@ function worktreeTree(cwd, options = {}) {
     if (!tree)
       return null;
     const base = line(git2(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
-    const key = skipped.length ? `sha256:${createHash5("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    const key = skipped.length ? `sha256:${createHash6("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
     return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
   } finally {
-    fs9.rmSync(scratch, { recursive: true, force: true });
+    fs10.rmSync(scratch, { recursive: true, force: true });
   }
 }
 function worktreeSignal(cwd, options = {}) {
@@ -12530,16 +12567,16 @@ function worktreeSignal(cwd, options = {}) {
   });
   if (!status.ok)
     return null;
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   hash.update(`${headSha(top) ?? "unborn"}\x00`);
   for (const entry of status.stdout.split("\x00")) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path8.join(top, file);
+    const absolute = path9.join(top, file);
     let stat = "-";
     try {
-      const info = fs9.lstatSync(absolute, { bigint: true });
+      const info = fs10.lstatSync(absolute, { bigint: true });
       stat = `${info.mode.toString(8)}:${info.size}:${info.mtimeNs}`;
       if (info.isDirectory())
         stat += `:${headSha(absolute) ?? "-"}`;
@@ -12606,17 +12643,17 @@ function pushRemoteName(cwd, branch) {
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash8, randomBytes as randomBytes2 } from "node:crypto";
-import fs11 from "node:fs";
-import path12 from "node:path";
+import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
+import fs12 from "node:fs";
+import path13 from "node:path";
 // packages/workit-core/src/core/vcs-config.ts
-import fs10 from "node:fs";
-import path11 from "node:path";
+import fs11 from "node:fs";
+import path12 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 // packages/workit-core/src/core/config.ts
@@ -12630,7 +12667,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import os2 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 // packages/workit-core/src/core/boundary.ts
 var EVENT = {
@@ -12674,7 +12711,7 @@ var mergePreset = (preset, input = {}, current = {
     protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
   };
 };
-var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path9.join(process.env.XDG_CONFIG_HOME || path9.join(os2.homedir(), ".config"), "workit");
+var resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path10.join(process.env.XDG_CONFIG_HOME || path10.join(os2.homedir(), ".config"), "workit");
 var migratedDir = null;
 var migrationFailed = false;
 var ensureConfigDir = (dir = resolveConfigDir()) => {
@@ -12684,7 +12721,7 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
     migratedDir = dir;
     return dir;
   }
-  const legacy = path9.join(process.env.XDG_CONFIG_HOME || path9.join(os2.homedir(), ".config"), "workflow-toolkit");
+  const legacy = path10.join(process.env.XDG_CONFIG_HOME || path10.join(os2.homedir(), ".config"), "workflow-toolkit");
   if (!existsSync3(legacy)) {
     migratedDir = dir;
     return dir;
@@ -12697,8 +12734,8 @@ var ensureConfigDir = (dir = resolveConfigDir()) => {
   mkdirSync2(dir, { recursive: true });
   diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
   for (const entry of readdirSync2(legacy, { withFileTypes: true })) {
-    const src = path9.join(legacy, entry.name);
-    const dest = path9.join(dir, entry.name);
+    const src = path10.join(legacy, entry.name);
+    const dest = path10.join(dir, entry.name);
     if (existsSync3(dest))
       continue;
     try {
@@ -12770,7 +12807,7 @@ var parseConfigResult = (raw, file) => {
   return { status: "valid", path: file, config };
 };
 var readConfigTyped = (dir) => {
-  const file = path9.join(dir ?? configDir(), "config.json");
+  const file = path10.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
 };
 var readConfig = () => {
@@ -12779,7 +12816,7 @@ var readConfig = () => {
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
 };
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path9.join(configDir(), "vcs.json");
+var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path10.join(configDir(), "vcs.json");
 var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
 var resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
@@ -12821,9 +12858,9 @@ var resolveCommitPolicy = (config, workspace) => {
 // packages/workit-core/src/core/workspaces.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 // packages/workit-core/src/core/branch-policy.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -12948,7 +12985,7 @@ var releaseTrackSchema = object({
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource?.kind === "package-json" && (path10.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path11.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -13008,7 +13045,7 @@ var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).opt
     names.add(workspace.name);
   }
 });
-var workspacesRevision = (contents) => createHash6("sha256").update(contents ?? "<missing>").digest("hex");
+var workspacesRevision = (contents) => createHash7("sha256").update(contents ?? "<missing>").digest("hex");
 var validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
     return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
@@ -13046,7 +13083,7 @@ var validateWorkspacesDocument = (parsed, file) => {
   };
 };
 var readWorkspacesResult = (dir = configDir()) => {
-  const file = path10.join(dir, "workspaces.json");
+  const file = path11.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13157,9 +13194,9 @@ var mainCheckoutOf = (cwd) => {
   let main = null;
   const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
   const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path10.resolve(gitDir) !== path10.resolve(common)) {
+  if (gitDir && common && path11.resolve(gitDir) !== path11.resolve(common)) {
     const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path10.basename(common) === ".git" ? path10.dirname(common) : common);
+    main = listed?.trim() || (path11.basename(common) === ".git" ? path11.dirname(common) : common);
   }
   mainCheckouts.set(cwd, main);
   return main;
@@ -13250,7 +13287,7 @@ var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
 var matchRuntimeWorkspace = (cwd) => {
-  const file = path10.join(configDir(), "workspaces.json");
+  const file = path11.join(configDir(), "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13325,7 +13362,7 @@ function workspaceDefaultTarget(cwd, globalDefault) {
 }
 // packages/workit-core/src/core/release-tracks.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { spawnSync as spawnSync7 } from "node:child_process";
 class ReleaseTrackError extends Error {
 }
@@ -13708,7 +13745,7 @@ function resolveTrackFor(cwd, options) {
       ]) ?? "",
       git3(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
     ] : [];
-    key = createHash7("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    key = createHash8("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
     const hit = memo2.get(key);
     if (hit)
       return hit;
@@ -13723,7 +13760,7 @@ function resolveTrackFor(cwd, options) {
 }
 // packages/workit-core/src/core/vcs-config.ts
-var workspacesPath = () => path11.join(configDir(), "workspaces.json");
+var workspacesPath = () => path12.join(configDir(), "workspaces.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
   const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
@@ -13813,7 +13850,7 @@ var readVcsConfig = () => {
   const file = vcsConfigPath();
   let raw;
   try {
-    raw = fs10.readFileSync(file, "utf8");
+    raw = fs11.readFileSync(file, "utf8");
   } catch {
     return { status: "missing", path: file, config: {} };
   }
@@ -13898,7 +13935,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const prov = cfg[provider] ?? {};
   const out = {
     ok: true,
-    configPath: path11.resolve(cfgPath),
+    configPath: path12.resolve(cfgPath),
     provider,
     defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
@@ -14109,7 +14146,7 @@ function diffHash(cwd, base, head) {
   ], GIT_TIMEOUTS.worktree);
   if (!diff.ok || !diff.stdout)
     return null;
-  const hash = createHash8("sha256");
+  const hash = createHash9("sha256");
   for (const line of diff.stdout.split(`
 `)) {
     if (line.startsWith("index "))
@@ -14121,14 +14158,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path12.resolve(cwd));
+  const location = resolveStore(path13.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path12.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path13.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 var newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
@@ -14148,7 +14185,7 @@ var onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
-    return isNetworkFsType(fs11.statfsSync(dir).type);
+    return isNetworkFsType(fs12.statfsSync(dir).type);
   } catch {
     return false;
   }
@@ -14158,15 +14195,15 @@ var LOCK_STALE_MS = 30000;
 var LOCK_OWNER = "owner";
 var lockToken = (lock) => {
   try {
-    return fs11.readFileSync(path12.join(lock, LOCK_OWNER), "utf8");
+    return fs12.readFileSync(path13.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 };
 var lockAgeMs = (lock) => {
-  for (const target of [path12.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path13.join(lock, LOCK_OWNER), lock]) {
     try {
-      return Date.now() - fs11.statSync(target).mtimeMs;
+      return Date.now() - fs12.statSync(target).mtimeMs;
     } catch {}
   }
   return null;
@@ -14174,14 +14211,14 @@ var lockAgeMs = (lock) => {
 var ledgerLock = {
   acquire(lock) {
     try {
-      fs11.mkdirSync(lock);
+      fs12.mkdirSync(lock);
     } catch (error) {
       if (error.code === "EEXIST")
         return null;
       throw error;
     }
     const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
-    fs11.writeFileSync(path12.join(lock, LOCK_OWNER), token);
+    fs12.writeFileSync(path13.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
@@ -14189,35 +14226,35 @@ var ledgerLock = {
       return false;
     const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
     try {
-      fs11.renameSync(lock, tomb);
+      fs12.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) !== token) {
       try {
-        fs11.renameSync(tomb, lock);
+        fs12.renameSync(tomb, lock);
       } catch {}
       return false;
     }
-    fs11.rmSync(tomb, { recursive: true, force: true });
+    fs12.rmSync(tomb, { recursive: true, force: true });
     return true;
   },
   token: lockToken,
   reap(lock, observed) {
     const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
     try {
-      fs11.renameSync(lock, tomb);
+      fs12.renameSync(lock, tomb);
     } catch {
       return false;
     }
     if (lockToken(tomb) === observed) {
-      fs11.rmSync(tomb, { recursive: true, force: true });
+      fs12.rmSync(tomb, { recursive: true, force: true });
       return true;
     }
     try {
-      fs11.renameSync(tomb, lock);
+      fs12.renameSync(tomb, lock);
     } catch {
-      fs11.rmSync(tomb, { recursive: true, force: true });
+      fs12.rmSync(tomb, { recursive: true, force: true });
     }
     return false;
   }
@@ -14244,14 +14281,14 @@ function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
     ledgerLock.release(lock, token);
   }
 }
-var sha2562 = (text) => createHash8("sha256").update(text).digest("hex");
+var sha2562 = (text) => createHash9("sha256").update(text).digest("hex");
 var chainHash = (prevHash, body) => sha2562(`${prevHash ?? ""}
 ${body}`);
 var TAIL_BYTES = 64 * 1024;
 var lastLine = (fd, size) => {
   for (let span = Math.min(size, TAIL_BYTES);span > 0; span = Math.min(size, span * 2)) {
     const buffer = Buffer.alloc(span);
-    fs11.readSync(fd, buffer, 0, span, size - span);
+    fs12.readSync(fd, buffer, 0, span, size - span);
     const end = buffer.lastIndexOf(10);
     if (end < 0) {
       if (span === size)
@@ -14282,13 +14319,13 @@ var lastLine = (fd, size) => {
 };
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs11.openSync(file, "a+");
+    const fd = fs12.openSync(file, "a+");
     try {
-      const size = fs11.fstatSync(fd).size;
+      const size = fs12.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
         const last = Buffer.alloc(1);
-        fs11.readSync(fd, last, 0, 1, size - 1);
+        fs12.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10)
           fence = `
 `;
@@ -14297,17 +14334,17 @@ function appendLine(file, build, options) {
       if (!line.ok)
         return line;
       const bytes = Buffer.from(fence + line.value);
-      const written = fs11.writeSync(fd, bytes);
+      const written = fs12.writeSync(fd, bytes);
       if (written !== bytes.length)
         return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
       return { ok: true, value: undefined };
     } finally {
-      fs11.closeSync(fd);
+      fs12.closeSync(fd);
     }
   };
   try {
-    fs11.mkdirSync(path12.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path12.dirname(file)))
+    fs12.mkdirSync(path13.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path13.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -14379,7 +14416,7 @@ function readLedger(cwd, options = {}) {
     return file;
   let text = "";
   try {
-    text = fs11.readFileSync(file.value, "utf8");
+    text = fs12.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {
@@ -14573,11 +14610,20 @@ function authorSessions(cwd, rows, branch, range = { base: null, head: null }, s
     sessions.add(session);
   return sessions;
 }
+var derivesFrom = (derived, bare) => !bare.includes(":") && derived.endsWith(`:${bare}`);
+var authoredBy = (authors, session) => {
+  if (authors.has(session))
+    return true;
+  for (const author of authors)
+    if (derivesFrom(author, session) || derivesFrom(session, author))
+      return true;
+  return false;
+};
 var independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
     reasons.push("no_session");
-  else if (authors.has(row.actor.session))
+  else if (authoredBy(authors, row.actor.session))
     reasons.push("author_session");
   if (row.self === true && !reasons.includes("no_session"))
     reasons.push("self");
@@ -14861,7 +14907,7 @@ var productDecision = (task, ledger) => {
   };
 };
 var planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path13.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path14.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -14920,15 +14966,15 @@ function writeBlockers(task, root) {
 }
 // packages/workit-core/src/core/task-evaluation.ts
-var digestBytes = (value) => createHash9("sha256").update(value).digest("hex");
-var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path14.sep}`);
-var relative = (root, candidate) => path14.relative(root, candidate).split(path14.sep).join("/") || ".";
+var digestBytes = (value) => createHash10("sha256").update(value).digest("hex");
+var inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path15.sep}`);
+var relative = (root, candidate) => path15.relative(root, candidate).split(path15.sep).join("/") || ".";
 var canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path14.posix.normalize(value);
+  const normalized = path15.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -14976,21 +15022,21 @@ var gitPaths = (root) => {
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path14.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path15.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path14.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path15.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 };
 var walk = (root, directory, output) => {
   let names;
   try {
-    names = fs12.readdirSync(directory);
+    names = fs13.readdirSync(directory);
   } catch {
     return true;
   }
@@ -14998,10 +15044,10 @@ var walk = (root, directory, output) => {
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path14.join(directory, name);
+    const target = path15.join(directory, name);
     let stat;
     try {
-      stat = fs12.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15016,14 +15062,14 @@ var walk = (root, directory, output) => {
 var scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path14.resolve(root, item);
+    const target = path15.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
-    while (!fs12.existsSync(ancestor) && ancestor !== root)
-      ancestor = path14.dirname(ancestor);
+    while (!fs13.existsSync(ancestor) && ancestor !== root)
+      ancestor = path15.dirname(ancestor);
     try {
-      if (!inside(root, fs12.realpathSync(ancestor)))
+      if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
     } catch {
       return failure2("invalid_input", `candidate scope cannot be inspected: ${item}`);
@@ -15035,7 +15081,7 @@ var scopeRoots = (root, scope) => {
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
-    checkout = fs12.realpathSync(root);
+    checkout = fs13.realpathSync(root);
   } catch {
     return failure2("invalid_input", "candidate root does not exist");
   }
@@ -15053,11 +15099,11 @@ function captureCandidate(root, scope, environment = []) {
     if (item === ".git" || item === ".workit")
       continue;
     names.add(item);
-    if (!fs12.existsSync(target))
+    if (!fs13.existsSync(target))
       continue;
     let stat;
     try {
-      stat = fs12.lstatSync(target);
+      stat = fs13.lstatSync(target);
     } catch {
       uncertain = true;
       continue;
@@ -15073,17 +15119,17 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path14.join(checkout, item);
+    const target = path15.join(checkout, item);
     try {
-      const stat = fs12.lstatSync(target);
+      const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
-        const link = fs12.readlinkSync(target);
+        const link = fs13.readlinkSync(target);
         files.push({ path: item, kind: "symlink", digest: digestBytes(link), executable: null });
       } else if (stat.isFile()) {
         files.push({
           path: item,
           kind: "file",
-          digest: digestBytes(fs12.readFileSync(target)),
+          digest: digestBytes(fs13.readFileSync(target)),
           executable: (stat.mode & 73) !== 0
         });
       } else if (!stat.isDirectory()) {
@@ -15248,7 +15294,7 @@ var findingVerificationPasses = (findingCandidateId, evidence) => evidence.statu
 var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
   let root;
   try {
-    root = fs12.realpathSync(checkoutRoot);
+    root = fs13.realpathSync(checkoutRoot);
   } catch {
     return failure2("permission_denied", "checkout root is unavailable");
   }
@@ -15257,23 +15303,23 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path14.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path14.sep}`))
+    const target = path15.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path15.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path14.relative(root, target);
+      const below = path15.relative(root, target);
       let current = root;
-      for (const segment of below.split(path14.sep)) {
+      for (const segment of below.split(path15.sep)) {
         if (!segment)
           continue;
-        current = path14.join(current, segment);
-        const stat = fs12.lstatSync(current);
-        const real = fs12.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path14.sep}`))
+        current = path15.join(current, segment);
+        const stat = fs13.lstatSync(current);
+        const real = fs13.realpathSync(current);
+        if (real !== root && !real.startsWith(`${root}${path15.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -15289,7 +15335,7 @@ var verifyDecisionContentAtRoot = (checkoutRoot, binding) => {
         if (current !== target && !stat.isDirectory())
           return failure2("invalid_input", "document reference ancestor is not a directory");
       }
-      if (digestBytes(fs12.readFileSync(target)) !== reference.digest)
+      if (digestBytes(fs13.readFileSync(target)) !== reference.digest)
         return failure2("permission_denied", "decision document bytes have changed");
     } catch {
       return failure2("invalid_input", "decision document is unavailable");
@@ -15658,7 +15704,8 @@ Autonomy contract:
   satisfies a gate; an ad-hoc \`workit check -- <cmd>\` never does.
 - Author is not verifier: your own verdict is \`--self\`, shown as
   self-reviewed, never verified. High risk, \`verification: independent\` and
-  merge need a verifier with its own session (\`WORKIT_SESSION_ID=<lead>-v<n>\`).
+  merge need a verifier with its own host-derived session (a subagent's
+  \`<lead>:<child>\`, set by the host); never hand-mint one such as \`<lead>-v1\`.
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
@@ -15815,7 +15862,7 @@ var exportDigest = (bundle) => sha256({
   task: bundle.task
 });
 // packages/workit-core/src/core/branch.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 // packages/workit-core/src/core/git.ts
 import { execFileSync } from "node:child_process";
@@ -15953,7 +16000,7 @@ var branchPolicySnapshotFor = (workspaceRoot) => {
   const source = resolved.provenance.branchPolicy;
   const allowed = branchPolicy.allowed.map((pattern) => `${pattern.source}/${pattern.flags}`).toSorted();
   const protectedRefs = [...branchPolicy.protected].map((name) => name.toLowerCase()).toSorted();
-  const fingerprint = createHash10("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
+  const fingerprint = createHash11("sha256").update(JSON.stringify({ allowed, protectedRefs, source })).digest("hex");
   return {
     branchPolicy,
     namePolicy: { allowed: branchPolicy.allowed, protected: branchPolicy.protected },
@@ -16209,7 +16256,7 @@ var judgeInputSummary = (raw) => {
 // packages/workit-core/src/autonomy.ts
 import os3 from "node:os";
-import path15 from "node:path";
+import path16 from "node:path";
 var accountHome = () => {
   try {
     return os3.userInfo().homedir;
@@ -16218,10 +16265,10 @@ var accountHome = () => {
   }
 };
 var grantsHome = { resolve: accountHome };
-var grantsDir = () => path15.join(grantsHome.resolve(), ".config", "workit");
+var grantsDir = () => path16.join(grantsHome.resolve(), ".config", "workit");
 var grantsOverride = () => {
-  const configured = path15.resolve(resolveConfigDir());
-  return configured === path15.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path15.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+  const configured = path16.resolve(resolveConfigDir());
+  return configured === path16.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path16.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 };
 var GRANT_KINDS = ["push", "pr", "merge", "release", "rerun"];
 var DEFAULT_GRANTS = Object.freeze({
@@ -17993,7 +18040,7 @@ class WorkitCore {
 // packages/workit-core/src/core/repo-context.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
-import path16 from "node:path";
+import path17 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
   try {
     gitRevisionParts(value);
@@ -18127,7 +18174,7 @@ var findPrTemplate = (cwd) => {
   ]) {
     const parts = rel.split("/");
     const base = parts[parts.length - 1];
-    const dir = parts.length > 1 ? path16.join(cwd, ...parts.slice(0, -1)) : cwd;
+    const dir = parts.length > 1 ? path17.join(cwd, ...parts.slice(0, -1)) : cwd;
     const actual = probeCaseInsensitive(dir, base);
     if (actual)
       return [...parts.slice(0, -1), actual].join("/");
@@ -18158,7 +18205,7 @@ var diffStatForRange = (cwd, range) => {
   return runGit(cwd, ["diff", "--stat", "--"]).stdout;
 };
 var packageScripts = (cwd, keys) => {
-  const pkgPath = path16.join(cwd, "package.json");
+  const pkgPath = path17.join(cwd, "package.json");
   if (!existsSync6(pkgPath))
     return [];
   try {
@@ -18184,9 +18231,9 @@ var documentationFiles = (cwd) => {
       if (entry.isDirectory()) {
         if (excluded.has(entry.name))
           continue;
-        walk(path16.join(dir, entry.name), depth + 1);
+        walk(path17.join(dir, entry.name), depth + 1);
       } else if (entry.isFile() && (entry.name === "README.md" || entry.name.endsWith(".md"))) {
-        matches.push("./" + path16.relative(cwd, path16.join(dir, entry.name)).replaceAll("\\", "/"));
+        matches.push("./" + path17.relative(cwd, path17.join(dir, entry.name)).replaceAll("\\", "/"));
       }
     }
   };
@@ -18202,7 +18249,7 @@ var readTrimmed2 = (file, maxLines) => {
 `);
 };
 function prReadyContext(root, range) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path17.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   let stdout = "";
@@ -18260,7 +18307,7 @@ ${status.stderr}` : "");
     stdout += `template_path: ${template}
 `;
-    stdout += readTrimmed2(path16.join(cwd, template), 220);
+    stdout += readTrimmed2(path17.join(cwd, template), 220);
   } else {
     stdout += `template_path: none
@@ -18270,7 +18317,7 @@ ${status.stderr}` : "");
   stdout += `
 `;
   stdout += printSection("Recent Validation Signals");
-  if (existsSync6(path16.join(cwd, "package.json"))) {
+  if (existsSync6(path17.join(cwd, "package.json"))) {
     stdout += `package.json detected. Common scripts:
 `;
     const found = packageScripts(cwd, ["lint", "format:check", "test", "build"]);
@@ -18279,7 +18326,7 @@ ${status.stderr}` : "");
 `) + `
 `;
   }
-  if (existsSync6(path16.join(cwd, "Cargo.toml")) || existsSync6(path16.join(cwd, "src-tauri/Cargo.toml"))) {
+  if (existsSync6(path17.join(cwd, "Cargo.toml")) || existsSync6(path17.join(cwd, "src-tauri/Cargo.toml"))) {
     stdout += `Rust project detected.
 `;
   }
@@ -18312,7 +18359,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path17.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -18330,7 +18377,7 @@ function changelogContext(root, range) {
   stdout += CHANGELOG_RULES + `
 `;
   stdout += printSection("Existing CHANGELOG.md");
-  const changelogPath = path16.join(cwd, "CHANGELOG.md");
+  const changelogPath = path17.join(cwd, "CHANGELOG.md");
   if (existsSync6(changelogPath)) {
     stdout += readTrimmed2(changelogPath, 260) + `
 `;
@@ -18350,7 +18397,7 @@ function changelogContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function docsRefreshContext(root, range) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path17.resolve(repoRoot(root));
   if (range !== undefined && !isResolvableContextRange(cwd, range))
     return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
@@ -18372,7 +18419,7 @@ function docsRefreshContext(root, range) {
 `) + `
 `;
   stdout += printSection("README Preview");
-  const readme = path16.join(cwd, "README.md");
+  const readme = path17.join(cwd, "README.md");
   if (existsSync6(readme)) {
     stdout += readTrimmed2(readme, 220) + `
 `;
@@ -18381,7 +18428,7 @@ function docsRefreshContext(root, range) {
 `;
   }
   stdout += printSection("Package Scripts");
-  const pkgPath = path16.join(cwd, "package.json");
+  const pkgPath = path17.join(cwd, "package.json");
   if (existsSync6(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
@@ -18395,7 +18442,7 @@ function docsRefreshContext(root, range) {
   return { stdout, stderr: "", exitCode: 0, cwd };
 }
 function releaseNotesContext(root, rangeOrTag) {
-  const cwd = path16.resolve(repoRoot(root));
+  const cwd = path17.resolve(repoRoot(root));
   if (!rangeOrTag) {
     return { stdout: "", stderr: `ERROR: release tag or range required
 `, exitCode: 1, cwd };
@@ -18433,7 +18480,7 @@ function releaseNotesContext(root, rangeOrTag) {
 `;
   stdout += printSection("Existing Release Files");
   for (const rel of ["CHANGELOG.md", "RELEASE_NOTES.md", ".github/releases.md"]) {
-    if (existsSync6(path16.join(cwd, rel)))
+    if (existsSync6(path17.join(cwd, rel)))
       stdout += rel + `
 `;
   }
@@ -18464,8 +18511,8 @@ function releaseNotesContext(root, rangeOrTag) {
 import { spawnSync as spawnSync13 } from "node:child_process";
 // packages/workit-core/src/core/pr-create.ts
-import fs13 from "node:fs";
-import path17 from "node:path";
+import fs14 from "node:fs";
+import path18 from "node:path";
 import { spawnSync as spawnSync12 } from "node:child_process";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
@@ -18476,13 +18523,13 @@ function parseGhIssue(value) {
 // packages/workit-core/src/core/pr-create.ts
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path17.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path18.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path17.join(dir, name);
+      const candidate = path18.join(dir, name);
       try {
-        fs13.accessSync(candidate, fs13.constants.X_OK);
+        fs14.accessSync(candidate, fs14.constants.X_OK);
         return candidate;
       } catch {}
     }
@@ -18600,8 +18647,8 @@ var fetchGitLabIssueBody = async (ref, root, deps = {}) => {
 };
 // packages/workit-core/src/core/youtrack.ts
-import fs14 from "node:fs";
-import path18 from "node:path";
+import fs15 from "node:fs";
+import path19 from "node:path";
 // packages/workit-core/src/core/templates.ts
 var repoRoot2 = assetRoot();
@@ -18614,22 +18661,22 @@ var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 // packages/workit-core/src/core/youtrack.ts
 var ISSUE_RE = /^[A-Z]+-\d+$/;
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
-var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path18.join(configDir(), "youtrack.json");
-var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path18.join(resolveConfigDir(), "youtrack.json");
+var youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path19.join(configDir(), "youtrack.json");
+var youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path19.join(resolveConfigDir(), "youtrack.json");
 var youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
-  const mode = fs14.statSync(p).mode & 511;
+  const mode = fs15.statSync(p).mode & 511;
   return mode === 384;
 };
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
-  if (!fs14.existsSync(cfgPath)) {
+  if (!fs15.existsSync(cfgPath)) {
     return required ? { error: "ERROR: missing youtrack.json", path: cfgPath } : { config: {}, path: cfgPath };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs14.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs15.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: `${cfgPath} is not valid JSON`, path: cfgPath };
   }
@@ -18640,11 +18687,11 @@ function readYouTrackConfig(required) {
 }
 var readYouTrackContextConfig = () => {
   const cfgPath = youTrackReadOnlyConfigPath();
-  if (!fs14.existsSync(cfgPath))
+  if (!fs15.existsSync(cfgPath))
     return { data: {} };
   let parsed;
   try {
-    parsed = JSON.parse(fs14.readFileSync(cfgPath, "utf8"));
+    parsed = JSON.parse(fs15.readFileSync(cfgPath, "utf8"));
   } catch {
     return { error: "YouTrack configuration is unavailable" };
   }
@@ -18683,12 +18730,12 @@ var youTrackToken = () => {
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path18.isAbsolute(tokenFile) ? path18.resolve(tokenFile) : path18.resolve(process.cwd(), tokenFile) : "";
-  if (!tokenPath || !fs14.existsSync(tokenPath))
+  const tokenPath = tokenFile ? path19.isAbsolute(tokenFile) ? path19.resolve(tokenFile) : path19.resolve(process.cwd(), tokenFile) : "";
+  if (!tokenPath || !fs15.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
     return { error: "youtrack.token mode must be 0600" };
-  const token = fs14.readFileSync(tokenPath, "utf8").trim();
+  const token = fs15.readFileSync(tokenPath, "utf8").trim();
   if (!token)
     return { error: "empty token file" };
   if (token === TOKEN_PLACEHOLDER || token.startsWith(TOKEN_PLACEHOLDER)) {
@@ -18753,9 +18800,9 @@ function resolveYouTrackFromPaths(spec_path, plan_path, workspace_root) {
     } catch {
       continue;
     }
-    if (!fs14.existsSync(full))
+    if (!fs15.existsSync(full))
       continue;
-    const text = fs14.readFileSync(full, "utf8");
+    const text = fs15.readFileSync(full, "utf8");
     const m = text.match(/^\*\*YouTrack:\*\*\s*`?([A-Z]+-\d+)`?/m);
     if (m)
       return m[1];
@@ -19040,15 +19087,15 @@ function resolveGitRevision(root, value) {
 }
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path19.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path19.sep)) {
+  const target = path20.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path20.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync7(ancestor))
-    ancestor = path19.dirname(ancestor);
+    ancestor = path20.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path19.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path20.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -19092,9 +19139,9 @@ var capabilitiesFor = (descriptor, observed = {}) => descriptor.capabilities.map
   };
 });
 // packages/workit-core/src/hooks/context.ts
-import { createHash as createHash11 } from "node:crypto";
-import fs15 from "node:fs";
-import path20 from "node:path";
+import { createHash as createHash12 } from "node:crypto";
+import fs16 from "node:fs";
+import path21 from "node:path";
 var MIGRATION_PENDING_NOTE = "workit migration pending — run `workit task status`";
 var migrationPending = (result) => !result.ok && result.code === "needs_input" && (result.error ?? "").startsWith(MIGRATION_PENDING);
 var boundTo = (entry, session) => entry.sessions.some((item) => item.host === session.host && item.handle === session.handle);
@@ -19179,7 +19226,7 @@ function entryCompactContext(store, entry, session, context) {
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
-  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path20.resolve(store.root, ref.path)] : []));
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path21.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
   const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
   if (!compact.ok || !compact.data)
@@ -19248,7 +19295,7 @@ var turnContextText = (input, descriptor) => {
   }
 };
 var TURN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
-var digestOf = (text) => createHash11("sha256").update(text).digest("hex");
+var digestOf = (text) => createHash12("sha256").update(text).digest("hex");
 var turnMarker = (input) => {
   if (!input.session.id)
     return null;
@@ -19257,32 +19304,32 @@ var turnMarker = (input) => {
     if (location instanceof Error)
       return null;
     const session = [input.host, input.session.id, input.session.agentId ?? ""].join("\x00");
-    return path20.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
+    return path21.join(location.dir, "hooks", `turn-${digestOf(session).slice(0, 32)}.json`);
   } catch {
     return null;
   }
 };
 var writeTurnDigest = (file, digest) => {
   try {
-    fs15.mkdirSync(path20.dirname(file), { recursive: true });
-    fs15.writeFileSync(file, `${JSON.stringify({ digest })}
+    fs16.mkdirSync(path21.dirname(file), { recursive: true });
+    fs16.writeFileSync(file, `${JSON.stringify({ digest })}
 `);
   } catch {}
 };
 var clearTurnDigest = (file) => {
   try {
-    fs15.rmSync(file, { force: true });
+    fs16.rmSync(file, { force: true });
   } catch {}
 };
 var pruneTurnDigests = (dir, now) => {
   try {
-    for (const name of fs15.readdirSync(dir)) {
+    for (const name of fs16.readdirSync(dir)) {
       if (!name.startsWith("turn-"))
         continue;
-      const file = path20.join(dir, name);
+      const file = path21.join(dir, name);
       try {
-        if (now - fs15.statSync(file).mtimeMs > TURN_TTL_MS)
-          fs15.rmSync(file, { force: true });
+        if (now - fs16.statSync(file).mtimeMs > TURN_TTL_MS)
+          fs16.rmSync(file, { force: true });
       } catch {}
     }
   } catch {}
@@ -19298,7 +19345,7 @@ var changedTurnContext = (input, text) => {
     return text;
   const digest = digestOf(text);
   try {
-    const previous = JSON.parse(fs15.readFileSync(file, "utf8"));
+    const previous = JSON.parse(fs16.readFileSync(file, "utf8"));
     if (previous.digest === digest)
       return null;
   } catch {}
@@ -19309,7 +19356,7 @@ var seedTurnContext = (input, descriptor, text = turnContextText(input, descript
   const file = turnMarker(input);
   if (!file)
     return;
-  pruneTurnDigests(path20.dirname(file), Date.now());
+  pruneTurnDigests(path21.dirname(file), Date.now());
   if (text)
     writeTurnDigest(file, digestOf(text));
   else
@@ -19322,7 +19369,7 @@ var shellPolicy = (cwd, command) => {
 };
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync6 } from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 // packages/workit-core/src/hooks/shell-words.ts
 var closingQuote = (command, start, dialect) => {
@@ -19452,22 +19499,22 @@ var NONE2 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path21.resolve(file);; dir = path21.dirname(dir)) {
+  for (let dir = path22.resolve(file);; dir = path22.dirname(dir)) {
     try {
-      return path21.join(realpathSync6(dir), rest);
+      return path22.join(realpathSync6(dir), rest);
     } catch {
-      if (path21.dirname(dir) === dir)
-        return path21.resolve(file);
-      rest = rest ? path21.join(path21.basename(dir), rest) : path21.basename(dir);
+      if (path22.dirname(dir) === dir)
+        return path22.resolve(file);
+      rest = rest ? path22.join(path22.basename(dir), rest) : path22.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path21.relative(fold(canonical2(root)), fold(canonical2(path21.resolve(cwd, file))));
-  if (relative.startsWith("..") || path21.isAbsolute(relative))
+  const relative = path22.relative(fold(canonical2(root)), fold(canonical2(path22.resolve(cwd, file))));
+  if (relative.startsWith("..") || path22.isAbsolute(relative))
     return true;
-  const posix = relative.split(path21.sep).join("/");
+  const posix = relative.split(path22.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -19565,7 +19612,7 @@ var shellWrites = (command) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path21.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path22.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -19625,15 +19672,15 @@ import { spawnSync as spawnSync16 } from "node:child_process";
 // packages/workit-core/src/hooks/raw-git.ts
 import { spawnSync as spawnSync15 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
-import fs17 from "node:fs";
+import { createHash as createHash14 } from "node:crypto";
+import fs18 from "node:fs";
 import os4 from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 // packages/workit-core/src/hooks/session-marker.ts
-import { createHash as createHash12 } from "node:crypto";
-import fs16 from "node:fs";
-import path22 from "node:path";
+import { createHash as createHash13 } from "node:crypto";
+import fs17 from "node:fs";
+import path23 from "node:path";
 var sessionMarkerFile = (input, session, store) => {
   let dir = store;
   if (dir === undefined) {
@@ -19642,13 +19689,13 @@ var sessionMarkerFile = (input, session, store) => {
       return null;
     dir = location.dir;
   }
-  const name = createHash12("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
-  return path22.join(dir, "hooks", `skills-${name}.json`);
+  const name = createHash13("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
+  return path23.join(dir, "hooks", `skills-${name}.json`);
 };
 var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 var readSessionMarker = (file) => {
   try {
-    const value = JSON.parse(fs16.readFileSync(file, "utf8"));
+    const value = JSON.parse(fs17.readFileSync(file, "utf8"));
     return { nudged: list2(value.nudged), loaded: list2(value.loaded), raw: list2(value.raw) };
   } catch {
     return { nudged: [], loaded: [], raw: [] };
@@ -19656,8 +19703,8 @@ var readSessionMarker = (file) => {
 };
 var writeSessionMarker = (file, marker) => {
   try {
-    fs16.mkdirSync(path22.dirname(file), { recursive: true });
-    fs16.writeFileSync(file, JSON.stringify(marker));
+    fs17.mkdirSync(path23.dirname(file), { recursive: true });
+    fs17.writeFileSync(file, JSON.stringify(marker));
   } catch {}
 };
@@ -19678,12 +19725,12 @@ var GIT_VALUE_OPTIONS = new Set([
   "--config-env",
   "--super-prefix"
 ]);
-var isAbsolute = (value) => path23.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+var isAbsolute = (value) => path24.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 var joinDir = (base, next) => {
   if (base === undefined || /[$`*?]/.test(next) || next === "-")
     return;
-  const expanded = next === "~" || next.startsWith("~/") ? path23.join(os4.homedir(), next.slice(1)) : next;
-  return base === null || isAbsolute(expanded) ? expanded : path23.join(base, expanded);
+  const expanded = next === "~" || next.startsWith("~/") ? path24.join(os4.homedir(), next.slice(1)) : next;
+  return base === null || isAbsolute(expanded) ? expanded : path24.join(base, expanded);
 };
 var cdTarget = (words) => {
   const args = words.slice(1);
@@ -19936,7 +19983,7 @@ var repoAt = (dir) => {
   return { location, dir, branch: resolveTaskKey(dir, location).branch };
 };
 var isWorkitWorkspace = (repo) => {
-  if (fs17.existsSync(repo.location.dir))
+  if (fs18.existsSync(repo.location.dir))
     return true;
   try {
     return resolveRuntimeWorkspaceVcs(repo.location.top ?? repo.dir) !== null;
@@ -19967,17 +20014,17 @@ var headSha2 = (repo) => {
   if (!git || git.reftable)
     return null;
   try {
-    const head = fs17.readFileSync(path23.join(git.gitDir, "HEAD"), "utf8").trim();
+    const head = fs18.readFileSync(path24.join(git.gitDir, "HEAD"), "utf8").trim();
     if (/^[0-9a-f]{40,64}$/.test(head))
       return head;
     const ref = /^ref: (refs\/.+)$/.exec(head)?.[1];
     if (!ref)
       return null;
-    const common = path23.dirname(repo.location.dir);
+    const common = path24.dirname(repo.location.dir);
     try {
-      return fs17.readFileSync(path23.join(common, ref), "utf8").trim() || null;
+      return fs18.readFileSync(path24.join(common, ref), "utf8").trim() || null;
     } catch {}
-    const packed = fs17.readFileSync(path23.join(common, "packed-refs"), "utf8");
+    const packed = fs18.readFileSync(path24.join(common, "packed-refs"), "utf8");
     return new RegExp(`^([0-9a-f]{40,64}) ${ref.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m").exec(packed)?.[1] ?? null;
   } catch {
     return null;
@@ -20014,7 +20061,7 @@ var actionsIn = (cwd, command, dialect) => {
     const action = rawAction(invocation);
     if (!action)
       continue;
-    const dir = path23.resolve(cwd, invocation.dir ?? ".");
+    const dir = path24.resolve(cwd, invocation.dir ?? ".");
     if (!repos.has(dir)) {
       const repo = repoAt(dir);
       repos.set(dir, repo && isWorkitWorkspace(repo) ? repo : null);
@@ -20083,8 +20130,8 @@ function rawGitPre(input, command, options = {}) {
 var deny = (reason) => ({ kind: "deny", reason, unblock: null });
 var NEXT_COMMAND = "next";
 var MARKER_TTL_SECONDS = 3600;
-var markerFile = (repo, session, key) => path23.join(repo.location.dir, "hooks", `commit-${createHash13("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
-var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash13("sha256").update(command).digest("hex")}`;
+var markerFile = (repo, session, key) => path24.join(repo.location.dir, "hooks", `commit-${createHash14("sha256").update(`${session}\x00${key}`).digest("hex").slice(0, 32)}.json`);
+var callKey = (toolUseId, command) => toolUseId ?? `cmd:${createHash14("sha256").update(command).digest("hex")}`;
 function noteRawCommit(input, command, key) {
   try {
     if (!input.session.id || !/\bcommit\b/.test(command))
@@ -20094,8 +20141,8 @@ function noteRawCommit(input, command, key) {
       if (action.kind !== "commit")
         continue;
       const file = markerFile(repo, input.session.id, key);
-      fs17.mkdirSync(path23.dirname(file), { recursive: true });
-      fs17.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
+      fs18.mkdirSync(path24.dirname(file), { recursive: true });
+      fs18.writeFileSync(file, `${JSON.stringify({ head: headSha2(repo), at })}
 `);
     }
   } catch {}
@@ -20118,11 +20165,11 @@ var headCommit = (dir) => {
 var settle2 = (input, repo, file) => {
   let marker;
   try {
-    marker = JSON.parse(fs17.readFileSync(file, "utf8"));
+    marker = JSON.parse(fs18.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-  fs17.rmSync(file, { force: true });
+  fs18.rmSync(file, { force: true });
   const session = input.session.id;
   const now = Date.now() / 1000;
   if (typeof marker.at !== "number" || now - marker.at > MARKER_TTL_SECONDS)
@@ -20171,7 +20218,7 @@ function settlePendingCommit(input) {
     if (!repo)
       return;
     const file = markerFile(repo, input.session.id, NEXT_COMMAND);
-    if (fs17.existsSync(file))
+    if (fs18.existsSync(file))
       settle2(input, repo, file);
   } catch {}
 }
@@ -20629,6 +20676,8 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
+  if (session)
+    recordIssuedSession(input.cwd || process.cwd(), session, own);
   return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
 };
 function handleHook(input, deps) {
@@ -20990,12 +21039,12 @@ var skillPromptNudge = (prompt, ctx) => process.env.WORKIT_PI_WORKER_SESSION ? n
 // packages/workit-pi/src/launches.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync as readdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import os5 from "node:os";
-import path24 from "node:path";
+import path25 from "node:path";
 var launchDir = (root) => {
   const location = resolveStore(root);
-  return location instanceof Error ? null : path24.join(location.dir, "pi-launches");
+  return location instanceof Error ? null : path25.join(location.dir, "pi-launches");
 };
-var fileFor = (dir, workerId) => path24.join(dir, `${workerId.replace(/[^A-Za-z0-9-]/g, "_")}.json`);
+var fileFor = (dir, workerId) => path25.join(dir, `${workerId.replace(/[^A-Za-z0-9-]/g, "_")}.json`);
 var recordLaunch = (root, attempt) => {
   const dir = launchDir(root);
   if (!dir)
@@ -21041,7 +21090,7 @@ var abandonedLaunches = (root) => {
   const found = [];
   for (const name of names) {
     try {
-      const attempt = JSON.parse(readFileSync6(path24.join(dir, name), "utf8"));
+      const attempt = JSON.parse(readFileSync6(path25.join(dir, name), "utf8"));
       if (typeof attempt.workerId === "string" && typeof attempt.session === "string") {
         if (!alive(attempt))
           found.push(attempt);
@@ -21215,7 +21264,7 @@ function launchWorker(assignment, options) {
     WORKIT_PI_WORKER_ID: workerId ?? "",
     WORKIT_PI_WORKER_SESSION: sessionId,
     WORKIT_HOST: "pi",
-    WORKIT_SESSION_ID: sessionId,
+    WORKIT_SESSION_ID: options.leadSession ? childSessionId(options.leadSession, sessionId) : sessionId,
     WORKIT_PI_WORKER_ROLE: assignment.role,
     WORKIT_PI_WORKER_SCOPE: JSON.stringify(assignment.scope)
   };
@@ -21762,6 +21811,7 @@ function extension(pi) {
     const handle = launchSupervisedWorker(worker.data.assignment, {
       runtime: runtimeFor(ctx),
       binding,
+      leadSession: ctx.sessionManager.getSessionId(),
       prompt: request.prompt,
       onPrepare: (pending) => {
         child = pending;