@helmsmith/workbrokr 0.0.0-stage → 0.2.0

package/dist/cli.js

@@ -0,0 +1,3280 @@
+// ../../platform/core/cli-kit-lib/src/auth-provider.ts
+var noopAuthProvider = {
+  async getToken() {
+    throw new Error(
+      "noopAuthProvider.getToken() called \u2014 wire a real AuthProvider via createCli({ auth })"
+    );
+  },
+  async whoami() {
+    return null;
+  }
+};
+
+// ../../platform/core/cli-kit-lib/src/create-cli.ts
+import { Command } from "commander";
+function createCli(opts) {
+  const program2 = new Command();
+  program2.name(opts.name).version(opts.version);
+  if (opts.description) program2.description(opts.description);
+  program2.configureOutput({
+    outputError: (str, write) => write(str)
+  });
+  return { program: program2, auth: opts.auth ?? noopAuthProvider };
+}
+
+// src/commands/audit.ts
+import chalk3 from "chalk";
+
+// src/lib/context.ts
+import chalk from "chalk";
+
+// src/core/config.ts
+import {
+  appendFileSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync,
+  realpathSync as realpathSync2,
+  writeFileSync
+} from "fs";
+import { join as join2 } from "path";
+
+// src/core/errors.ts
+var REFUSALS = /* @__PURE__ */ new Set([
+  "MANIFEST_INVALID",
+  "AREA_UNKNOWN",
+  "TASK_INVALID",
+  "TYPE_UNKNOWN",
+  "MODE_UNKNOWN",
+  "MODE_MISMATCH",
+  "SCOPE_REQUIRES_TASK",
+  "SCOPE_OUTSIDE_AREA",
+  "MAIN_CHECKOUT",
+  "WORKTREE_INVALID",
+  "PROTECTED_BRANCH",
+  "EFFORT_OPEN",
+  "EFFORT_NOT_FOUND",
+  "SCOPE_CONFLICT",
+  "COMMONS_LOCKED",
+  "NO_FREE_SLOT",
+  "LEASE_NOT_FOUND",
+  "PORT_RANGE_TAKEN",
+  "SYNC_CONFLICT",
+  "DIRTY_WORKTREE",
+  "UNPUSHED"
+]);
+function exitCodeFor(code) {
+  return REFUSALS.has(code) ? 2 : 1;
+}
+var WorkkitError = class extends Error {
+  code;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.name = "WorkkitError";
+    this.code = code;
+    if (details) this.details = details;
+  }
+};
+function toErrorBody(err) {
+  if (err instanceof WorkkitError) {
+    return err.details ? { code: err.code, message: err.message, details: err.details } : { code: err.code, message: err.message };
+  }
+  return { code: "INTERNAL", message: err instanceof Error ? err.message : String(err) };
+}
+
+// src/core/git.ts
+import { spawnSync } from "child_process";
+import { existsSync, mkdirSync, realpathSync, rmSync, statSync } from "fs";
+import { dirname, join, resolve, sep } from "path";
+var realpathOr = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+};
+var SAFE_SUBMODULE_NAME = /^[^\p{Cc}\s=]+$/u;
+var Git = class _Git {
+  constructor(cwd) {
+    this.cwd = cwd;
+  }
+  cwd;
+  tryRun(args) {
+    const r = spawnSync("git", args, { cwd: this.cwd, encoding: "utf8" });
+    return { code: r.status ?? 1, out: r.stdout ?? "", err: r.stderr ?? "" };
+  }
+  run(args) {
+    const r = this.tryRun(args);
+    if (r.code !== 0) {
+      throw new WorkkitError(
+        "GIT_FAILED",
+        `git ${args.join(" ")} (in ${this.cwd}): ${r.err.trim() || r.out.trim()}`,
+        {
+          args,
+          cwd: this.cwd
+        }
+      );
+    }
+    return r.out;
+  }
+  lines(args) {
+    return this.run(args).split("\n").map((l) => l.trim()).filter(Boolean);
+  }
+  /** The checkout's top level (symlinks resolved). */
+  root() {
+    return realpathSync(this.run(["rev-parse", "--show-toplevel"]).trim());
+  }
+  /** The main checkout's top level, from any worktree of the repo. */
+  mainRoot() {
+    const common = realpathSync(
+      this.run(["rev-parse", "--path-format=absolute", "--git-common-dir"]).trim()
+    );
+    return dirname(common);
+  }
+  /** The main checkout is the one whose git dir IS the common dir (compared as absolute realpaths). */
+  isMainCheckout() {
+    const gitDir = realpathSync(
+      this.run(["rev-parse", "--path-format=absolute", "--git-dir"]).trim()
+    );
+    const common = realpathSync(
+      this.run(["rev-parse", "--path-format=absolute", "--git-common-dir"]).trim()
+    );
+    return gitDir === common;
+  }
+  currentBranch() {
+    return this.run(["branch", "--show-current"]).trim();
+  }
+  branchExists(name) {
+    return this.tryRun(["rev-parse", "--verify", "-q", `refs/heads/${name}`]).code === 0;
+  }
+  remoteBranchExists(name) {
+    return this.run(["ls-remote", "--heads", "origin", name]).trim().length > 0;
+  }
+  fetch(branch) {
+    this.run(["fetch", "-q", "origin", branch]);
+  }
+  hasUpstream() {
+    return this.tryRun(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]).code === 0;
+  }
+  /** Commits on HEAD that origin does not have: against the upstream, else the same-named remote branch, else origin/<base>. */
+  unpushedCount(base) {
+    let ref = `origin/${base}`;
+    if (this.hasUpstream()) ref = "@{u}";
+    else if (this.remoteBranchExists(this.currentBranch())) ref = `origin/${this.currentBranch()}`;
+    return this.lines(["rev-list", `${ref}..HEAD`]).length;
+  }
+  isDirty() {
+    return this.run(["status", "--porcelain"]).trim().length > 0;
+  }
+  changedPathsStaged() {
+    return this.lines(["diff", "--cached", "--name-only"]);
+  }
+  changedPaths(from, to) {
+    return this.lines(["diff", "--name-only", "--no-renames", from, to]);
+  }
+  /** Paths this branch changed since it diverged from origin/<base> (three-dot), without the base's own changes. */
+  changedSince(base) {
+    return this.lines(["diff", "--name-only", "--no-renames", `origin/${base}...HEAD`]);
+  }
+  commitsNotOn(base) {
+    return this.lines(["rev-list", `origin/${base}..HEAD`]);
+  }
+  rev(ref) {
+    return this.run(["rev-parse", ref]).trim();
+  }
+  /** Fast-forward when HEAD has no own commits, otherwise merge; never rebase. A conflict is left in place. */
+  syncFrom(base) {
+    const target = `origin/${base}`;
+    const before = this.rev("HEAD");
+    const targetRev = this.rev(target);
+    if (before === targetRev) return { kind: "up-to-date", before, after: before, conflicted: [] };
+    if (this.tryRun(["merge-base", "--is-ancestor", "HEAD", target]).code === 0) {
+      this.run(["merge", "--ff-only", "-q", target]);
+      return { kind: "ff", before, after: this.rev("HEAD"), conflicted: [] };
+    }
+    if (this.tryRun(["merge-base", "--is-ancestor", target, "HEAD"]).code === 0) {
+      return { kind: "up-to-date", before, after: before, conflicted: [] };
+    }
+    const merged = this.tryRun(["merge", "--no-edit", "-q", target]);
+    if (merged.code === 0)
+      return { kind: "merge", before, after: this.rev("HEAD"), conflicted: [] };
+    const conflicted = this.lines(["diff", "--name-only", "--diff-filter=U"]);
+    return { kind: "conflict", before, after: before, conflicted };
+  }
+  worktreeAdd(path, branch, startPoint) {
+    mkdirSync(dirname(path), { recursive: true });
+    if (this.branchExists(branch)) this.run(["worktree", "add", "-q", path, branch]);
+    else
+      this.run(["worktree", "add", "-q", "--no-track", "-b", branch, path, startPoint ?? "HEAD"]);
+  }
+  worktreeRemove(path) {
+    this.run(["worktree", "remove", "--force", path]);
+  }
+  checkout(branch, createFrom) {
+    if (this.branchExists(branch)) this.run(["checkout", "-q", branch]);
+    else this.run(["checkout", "-q", "--no-track", "-b", branch, createFrom ?? "HEAD"]);
+  }
+  push(branch) {
+    this.run(["push", "-q", "-u", "origin", branch]);
+  }
+  deleteLocalBranch(branch) {
+    this.run(["branch", "-q", "-D", branch]);
+  }
+  isAncestor(ancestor, descendant) {
+    return this.tryRun(["merge-base", "--is-ancestor", ancestor, descendant]).code === 0;
+  }
+  /** True when HEAD's tree matches origin/<base>, or every commit on HEAD is patch-equivalent to origin/<base> (squash-merged). */
+  isEquivalentToBase(base) {
+    const target = `origin/${base}`;
+    if (this.tryRun(["diff", "--quiet", target, "HEAD"]).code === 0) return true;
+    const cherry = this.tryRun(["cherry", target, "HEAD"]);
+    if (cherry.code !== 0) return false;
+    const lines = cherry.out.split("\n").map((l) => l.trim()).filter(Boolean);
+    return lines.length > 0 && lines.every((l) => l.startsWith("- "));
+  }
+  /**
+   * Give a linked worktree its own clone of every submodule the main checkout has initialized,
+   * cloned locally from the main checkout's module directory (no network) and then re-pointed at
+   * the real URL. `git worktree add` under submodule.recurse leaves a gitfile aimed at a module
+   * directory that was never cloned; a gitfile aimed at the MAIN checkout's module directory is
+   * worse, because that module's core.worktree is the main checkout's submodule, so any git
+   * command in the worktree's submodule (checkout -f, reset, merge) rewrites the human's files.
+   * Both shapes are replaced; a submodule that is already its own working tree is left alone.
+   */
+  repairSubmodules(mainRoot, log = () => {
+  }) {
+    const gitmodules = join(this.cwd, ".gitmodules");
+    if (!existsSync(gitmodules)) return;
+    const cfg = this.tryRun([
+      "config",
+      "-f",
+      ".gitmodules",
+      "--get-regexp",
+      "^submodule\\..*\\.path$"
+    ]);
+    if (cfg.code !== 0) return;
+    const wtGitDir = this.run(["rev-parse", "--path-format=absolute", "--git-dir"]).trim();
+    for (const line of cfg.out.split("\n").filter(Boolean)) {
+      const m = /^submodule\.(.+)\.path\s+(.+)$/.exec(line.trim());
+      if (!m) continue;
+      const [, name, subPath] = m;
+      const modulesDir = resolve(wtGitDir, "modules");
+      const moduleDir = resolve(modulesDir, name);
+      if (!SAFE_SUBMODULE_NAME.test(name) || name.split(/[\\/]/).some((seg) => seg === "" || seg === "." || seg === "..") || !moduleDir.startsWith(modulesDir + sep)) {
+        log(`submodule ${subPath}: refusing name ${JSON.stringify(name)}; not repaired`);
+        continue;
+      }
+      const wtSub = join(this.cwd, subPath);
+      const wtGit = join(wtSub, ".git");
+      if (this.isOwnSubmodule(wtSub, wtGit)) continue;
+      const mainSub = join(mainRoot, subPath);
+      if (!existsSync(join(mainSub, ".git"))) continue;
+      const src = new _Git(mainSub).tryRun(["rev-parse", "--path-format=absolute", "--git-dir"]);
+      if (src.code !== 0 || !src.out.trim()) continue;
+      if (existsSync(wtGit) && statSync(wtGit).isFile()) rmSync(wtGit);
+      rmSync(moduleDir, { recursive: true, force: true });
+      const r = this.tryRun([
+        "-c",
+        "protocol.file.allow=always",
+        "-c",
+        `submodule.${name}.url=${src.out.trim()}`,
+        "submodule",
+        "update",
+        "--init",
+        "--",
+        subPath
+      ]);
+      if (r.code !== 0) {
+        log(
+          `submodule ${subPath}: not repaired (${(r.err || r.out).trim()}); the project's refresh steps may still set it up`
+        );
+        continue;
+      }
+      this.tryRun(["submodule", "sync", "-q", "--", subPath]);
+    }
+  }
+  /** A submodule is the worktree's own when git, run inside it, says its top level IS that directory. */
+  isOwnSubmodule(wtSub, wtGit) {
+    if (!existsSync(wtGit)) return false;
+    const top = new _Git(wtSub).tryRun(["rev-parse", "--show-toplevel"]);
+    if (top.code !== 0) return false;
+    return realpathOr(top.out.trim()) === realpathOr(wtSub);
+  }
+};
+
+// src/core/config.ts
+function renderTemplate(s, vars) {
+  return s.replace(/\$\{([A-Z0-9_]+)\}/g, (_, name) => {
+    if (!(name in vars)) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        `template references ${name}, which this effort does not define`
+      );
+    }
+    return vars[name];
+  });
+}
+function storybookHostFor(m, worktree) {
+  if (!worktree) return "";
+  return m.storybook?.hostRoot ? join2(worktree, m.storybook.hostRoot) : worktree;
+}
+function slotVars(m, o) {
+  const vars = {
+    SLOT: o.slot === void 0 ? "" : String(o.slot),
+    PROJECT: m.project,
+    AREA: o.area ?? "",
+    BRANCH: o.branch ?? "",
+    WORKTREE: o.worktree ?? "",
+    LOG_DIR: o.logDir ?? "",
+    PORT_STORYBOOK: o.storybookPort === void 0 ? "" : String(o.storybookPort),
+    STORYBROKR_HOST: storybookHostFor(m, o.worktree)
+  };
+  for (const service of Object.keys(m.ports.services)) {
+    const p = o.ports[service];
+    vars[`PORT_${service.toUpperCase()}`] = p === void 0 ? "" : String(p);
+  }
+  return vars;
+}
+function ensureExcluded(worktree, patterns) {
+  const r = new Git(worktree).tryRun(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (r.code !== 0) return;
+  const common = realpathSync2(r.out.trim());
+  const file = join2(common, "info", "exclude");
+  mkdirSync2(join2(common, "info"), { recursive: true });
+  const present = new Set(
+    existsSync2(file) ? readFileSync(file, "utf8").split("\n").map((l) => l.trim()) : []
+  );
+  const missing = patterns.filter((p) => !present.has(p));
+  if (missing.length === 0) return;
+  appendFileSync(
+    file,
+    `${present.size ? "\n" : ""}# written by @helmsmith/workbrokr: per-worktree config and logs
+${missing.join("\n")}
+`
+  );
+}
+function emitWorktreeConfig(a) {
+  ensureExcluded(a.worktree, [
+    ".slot",
+    a.m.env.file,
+    `${a.m.logs.dir.replace(/\/+$/, "")}/`,
+    `${a.m.worktreeRoot.replace(/\/+$/, "")}/`
+  ]);
+  const logDir = join2(a.worktree, a.m.logs.dir);
+  mkdirSync2(logDir, { recursive: true });
+  const vars = slotVars(a.m, { ...a, logDir });
+  const envFile = join2(a.worktree, a.m.env.file);
+  const lines = Object.entries(a.m.env.template).map(([k, v]) => `${k}=${renderTemplate(v, vars)}`);
+  writeFileSync(envFile, `${lines.join("\n")}
+`);
+  let slotFile;
+  if (a.slot !== void 0) {
+    slotFile = join2(a.worktree, ".slot");
+    writeFileSync(slotFile, `${a.slot}
+`);
+  }
+  return slotFile ? { envFile, slotFile, logDir, vars } : { envFile, logDir, vars };
+}
+
+// src/core/guards.ts
+import { existsSync as existsSync3, realpathSync as realpathSync3 } from "fs";
+
+// src/core/scopes.ts
+import picomatch from "picomatch";
+function areaVars(area) {
+  const parts = area.split("/");
+  return { group: parts.slice(0, -1).join("/"), section: parts[parts.length - 1] };
+}
+function fill(template, vars) {
+  let missing = false;
+  const out = template.replace(/\{(group|section|module)\}/g, (_, name) => {
+    const v = vars[name];
+    if (v === void 0 || v === "") {
+      missing = true;
+      return "";
+    }
+    return v;
+  });
+  return missing ? null : out;
+}
+function extraScopesForMode(spec, mode) {
+  if (!spec.extraScopes) return [];
+  if (Array.isArray(spec.extraScopes)) {
+    return mode === "frontend" || mode === "fullstack" ? spec.extraScopes : [];
+  }
+  const out = [];
+  if (mode === "frontend" || mode === "fullstack") out.push(...spec.extraScopes.frontend ?? []);
+  if (mode === "backend" || mode === "fullstack") out.push(...spec.extraScopes.backend ?? []);
+  return out;
+}
+var normalizeGlob = (g) => g.replace(/^\.\//, "").replace(/\/+$/, "");
+var hasWildcard = (s) => /[*?[{]/.test(s);
+function isSubGlob(child, parent) {
+  const c = normalizeGlob(child);
+  const p = normalizeGlob(parent);
+  if (c === p) return true;
+  const cSegs = c.split("/");
+  const pSegs = p.split("/");
+  for (let i = 0; i < pSegs.length; i++) {
+    const ps = pSegs[i];
+    if (ps === "**") return true;
+    const cs = cSegs[i];
+    if (cs === void 0 || cs === "**") return false;
+    if (!hasWildcard(ps) && !hasWildcard(cs)) {
+      if (ps !== cs) return false;
+      continue;
+    }
+    if (!hasWildcard(cs) && hasWildcard(ps)) {
+      if (!picomatch.isMatch(cs, ps, { dot: true })) return false;
+      continue;
+    }
+    if (cs !== ps) return false;
+  }
+  return cSegs.length === pSegs.length;
+}
+function expandScopes(m, area, mode, narrowedScopes, hasTask = false) {
+  const spec = m.areas[area];
+  if (!spec)
+    throw new WorkkitError(
+      "AREA_UNKNOWN",
+      `unknown area "${area}" (known: ${Object.keys(m.areas).join(", ")})`
+    );
+  const vars = { ...areaVars(area), module: spec.module };
+  const out = [];
+  if (mode === "frontend" || mode === "fullstack") {
+    for (const t of m.scopes.frontend) {
+      const g = fill(t, vars);
+      if (g) out.push(g);
+    }
+  }
+  if (mode === "backend" || mode === "fullstack") {
+    if (!spec.module) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        `area "${area}" has no module, so a ${mode} effort cannot hold a backend scope; add areas["${area}"].module or use --mode frontend`
+      );
+    }
+    for (const t of m.scopes.backend) {
+      const g = fill(t, vars);
+      if (g) out.push(g);
+    }
+  }
+  out.push(...extraScopesForMode(spec, mode));
+  if (!narrowedScopes || narrowedScopes.length === 0) return out;
+  if (!hasTask) {
+    throw new WorkkitError(
+      "SCOPE_REQUIRES_TASK",
+      "--scope narrowing requires --task <slug> so primary area efforts always protect the full area"
+    );
+  }
+  const allowed = [...out, ...spec.sharedScopes ?? []];
+  for (const g of narrowedScopes) {
+    if (!allowed.some((base) => isSubGlob(g, base))) {
+      throw new WorkkitError(
+        "SCOPE_OUTSIDE_AREA",
+        `narrowed scope "${g}" is outside ${area}'s ${mode} scopes (${allowed.join(", ")})`,
+        { area, mode, scope: g, allowed }
+      );
+    }
+  }
+  return narrowedScopes;
+}
+function allowedScopesForEffort(m, effort) {
+  const shared = m.areas[effort.area]?.sharedScopes ?? [];
+  const allCommons = Object.values(m.commons).flat();
+  return [...effort.scopes, ...shared, ...allCommons];
+}
+function segmentsOverlap(sx, sy) {
+  if (sx === sy) return true;
+  const wx = hasWildcard(sx);
+  const wy = hasWildcard(sy);
+  if (!wx && !wy) return false;
+  if (!wx && wy) return picomatch.isMatch(sx, sy, { dot: true });
+  if (wx && !wy) return picomatch.isMatch(sy, sx, { dot: true });
+  const starToken = /^\*([^*?[{]+)\*$/;
+  const mx = starToken.exec(sx);
+  const my = starToken.exec(sy);
+  if (mx && my) {
+    const tx = mx[1];
+    const ty = my[1];
+    return tx.includes(ty) || ty.includes(tx);
+  }
+  return true;
+}
+function twoGlobsOverlap(x, y) {
+  const xs = normalizeGlob(x).split("/");
+  const ys = normalizeGlob(y).split("/");
+  const len = Math.min(xs.length, ys.length);
+  for (let i = 0; i < len; i++) {
+    if (xs[i] === "**" || ys[i] === "**") return true;
+    if (!segmentsOverlap(xs[i], ys[i])) return false;
+  }
+  if (xs.length === ys.length) return true;
+  const longer = xs.length > ys.length ? xs : ys;
+  return longer[len] === "**";
+}
+function globsOverlap(a, b) {
+  const pairs = [];
+  for (const x of a) {
+    for (const y of b) {
+      if (twoGlobsOverlap(x, y)) pairs.push(`${x} ~ ${y}`);
+    }
+  }
+  return pairs;
+}
+function pathsMatching(paths, globs) {
+  if (globs.length === 0) return [];
+  const isMatch = picomatch(globs, { dot: true });
+  return paths.filter((p) => isMatch(p));
+}
+function commonsTouched(m, paths) {
+  return Object.entries(m.commons).filter(([, globs]) => pathsMatching(paths, globs).length > 0).map(([name]) => name);
+}
+
+// src/core/guards.ts
+function assertNotProtected(m, branch) {
+  if (m.protectedBranches.includes(branch)) {
+    throw new WorkkitError(
+      "PROTECTED_BRANCH",
+      `branch "${branch}" is protected (${m.protectedBranches.join(", ")}): work happens on <type>/<area> branches, never here`,
+      { branch }
+    );
+  }
+}
+var same = (a, b) => {
+  try {
+    return realpathSync3(a) === realpathSync3(b);
+  } catch {
+    return a === b;
+  }
+};
+var effortLabel = (e) => e.task ? `${e.area}--${e.task}` : e.area;
+function checkCommit(c) {
+  const refusals = [];
+  const warnings = [];
+  if (c.m.protectedBranches.includes(c.branch)) {
+    refusals.push(
+      `branch "${c.branch}" is protected (${c.m.protectedBranches.join(", ")}): work happens on <type>/<area> branches, never here`
+    );
+  }
+  const allEfforts = c.registry.efforts({ project: c.project });
+  const efforts = new Map(allEfforts.map((e) => [e.id, e]));
+  for (const lease of c.registry.leases({ project: c.project, kind: "commons" })) {
+    const holder = efforts.get(lease.effort);
+    const holderHasWorktree = Boolean(holder && existsSync3(holder.worktree));
+    if (holder && holderHasWorktree && c.checkoutRoot) {
+      if (same(holder.worktree, c.checkoutRoot)) continue;
+    } else if (lease.owner.session === c.ownerSession) {
+      continue;
+    }
+    const globs = c.m.commons[String(lease.value)] ?? [];
+    const hit = pathsMatching(c.stagedPaths, globs);
+    if (hit.length > 0) {
+      refusals.push(
+        `commons "${lease.value}" is write-locked by ${lease.owner.session} (effort ${lease.effort}, since ${lease.touched}); staged: ${hit.join(", ")}`
+      );
+    }
+  }
+  const openEfforts = allEfforts.filter((e) => e.state === "active" || e.state === "starting");
+  for (const other of openEfforts) {
+    if (c.checkoutRoot && existsSync3(other.worktree) && same(other.worktree, c.checkoutRoot)) {
+      continue;
+    }
+    if (!c.checkoutRoot && other.branch === c.branch) continue;
+    const hit = pathsMatching(c.stagedPaths, other.scopes);
+    if (hit.length > 0) {
+      refusals.push(
+        `path(s) ${hit.join(", ")} are inside the active scope of ${effortLabel(other)} (${other.branch}, owned by ${other.owner.session})`
+      );
+    }
+  }
+  const mine = openEfforts.find(
+    (e) => c.checkoutRoot && existsSync3(e.worktree) ? same(e.worktree, c.checkoutRoot) : e.branch === c.branch
+  );
+  if (mine && c.stagedPaths.length > 0) {
+    const allowed = allowedScopesForEffort(c.m, mine);
+    const inScope = new Set(pathsMatching(c.stagedPaths, allowed));
+    const outside = c.stagedPaths.filter((p) => !inScope.has(p));
+    if (outside.length > 0) {
+      warnings.push(
+        `${outside.length} staged path(s) are outside the effort's scope (${effortLabel(mine)}): ${outside.join(", ")}`
+      );
+    }
+  }
+  return { refusals, warnings };
+}
+function checkPush(c) {
+  const refusals = [];
+  const warnings = [];
+  const destination = (c.remoteRef ?? `refs/heads/${c.branch}`).replace(/^refs\/heads\//, "");
+  if (c.m.protectedBranches.includes(destination)) {
+    refusals.push(
+      c.isDelete ? `refusing to delete protected branch "${destination}"` : `"${destination}" is protected (${c.m.protectedBranches.join(", ")}): nothing is pushed to it directly, open a PR from ${c.branch || "an area branch"}`
+    );
+    return { refusals, warnings };
+  }
+  if (c.isDelete) return { refusals, warnings };
+  const effort = c.registry.efforts({ project: c.project }).find((e) => (e.state === "active" || e.state === "parked") && e.branch === c.branch);
+  const commons = commonsTouched(c.m, c.changedPaths);
+  if (effort) {
+    const allowed = allowedScopesForEffort(c.m, effort);
+    const inScope = new Set(pathsMatching(c.changedPaths, allowed));
+    const outside = c.changedPaths.filter((p) => !inScope.has(p));
+    if (outside.length > 0) {
+      warnings.push(
+        `${outside.length} changed path(s) are outside the effort's scope (${effortLabel(effort)}): ${outside.join(", ")} \u2014 add a scope template or expect a merge collision`
+      );
+    }
+  }
+  for (const name of commons)
+    warnings.push(`commons ${name} touched: the other areas are told at \`work finish\``);
+  return { refusals, warnings };
+}
+
+// src/core/hooks.ts
+import { chmodSync, lstatSync, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4 } from "path";
+
+// src/core/manifest.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
+import { pathToFileURL } from "url";
+import { z } from "zod";
+var MANIFEST_FILES = [
+  "helmsmith.config.ts",
+  "helmsmith.config.mjs",
+  "helmsmith.config.json"
+];
+var BRANCH_NAME = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+var BRANCH_NAME_HINT = 'must be a plain ref name: letters, digits, ".", "_", "/", "-"';
+var TASK_SLUG = /^(?!.*--)[a-z0-9][a-z0-9_-]{0,47}$/;
+var Service = z.object({
+  start: z.string().min(1),
+  stop: z.string().min(1),
+  health: z.string().min(1),
+  healthyCodes: z.array(z.number().int()).optional(),
+  reset: z.string().optional(),
+  healthTimeoutMs: z.number().int().positive().optional(),
+  modes: z.array(z.enum(["backend", "fullstack"])).optional()
+});
+var ExtraScopes = z.union([
+  z.array(z.string()),
+  z.object({
+    frontend: z.array(z.string()).optional(),
+    backend: z.array(z.string()).optional()
+  })
+]);
+var Schema = z.object({
+  project: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+  baseBranch: z.string().regex(BRANCH_NAME, BRANCH_NAME_HINT),
+  protectedBranches: z.array(z.string().regex(BRANCH_NAME, BRANCH_NAME_HINT)).optional(),
+  worktreeRoot: z.string().default(".claude/worktrees"),
+  branch: z.object({ types: z.array(z.string().regex(/^[a-z]+$/)).min(1) }).default({ types: ["feature", "chore", "fix"] }),
+  slots: z.object({
+    count: z.number().int().min(1).max(100),
+    reserved: z.array(z.number().int().min(0))
+  }).default({ count: 10, reserved: [0] }),
+  ports: z.object({
+    services: z.record(z.string(), z.object({ base: z.number().int().min(1024).max(65535) }))
+  }),
+  services: z.record(z.string(), Service),
+  storybook: z.object({ hostRoot: z.string() }).optional(),
+  logs: z.object({ dir: z.string() }).default({ dir: ".logs" }),
+  env: z.object({ file: z.string(), template: z.record(z.string(), z.string()) }).optional(),
+  seed: z.array(z.string().min(1)).optional(),
+  refresh: z.array(
+    z.object({
+      when: z.string().optional(),
+      always: z.boolean().optional(),
+      run: z.string().optional(),
+      mark: z.string().optional(),
+      restoreWhenIfClean: z.boolean().optional()
+    })
+  ).default([]),
+  scopes: z.object({ frontend: z.array(z.string()), backend: z.array(z.string()) }),
+  areas: z.record(
+    z.string().regex(/^(?!.*--)[a-z0-9-]+(\/[a-z0-9-]+)*$/),
+    z.object({
+      module: z.string().optional(),
+      commons: z.array(z.string()).optional(),
+      extraScopes: ExtraScopes.optional(),
+      sharedScopes: z.array(z.string()).optional()
+    })
+  ),
+  commons: z.record(z.string(), z.array(z.string())).default({}),
+  expiry: z.object({
+    slotHours: z.number().positive(),
+    commonsHours: z.number().positive(),
+    storybookHours: z.number().positive()
+  }).default({ slotHours: 12, commonsHours: 4, storybookHours: 2 }),
+  archive: z.object({
+    paths: z.array(z.string()),
+    keepDays: z.number().int().positive(),
+    keepPerArea: z.number().int().positive()
+  }).default({ paths: [], keepDays: 30, keepPerArea: 5 })
+});
+function templateVariables(m) {
+  const vars = /* @__PURE__ */ new Set([
+    "SLOT",
+    "LOG_DIR",
+    "PROJECT",
+    "AREA",
+    "BRANCH",
+    "WORKTREE",
+    "PORT_STORYBOOK",
+    "STORYBROKR_HOST"
+  ]);
+  for (const s of Object.keys(m.ports.services)) vars.add(`PORT_${s.toUpperCase()}`);
+  return vars;
+}
+function defaultEnv(services) {
+  const template = {
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: manifest template placeholder
+    SLOT: "${SLOT}",
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: manifest template placeholder
+    LOG_DIR: "${LOG_DIR}",
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: manifest template placeholder
+    STORYBROKR_HOST: "${STORYBROKR_HOST}"
+  };
+  for (const s of services) template[`PORT_${s.toUpperCase()}`] = `\${PORT_${s.toUpperCase()}}`;
+  return { file: ".env.slot", template };
+}
+function validateManifest(raw) {
+  const parsed = Schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new WorkkitError(
+      "MANIFEST_INVALID",
+      parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+    );
+  }
+  const m = parsed.data;
+  const problems = [];
+  const areas = Object.keys(m.areas).sort();
+  for (const a of areas) {
+    for (const b of areas) {
+      if (a !== b && b.startsWith(`${a}/`)) {
+        problems.push(`area "${a}" is an ancestor of "${b}": areas must be leaves`);
+      }
+    }
+  }
+  for (const s of Object.keys(m.services)) {
+    if (!m.ports.services[s]) problems.push(`service "${s}" has no port base under ports.services`);
+  }
+  for (const s of Object.keys(m.ports.services)) {
+    if (!m.services[s] && s !== "storybook") problems.push(`port "${s}" names no service`);
+  }
+  for (const r of m.slots.reserved) {
+    if (r >= m.slots.count) problems.push(`reserved slot ${r} is outside 0..${m.slots.count - 1}`);
+  }
+  const env = m.env ?? defaultEnv(Object.keys(m.ports.services));
+  const allowed = templateVariables(m);
+  for (const [k, v] of Object.entries(env.template)) {
+    for (const [, name] of v.matchAll(/\$\{([A-Z0-9_]+)\}/g)) {
+      if (!allowed.has(name)) {
+        problems.push(
+          `env.template.${k} references ${name}, which no slot derives (allowed: ${[...allowed].join(", ")})`
+        );
+      }
+    }
+  }
+  for (const [area, spec] of Object.entries(m.areas)) {
+    for (const c of spec.commons ?? []) {
+      if (!m.commons[c])
+        problems.push(`area "${area}" names commons "${c}", which is not declared`);
+    }
+  }
+  if (problems.length) throw new WorkkitError("MANIFEST_INVALID", problems.join("; "));
+  return { ...m, protectedBranches: m.protectedBranches ?? [m.baseBranch], env };
+}
+async function loadManifest(repoRoot) {
+  for (const name of MANIFEST_FILES) {
+    const file = join3(repoRoot, name);
+    if (!existsSync4(file)) continue;
+    if (name.endsWith(".json")) return validateManifest(JSON.parse(readFileSync2(file, "utf8")));
+    const mod = await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+    return validateManifest(mod.default);
+  }
+  throw new WorkkitError(
+    "MANIFEST_NOT_FOUND",
+    `no ${MANIFEST_FILES.join(" | ")} in ${repoRoot}; run \`work init\``
+  );
+}
+
+// src/core/hooks.ts
+var HOOKS_DIR = ".helmsmith/hooks";
+function preCommitScript(protectedBranches) {
+  return `#!/bin/sh
+# Installed by \`work init\` (@helmsmith/workbrokr). The protected-branch rule lives here; the rest in workbrokr.
+PROTECTED="${protectedBranches.join(" ")}"
+branch=$(git symbolic-ref --short -q HEAD)
+for p in $PROTECTED; do
+  if [ "$branch" = "$p" ]; then
+    echo "work: branch \\"$branch\\" is protected ($PROTECTED): work happens on <type>/<area> branches, never here" >&2
+    exit 2
+  fi
+done
+if command -v workbrokr >/dev/null 2>&1; then
+  workbrokr hook pre-commit "$@" || exit $?
+else
+  echo "work: workbrokr is not on PATH; commons and scope checks skipped (npm i -g @helmsmith/workbrokr)" >&2
+fi
+COMMON_DIR=$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)
+LEGACY="$COMMON_DIR/hooks/pre-commit"
+if [ -n "$COMMON_DIR" ] && [ -x "$LEGACY" ]; then
+  SELF_DIR=$(cd "$(dirname "$0")" && pwd)
+  LEGACY_DIR=$(cd "$(dirname "$LEGACY")" && pwd)
+  if [ "$SELF_DIR" != "$LEGACY_DIR" ]; then
+    exec "$LEGACY" "$@"
+  fi
+fi
+exit 0
+`;
+}
+function prePushScript(protectedBranches) {
+  return `#!/bin/sh
+# Installed by \`work init\` (@helmsmith/workbrokr). Refuses a push to, or a delete of, a protected branch here; the rest in workbrokr.
+PROTECTED="${protectedBranches.join(" ")}"
+input=$(cat)
+printf '%s\\n' "$input" | while read -r lref lsha rref rsha; do
+  [ -n "$rref" ] || continue
+  dest=\${rref#refs/heads/}
+  for p in $PROTECTED; do
+    if [ "$dest" = "$p" ]; then
+      echo "work: \\"$dest\\" is protected ($PROTECTED): nothing is pushed to it directly, open a PR from an area branch" >&2
+      exit 2
+    fi
+  done
+done || exit 2
+if command -v workbrokr >/dev/null 2>&1; then
+  printf '%s\\n' "$input" | workbrokr hook pre-push "$@" || exit $?
+else
+  echo "work: workbrokr is not on PATH; scope and commons warnings skipped" >&2
+fi
+COMMON_DIR=$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)
+LEGACY="$COMMON_DIR/hooks/pre-push"
+if [ -n "$COMMON_DIR" ] && [ -x "$LEGACY" ]; then
+  SELF_DIR=$(cd "$(dirname "$0")" && pwd)
+  LEGACY_DIR=$(cd "$(dirname "$LEGACY")" && pwd)
+  if [ "$SELF_DIR" != "$LEGACY_DIR" ]; then
+    printf '%s\\n' "$input" | exec "$LEGACY" "$@"
+  fi
+fi
+exit 0
+`;
+}
+function installHooks(repoRoot, opts) {
+  for (const b of opts.protectedBranches) {
+    if (!BRANCH_NAME.test(b))
+      throw new WorkkitError("MANIFEST_INVALID", `protected branch "${b}" is not a plain ref name`);
+  }
+  const hooksDir = join4(repoRoot, HOOKS_DIR);
+  mkdirSync3(hooksDir, { recursive: true });
+  const files = [];
+  const scripts = [
+    ["pre-commit", preCommitScript(opts.protectedBranches)],
+    ["pre-push", prePushScript(opts.protectedBranches)]
+  ];
+  for (const [name, body] of scripts) {
+    const file = join4(hooksDir, name);
+    let existing;
+    try {
+      existing = lstatSync(file);
+    } catch {
+      existing = void 0;
+    }
+    if (existing?.isSymbolicLink()) {
+      throw new WorkkitError("INTERNAL", `refusing to write hook ${file}: it is a symlink`, {
+        file
+      });
+    }
+    writeFileSync2(file, body);
+    chmodSync(file, 493);
+    files.push(file);
+  }
+  new Git(repoRoot).run(["config", "core.hooksPath", HOOKS_DIR]);
+  return { hooksDir, files };
+}
+
+// src/core/paths.ts
+import { homedir } from "os";
+import { join as join5 } from "path";
+function homeDir(env = process.env) {
+  return env.HELMSMITH_HOME && env.HELMSMITH_HOME.length > 0 ? env.HELMSMITH_HOME : join5(homedir(), ".cache", "helmsmith");
+}
+var registryFile = (home) => join5(home, "registry.json");
+var lockDir = (home) => join5(home, "registry.lock");
+
+// src/core/ports.ts
+function portsForSlot(m, slot) {
+  return Object.fromEntries(
+    Object.entries(m.ports.services).map(([service, { base }]) => [service, base + slot])
+  );
+}
+function rangesFor(m) {
+  return Object.fromEntries(
+    Object.entries(m.ports.services).map(([service, { base }]) => [
+      service,
+      { base, count: m.slots.count }
+    ])
+  );
+}
+function rangesOverlap(a, b) {
+  return a.base < b.base + b.count && b.base < a.base + a.count;
+}
+function claimRanges(registry, m, repoRoot) {
+  const mine = rangesFor(m);
+  const others = Object.entries(registry.read().projects).filter(([name]) => name !== m.project);
+  for (const [service, range] of Object.entries(mine)) {
+    for (const [name, entry] of others) {
+      for (const [theirService, theirs] of Object.entries(entry.ranges)) {
+        if (rangesOverlap(range, theirs)) {
+          throw new WorkkitError(
+            "PORT_RANGE_TAKEN",
+            `ports ${range.base}-${range.base + range.count - 1} for "${service}" overlap project "${name}" (${theirService}: ${theirs.base}-${theirs.base + theirs.count - 1}); pick another base in ports.services.${service}`,
+            { project: name, service, theirs }
+          );
+        }
+      }
+    }
+  }
+  registry.upsertProject(m.project, { root: repoRoot, ranges: mine });
+}
+
+// src/core/refresh.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createHash } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, join as join6 } from "path";
+import picomatch2 from "picomatch";
+function matchesWhen(glob) {
+  const isMatch = picomatch2(glob, { dot: true });
+  return (p) => isMatch(p);
+}
+function readStamps(stampFile) {
+  if (!stampFile || !existsSync5(stampFile)) return {};
+  try {
+    return JSON.parse(readFileSync3(stampFile, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeStamps(stampFile, stamps) {
+  mkdirSync4(dirname2(stampFile), { recursive: true });
+  writeFileSync3(stampFile, `${JSON.stringify(stamps, null, 2)}
+`);
+}
+function matchedFilesInWorktree(worktree, whenGlob) {
+  if (!/[*?[{]/.test(whenGlob)) {
+    return existsSync5(join6(worktree, whenGlob)) ? [whenGlob] : [];
+  }
+  const r = spawnSync2("git", ["ls-files"], { cwd: worktree, encoding: "utf8" });
+  if (r.status !== 0) return [];
+  const isMatch = matchesWhen(whenGlob);
+  return (r.stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && isMatch(l) && existsSync5(join6(worktree, l)));
+}
+function hashFiles(worktree, relPaths) {
+  if (relPaths.length === 0) return null;
+  const h = createHash("sha256");
+  for (const rel of [...relPaths].sort()) {
+    const abs = join6(worktree, rel);
+    if (!existsSync5(abs)) continue;
+    h.update(`${rel}\0`);
+    h.update(readFileSync3(abs));
+    h.update("\0");
+  }
+  return h.digest("hex");
+}
+function isFileCleanInGit(worktree, relPath) {
+  const r = spawnSync2("git", ["status", "--porcelain", "--", relPath], {
+    cwd: worktree,
+    encoding: "utf8"
+  });
+  return r.status === 0 && (r.stdout ?? "").trim().length === 0;
+}
+function selectRefresh(entries, changedPaths, opts) {
+  const runs = [];
+  const marks = [];
+  const stored = readStamps(opts?.stampFile);
+  const pendingStamps = { ...stored };
+  const cleanWhenFiles = /* @__PURE__ */ new Set();
+  for (const e of entries) {
+    let hit = e.always === true;
+    let matchedFiles = [];
+    if (e.when !== void 0) {
+      const byChanged = changedPaths.some(matchesWhen(e.when));
+      if (opts?.worktree) {
+        matchedFiles = matchedFilesInWorktree(opts.worktree, e.when);
+        const digest = hashFiles(opts.worktree, matchedFiles);
+        if (digest !== null) {
+          if (stored[e.when] !== digest) hit = true;
+          pendingStamps[e.when] = digest;
+        }
+      }
+      if (byChanged) hit = true;
+    }
+    if (!hit) continue;
+    if (e.run) {
+      runs.push(e.run);
+      if (opts?.worktree && e.when && e.restoreWhenIfClean !== false) {
+        for (const f of matchedFiles) {
+          if (isFileCleanInGit(opts.worktree, f)) cleanWhenFiles.add(f);
+        }
+      }
+    }
+    if (e.mark) marks.push(e.mark);
+  }
+  if (!opts?.worktree) return { runs, marks };
+  return {
+    runs,
+    marks,
+    pendingStamps,
+    cleanWhenFiles: [...cleanWhenFiles]
+  };
+}
+function runRefresh(runs, cwd, log, env = process.env, opts) {
+  for (const cmd of runs) {
+    log(`$ ${cmd}`);
+    const r = spawnSync2("sh", ["-c", cmd], { cwd, env, encoding: "utf8" });
+    if (r.stdout) log(r.stdout.trimEnd());
+    if (r.stderr) log(r.stderr.trimEnd());
+    if (r.status !== 0) {
+      throw new WorkkitError("INTERNAL", `refresh command failed (${r.status}): ${cmd}`, {
+        cmd,
+        status: r.status
+      });
+    }
+  }
+  if (opts?.restoreFiles && opts.restoreFiles.length > 0) {
+    for (const rel of opts.restoreFiles) {
+      if (!isFileCleanInGit(cwd, rel)) {
+        spawnSync2("git", ["checkout", "--", rel], { cwd, encoding: "utf8" });
+      }
+    }
+  }
+  if (opts?.stampFile && opts.pendingStamps) {
+    writeStamps(opts.stampFile, opts.pendingStamps);
+  }
+}
+
+// src/core/registry.ts
+import { randomBytes } from "crypto";
+import {
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync4,
+  renameSync,
+  rmSync as rmSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync4
+} from "fs";
+var newId = (prefix) => `${prefix}_${randomBytes(4).toString("hex")}`;
+var EMPTY = { version: 1, projects: {}, leases: [], efforts: [] };
+var LOCK_STALE_MS = 3e4;
+var LOCK_WAIT_MS = 5e3;
+function sleep(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+var Registry = class _Registry {
+  constructor(home, now2) {
+    this.home = home;
+    this.now = now2;
+  }
+  home;
+  now;
+  static open(home, now2 = () => /* @__PURE__ */ new Date()) {
+    mkdirSync5(home, { recursive: true });
+    return new _Registry(home, now2);
+  }
+  /** The registry as it is on disk. A file that does not parse is refused, never replaced. */
+  read() {
+    const file = registryFile(this.home);
+    if (!existsSync6(file)) return structuredClone(EMPTY);
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync4(file, "utf8"));
+    } catch (err) {
+      throw new WorkkitError(
+        "INTERNAL",
+        `${file} is corrupt (${err instanceof Error ? err.message : String(err)}); nothing was changed. Move it aside (mv ${file} ${file}.corrupt-$(date +%s)) to start fresh, knowing its leases and running pids are lost`,
+        { file }
+      );
+    }
+    const r = parsed;
+    if (!r || typeof r !== "object" || r.version !== 1) {
+      throw new WorkkitError(
+        "INTERNAL",
+        `${file} has an unknown registry version (${String(r?.version)}); this build reads version 1`,
+        { file }
+      );
+    }
+    return {
+      version: 1,
+      projects: r.projects ?? {},
+      leases: r.leases ?? [],
+      efforts: r.efforts ?? [],
+      notices: r.notices ?? []
+    };
+  }
+  /** Lock, re-read, mutate, write atomically, unlock. The only way state changes. */
+  update(fn) {
+    const lock = lockDir(this.home);
+    const started = Date.now();
+    for (; ; ) {
+      try {
+        mkdirSync5(lock);
+        break;
+      } catch {
+        try {
+          if (Date.now() - statSync2(lock).mtimeMs > LOCK_STALE_MS) {
+            rmSync2(lock, { recursive: true, force: true });
+            continue;
+          }
+        } catch {
+          continue;
+        }
+        if (Date.now() - started > LOCK_WAIT_MS) {
+          throw new WorkkitError(
+            "INTERNAL",
+            `registry lock ${lock} held for over ${LOCK_WAIT_MS} ms`
+          );
+        }
+        sleep(25);
+      }
+    }
+    try {
+      const r = this.read();
+      const out = fn(r);
+      const file = registryFile(this.home);
+      const tmp = `${file}.${process.pid}.tmp`;
+      writeFileSync4(tmp, `${JSON.stringify(r, null, 2)}
+`);
+      renameSync(tmp, file);
+      return out;
+    } finally {
+      rmSync2(lock, { recursive: true, force: true });
+    }
+  }
+  project(name) {
+    return this.read().projects[name];
+  }
+  upsertProject(name, entry) {
+    this.update((r) => {
+      r.projects[name] = entry;
+    });
+  }
+  leases(filter = {}) {
+    return this.read().leases.filter(
+      (l) => Object.entries(filter).every(([k, v]) => l[k] === v)
+    );
+  }
+  efforts(filter = {}) {
+    return this.read().efforts.filter(
+      (e) => Object.entries(filter).every(([k, v]) => e[k] === v)
+    );
+  }
+  activeEffortFor(project, area, task) {
+    return this.efforts({ project, area, state: "active" }).find(
+      (e) => (e.task ?? void 0) === (task ?? void 0)
+    );
+  }
+  /** An effort that is being started counts as open: nobody else may start on the same (area, task) meanwhile. */
+  openEffortFor(project, area, task) {
+    return this.efforts({ project, area }).find(
+      (e) => (e.state === "starting" || e.state === "active") && (e.task ?? void 0) === (task ?? void 0)
+    );
+  }
+  addNotice(project, area, notice) {
+    this.update((r) => {
+      const existing = r.notices ?? [];
+      const dup = existing.findIndex(
+        (n) => n.project === project && n.area === area && n.notice.from === notice.from && n.notice.text === notice.text
+      );
+      if (dup >= 0) {
+        existing[dup] = { project, area, notice };
+        r.notices = existing;
+      } else {
+        r.notices = [...existing, { project, area, notice }];
+      }
+    });
+  }
+  notices(project, area) {
+    return (this.read().notices ?? []).filter((n) => n.project === project && n.area === area).map((n) => n.notice);
+  }
+  clearNotices(project, area) {
+    this.update((r) => {
+      r.notices = (r.notices ?? []).filter((n) => !(n.project === project && n.area === area));
+    });
+  }
+  clearNoticesFrom(project, branches) {
+    const set = new Set(branches);
+    this.update((r) => {
+      r.notices = (r.notices ?? []).filter(
+        (n) => !(n.project === project && set.has(n.notice.from))
+      );
+    });
+  }
+  pruneNoticesWhere(project, area, remove) {
+    this.update((r) => {
+      r.notices = (r.notices ?? []).filter(
+        (n) => !(n.project === project && n.area === area && remove(n.notice))
+      );
+    });
+  }
+  allocateSlot(project, m, owner, effort, exclude = /* @__PURE__ */ new Set()) {
+    return this.update((r) => {
+      const taken = new Set(
+        r.leases.filter((l) => l.project === project && l.kind === "slot").map((l) => l.value)
+      );
+      const reserved = new Set(m.slots.reserved);
+      let slot = -1;
+      for (let n = 0; n < m.slots.count; n++) {
+        if (!taken.has(n) && !reserved.has(n) && !exclude.has(n)) {
+          slot = n;
+          break;
+        }
+      }
+      if (slot < 0) {
+        throw new WorkkitError(
+          "NO_FREE_SLOT",
+          `no free slot in ${project} (0..${m.slots.count - 1}, reserved ${[...reserved].join(",")})`
+        );
+      }
+      const lease = this.lease(
+        project,
+        "slot",
+        slot,
+        owner,
+        effort,
+        m.expiry.slotHours,
+        portsForSlot(m, slot)
+      );
+      r.leases.push(lease);
+      return lease;
+    });
+  }
+  addLease(kind, project, value, owner, effort, hours, extra = {}) {
+    return this.update((r) => {
+      const l = { ...this.lease(project, kind, value, owner, effort, hours), ...extra };
+      r.leases.push(l);
+      return l;
+    });
+  }
+  lease(project, kind, value, owner, effort, hours, ports) {
+    const now2 = this.now();
+    return {
+      id: newId("lease"),
+      project,
+      kind,
+      value,
+      ...ports ? { ports } : {},
+      owner,
+      effort,
+      created: now2.toISOString(),
+      touched: now2.toISOString(),
+      expires: new Date(now2.getTime() + hours * 36e5).toISOString()
+    };
+  }
+  touch(leaseId, hours) {
+    this.update((r) => {
+      const l = r.leases.find((x) => x.id === leaseId);
+      if (!l) throw new WorkkitError("LEASE_NOT_FOUND", leaseId);
+      const now2 = this.now();
+      l.touched = now2.toISOString();
+      l.expires = new Date(now2.getTime() + hours * 36e5).toISOString();
+    });
+  }
+  patchLease(leaseId, patch) {
+    this.update((r) => {
+      const i = r.leases.findIndex((x) => x.id === leaseId);
+      if (i < 0) throw new WorkkitError("LEASE_NOT_FOUND", leaseId);
+      r.leases[i] = { ...r.leases[i], ...patch };
+    });
+  }
+  release(leaseId) {
+    this.update((r) => {
+      r.leases = r.leases.filter((l) => l.id !== leaseId);
+    });
+  }
+  expired(now2 = this.now()) {
+    return this.read().leases.filter((l) => Date.parse(l.expires) < now2.getTime());
+  }
+  addEffort(e) {
+    this.update((r) => {
+      r.efforts.push(e);
+    });
+  }
+  updateEffort(id, patch) {
+    return this.update((r) => {
+      const i = r.efforts.findIndex((e) => e.id === id);
+      if (i < 0) throw new WorkkitError("EFFORT_NOT_FOUND", `no effort ${id}`);
+      r.efforts[i] = { ...r.efforts[i], ...patch };
+      return r.efforts[i];
+    });
+  }
+  removeEfforts(predicate) {
+    return this.update((r) => {
+      const before = r.efforts.length;
+      r.efforts = r.efforts.filter((e) => !predicate(e));
+      return before - r.efforts.length;
+    });
+  }
+};
+
+// src/core/runner.ts
+import { spawn, spawnSync as spawnSync3 } from "child_process";
+import { closeSync, openSync } from "fs";
+import { join as join7 } from "path";
+var DEFAULT_HEALTH_TIMEOUT_MS = 18e4;
+var HEALTH_POLL_MS = 1e3;
+var PROBE_CAP_MS = 1e4;
+var STOP_COMMAND_TIMEOUT_MS = 15e3;
+var STOP_GRACE_MS = 5e3;
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pidSignature(pid) {
+  const r = spawnSync3("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" });
+  return r.status === 0 ? (r.stdout ?? "").trim() : "";
+}
+function serviceModes(name, spec) {
+  if (spec.modes && spec.modes.length > 0) return spec.modes;
+  return name === "frontend" ? ["fullstack"] : ["backend", "fullstack"];
+}
+function probe(spec, cwd, env, timeoutMs = PROBE_CAP_MS) {
+  const r = spawnSync3("sh", ["-c", spec.health], {
+    cwd,
+    env,
+    encoding: "utf8",
+    timeout: Math.max(100, timeoutMs)
+  });
+  const out = (r.stdout ?? "").trim();
+  const last = out.split(/\s+/).filter(Boolean).pop() ?? "";
+  if (r.error) return { healthy: false, last: `probe ${r.error.message}` };
+  if (r.status !== 0) return { healthy: false, last: (r.stderr ?? "").trim() || out };
+  if (spec.healthyCodes && spec.healthyCodes.length > 0)
+    return { healthy: spec.healthyCodes.includes(Number(last)), last };
+  return { healthy: true, last };
+}
+async function waitHealthy(o) {
+  const budget = o.timeoutMs ?? o.spec.healthTimeoutMs ?? DEFAULT_HEALTH_TIMEOUT_MS;
+  const deadline = Date.now() + budget;
+  let last = "";
+  while (Date.now() < deadline) {
+    const p = probe(o.spec, o.cwd, o.env, Math.min(PROBE_CAP_MS, deadline - Date.now()));
+    if (p.healthy) return;
+    last = p.last;
+    if (Date.now() >= deadline) break;
+    await sleep2(Math.min(HEALTH_POLL_MS, Math.max(0, deadline - Date.now())));
+  }
+  throw new WorkkitError(
+    "HEALTH_TIMEOUT",
+    `service "${o.name}" was not healthy within ${(budget / 1e3).toFixed(0)} s (last probe: ${last || "no output"})`,
+    { service: o.name, last }
+  );
+}
+function spawnService(name, spec, a) {
+  const fd = openSync(join7(a.logDir, `${name}.log`), "a");
+  try {
+    const child = spawn("sh", ["-c", spec.start], {
+      cwd: a.cwd,
+      env: a.env,
+      detached: true,
+      stdio: ["ignore", fd, fd]
+    });
+    child.unref();
+    if (child.pid === void 0) {
+      throw new WorkkitError("SERVICE_FAILED", `service "${name}" did not spawn: ${spec.start}`, {
+        service: name
+      });
+    }
+    return child.pid;
+  } finally {
+    closeSync(fd);
+  }
+}
+async function startServices(a) {
+  const pids = {};
+  const signatures = {};
+  const targetMode = a.mode ?? "fullstack";
+  const entries = Object.entries(a.m.services).filter(([name, spec]) => {
+    if (a.onlyServices) return a.onlyServices.includes(name);
+    return serviceModes(name, spec).includes(targetMode);
+  });
+  for (const [name, spec] of entries) {
+    a.onLog?.(`starting ${name}: ${spec.start}`);
+    pids[name] = spawnService(name, spec, a);
+    signatures[name] = pidSignature(pids[name]);
+    a.onSpawn?.(name, pids[name], signatures[name]);
+    try {
+      await waitHealthy({ name, spec, cwd: a.cwd, env: a.env });
+    } catch (err) {
+      await stopServices({ m: a.m, cwd: a.cwd, env: a.env, pids, signatures, onLog: a.onLog });
+      throw err;
+    }
+    a.onLog?.(`${name} healthy (pid ${pids[name]})`);
+  }
+  return { pids, signatures };
+}
+function killGroup(pid, signal) {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  }
+}
+async function stopServices(o) {
+  const names = Object.keys(o.m.services).filter((n) => o.pids[n] !== void 0).reverse();
+  if (!o.skipStopCommands) {
+    for (const name of names) {
+      const spec = o.m.services[name];
+      o.onLog?.(`stopping ${name}: ${spec.stop}`);
+      const r = spawnSync3("sh", ["-c", spec.stop], {
+        cwd: o.cwd,
+        env: o.env,
+        encoding: "utf8",
+        timeout: STOP_COMMAND_TIMEOUT_MS
+      });
+      if (r.error) o.onLog?.(`stop command for ${name} ${r.error.message}`);
+    }
+  }
+  const ours = names.filter((n) => {
+    const pid = o.pids[n];
+    if (!isAlive(pid)) return false;
+    const expected = o.signatures?.[n];
+    if (expected === void 0) return true;
+    const actual = pidSignature(pid);
+    if (actual !== expected) {
+      o.onLog?.(
+        `not signalling pid ${pid} (${n}): it is no longer the process started for this lease`
+      );
+      return false;
+    }
+    return true;
+  });
+  const alive = () => ours.filter((n) => isAlive(o.pids[n]));
+  if (alive().length === 0) return;
+  for (const n of alive()) killGroup(o.pids[n], "SIGTERM");
+  const deadline = Date.now() + STOP_GRACE_MS;
+  while (alive().length > 0 && Date.now() < deadline) await sleep2(200);
+  for (const n of alive()) killGroup(o.pids[n], "SIGKILL");
+  const hardDeadline = Date.now() + STOP_GRACE_MS;
+  while (alive().length > 0 && Date.now() < hardDeadline) await sleep2(100);
+}
+
+// src/core/session.ts
+import { hostname, userInfo } from "os";
+function currentOwner(env = process.env) {
+  const named = [env.WORK_SESSION, env.CLAUDE_SESSION_NAME, env.CLAUDE_CODE_SESSION_ID].find(
+    (v) => v !== void 0 && v.length > 0
+  );
+  return { session: named ?? `${userInfo().username}@${hostname()}`, pid: process.pid };
+}
+
+// src/lib/storybrokr.ts
+import { spawnSync as spawnSync4 } from "child_process";
+var MIN_STORYBROKR_VERSION = "0.3.0";
+var versionChecked = false;
+function compareSemver(a, b) {
+  const pa = a.trim().replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const pb = b.trim().replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function run(args) {
+  const r = spawnSync4("storybrokr", args, { encoding: "utf8" });
+  if (r.error) {
+    throw new WorkkitError(
+      "STORYBROKR_FAILED",
+      `storybrokr is not installed (npm i -g @helmsmith/storybrokr): ${r.error.message}`
+    );
+  }
+  return { code: r.status ?? 1, out: r.stdout ?? "", err: r.stderr ?? "" };
+}
+function assertStorybrokrVersion() {
+  if (versionChecked) return;
+  const r = run(["--version"]);
+  const found = r.out.trim();
+  if (r.code !== 0 || compareSemver(found, MIN_STORYBROKR_VERSION) < 0) {
+    throw new WorkkitError(
+      "STORYBROKR_FAILED",
+      `storybrokr >= ${MIN_STORYBROKR_VERSION} required (found ${found || "unknown"}); upgrade @helmsmith/storybrokr`
+    );
+  }
+  versionChecked = true;
+}
+var storybrokrCli = {
+  async up(story, hostRoot, opts) {
+    assertStorybrokrVersion();
+    const args = ["up", story, "--host", hostRoot, "--json"];
+    if (opts?.ttlMinutes !== void 0) args.push("--ttl", String(opts.ttlMinutes));
+    const r = run(args);
+    if (r.code !== 0) {
+      throw new WorkkitError(
+        "STORYBROKR_FAILED",
+        `storybrokr up ${story} failed: ${r.err.trim() || r.out.trim()}`
+      );
+    }
+    const record = JSON.parse(r.out);
+    return { id: record.id, port: record.port, url: record.url };
+  },
+  async down(id) {
+    const r = run(["down", id]);
+    if (r.code !== 0)
+      throw new WorkkitError("STORYBROKR_FAILED", `storybrokr down ${id} failed: ${r.err.trim()}`);
+  },
+  async downHost(hostRoot) {
+    const r = spawnSync4("storybrokr", ["down", "--host", hostRoot, "--json"], { encoding: "utf8" });
+    void r;
+  },
+  async touch(id) {
+    const r = spawnSync4("storybrokr", ["touch", id], { encoding: "utf8" });
+    void r;
+  }
+};
+
+// src/lib/context.ts
+function resolveRepoRoot(cwd, override) {
+  if (override) return override;
+  return new Git(cwd).mainRoot();
+}
+async function buildCtx(opts = {}) {
+  const repoRoot = resolveRepoRoot(opts.cwd ?? process.cwd(), opts.projectRoot);
+  const manifest = await loadManifest(repoRoot);
+  const home = homeDir();
+  const registry = Registry.open(home);
+  if (!registry.project(manifest.project)) claimRanges(registry, manifest, repoRoot);
+  return {
+    home,
+    repoRoot,
+    manifest,
+    registry,
+    owner: currentOwner(),
+    runner: { start: startServices, stop: stopServices },
+    storybrokr: storybrokrCli,
+    log: opts.quiet ? () => {
+    } : (line) => console.error(chalk.gray(line))
+  };
+}
+
+// src/lib/effort.ts
+import {
+  appendFileSync as appendFileSync2,
+  cpSync,
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync6,
+  readdirSync,
+  realpathSync as realpathSync4,
+  rmSync as rmSync3,
+  statSync as statSync3
+} from "fs";
+import { connect, createServer } from "net";
+import { dirname as dirname3, join as join8 } from "path";
+var worktreePathFor = (ctx, area, task) => task ? join8(ctx.repoRoot, ctx.manifest.worktreeRoot, "_tasks", `${area}--${task}`) : join8(ctx.repoRoot, ctx.manifest.worktreeRoot, area);
+var branchFor = (type, area, task) => task ? `${type}/${area}--${task}` : `${type}/${area}`;
+var effortLabel2 = (area, task) => task ? `${area}--${task}` : area;
+var now = () => (/* @__PURE__ */ new Date()).toISOString();
+var STARTING_GRACE_MS = 30 * 6e4;
+var JOIN_WAIT_MS = 6e4;
+var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var realpathOr2 = (p) => {
+  try {
+    return realpathSync4(p);
+  } catch {
+    return p;
+  }
+};
+function fetchBaseOnce(ctx) {
+  new Git(ctx.repoRoot).tryRun(["fetch", "-q", "origin", ctx.manifest.baseBranch]);
+}
+function hoursFor(m, kind) {
+  return {
+    slot: m.expiry.slotHours,
+    storybook: m.expiry.storybookHours,
+    commons: m.expiry.commonsHours
+  }[kind];
+}
+function modeCovers(existing, requested) {
+  if (existing === "fullstack") return true;
+  return existing === requested;
+}
+var STORYBROKR_TOUCH_THROTTLE_MS = 6e4;
+function touchEffort(ctx, effort) {
+  const prevMs = Date.parse(effort.lastActivity);
+  const shouldTouchStorybrokr = Number.isNaN(prevMs) || Date.now() - prevMs >= STORYBROKR_TOUCH_THROTTLE_MS;
+  for (const l of ctx.registry.leases({ effort: effort.id })) {
+    ctx.registry.touch(l.id, hoursFor(ctx.manifest, l.kind));
+    if (l.kind === "storybook" && shouldTouchStorybrokr) {
+      void Promise.resolve(ctx.storybrokr.touch?.(String(l.value))).catch(() => {
+      });
+    }
+  }
+  ctx.registry.updateEffort(effort.id, { lastActivity: now() });
+}
+function portBusy(port) {
+  return new Promise((resolve4) => {
+    const srv = createServer();
+    srv.once("error", () => resolve4(true));
+    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve4(false)));
+  });
+}
+async function busyPorts(ports) {
+  const out = [];
+  for (const [service, port] of Object.entries(ports))
+    if (await portBusy(port)) out.push(`${service}=${port}`);
+  return out;
+}
+function portAnswers(port) {
+  return new Promise((resolve4) => {
+    const sock = connect({ port, host: "127.0.0.1" });
+    const done = (v) => {
+      sock.destroy();
+      resolve4(v);
+    };
+    sock.setTimeout(300, () => done(false));
+    sock.once("connect", () => done(true));
+    sock.once("error", () => done(false));
+  });
+}
+async function anyPortAnswers(ports) {
+  for (const port of Object.values(ports ?? {})) if (await portAnswers(port)) return true;
+  return false;
+}
+async function claimFreeSlot(ctx, effortId, warnings) {
+  const m = ctx.manifest;
+  const exclude = /* @__PURE__ */ new Set();
+  const busyNotes = [];
+  for (; ; ) {
+    const candidate = ctx.registry.allocateSlot(m.project, m, ctx.owner, effortId, exclude);
+    const busy = await busyPorts(candidate.ports ?? {});
+    if (busy.length === 0) {
+      if (busyNotes.length) warnings.push(...busyNotes);
+      return candidate;
+    }
+    ctx.registry.release(candidate.id);
+    exclude.add(candidate.value);
+    busyNotes.push(`slot ${candidate.value}: ${busy.join(", ")} already in use`);
+    ctx.log(busyNotes[busyNotes.length - 1]);
+  }
+}
+function guardStart(ctx, o) {
+  const m = ctx.manifest;
+  const spec = m.areas[o.area];
+  if (!spec)
+    throw new WorkkitError(
+      "AREA_UNKNOWN",
+      `unknown area "${o.area}" (known: ${Object.keys(m.areas).join(", ")})`,
+      { area: o.area }
+    );
+  if (o.task !== void 0 && !TASK_SLUG.test(o.task))
+    throw new WorkkitError(
+      "TASK_INVALID",
+      `invalid task slug "${o.task}" (must match /^[a-z0-9][a-z0-9_-]{0,47}$/ with no "--")`,
+      { task: o.task }
+    );
+  if (!m.branch.types.includes(o.type))
+    throw new WorkkitError(
+      "TYPE_UNKNOWN",
+      `unknown type "${o.type}" (allowed: ${m.branch.types.join(", ")})`,
+      { type: o.type }
+    );
+  if (o.mode !== "frontend" && o.mode !== "backend" && o.mode !== "fullstack")
+    throw new WorkkitError(
+      "MODE_UNKNOWN",
+      `unknown mode "${o.mode}" (frontend | backend | fullstack)`
+    );
+  const branch = branchFor(o.type, o.area, o.task);
+  assertNotProtected(m, branch);
+  const scopes = expandScopes(m, o.area, o.mode, o.scopes, Boolean(o.task));
+  const commons = spec.commons ?? [];
+  const warnings = [];
+  if (commons.length > 0) {
+    for (const e of ctx.registry.efforts({ project: m.project })) {
+      if (e.area === o.area && (e.task ?? void 0) === (o.task ?? void 0) || e.state !== "active" && e.state !== "starting" || !existsSync7(e.worktree))
+        continue;
+      const changed = new Git(e.worktree).tryRun(["diff", "--name-only", "--no-renames", `origin/${m.baseBranch}...HEAD`]).out.split("\n").filter(Boolean);
+      const hit = commonsTouched(m, changed).filter((c) => commons.includes(c));
+      if (hit.length > 0)
+        warnings.push(
+          `${effortLabel2(e.area, e.task)} (${e.branch}, ${e.owner.session}) already has commits under commons ${hit.join(", ")}: coordinate or wait for its merge`
+        );
+    }
+  }
+  return { branch, scopes, commons, warnings };
+}
+function reserveEffort(ctx, o, branch, scopes, commons) {
+  const m = ctx.manifest;
+  const effort = {
+    id: newId("eff"),
+    project: m.project,
+    area: o.area,
+    ...o.task ? { task: o.task } : {},
+    type: o.type,
+    mode: o.mode,
+    branch,
+    worktree: worktreePathFor(ctx, o.area, o.task),
+    owner: ctx.owner,
+    state: "starting",
+    scopes,
+    commons,
+    leases: [],
+    notices: [],
+    started: now(),
+    lastActivity: now()
+  };
+  ctx.registry.update((r) => {
+    const open = r.efforts.filter(
+      (e) => e.project === m.project && (e.state === "active" || e.state === "starting")
+    );
+    const onTarget = open.find(
+      (e) => e.area === o.area && (e.task ?? void 0) === (o.task ?? void 0)
+    );
+    if (onTarget) {
+      const label = effortLabel2(o.area, o.task);
+      throw new WorkkitError(
+        "EFFORT_OPEN",
+        `an effort is open on ${label} (${onTarget.branch}, ${onTarget.mode}) owned by ${onTarget.owner.session} since ${onTarget.started}; finish it, or pass --join to work in the same checkout`,
+        { owner: onTarget.owner.session, effort: onTarget.id, branch: onTarget.branch }
+      );
+    }
+    for (const e of open) {
+      const pairs = globsOverlap(scopes, e.scopes);
+      if (pairs.length > 0) {
+        const otherLabel = effortLabel2(e.area, e.task);
+        throw new WorkkitError(
+          "SCOPE_CONFLICT",
+          `scope overlaps the open effort on ${otherLabel} (${e.branch}, owner ${e.owner.session}): ${pairs.join("; ")}`,
+          { with: otherLabel, owner: e.owner.session, effort: e.id, pairs }
+        );
+      }
+    }
+    r.efforts.push(effort);
+  });
+  return effort;
+}
+function ensureWorktree(ctx, area, branch, task) {
+  const m = ctx.manifest;
+  const path = worktreePathFor(ctx, area, task);
+  const main = new Git(ctx.repoRoot);
+  if (!existsSync7(path)) {
+    main.worktreeAdd(path, branch, `origin/${m.baseBranch}`);
+    const wg2 = new Git(path);
+    wg2.repairSubmodules(ctx.repoRoot, ctx.log);
+    return { wg: wg2, created: true };
+  }
+  const registered = main.run(["worktree", "list", "--porcelain"]).split("\n").filter((l) => l.startsWith("worktree ")).map((l) => realpathOr2(l.slice(9)));
+  const real = realpathOr2(path);
+  const wg = new Git(path);
+  const topLevel = wg.tryRun(["rev-parse", "--show-toplevel"]);
+  if (!registered.includes(real) || topLevel.code !== 0 || realpathOr2(topLevel.out.trim()) !== real || wg.isMainCheckout()) {
+    throw new WorkkitError(
+      "WORKTREE_INVALID",
+      `${path} exists but is not this repository's worktree for ${effortLabel2(area, task)} (a leftover directory?); move it away, or \`git worktree prune\` and retry`,
+      { worktree: path }
+    );
+  }
+  wg.repairSubmodules(ctx.repoRoot, ctx.log);
+  const current = wg.currentBranch();
+  if (current !== branch) {
+    if (wg.isDirty())
+      throw new WorkkitError(
+        "DIRTY_WORKTREE",
+        `${path} has uncommitted changes on ${current}; commit or park them before switching to ${branch}`,
+        { worktree: path }
+      );
+    const unshipped = wg.commitsNotOn(m.baseBranch);
+    if (unshipped.length > 0 && !wg.isEquivalentToBase(m.baseBranch)) {
+      throw new WorkkitError(
+        "EFFORT_OPEN",
+        `${current} holds ${unshipped.length} commit(s) not yet on ${m.baseBranch}: ship or finish it first, or --join it`,
+        { branch: current, area }
+      );
+    }
+    wg.checkout(branch, `origin/${m.baseBranch}`);
+    if (!wg.isDirty() && wg.commitsNotOn(m.baseBranch).length > 0 && wg.isEquivalentToBase(m.baseBranch)) {
+      wg.run(["reset", "--hard", `origin/${m.baseBranch}`]);
+    }
+  } else if (!wg.isDirty() && wg.commitsNotOn(m.baseBranch).length > 0 && wg.isEquivalentToBase(m.baseBranch)) {
+    wg.run(["reset", "--hard", `origin/${m.baseBranch}`]);
+  }
+  return { wg, created: false };
+}
+function appendLog(file, line) {
+  appendFileSync2(file, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`);
+}
+async function startEffort(ctx, o) {
+  const m = ctx.manifest;
+  fetchBaseOnce(ctx);
+  const { branch, scopes, commons, warnings } = guardStart(ctx, o);
+  const notices = ctx.registry.notices(m.project, o.area);
+  let open = ctx.registry.openEffortFor(m.project, o.area, o.task);
+  if (open && o.join) {
+    const deadline = Date.now() + JOIN_WAIT_MS;
+    while (open && open.state === "starting" && Date.now() < deadline) {
+      await sleep3(200);
+      open = ctx.registry.openEffortFor(m.project, o.area, o.task);
+    }
+    if (!open || open.state !== "active") {
+      throw new WorkkitError(
+        "EFFORT_NOT_FOUND",
+        `effort on ${effortLabel2(o.area, o.task)} did not become active in time to join`,
+        { area: o.area, task: o.task }
+      );
+    }
+    if (!modeCovers(open.mode, o.mode)) {
+      const label = effortLabel2(o.area, o.task);
+      throw new WorkkitError(
+        "MODE_MISMATCH",
+        `open effort on ${label} is in ${open.mode} mode, which does not cover ${o.mode}; run \`work promote --area ${o.area}${o.task ? ` --task ${o.task}` : ""} --mode fullstack\` first`,
+        { area: o.area, task: o.task, openMode: open.mode, requestedMode: o.mode }
+      );
+    }
+    const currentLeases = ctx.registry.leases({ effort: open.id });
+    if (o.story && !currentLeases.some((l) => l.kind === "storybook")) {
+      const hostRoot = storybookHostFor(m, open.worktree);
+      const inst = await ctx.storybrokr.up(o.story, hostRoot, {
+        ttlMinutes: Math.ceil(m.expiry.storybookHours * 60)
+      });
+      const sbLease = ctx.registry.addLease(
+        "storybook",
+        m.project,
+        inst.id,
+        ctx.owner,
+        open.id,
+        m.expiry.storybookHours,
+        { ports: { storybook: inst.port } }
+      );
+      open = ctx.registry.updateEffort(open.id, {
+        leases: [...open.leases, sbLease.id]
+      });
+    }
+    const existingParticipants = open.participants ?? [];
+    const isAlreadyMember = open.owner.session === ctx.owner.session || existingParticipants.some((p) => p.session === ctx.owner.session);
+    if (!isAlreadyMember) {
+      open = ctx.registry.updateEffort(open.id, {
+        participants: [...existingParticipants, ctx.owner]
+      });
+    }
+    touchEffort(ctx, open);
+    return {
+      effort: open,
+      leases: ctx.registry.leases({ effort: open.id }),
+      sync: "skipped",
+      refreshed: [],
+      marks: [],
+      joined: true,
+      warnings,
+      notices
+    };
+  }
+  const effort = reserveEffort(ctx, o, branch, scopes, commons);
+  const leases = [];
+  const abandon = async (stopPids) => {
+    for (const l of ctx.registry.leases({ effort: effort.id })) {
+      if (stopPids && l.kind === "slot" && l.pids && Object.keys(l.pids).length > 0) {
+        await ctx.runner.stop({
+          m,
+          cwd: effort.worktree,
+          env: process.env,
+          pids: l.pids,
+          signatures: l.signatures,
+          onLog: ctx.log
+        }).catch(() => void 0);
+      } else if (stopPids && l.kind === "storybook") {
+        await ctx.storybrokr.down(String(l.value)).catch(() => void 0);
+      }
+      ctx.registry.release(l.id);
+    }
+    ctx.registry.removeEfforts((e) => e.id === effort.id);
+  };
+  const onSignal = () => {
+    abandon(true).finally(() => process.exit(130));
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  try {
+    const { wg, created } = ensureWorktree(ctx, o.area, branch, o.task);
+    const worktree = wg.root();
+    ctx.registry.updateEffort(effort.id, { worktree });
+    effort.worktree = worktree;
+    const logDir = join8(worktree, m.logs.dir);
+    mkdirSync6(logDir, { recursive: true });
+    const refreshLog = join8(logDir, "refresh.log");
+    const stampFile = join8(logDir, ".refresh-stamps.json");
+    if (created && m.seed && m.seed.length > 0) {
+      runRefresh(
+        m.seed,
+        worktree,
+        (l) => {
+          appendLog(refreshLog, l);
+          ctx.log(l);
+        },
+        { ...process.env, WORKTREE: worktree, MAIN_ROOT: ctx.repoRoot }
+      );
+    }
+    let sync = "skipped";
+    let changed = [];
+    if (o.sync !== false) {
+      const r = wg.syncFrom(m.baseBranch);
+      if (r.kind === "conflict") {
+        throw new WorkkitError(
+          "SYNC_CONFLICT",
+          `merging origin/${m.baseBranch} into ${branch} conflicts in ${r.conflicted.join(", ")}; resolve in ${worktree}, commit, then rerun with --no-sync`,
+          { conflicted: r.conflicted, worktree }
+        );
+      }
+      sync = r.kind;
+      if (r.kind === "ff" || r.kind === "merge") changed = wg.changedPaths(r.before, r.after);
+      ctx.registry.pruneNoticesWhere(
+        m.project,
+        o.area,
+        (n) => wg.isAncestor(`origin/${n.from}`, "HEAD") || wg.isAncestor(n.from, "HEAD")
+      );
+    }
+    const sel = selectRefresh(m.refresh, changed, { worktree, stampFile });
+    runRefresh(
+      sel.runs,
+      worktree,
+      (l) => {
+        appendLog(refreshLog, l);
+        ctx.log(l);
+      },
+      process.env,
+      {
+        stampFile,
+        pendingStamps: sel.pendingStamps,
+        restoreFiles: sel.cleanWhenFiles
+      }
+    );
+    const baseSha = wg.rev("HEAD");
+    for (const name of commons)
+      leases.push(
+        ctx.registry.addLease(
+          "commons",
+          m.project,
+          name,
+          ctx.owner,
+          effort.id,
+          m.expiry.commonsHours
+        )
+      );
+    if (o.mode === "fullstack" || o.mode === "backend") {
+      const slot = await claimFreeSlot(ctx, effort.id, warnings);
+      leases.push(slot);
+      const cfg = emitWorktreeConfig({
+        m,
+        worktree,
+        slot: slot.value,
+        ports: slot.ports ?? {},
+        area: o.area,
+        branch
+      });
+      const env = { ...process.env, ...cfg.vars };
+      if (sel.marks.includes("db-reset") && m.services.postgres?.reset) {
+        runRefresh([m.services.postgres.reset], worktree, (l) => appendLog(refreshLog, l), env);
+      }
+      const pids = {};
+      const signatures = {};
+      const result = await ctx.runner.start({
+        m,
+        cwd: worktree,
+        env,
+        logDir,
+        mode: o.mode,
+        onLog: ctx.log,
+        onSpawn: (service, pid, signature) => {
+          pids[service] = pid;
+          signatures[service] = signature;
+          ctx.registry.patchLease(slot.id, { pids: { ...pids }, signatures: { ...signatures } });
+        }
+      });
+      ctx.registry.patchLease(slot.id, {
+        pids: result.pids,
+        signatures: result.signatures ?? signatures
+      });
+    } else {
+      let storybookPort;
+      if (o.story) {
+        const hostRoot = storybookHostFor(m, worktree);
+        const inst = await ctx.storybrokr.up(o.story, hostRoot, {
+          ttlMinutes: Math.ceil(m.expiry.storybookHours * 60)
+        });
+        storybookPort = inst.port;
+        leases.push(
+          ctx.registry.addLease(
+            "storybook",
+            m.project,
+            inst.id,
+            ctx.owner,
+            effort.id,
+            m.expiry.storybookHours,
+            { ports: { storybook: inst.port } }
+          )
+        );
+      }
+      emitWorktreeConfig({ m, worktree, ports: {}, storybookPort, area: o.area, branch });
+    }
+    const active = ctx.registry.updateEffort(effort.id, {
+      state: "active",
+      baseSha,
+      leases: leases.map((l) => l.id),
+      lastActivity: now()
+    });
+    return {
+      effort: active,
+      leases: ctx.registry.leases({ effort: effort.id }),
+      sync,
+      refreshed: sel.runs,
+      marks: sel.marks,
+      joined: false,
+      warnings,
+      notices
+    };
+  } catch (err) {
+    await abandon(true);
+    throw err;
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+}
+async function promoteEffort(ctx, o) {
+  const m = ctx.manifest;
+  if (o.mode !== "backend" && o.mode !== "fullstack") {
+    throw new WorkkitError("MODE_UNKNOWN", `promote target mode must be backend or fullstack`);
+  }
+  const open = ctx.registry.openEffortFor(m.project, o.area, o.task);
+  if (!open) {
+    throw new WorkkitError(
+      "EFFORT_NOT_FOUND",
+      `no open effort on ${effortLabel2(o.area, o.task)} to promote`,
+      { area: o.area, task: o.task }
+    );
+  }
+  if (open.mode === "fullstack" && o.mode === "backend" || open.mode === "frontend" && o.mode === "backend") {
+    throw new WorkkitError(
+      "MODE_MISMATCH",
+      `cannot transition effort on ${effortLabel2(o.area, o.task)} from ${open.mode} to ${o.mode}`,
+      { from: open.mode, to: o.mode }
+    );
+  }
+  const modeScopes = expandScopes(m, o.area, o.mode);
+  const nextScopes = open.task ? [.../* @__PURE__ */ new Set([...open.scopes, ...modeScopes])] : modeScopes;
+  ctx.registry.update((r) => {
+    const others = r.efforts.filter(
+      (e) => e.project === m.project && e.id !== open.id && (e.state === "active" || e.state === "starting")
+    );
+    for (const e of others) {
+      const pairs = globsOverlap(nextScopes, e.scopes);
+      if (pairs.length > 0) {
+        const otherLabel = effortLabel2(e.area, e.task);
+        throw new WorkkitError(
+          "SCOPE_CONFLICT",
+          `promoting ${effortLabel2(o.area, o.task)} to ${o.mode} overlaps ${otherLabel} (${e.branch}): ${pairs.join("; ")}`,
+          { with: otherLabel, owner: e.owner.session, effort: e.id, pairs }
+        );
+      }
+    }
+    const idx = r.efforts.findIndex((e) => e.id === open.id);
+    if (idx >= 0) {
+      r.efforts[idx] = { ...r.efforts[idx], mode: o.mode, scopes: nextScopes, lastActivity: now() };
+    }
+  });
+  const warnings = [];
+  let slot = ctx.registry.leases({ effort: open.id, kind: "slot" })[0];
+  const sb = ctx.registry.leases({ effort: open.id, kind: "storybook" })[0];
+  if (!slot) {
+    slot = await claimFreeSlot(ctx, open.id, warnings);
+    ctx.registry.updateEffort(open.id, { leases: [...open.leases, slot.id] });
+  }
+  const cfg = emitWorktreeConfig({
+    m,
+    worktree: open.worktree,
+    slot: slot.value,
+    ports: slot.ports ?? {},
+    storybookPort: sb?.ports?.storybook,
+    area: o.area,
+    branch: open.branch
+  });
+  const env = { ...process.env, ...cfg.vars };
+  const logDir = join8(open.worktree, m.logs.dir);
+  mkdirSync6(logDir, { recursive: true });
+  const existingPids = { ...slot.pids ?? {} };
+  const existingSigs = { ...slot.signatures ?? {} };
+  const missingServices = Object.entries(m.services).filter(([name, spec]) => serviceModes(name, spec).includes(o.mode) && !existingPids[name]).map(([name]) => name);
+  if (missingServices.length > 0) {
+    const result = await ctx.runner.start({
+      m,
+      cwd: open.worktree,
+      env,
+      logDir,
+      mode: o.mode,
+      onlyServices: missingServices,
+      onLog: ctx.log,
+      onSpawn: (service, pid, signature) => {
+        existingPids[service] = pid;
+        existingSigs[service] = signature;
+        ctx.registry.patchLease(slot.id, {
+          pids: { ...existingPids },
+          signatures: { ...existingSigs }
+        });
+      }
+    });
+    ctx.registry.patchLease(slot.id, {
+      pids: { ...existingPids, ...result.pids },
+      signatures: { ...existingSigs, ...result.signatures ?? {} }
+    });
+  }
+  const updated = ctx.registry.updateEffort(open.id, { lastActivity: now() });
+  touchEffort(ctx, updated);
+  return {
+    effort: updated,
+    leases: ctx.registry.leases({ effort: open.id }),
+    startedServices: missingServices,
+    warnings
+  };
+}
+function behindBase(ctx, worktree) {
+  if (!existsSync7(worktree)) return 0;
+  const g = new Git(worktree);
+  const r = g.tryRun(["rev-list", "--count", `HEAD..origin/${ctx.manifest.baseBranch}`]);
+  return r.code === 0 ? Number(r.out.trim()) || 0 : 0;
+}
+function statusFor(ctx, area, task) {
+  const m = ctx.manifest;
+  fetchBaseOnce(ctx);
+  const names = (area ? [area] : Object.keys(m.areas)).sort();
+  const areas = names.map((name) => {
+    const effort = ctx.registry.openEffortFor(m.project, name, area ? task : void 0);
+    if (effort && area) touchEffort(ctx, effort);
+    const worktree = worktreePathFor(ctx, name, area ? task : void 0);
+    const out = {
+      area: area && task ? `${name}--${task}` : name,
+      leases: effort ? ctx.registry.leases({ effort: effort.id }) : [],
+      behindBase: behindBase(ctx, worktree),
+      notices: ctx.registry.notices(m.project, name)
+    };
+    if (effort) out.effort = effort;
+    if (existsSync7(worktree)) out.worktree = worktree;
+    return out;
+  });
+  return { project: m.project, areas, leases: ctx.registry.leases({ project: m.project }) };
+}
+function slotEnv(m, slot) {
+  return slotVars(m, { slot, ports: portsForSlot(m, slot) });
+}
+function effortEnv(ctx, area, task) {
+  const m = ctx.manifest;
+  const effort = ctx.registry.openEffortFor(m.project, area, task);
+  if (!effort)
+    throw new WorkkitError(
+      "EFFORT_NOT_FOUND",
+      `no open effort on ${effortLabel2(area, task)}; \`work start --area ${area} \u2026\` first`,
+      { area, task }
+    );
+  touchEffort(ctx, effort);
+  const slot = ctx.registry.leases({ effort: effort.id, kind: "slot" })[0];
+  const sb = ctx.registry.leases({ effort: effort.id, kind: "storybook" })[0];
+  const vars = slotVars(m, {
+    slot: slot ? slot.value : void 0,
+    ports: slot?.ports ?? {},
+    storybookPort: sb?.ports?.storybook,
+    area,
+    branch: effort.branch,
+    worktree: effort.worktree,
+    logDir: join8(effort.worktree, m.logs.dir)
+  });
+  return { ...vars, MODE: effort.mode };
+}
+function leaseEnv(ctx, effort, lease) {
+  const vars = slotVars(ctx.manifest, {
+    slot: lease.kind === "slot" ? lease.value : void 0,
+    ports: lease.ports ?? {},
+    area: effort.area,
+    branch: effort.branch,
+    worktree: effort.worktree,
+    logDir: join8(effort.worktree, ctx.manifest.logs.dir)
+  });
+  return { ...process.env, ...vars };
+}
+async function releaseLease(ctx, effort, lease) {
+  try {
+    if (lease.kind === "slot" && lease.pids && Object.keys(lease.pids).length > 0) {
+      const hasWorktree = effort !== void 0 && existsSync7(effort.worktree);
+      await ctx.runner.stop({
+        m: ctx.manifest,
+        cwd: hasWorktree && effort ? effort.worktree : ctx.repoRoot,
+        env: effort ? leaseEnv(ctx, effort, lease) : process.env,
+        pids: lease.pids,
+        signatures: lease.signatures,
+        skipStopCommands: !hasWorktree,
+        onLog: ctx.log
+      });
+    } else if (lease.kind === "storybook") {
+      await ctx.storybrokr.down(String(lease.value));
+    }
+  } catch (err) {
+    ctx.log(
+      `while releasing ${lease.kind} ${lease.value}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  ctx.registry.release(lease.id);
+}
+function leaveNotices(ctx, effort, commons) {
+  if (commons.length === 0) return 0;
+  const notice = {
+    from: effort.branch,
+    text: `commons ${commons.join(", ")} changed on ${effort.branch}: sync and re-verify`,
+    at: now()
+  };
+  let count = 0;
+  for (const area of Object.keys(ctx.manifest.areas)) {
+    if (area === effort.area) continue;
+    ctx.registry.addNotice(ctx.manifest.project, area, notice);
+    count++;
+  }
+  return count;
+}
+async function finishEffort(ctx, o) {
+  const m = ctx.manifest;
+  const effort = ctx.registry.openEffortFor(m.project, o.area, o.task) ?? ctx.registry.efforts({ project: m.project, area: o.area, state: "parked" }).filter((e) => (e.task ?? void 0) === (o.task ?? void 0)).sort((a, b) => b.started.localeCompare(a.started))[0];
+  if (!effort)
+    throw new WorkkitError(
+      "EFFORT_NOT_FOUND",
+      `no open or parked effort on ${effortLabel2(o.area, o.task)}`,
+      { area: o.area, task: o.task }
+    );
+  if (!o.force && effort.participants && effort.participants.length > 0) {
+    if (ctx.owner.session === effort.owner.session) {
+      const [nextOwner, ...rest] = effort.participants;
+      const updated = ctx.registry.updateEffort(effort.id, {
+        owner: nextOwner,
+        participants: rest,
+        lastActivity: now()
+      });
+      touchEffort(ctx, updated);
+      return { effort: updated, pushed: false, parked: false, left: true, notices: 0 };
+    }
+    if (effort.participants.some((p) => p.session === ctx.owner.session)) {
+      const updated = ctx.registry.updateEffort(effort.id, {
+        participants: effort.participants.filter((p) => p.session !== ctx.owner.session),
+        lastActivity: now()
+      });
+      touchEffort(ctx, updated);
+      return { effort: updated, pushed: false, parked: false, left: true, notices: 0 };
+    }
+  }
+  const label = effortLabel2(effort.area, effort.task);
+  const g = new Git(effort.worktree);
+  let parked = false;
+  if (g.isDirty()) {
+    if (!o.park) {
+      throw new WorkkitError(
+        "DIRTY_WORKTREE",
+        `${effort.worktree} has uncommitted changes: commit them, or \`work finish --park\` to commit them as wip(${label}) and push`,
+        { worktree: effort.worktree }
+      );
+    }
+    g.run(["add", "-A"]);
+    g.run(["commit", "-q", "-m", `wip(${label}): parked ${now()}`]);
+    parked = true;
+  }
+  if (o.intoArea) {
+    if (!effort.task) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        "--into-area requires a task sub-effort (--task <slug>)",
+        { area: effort.area }
+      );
+    }
+    fetchBaseOnce(ctx);
+    const parentBranch = branchFor(effort.type, effort.area);
+    const { wg: areaGit } = ensureWorktree(ctx, effort.area, parentBranch);
+    if (areaGit.isDirty()) {
+      throw new WorkkitError(
+        "DIRTY_WORKTREE",
+        `parent area worktree ${areaGit.cwd} has uncommitted changes; commit or clean it before merging task ${effort.branch} --into-area`,
+        { worktree: areaGit.cwd }
+      );
+    }
+    const merged = areaGit.tryRun(["merge", "--no-edit", "-q", effort.branch]);
+    if (merged.code !== 0) {
+      const conflicted = areaGit.tryRun(["diff", "--name-only", "--diff-filter=U"]).out.split("\n").map((l) => l.trim()).filter(Boolean);
+      areaGit.tryRun(["merge", "--abort"]);
+      throw new WorkkitError(
+        "SYNC_CONFLICT",
+        `merging ${effort.branch} into ${parentBranch} conflicts in ${conflicted.join(", ")}; resolve in ${effort.worktree} before retrying \`work finish --into-area\``,
+        { conflicted, worktree: areaGit.cwd }
+      );
+    }
+  }
+  for (const lease of ctx.registry.leases({ effort: effort.id }))
+    await releaseLease(ctx, effort, lease);
+  await Promise.resolve(ctx.storybrokr.downHost?.(storybookHostFor(m, effort.worktree))).catch(
+    () => void 0
+  );
+  let notices = 0;
+  if (!o.intoArea) {
+    g.push(effort.branch);
+    if (g.commitsNotOn(m.baseBranch).length > 0 && !g.isEquivalentToBase(m.baseBranch)) {
+      const since = g.changedSince(m.baseBranch);
+      const sinceSet = new Set(since);
+      const changed = effort.baseSha ? g.changedPaths(effort.baseSha, "HEAD").filter((p) => sinceSet.has(p)) : since;
+      notices = leaveNotices(ctx, effort, commonsTouched(m, changed));
+    }
+  }
+  if (effort.task) {
+    archiveWorktree(ctx, label, effort.worktree);
+    const main = new Git(ctx.repoRoot);
+    main.worktreeRemove(effort.worktree);
+    if (o.intoArea) {
+      main.deleteLocalBranch(effort.branch);
+    }
+    const finished2 = { ...effort, state: "finished", lastActivity: now() };
+    ctx.registry.removeEfforts((e) => e.id === effort.id);
+    return {
+      effort: finished2,
+      pushed: !o.intoArea,
+      parked,
+      mergedIntoArea: Boolean(o.intoArea),
+      notices
+    };
+  }
+  const finished = ctx.registry.updateEffort(effort.id, { state: "finished", lastActivity: now() });
+  return { effort: finished, pushed: true, parked, notices };
+}
+async function reapLeases(ctx, o = {}) {
+  const m = ctx.manifest;
+  const at = o.now ?? /* @__PURE__ */ new Date();
+  const efforts = new Map(ctx.registry.efforts({ project: m.project }).map((e) => [e.id, e]));
+  const leases = ctx.registry.leases({ project: m.project });
+  const doomed = /* @__PURE__ */ new Set();
+  for (const l of leases) {
+    const effort = efforts.get(l.effort);
+    if (effort?.state === "starting" && Date.now() - Date.parse(effort.started) < STARTING_GRACE_MS)
+      continue;
+    const expired = Date.parse(l.expires) < at.getTime();
+    const orphaned = !effort || !existsSync7(effort.worktree);
+    const garbage = orphaned && !await anyPortAnswers(l.ports);
+    if (expired || garbage) doomed.add(l.effort);
+  }
+  const reaped = leases.filter((l) => doomed.has(l.effort));
+  if (o.dryRun) return { reaped };
+  for (const lease of reaped) await releaseLease(ctx, efforts.get(lease.effort), lease);
+  for (const id of doomed) {
+    const effort = efforts.get(id);
+    if (effort) {
+      await Promise.resolve(ctx.storybrokr.downHost?.(storybookHostFor(m, effort.worktree))).catch(
+        () => void 0
+      );
+      if (effort.state === "active" || effort.state === "starting") {
+        ctx.registry.updateEffort(effort.id, {
+          state: "parked",
+          parkedReason: `idle: a lease expired by ${at.toISOString()}`,
+          lastActivity: now()
+        });
+      }
+    }
+  }
+  return { reaped };
+}
+var ARCHIVE_DIR = ".slot-archive";
+function dirSize(path) {
+  if (!existsSync7(path)) return 0;
+  let total = 0;
+  for (const entry of readdirSync(path, { withFileTypes: true })) {
+    const p = join8(path, entry.name);
+    total += entry.isDirectory() ? dirSize(p) : statSync3(p).size;
+  }
+  return total;
+}
+function archiveWorktree(ctx, area, worktree) {
+  const m = ctx.manifest;
+  const areaRoot = join8(ctx.repoRoot, ARCHIVE_DIR, area);
+  const stamp = now().replace(/[-:]/g, "").replace("T", "-").slice(0, 15);
+  const target = join8(areaRoot, stamp);
+  const archived = [];
+  for (const rel of m.archive.paths) {
+    const src = join8(worktree, rel);
+    if (!existsSync7(src)) continue;
+    const dst = join8(target, rel);
+    mkdirSync6(dirname3(dst), { recursive: true });
+    cpSync(src, dst, { recursive: true });
+    archived.push(dst);
+  }
+  if (archived.length > 0) ensureExcluded(ctx.repoRoot, [`${ARCHIVE_DIR}/`]);
+  if (existsSync7(areaRoot)) {
+    const stamps = readdirSync(areaRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort().reverse();
+    const cutoff = Date.now() - m.archive.keepDays * 864e5;
+    stamps.forEach((d, i) => {
+      const t = statSync3(join8(areaRoot, d)).mtimeMs;
+      if (i >= m.archive.keepPerArea || t < cutoff)
+        rmSync3(join8(areaRoot, d), { recursive: true, force: true });
+    });
+  }
+  return archived;
+}
+async function retireArea(ctx, o) {
+  const m = ctx.manifest;
+  if (!m.areas[o.area])
+    throw new WorkkitError("AREA_UNKNOWN", `unknown area "${o.area}"`, { area: o.area });
+  const open = ctx.registry.efforts({ project: m.project, area: o.area }).find((e) => e.state === "starting" || e.state === "active");
+  if (open)
+    throw new WorkkitError(
+      "EFFORT_OPEN",
+      `an effort is open on ${effortLabel2(open.area, open.task)} (${open.owner.session}); \`work finish\` it first`,
+      { owner: open.owner.session }
+    );
+  const worktree = realpathOr2(worktreePathFor(ctx, o.area));
+  const main = new Git(ctx.repoRoot);
+  let archived = [];
+  await Promise.resolve(ctx.storybrokr.downHost?.(storybookHostFor(m, worktree))).catch(
+    () => void 0
+  );
+  if (existsSync7(worktree)) {
+    const g = new Git(worktree);
+    if (g.isDirty())
+      throw new WorkkitError(
+        "UNPUSHED",
+        `${worktree} has uncommitted changes; commit and push them (or \`work finish --park\`) before retiring`,
+        { worktree }
+      );
+    const unpushed = g.unpushedCount(m.baseBranch);
+    if (unpushed > 0)
+      throw new WorkkitError(
+        "UNPUSHED",
+        `${g.currentBranch()} has ${unpushed} commit(s) not on origin; push before retiring`,
+        { worktree, unpushed }
+      );
+    archived = archiveWorktree(ctx, o.area, worktree);
+    main.worktreeRemove(worktree);
+  }
+  const branchesDeleted = [];
+  const branchesKept = [];
+  const allAreaBranches = m.branch.types.map((type) => `${type}/${o.area}`);
+  for (const branch of allAreaBranches) {
+    if (!main.branchExists(branch)) continue;
+    const onOrigin = main.remoteBranchExists(branch) && main.tryRun(["rev-list", "--count", `origin/${branch}..${branch}`]).out.trim() === "0";
+    if (onOrigin) {
+      main.deleteLocalBranch(branch);
+      branchesDeleted.push(branch);
+    } else branchesKept.push(branch);
+  }
+  ctx.registry.removeEfforts((e) => e.project === m.project && e.area === o.area);
+  ctx.registry.clearNotices(m.project, o.area);
+  ctx.registry.clearNoticesFrom(m.project, allAreaBranches);
+  return { archived, removed: worktree, branchesDeleted, branchesKept };
+}
+var BEHIND_LIMIT = 20;
+var NOTICE_STALE_MS = 7 * 864e5;
+var ARCHIVE_LIMIT_BYTES = 5 * 1024 ** 3;
+function registeredWorktrees(ctx) {
+  const out = [];
+  const porcelain = new Git(ctx.repoRoot).run(["worktree", "list", "--porcelain"]);
+  let current = null;
+  for (const line of porcelain.split("\n")) {
+    if (line.startsWith("worktree ")) current = { path: line.slice(9), branch: "" };
+    else if (line.startsWith("branch ") && current)
+      current.branch = line.slice(7).replace(/^refs\/heads\//, "");
+    else if (line === "" && current) {
+      out.push(current);
+      current = null;
+    }
+  }
+  if (current) out.push(current);
+  const wtRoot = join8(realpathOr2(ctx.repoRoot), ctx.manifest.worktreeRoot);
+  return out.filter((w) => existsSync7(w.path) && realpathOr2(w.path).startsWith(wtRoot));
+}
+async function auditProject(ctx) {
+  const m = ctx.manifest;
+  fetchBaseOnce(ctx);
+  const findings = [];
+  const types = m.branch.types.join("|");
+  const areaOf = (branch) => {
+    const match = new RegExp(`^(${types})/(.+?)(?:--([a-z0-9][a-z0-9_-]*))?$`).exec(branch);
+    return match && m.areas[match[2]] ? match[2] : null;
+  };
+  for (const w of registeredWorktrees(ctx)) {
+    const area = areaOf(w.branch);
+    if (!area) {
+      findings.push({
+        kind: "foreign-branch",
+        detail: `${w.path} is on "${w.branch || "detached HEAD"}", not a <type>/<area> branch of a declared area`
+      });
+      continue;
+    }
+    const g = new Git(w.path);
+    if (g.isDirty())
+      findings.push({
+        kind: "dirty",
+        area,
+        detail: `${w.path} has uncommitted changes on ${w.branch}`
+      });
+    const unpushed = g.unpushedCount(m.baseBranch);
+    if (unpushed > 0)
+      findings.push({
+        kind: "unpushed",
+        area,
+        detail: `${w.branch} has ${unpushed} commit(s) not on origin`
+      });
+    const behind = behindBase(ctx, w.path);
+    if (behind > BEHIND_LIMIT)
+      findings.push({
+        kind: "behind-base",
+        area,
+        detail: `${w.branch} is ${behind} commits behind ${m.baseBranch}`
+      });
+  }
+  const nowMs = Date.now();
+  for (const l of ctx.registry.leases({ project: m.project })) {
+    const half = (Date.parse(l.touched) + Date.parse(l.expires)) / 2;
+    if (nowMs > half)
+      findings.push({
+        kind: "lease-aging",
+        detail: `${l.kind} ${l.value} held by ${l.owner.session}, last used ${l.touched}, expires ${l.expires}`
+      });
+  }
+  for (const area of Object.keys(m.areas)) {
+    for (const n of ctx.registry.notices(m.project, area)) {
+      if (nowMs - Date.parse(n.at) > NOTICE_STALE_MS)
+        findings.push({ kind: "notice-stale", area, detail: `${n.text} (since ${n.at})` });
+    }
+  }
+  const bytes = dirSize(join8(ctx.repoRoot, ARCHIVE_DIR));
+  if (bytes > ARCHIVE_LIMIT_BYTES)
+    findings.push({
+      kind: "archive-size",
+      detail: `${ARCHIVE_DIR} holds ${(bytes / 1024 ** 3).toFixed(1)} GB`
+    });
+  return findings;
+}
+
+// src/commands/_shared/output.ts
+import chalk2 from "chalk";
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function fail(err, json) {
+  const body = toErrorBody(err);
+  if (json) console.error(JSON.stringify(body));
+  else {
+    console.error(chalk2.red(`${body.code}: ${body.message}`));
+    if (body.details) console.error(chalk2.gray(`  ${JSON.stringify(body.details)}`));
+  }
+  process.exit(exitCodeFor(body.code));
+}
+function warn(line) {
+  console.error(chalk2.yellow(`! ${line}`));
+}
+
+// src/commands/audit.ts
+function registerAudit(program2) {
+  program2.command("audit").description(
+    "List what would otherwise be forgotten: unsaved work, stray checkouts, aging leases, drift, stale notices"
+  ).option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the findings as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: true });
+      const findings = await auditProject(ctx);
+      if (o.json) printJson(findings);
+      else if (findings.length === 0) console.log(chalk3.green("nothing forgotten"));
+      else
+        for (const f of findings)
+          console.log(
+            `${chalk3.yellow(f.kind.padEnd(14))} ${f.area ? `${f.area}  ` : ""}${f.detail}`
+          );
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/env.ts
+function registerEnv(program2) {
+  program2.command("env").description("The slot-derived variables of an area's open effort, or of a slot number alone").option("--area <area>", "the area whose open effort to read").option("--task <slug>", "intra-area task slug").option(
+    "--slot <n>",
+    "compute the variables for this slot from the manifest alone",
+    (v) => Number(v)
+  ).option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print as JSON (default: KEY=value lines)").option("--sh", "print KEY=value lines (the default)").action(
+    async (o) => {
+      try {
+        const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: true });
+        let vars;
+        if (o.area) vars = effortEnv(ctx, o.area, o.task);
+        else if (o.slot !== void 0 && Number.isInteger(o.slot))
+          vars = slotEnv(ctx.manifest, o.slot);
+        else throw new WorkkitError("EFFORT_NOT_FOUND", "pass --area <area> or --slot <n>");
+        if (o.json) printJson(vars);
+        else for (const [k, v] of Object.entries(vars)) console.log(`${k}=${v}`);
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/commands/finish.ts
+import chalk4 from "chalk";
+function registerFinish(program2) {
+  program2.command("finish").description(
+    "Stop the effort's runner, release its leases, push its branch (or merge --into-area); area worktrees stay, task worktrees are cleaned up"
+  ).requiredOption("--area <area>", "the area whose open effort to finish").option("--task <slug>", "finish an intra-area task sub-effort").option("--park", "commit uncommitted changes as wip(<area>) instead of refusing").option("--into-area", "merge task branch into <type>/<area> instead of pushing to origin").option("--force", "stop and finish even if other joined participants remain").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(
+    async (o) => {
+      try {
+        const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+        const r = await finishEffort(ctx, {
+          area: o.area,
+          task: o.task,
+          park: o.park,
+          intoArea: o.intoArea,
+          force: o.force
+        });
+        if (o.json) printJson(r);
+        else {
+          const label = r.effort.task ? `${r.effort.area}--${r.effort.task}` : r.effort.area;
+          if (r.left) {
+            console.log(`${chalk4.bold(label)}: left shared effort (other participants remain)`);
+          } else if (r.mergedIntoArea) {
+            console.log(
+              `${chalk4.bold(label)} finished: ${r.effort.branch} merged into ${r.effort.type}/${r.effort.area}`
+            );
+          } else {
+            console.log(
+              `${chalk4.bold(label)} finished: ${r.effort.branch} pushed${r.parked ? " (uncommitted changes parked as wip)" : ""}`
+            );
+          }
+          if (r.notices) console.log(`  ${r.notices} area(s) told about commons changes`);
+        }
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/commands/hook.ts
+import { readFileSync as readFileSync5, realpathSync as realpathSync5 } from "fs";
+import { resolve as resolve2 } from "path";
+import chalk5 from "chalk";
+var ZEROS = /^0+$/;
+async function hookContext(cwd) {
+  const git = new Git(cwd);
+  const repoRoot = git.mainRoot();
+  try {
+    const manifest = await loadManifest(repoRoot);
+    return { git, repoRoot, manifest, registry: Registry.open(homeDir()) };
+  } catch (err) {
+    if (err instanceof WorkkitError && err.code === "MANIFEST_NOT_FOUND") return null;
+    throw err;
+  }
+}
+async function runPreCommit(cwd) {
+  const c = await hookContext(cwd);
+  if (!c) return 0;
+  const root = c.git.root();
+  touchByWorktree(c.registry, c.manifest, root);
+  const { refusals, warnings } = checkCommit({
+    m: c.manifest,
+    registry: c.registry,
+    git: c.git,
+    project: c.manifest.project,
+    branch: c.git.currentBranch(),
+    stagedPaths: c.git.changedPathsStaged(),
+    ownerSession: currentOwner().session,
+    checkoutRoot: root
+  });
+  for (const w of warnings) console.error(chalk5.yellow(`work: ${w}`));
+  for (const r of refusals) console.error(chalk5.red(`work: ${r}`));
+  return refusals.length ? 2 : 0;
+}
+async function runPrePush(cwd, stdin) {
+  const c = await hookContext(cwd);
+  if (!c) return 0;
+  touchByWorktree(c.registry, c.manifest, c.git.root());
+  let code = 0;
+  for (const line of stdin.split("\n").filter(Boolean)) {
+    const [localRef, localSha, remoteRef, remoteSha] = line.split(/\s+/);
+    if (!localRef || !localSha || !remoteRef) continue;
+    const isDelete = ZEROS.test(localSha);
+    const branch = isDelete ? "" : localRef.replace(/^refs\/heads\//, "");
+    let changed = [];
+    if (!isDelete) {
+      const from = remoteSha && !ZEROS.test(remoteSha) ? remoteSha : `origin/${c.manifest.baseBranch}`;
+      const range = remoteSha && !ZEROS.test(remoteSha) ? `${from}..${localSha}` : `${from}...${localSha}`;
+      changed = c.git.tryRun(["diff", "--name-only", "--no-renames", range]).out.split("\n").filter(Boolean);
+    }
+    const { refusals, warnings } = checkPush({
+      m: c.manifest,
+      registry: c.registry,
+      git: c.git,
+      project: c.manifest.project,
+      branch,
+      remoteRef,
+      isDelete,
+      changedPaths: changed
+    });
+    for (const w of warnings) console.error(chalk5.yellow(`work: ${w}`));
+    for (const r of refusals) console.error(chalk5.red(`work: ${r}`));
+    if (refusals.length) code = 2;
+  }
+  return code;
+}
+function touchByWorktree(registry, m, root) {
+  const same2 = (p) => {
+    try {
+      return realpathSync5(p) === realpathSync5(root);
+    } catch {
+      return false;
+    }
+  };
+  const hours = {
+    slot: m.expiry.slotHours,
+    storybook: m.expiry.storybookHours,
+    commons: m.expiry.commonsHours
+  };
+  for (const e of registry.efforts({ project: m.project })) {
+    if (e.state !== "active" && e.state !== "starting" || !same2(e.worktree)) continue;
+    for (const l of registry.leases({ effort: e.id })) registry.touch(l.id, hours[l.kind]);
+    registry.updateEffort(e.id, { lastActivity: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+}
+function registerHook(program2) {
+  const hook = program2.command("hook").description("Entry points the installed git hooks call");
+  hook.command("pre-commit").description("Refuse commits on protected branches and writes under write-locked commons").action(async () => {
+    try {
+      process.exit(await runPreCommit(process.cwd()));
+    } catch (err) {
+      fail(err, false);
+    }
+  });
+  hook.command("pre-push").description(
+    "Refuse pushes to protected branches; warn when paths leave the effort scope or touch commons"
+  ).argument("[remote]", "passed by git, unused").argument("[url]", "passed by git, unused").action(async () => {
+    try {
+      const stdin = process.stdin.isTTY ? "" : readFileSync5(0, "utf8");
+      process.exit(await runPrePush(process.cwd(), stdin));
+    } catch (err) {
+      fail(err, false);
+    }
+  });
+  const hooks = program2.command("hooks").description("Manage the git hooks in a clone");
+  hooks.command("install").description(
+    "Write .helmsmith/hooks and point this clone's core.hooksPath at them (for a repo whose manifest already exists)"
+  ).option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const repoRoot = o.projectRoot ? resolve2(o.projectRoot) : new Git(process.cwd()).mainRoot();
+      const manifest = await loadManifest(repoRoot);
+      const out = installHooks(repoRoot, { protectedBranches: manifest.protectedBranches });
+      if (o.json) printJson(out);
+      else for (const f of out.files) console.log(`installed ${f}`);
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync8, writeFileSync as writeFileSync5 } from "fs";
+import { join as join9, resolve as resolve3 } from "path";
+var STORYBOOK_BASE = 6100;
+function defaultService(name) {
+  const PORT = `\${PORT_${name.toUpperCase()}}`;
+  if (name === "postgres" || name === "db") {
+    return {
+      start: `docker compose up -d ${name}`,
+      stop: `docker compose stop ${name}`,
+      health: `pg_isready -h 127.0.0.1 -p ${PORT} -q`,
+      healthTimeoutMs: 12e4
+    };
+  }
+  return {
+    start: `make -C ${name} dev`,
+    stop: `make -C ${name} dev-stop`,
+    health: `curl -sf -o /dev/null http://127.0.0.1:${PORT}/health`,
+    healthTimeoutMs: 3e5
+  };
+}
+function buildStarterManifest(o) {
+  const ports = {};
+  const services = {};
+  for (const spec of o.services) {
+    const m = /^([a-z][a-z0-9_-]*)=(\d{4,5})$/.exec(spec);
+    if (!m)
+      throw new WorkkitError("MANIFEST_INVALID", `--service expects name=port, got "${spec}"`);
+    ports[m[1]] = { base: Number(m[2]) };
+    services[m[1]] = defaultService(m[1]);
+  }
+  if (o.storybookHost) ports.storybook = { base: STORYBOOK_BASE };
+  const manifest = {
+    project: o.project,
+    baseBranch: o.baseBranch,
+    protectedBranches: [o.baseBranch],
+    worktreeRoot: o.worktreeRoot ?? ".claude/worktrees",
+    branch: { types: ["feature", "chore", "fix"] },
+    slots: { count: 10, reserved: [0] },
+    ports: { services: ports },
+    services,
+    ...o.storybookHost ? { storybook: { hostRoot: o.storybookHost } } : {},
+    logs: { dir: ".logs" },
+    refresh: [],
+    scopes: {
+      frontend: [
+        "app/{group}/{section}/**",
+        "components/{group}/{section}/**",
+        "app/api/{section}/**"
+      ],
+      backend: ["services/{module}/**"]
+    },
+    areas: {},
+    commons: {},
+    expiry: { slotHours: 12, commonsHours: 4, storybookHours: 2 },
+    archive: { paths: [], keepDays: 30, keepPerArea: 5 }
+  };
+  validateManifest(manifest);
+  return manifest;
+}
+var HEADER = `// biome-ignore-all lint/suspicious/noTemplateCurlyInString: \${PORT_*} are the manifest's own placeholders
+// helmsmith.config.mjs \u2014 read by \`work\` (@helmsmith/workbrokr). Written by \`work init\`.
+// Edit: the services' start/stop/health commands, the scope templates, the areas (leaves only,
+// each with its backend module) and the commons. Nothing here is read by the application.
+`;
+function runInit(o) {
+  const repoRoot = resolve3(o.repoRoot);
+  for (const name of MANIFEST_FILES) {
+    if (existsSync8(join9(repoRoot, name)) && !o.force) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        `${name} already exists in ${repoRoot}; pass --force to overwrite`
+      );
+    }
+  }
+  const manifest = buildStarterManifest(o);
+  const manifestPath = join9(repoRoot, "helmsmith.config.mjs");
+  writeFileSync5(manifestPath, `${HEADER}export default ${JSON.stringify(manifest, null, 2)};
+`);
+  claimRanges(Registry.open(o.home), validateManifest(manifest), repoRoot);
+  const hooks = o.hooks ? installHooks(repoRoot, { protectedBranches: [o.baseBranch] }).files : [];
+  return { manifestPath, hooks };
+}
+function defaultRepoRoot() {
+  try {
+    return new Git(process.cwd()).mainRoot();
+  } catch {
+    return process.cwd();
+  }
+}
+function defaultBaseBranch(repoRoot) {
+  const g = new Git(repoRoot);
+  const head = g.tryRun(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+  if (head.code === 0) return head.out.trim().replace(/^origin\//, "");
+  return "main";
+}
+function registerInit(program2) {
+  program2.command("init").description(
+    "Write helmsmith.config.mjs for this repo, claim its port ranges, install the git hooks"
+  ).requiredOption("--project <name>", "project name (lowercase, digits, dashes)").option("--base-branch <branch>", "base branch (default: origin's HEAD, else main)").option(
+    "--service <name=port>",
+    "a service and its slot-0 port; repeat per service",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--storybook-host <dir>", "the package whose .storybook storybrokr boots from").option("--worktree-root <dir>", "where area worktrees live (default .claude/worktrees)").option("--repo-root <dir>", "repository root (default: the main checkout of the cwd)").option("--no-hooks", "do not install the git hooks").option("--force", "overwrite an existing manifest").option("--json", "print the result as JSON").action(
+    (o) => {
+      try {
+        const repoRoot = o.repoRoot ? resolve3(o.repoRoot) : defaultRepoRoot();
+        if (o.service.length === 0)
+          throw new WorkkitError(
+            "MANIFEST_INVALID",
+            "at least one --service name=port is required"
+          );
+        const out = runInit({
+          repoRoot,
+          home: homeDir(),
+          project: o.project,
+          baseBranch: o.baseBranch ?? defaultBaseBranch(repoRoot),
+          services: o.service,
+          storybookHost: o.storybookHost,
+          worktreeRoot: o.worktreeRoot,
+          hooks: o.hooks,
+          force: o.force === true
+        });
+        if (o.json) printJson(out);
+        else {
+          console.log(`wrote ${out.manifestPath}`);
+          for (const h of out.hooks) console.log(`installed ${h}`);
+          console.log(
+            "next: edit the services and areas, commit helmsmith.config.mjs and .helmsmith/hooks, then `work start`"
+          );
+        }
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z as z2 } from "zod";
+
+// src/version.ts
+import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
+import { dirname as dirname4, join as join10 } from "path";
+import { fileURLToPath } from "url";
+function findPackageJson(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const candidate = join10(dir, "package.json");
+    if (existsSync9(candidate)) return candidate;
+    const parent = dirname4(dir);
+    if (parent === dir) throw new Error(`package.json not found above ${startDir}`);
+    dir = parent;
+  }
+}
+var pkgFile = findPackageJson(dirname4(fileURLToPath(import.meta.url)));
+var VERSION = JSON.parse(readFileSync6(pkgFile, "utf8")).version;
+
+// src/mcp/server.ts
+var ok = (value) => ({
+  content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
+});
+var failed = (err) => ({
+  content: [{ type: "text", text: JSON.stringify(toErrorBody(err)) }],
+  isError: true
+});
+async function guard(fn) {
+  try {
+    return ok(await fn());
+  } catch (err) {
+    return failed(err);
+  }
+}
+function buildMcpServer(ctxFactory) {
+  const server = new McpServer({ name: "work", version: VERSION });
+  server.registerTool(
+    "work_start",
+    {
+      description: "Start an effort on an area (or intra-area task): its worktree on <type>/<area> (or <type>/<area>--<task>), synced from the base branch, refreshed, leased (a slot for fullstack/backend, a storybrokr instance for frontend with a story) and running. Refuses with EFFORT_OPEN (another effort is open; join=true to share it), SCOPE_CONFLICT, SYNC_CONFLICT (resolve in the worktree, rerun with sync=false).",
+      inputSchema: {
+        area: z2.string().describe("a leaf area from helmsmith.config (e.g. org/applications)"),
+        task: z2.string().optional().describe("optional intra-area task slug for parallel sub-efforts (<type>/<area>--<task>)"),
+        type: z2.string().describe("feature | chore | fix"),
+        mode: z2.enum(["frontend", "backend", "fullstack"]),
+        scopes: z2.array(z2.string()).optional().describe("optional narrowed scope globs for a task sub-effort"),
+        story: z2.string().optional().describe(
+          "frontend: story file or component folder for storybrokr, relative to its host"
+        ),
+        join: z2.boolean().optional().describe("work in the already-open effort instead of refusing"),
+        sync: z2.boolean().optional().describe("fetch and merge the base branch first (default true)"),
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ area, task, type, mode, scopes, story, join: join11, sync, projectRoot }) => guard(
+      async () => startEffort(await ctxFactory(projectRoot), {
+        area,
+        task,
+        type,
+        mode,
+        scopes,
+        story,
+        join: join11,
+        sync
+      })
+    )
+  );
+  server.registerTool(
+    "work_promote",
+    {
+      description: "Promote an open effort in place to backend or fullstack mode, claiming a slot if needed and starting only newly required services.",
+      inputSchema: {
+        area: z2.string().describe("the area of the open effort"),
+        task: z2.string().optional().describe("optional intra-area task slug"),
+        mode: z2.enum(["backend", "fullstack"]).describe("target mode to promote into"),
+        story: z2.string().optional().describe("optional story path"),
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ area, task, mode, story, projectRoot }) => guard(async () => promoteEffort(await ctxFactory(projectRoot), { area, task, mode, story }))
+  );
+  server.registerTool(
+    "work_status",
+    {
+      description: "Per area: the open effort, its leases, how far behind the base branch it is, pending notices; plus every lease of the project.",
+      inputSchema: {
+        area: z2.string().optional(),
+        task: z2.string().optional(),
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ area, task, projectRoot }) => guard(async () => statusFor(await ctxFactory(projectRoot), area, task))
+  );
+  server.registerTool(
+    "work_finish",
+    {
+      description: "Stop the effort's runner, release its leases, push its branch (or merge --into-area for task sub-efforts), leave commons notices. Refuses DIRTY_WORKTREE unless park=true (commits as wip).",
+      inputSchema: {
+        area: z2.string(),
+        task: z2.string().optional().describe("optional intra-area task slug"),
+        park: z2.boolean().optional(),
+        intoArea: z2.boolean().optional().describe("merge task branch into <type>/<area> instead of pushing to origin"),
+        force: z2.boolean().optional().describe("stop and finish even if other joined participants remain"),
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ area, task, park, intoArea, force, projectRoot }) => guard(
+      async () => finishEffort(await ctxFactory(projectRoot), { area, task, park, intoArea, force })
+    )
+  );
+  server.registerTool(
+    "work_reap",
+    {
+      description: "Expire idle leases: stop only what they started, release them, park their efforts. dryRun lists without touching.",
+      inputSchema: {
+        dryRun: z2.boolean().optional(),
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ dryRun, projectRoot }) => guard(async () => reapLeases(await ctxFactory(projectRoot), { dryRun }))
+  );
+  server.registerTool(
+    "work_audit",
+    {
+      description: "Findings: dirty or unpushed area worktrees, foreign worktrees, aging leases, drift from the base branch, stale notices, archive size.",
+      inputSchema: {
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ projectRoot }) => guard(async () => auditProject(await ctxFactory(projectRoot)))
+  );
+  server.registerTool(
+    "work_env",
+    {
+      description: "The slot-derived variables of an area's open effort (PORT_*, SLOT, LOG_DIR, WORKTREE, BRANCH, MODE).",
+      inputSchema: {
+        area: z2.string(),
+        task: z2.string().optional(),
+        projectRoot: z2.string().optional().describe("optional repository root path override")
+      }
+    },
+    async ({ area, task, projectRoot }) => guard(async () => effortEnv(await ctxFactory(projectRoot), area, task))
+  );
+  return server;
+}
+async function runStdio() {
+  const server = buildMcpServer((projectRoot) => buildCtx({ projectRoot, quiet: true }));
+  await server.connect(new StdioServerTransport());
+}
+
+// src/commands/mcp.ts
+function registerMcp(program2) {
+  program2.command("mcp").description("Serve the MCP stdio interface (the same verbs as the CLI)").action(async () => {
+    await runStdio();
+  });
+}
+
+// src/commands/promote.ts
+import chalk6 from "chalk";
+function registerPromote(program2) {
+  program2.command("promote").description("Promote an open effort in place to backend or fullstack mode").requiredOption("--area <area>", "the area of the open effort").option("--task <slug>", "intra-area task slug if promoting a task sub-effort").requiredOption("--mode <mode>", "target mode: backend | fullstack").option("--story <path>", "optional story path to attach via storybrokr").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(
+    async (o) => {
+      try {
+        const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+        const r = await promoteEffort(ctx, {
+          area: o.area,
+          task: o.task,
+          mode: o.mode,
+          story: o.story
+        });
+        if (o.json) printJson(r);
+        else {
+          const label = r.effort.task ? `${r.effort.area}--${r.effort.task}` : r.effort.area;
+          console.log(
+            `${chalk6.bold(label)} promoted to ${r.effort.mode}${r.startedServices.length ? ` (started: ${r.startedServices.join(", ")})` : ""}`
+          );
+          for (const w of r.warnings) warn(w);
+        }
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/commands/reap.ts
+import chalk7 from "chalk";
+function registerReap(program2) {
+  program2.command("reap").description(
+    "Expire idle leases: stop only what they started, release them, park their efforts"
+  ).option("--dry-run", "list what would be reaped without touching anything").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+      const r = await reapLeases(ctx, { dryRun: o.dryRun });
+      if (o.json) printJson(r);
+      else if (r.reaped.length === 0) console.log(chalk7.gray("nothing to reap"));
+      else
+        for (const l of r.reaped)
+          console.log(
+            `${o.dryRun ? "would reap" : "reaped"} ${l.kind} ${l.value} (${l.owner.session}, expired ${l.expires})`
+          );
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/retire.ts
+import chalk8 from "chalk";
+function registerRetire(program2) {
+  program2.command("retire").description(
+    "Archive an area's evidence, remove its worktree and its local branches that are on origin (the only destructive verb)"
+  ).requiredOption("--area <area>", "the area to retire").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+      const r = await retireArea(ctx, { area: o.area });
+      if (o.json) printJson(r);
+      else {
+        console.log(`${chalk8.bold(o.area)} retired: removed ${r.removed}`);
+        for (const a of r.archived) console.log(`  archived ${a}`);
+        for (const b of r.branchesDeleted) console.log(`  deleted local branch ${b}`);
+        for (const b of r.branchesKept)
+          console.log(chalk8.yellow(`  kept ${b}: not fully on origin`));
+      }
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/start.ts
+import chalk9 from "chalk";
+function printStart(r) {
+  const e = r.effort;
+  const label = e.task ? `${e.area}--${e.task}` : e.area;
+  console.log(
+    `${chalk9.bold(label)}  ${e.type}/${e.mode}  ${e.branch}${r.joined ? chalk9.yellow("  (joined)") : ""}`
+  );
+  console.log(`  worktree  ${e.worktree}`);
+  console.log(
+    `  sync      ${r.sync}${r.refreshed.length ? `  refreshed: ${r.refreshed.join("; ")}` : ""}`
+  );
+  for (const l of r.leases) {
+    const ports = l.ports ? `  ${Object.entries(l.ports).map(([k, v]) => `${k}=${v}`).join(" ")}` : "";
+    console.log(`  lease     ${l.kind} ${l.value}${ports}  expires ${l.expires}`);
+  }
+  for (const w of r.warnings) warn(w);
+  for (const n of r.notices) console.log(chalk9.yellow(`  notice    ${n.text} (${n.at})`));
+}
+function registerStart(program2) {
+  program2.command("start").description(
+    "Start an effort: the area's worktree on <type>/<area> (or <type>/<area>--<task>), synced from the base branch, leased and running"
+  ).requiredOption("--area <area>", "a leaf area from helmsmith.config (e.g. org/applications)").option("--task <slug>", "intra-area task slug for parallel sub-efforts (<type>/<area>--<slug>)").requiredOption("--type <type>", "feature | chore | fix (as the manifest allows)").requiredOption("--mode <mode>", "fullstack | backend (a slot) | frontend (storybrokr)").option("--scope <glob...>", "narrow exclusive scope globs for this task sub-effort").option(
+    "--story <path>",
+    "frontend: the story file or component folder storybrokr boots, relative to the Storybook host"
+  ).option("--join", "work in the already-open effort on this area instead of refusing").option("--no-sync", "skip the fetch and merge from the base branch (reproducing something)").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(
+    async (o) => {
+      try {
+        const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+        const r = await startEffort(ctx, {
+          area: o.area,
+          task: o.task,
+          type: o.type,
+          mode: o.mode,
+          scopes: o.scope,
+          story: o.story,
+          join: o.join,
+          sync: o.sync
+        });
+        if (o.json) printJson(r);
+        else printStart(r);
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/commands/status.ts
+import chalk10 from "chalk";
+var age = (iso) => {
+  const mins = Math.max(0, Math.round((Date.now() - Date.parse(iso)) / 6e4));
+  return mins < 60 ? `${mins}m` : mins < 1440 ? `${Math.round(mins / 60)}h` : `${Math.round(mins / 1440)}d`;
+};
+var expiresIn = (iso) => {
+  const mins = Math.round((Date.parse(iso) - Date.now()) / 6e4);
+  return mins <= 0 ? chalk10.red("expired") : mins < 60 ? `${mins}m` : `${Math.round(mins / 60)}h`;
+};
+function printStatus(r) {
+  console.log(chalk10.bold(`${r.project}`));
+  const cols = ["AREA", "TYPE/MODE", "BRANCH", "OWNER", "STARTED", "LEASES", "BEHIND", "NOTICES"];
+  const rows = r.areas.map((a) => [
+    a.area,
+    a.effort ? `${a.effort.type}/${a.effort.mode}` : chalk10.gray("-"),
+    a.effort?.branch ?? chalk10.gray("-"),
+    a.effort?.owner.session ?? chalk10.gray("-"),
+    a.effort ? age(a.effort.started) : chalk10.gray("-"),
+    a.leases.length ? a.leases.map((l) => `${l.kind}:${l.value}`).join(",") : chalk10.gray("-"),
+    a.behindBase > 0 ? chalk10.yellow(String(a.behindBase)) : "0",
+    a.notices.length ? chalk10.yellow(String(a.notices.length)) : "0"
+  ]);
+  const plain = (s) => s.replace(/\u001b\[[0-9;]*m/g, "");
+  const widths = cols.map((c, i) => Math.max(c.length, ...rows.map((row) => plain(row[i]).length)));
+  const line = (cells) => cells.map((c, i) => c + " ".repeat(widths[i] - plain(c).length)).join("  ");
+  console.log(chalk10.bold(line(cols)));
+  for (const row of rows) console.log(line(row));
+  if (r.leases.length) {
+    console.log("");
+    console.log(chalk10.bold("KIND       VALUE        OWNER                 AGE   EXPIRES-IN"));
+    for (const l of r.leases) {
+      console.log(
+        `${l.kind.padEnd(10)} ${String(l.value).padEnd(12)} ${l.owner.session.padEnd(21)} ${age(l.created).padEnd(5)} ${expiresIn(l.expires)}`
+      );
+    }
+  }
+}
+function registerStatus(program2) {
+  program2.command("status").description("Open efforts, leases, drift from the base branch and notices, per area").option("--area <area>", "one area only").option("--task <slug>", "intra-area task slug").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the report as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: true });
+      const r = statusFor(ctx, o.area, o.task);
+      if (o.json) printJson(r);
+      else printStatus(r);
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/cli.ts
+var { program } = createCli({
+  name: "work",
+  version: VERSION,
+  description: "Area-based work: start, promote, status, finish, reap, retire, audit."
+});
+registerInit(program);
+registerStart(program);
+registerPromote(program);
+registerStatus(program);
+registerEnv(program);
+registerFinish(program);
+registerReap(program);
+registerRetire(program);
+registerAudit(program);
+registerHook(program);
+registerMcp(program);
+program.parseAsync(process.argv).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map