@brainervirus/workit-claude-code 6.0.0 → 7.0.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "workit",
   "displayName": "Workit",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "description": "Workflow rails for agentic coding: task context on every session, branch policy on shell commands, and the workit method skills",
   "author": {
     "name": "BrainerVirus"

package/README.md

@@ -1,10 +1,11 @@
 # @brainervirus/workit-claude-code
 
 [![CI](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml/badge.svg)](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
-[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](../../LICENSE)
+[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/BrainerVirus/workit/blob/main/LICENSE)
 
-Workit plugin for Claude Code: task context on session start and per turn,
-branch policy on `git` shell commands, eleven method skills (`/workit:<name>`),
+[Workit](https://github.com/BrainerVirus/workit) plugin for Claude Code: task context on session start and per turn,
+branch policy on `git` shell commands, the before-write gate on edits and shell
+writes, eleven method skills (`/workit:<name>`),
 and `verifier`, `reviewer` and `implementer` agents.
 
 ## Install
@@ -36,11 +37,13 @@ export CLAUDE_CODE_PLUGIN_DIRS="$HOME/path/to/workit/packages/workit-claude-code
 | Path | Purpose |
 | --- | --- |
 | `.claude-plugin/plugin.json` | Manifest (version synced at release) |
-| `hooks/hooks.json` | SessionStart (startup/resume/clear/compact/fork), UserPromptSubmit, PreToolUse (Bash/PowerShell `git *`), SubagentStart |
-| `bin/workit-hook.mjs` | Hook launcher: source with Bun in a checkout, `dist/workit-hook.js` when installed; fails open (`{}` + one stderr line) when neither can run |
+| `hooks/hooks.json` | SessionStart (startup/resume/clear/compact/fork), UserPromptSubmit, PreToolUse (Bash, PowerShell, Edit/Write/MultiEdit/NotebookEdit), SubagentStart |
+| `bin/workit-hook.mjs` | Hook launcher: source with Bun in a checkout, `dist/workit-hook.js` when installed; answers plain shell commands and edits in task-less checkouts with `{}` before loading the runtime; fails open (`{}` + one stderr line) when neither can run |
 | `bin/workit` | `workit` on the Bash tool's PATH (same source/dist switch) |
 | `agents/` | `verifier`, `reviewer` (read-only), `implementer` (`isolation: worktree`) |
 | `skills/` | Generated by `scripts/build.ts` from `packages/workit-core/skills` (not committed) |
 | `evals/` | Opt-in `claude plugin eval` suite (nightly / `eval` label, not a PR gate) |
 
 Requires Node.js 24+ (installed plugin) or Bun (local pin).
+
+Full guide: [Claude Code](https://github.com/BrainerVirus/workit/blob/main/docs/guides/claude-code.md).

package/bin/workit-hook.mjs

@@ -12,7 +12,7 @@
 // proceeds as if no Workit hook were installed (no context, no branch
 // policy): a broken hook must never brick the host.
 import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -31,9 +31,67 @@ const failOpen = (reason) => {
   process.stdout.write("{}\n");
 };
 
-if (fromSource) {
+// Every Bash/PowerShell call and every file edit reaches this hook (branch
+// policy and the before-write gate). Two fast paths answer `{}` before the
+// runtime loads: a shell command with no git, no redirect and no writing verb
+// can need neither; and with no Workit task store for the checkout there is
+// no task to gate a non-git edit on.
+let payload = "";
+for await (const chunk of process.stdin) payload += String(chunk);
+const MAYBE_GATED =
+  /\bgit\b|>|\b(?:tee|touch|mkdir|rm|rmdir|mv|cp|truncate|install|ln|patch|dd|sed|perl|set-content|add-content|out-file|new-item|ni|remove-item|del|copy-item|move-item)\b/i;
+const SHELLS = new Set(["Bash", "PowerShell"]);
+const EDITS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+
+/** `<git-common-dir>/workit` (or `<dir>/.workit` outside git) holds tasks. */
+const hasTaskStore = (cwd) => {
+  try {
+    for (let dir = path.resolve(cwd); ; dir = path.dirname(dir)) {
+      const dotGit = path.join(dir, ".git");
+      if (existsSync(dotGit)) {
+        let gitDir = dotGit;
+        if (statSync(dotGit).isFile()) {
+          const target = /^gitdir:\s*(.+)$/m.exec(readFileSync(dotGit, "utf8"))?.[1]?.trim();
+          if (!target) return true;
+          gitDir = path.resolve(dir, target);
+          const common = path.join(gitDir, "commondir");
+          if (existsSync(common))
+            gitDir = path.resolve(gitDir, readFileSync(common, "utf8").trim());
+        }
+        const store = path.join(gitDir, "workit");
+        return (
+          existsSync(path.join(store, "tasks")) || existsSync(path.join(store, "task-index.json"))
+        );
+      }
+      if (existsSync(path.join(dir, ".workit"))) return true;
+      if (path.dirname(dir) === dir) return false;
+    }
+  } catch {
+    return true;
+  }
+};
+
+const fastAllow = (() => {
+  try {
+    const value = JSON.parse(payload);
+    if (value?.hook_event_name !== "PreToolUse") return false;
+    const command = value?.tool_input?.command;
+    if (SHELLS.has(value.tool_name) && typeof command === "string") {
+      if (!MAYBE_GATED.test(command)) return true;
+      return !/\bgit\b/.test(command) && !hasTaskStore(String(value.cwd ?? "."));
+    }
+    return EDITS.has(value.tool_name) && !hasTaskStore(String(value.cwd ?? "."));
+  } catch {
+    return false;
+  }
+})();
+
+if (fastAllow) {
+  process.stdout.write("{}\n");
+} else if (fromSource) {
   const run = spawnSync(process.env.WORKIT_BUN ?? "bun", [source], {
-    stdio: "inherit",
+    input: payload,
+    stdio: ["pipe", "inherit", "inherit"],
     windowsHide: true,
   });
   if (run.error) failOpen(`bun is required for the local pin (${run.error.message})`);
@@ -45,7 +103,7 @@ if (fromSource) {
   } catch (error) {
     failOpen(`cannot load ${dist} (${error instanceof Error ? error.message : String(error)})`);
   }
-  if (runClaudeHook) process.exitCode = await runClaudeHook(process.stdin, process.stdout);
+  if (runClaudeHook) process.exitCode = await runClaudeHook([payload], process.stdout);
 } else {
   failOpen(`${dist} is missing; run \`bun scripts/build.ts\` in ${root}`);
 }