@brainervirus/workit-claude-code 8.27.0 → 8.28.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "workit",
   "displayName": "Workit",
-  "version": "8.27.0",
+  "version": "8.28.1",
   "description": "Workflow rails for agentic coding: task context on every session, branch policy on shell commands, and the workit method skills",
   "author": {
     "name": "BrainerVirus"

package/bin/workit-hook.mjs

@@ -33,6 +33,33 @@ const failOpen = (reason) => {
   process.stdout.write("{}\n");
 };
 
+// A Node below this package's own engines minimum cannot load dist: fail open
+// with one clear line instead of a syntax error. WORKIT_HOOK_NODE_VERSION
+// stands in for process.versions.node (tests). An unreadable minimum never blocks.
+const nodeFloorMessage = () => {
+  try {
+    const found = process.env.WORKIT_HOOK_NODE_VERSION || process.versions.node;
+    const range = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).engines?.node;
+    const min = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(String(range ?? ""));
+    if (!min) return null;
+    const need = [min[1], min[2] ?? 0, min[3] ?? 0].map(Number);
+    const have = String(found).replace(/^v/, "").split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+      const a = have[i] ?? 0;
+      if (Number.isNaN(a)) return null;
+      if (a !== need[i]) return a < need[i] ? `needs Node ${range}, found ${found}` : null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+};
+const tooOld = nodeFloorMessage();
+if (tooOld) {
+  failOpen(tooOld);
+  process.exit(0);
+}
+
 // Every Bash/PowerShell call and every file edit reaches this hook (branch
 // policy, raw git/forge steering and the before-write gate). Fast paths
 // answer `{}` before the runtime loads: a shell command with no git/gh/glab,
@@ -213,10 +240,51 @@ const standingPending = (cwd, session, agentId) => {
   return readJson(path.join(store, "standing", "seen", `${key}.json`))?.rev !== rev;
 };
 
+// The plugin dir this hook runs from (`<config>/plugins/cache/<mkt>/workit/<version>`)
+// against the newest version the registry lists beside it: while the line has not
+// been given this session, the runtime runs (src/stale-plugin.ts holds the same test).
+const parts = (version) => /^(\d+)\.(\d+)\.(\d+)/.exec(version)?.slice(1).map(Number);
+const staleUnannounced = (session) => {
+  try {
+    const versions = path.dirname(root);
+    if (path.basename(path.dirname(path.dirname(versions))) !== "cache") return false;
+    const running = parts(path.basename(root));
+    if (!running || typeof session !== "string") return false;
+    const registry = readJson(
+      path.join(path.dirname(path.dirname(path.dirname(versions))), "installed_plugins.json"),
+    );
+    for (const entries of Object.values(registry?.plugins ?? {}))
+      for (const entry of Array.isArray(entries) ? entries : []) {
+        const at = typeof entry?.version === "string" ? parts(entry.version) : undefined;
+        if (
+          at &&
+          path.dirname(String(entry.installPath)) === versions &&
+          (at[0] - running[0] || at[1] - running[1] || at[2] - running[2]) > 0
+        )
+          return !existsSync(markerFor(session, entry.version));
+      }
+  } catch {
+    // an unreadable registry is not a reason to load the runtime
+  }
+  return false;
+};
+const markerFor = (session, installed) =>
+  path.join(
+    stateDir(),
+    "stale-plugin",
+    createHash("sha256").update(`${session}\0${installed}`).digest("hex").slice(0, 32),
+  );
+
 const fastAllow = (() => {
   try {
     const value = JSON.parse(payload);
     const command = value?.tool_input?.command;
+    if (
+      value?.hook_event_name === "PreToolUse" &&
+      !value.agent_id &&
+      staleUnannounced(value.session_id)
+    )
+      return false;
     if (value?.hook_event_name === "PostToolUse")
       return typeof command === "string" && !/\bcommit\b/.test(command);
     if (value?.hook_event_name !== "PreToolUse") return false;
@@ -233,12 +301,16 @@ const fastAllow = (() => {
         return true;
       return !implementer && !RAW_TOOLS.test(command) && !hasTaskStore(String(value.cwd ?? "."));
     }
+    // A subagent spawn that names its model has no default to fill (hooks/agent-model.ts).
+    if (value.tool_name === "Agent" || value.tool_name === "Task")
+      return typeof value.tool_input?.model === "string" && value.tool_input.model.trim() !== "";
     return EDITS.has(value.tool_name) && !implementer && !hasTaskStore(String(value.cwd ?? "."));
   } catch {
     return false;
   }
 })();
 
+process.env.WORKIT_PLUGIN_ROOT = root;
 if (fastAllow) {
   process.stdout.write("{}\n");
 } else if (fromSource) {