@brainervirus/workit-claude-code 8.40.0 → 8.40.2

package/dist/workit.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.40.0",
+    version: "8.40.2",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.40.0",
+      "@brainervirus/workit-cursor": "^8.40.2",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.40.0"
+      "@brainervirus/workit-core": "^8.40.2"
     },
     engines: {
       node: ">=24"
@@ -9779,34 +9779,20 @@ function configuredGrants(entry) {
   const legacy = fromAutoApprove(record.autoApprove);
   return legacy ? { grants: legacy, source: "autoApprove" } : { grants: {}, source: "default" };
 }
-function resolveAutonomy(cwd) {
-  const override = grantsOverride();
-  if (override)
-    return {
-      workspace: null,
-      grants: { ...DEFAULT_GRANTS },
-      configured: [],
-      source: "default",
-      accountConfigured: false,
-      defaultEndpoint: DEFAULT_ENDPOINT,
-      configuredEndpoint: null,
-      effectiveEndpoint: DEFAULT_ENDPOINT,
-      verification: DEFAULT_VERIFICATION,
-      note: override
-    };
-  const workspace = resolveWorkspaceFrom(cwd, grantsDir(), process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+function autonomyOf(workspace) {
   const { grants, source } = configuredGrants(workspace);
   const full = { ...DEFAULT_GRANTS, ...grants };
   const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
   const accountConfigured = Boolean(workspace?.vcs?.account);
+  const name = workspace?.name ?? null;
   return {
-    workspace: workspace?.name ?? null,
+    workspace: name,
     grants: full,
     configured,
     source,
     accountConfigured,
     ...endpointView(workspace, {
-      workspace: workspace?.name ?? null,
+      workspace: name,
       grants: full,
       configured,
       accountConfigured
@@ -9814,6 +9800,64 @@ function resolveAutonomy(cwd) {
     verification: verificationOf(workspace)
   };
 }
+function capByFolder(named, folder, name) {
+  if (folder?.workspace === named.workspace)
+    return named;
+  const nothing = !folder || folder.configured.length > 0 && !folder.accountConfigured;
+  const grants = { ...named.grants };
+  const lowered = [];
+  for (const kind of GRANT_KINDS) {
+    const floor = !nothing && folder.grants[kind];
+    if (!raises(kind, floor, grants[kind]))
+      continue;
+    grants[kind] = floor;
+    lowered.push(kind);
+  }
+  const ceiling = !nothing && folder.effectiveEndpoint || DEFAULT_ENDPOINT;
+  const endpoint = raisesEndpoint(ceiling, named.effectiveEndpoint);
+  if (endpoint)
+    lowered.push("defaultEndpoint");
+  const strict = folder?.verification ?? "independent";
+  const looser = VERIFICATION_MODES.indexOf(named.verification) < VERIFICATION_MODES.indexOf(strict);
+  if (looser)
+    lowered.push("verification");
+  if (lowered.length === 0)
+    return named;
+  return {
+    ...named,
+    grants,
+    ...endpoint ? { effectiveEndpoint: ceiling, endpointReason: undefined } : {},
+    verification: looser ? strict : named.verification,
+    note: `WORKFLOW_WORKSPACE_NAME=${name}: ${lowered.join(", ")} capped at ${folder ? `workspace ${folder.workspace}` : "nothing (tied workspaces)"}; a name never raises grants`
+  };
+}
+function resolveAutonomy(cwd) {
+  const override = grantsOverride();
+  if (override)
+    return {
+      workspace: null,
+      grants: { ...DEFAULT_GRANTS },
+      configured: [],
+      source: "default",
+      accountConfigured: false,
+      defaultEndpoint: DEFAULT_ENDPOINT,
+      configuredEndpoint: null,
+      effectiveEndpoint: DEFAULT_ENDPOINT,
+      verification: DEFAULT_VERIFICATION,
+      note: override
+    };
+  const name = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  const named = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir(), name));
+  if (name === undefined)
+    return named;
+  let folder;
+  try {
+    folder = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir()));
+  } catch {
+    folder = null;
+  }
+  return capByFolder(named, folder, name);
+}
 function requireGrant(cwd, kind, options = {}) {
   let autonomy;
   try {
@@ -21793,13 +21837,51 @@ function emit(io, envelope, human) {
   }
   return exitCodeFor(envelope.code);
 }
+async function withFailureLine(io, command, run, outcome) {
+  let wrote = false;
+  let reason = null;
+  const code = await run({
+    ...io,
+    stdout: (text) => {
+      wrote ||= text.length > 0;
+      io.stdout(text);
+    },
+    stderr: (text) => {
+      wrote ||= text.length > 0;
+      reason ??= /^workit: ([a-z][a-z_]*):/u.exec(text)?.[1] ?? null;
+      io.stderr(text);
+    }
+  });
+  if (code === 0)
+    return code;
+  if (outcome)
+    io.stderr(`workit: error: ${outcome} (${reason ?? EXIT_NAMES[code] ?? "failed"}, exit ${code})
+`);
+  else if (!wrote)
+    io.stderr(`workit: error: ${command} failed (exit ${code})
+`);
+  return code;
+}
 var EXIT, EXIT_BY_CODE, exitCodeFor = (code) => EXIT_BY_CODE[code], ok2 = (data) => ({ ok: true, code: "ok", data }), fail2 = (code, error, extra = {}) => ({
   ok: false,
   code,
   data: extra.data ?? {},
   error,
   ...extra.unblock ? { unblock: extra.unblock } : {}
-});
+}), EXIT_NAMES, flushStreams = async (streams = [process.stdout, process.stderr], timeoutMs = 2000) => {
+  await Promise.all(streams.map((stream) => new Promise((resolve) => {
+    const timer = setTimeout(resolve, timeoutMs);
+    const done = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    try {
+      stream.write("", done);
+    } catch {
+      done();
+    }
+  })));
+};
 var init_output = __esm(() => {
   EXIT = {
     ok: 0,
@@ -21820,6 +21902,13 @@ var init_output = __esm(() => {
     pending: EXIT.busy,
     unavailable: EXIT.unavailable
   };
+  EXIT_NAMES = {
+    1: "failed",
+    2: "invalid_input",
+    3: "blocked",
+    4: "busy",
+    5: "unavailable"
+  };
 });
 
 // packages/workit-cli/src/verbs/task.ts
@@ -81597,7 +81686,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return {
       ok: false,
       code: "failed",
-      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
+      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${state === "open" ? ", so it is not merged yet (a merge queue or auto-merge may hold it)" : ""}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
       unblock: `workit verify-delivery merged --pr ${doc.number}`,
       recorded
     };
@@ -108755,43 +108844,54 @@ async function main(argv, overrides = {}, options = {}) {
   const entry = findVerb(command);
   if (!entry)
     return unknown2(io, command);
-  if (wantsHelp(verbArgs)) {
-    const word = firstWord(verbArgs);
-    const sub = word === undefined ? undefined : findSubcommand(entry, word);
-    const asValue = helpAsValue(verbArgs, sub ? [sub.usage] : usageLines(entry));
-    if (asValue)
-      return emit(io, fail2("invalid_input", asValue, {
-        unblock: `workit help ${entry.name}${sub ? ` ${sub.name}` : ""}`
-      }));
-    return help(io, sub ? subcommandHelp(entry, sub) : verbHelp(entry));
-  }
-  const ended = endOfOptions(io, entry, args);
-  if (typeof ended === "number")
-    return ended;
-  const checked = checkFlags(entry, ended);
-  if ("error" in checked)
-    return emit(io, fail2("invalid_input", checked.error, { unblock: checked.unblock }));
-  if (parsed.cwd !== null) {
-    try {
-      process.chdir(io.cwd);
-    } catch {
-      return emit(io, fail2("invalid_input", `--cwd: cannot enter ${io.cwd}`));
-    }
-    if (process.env.WORKFLOW_WORKSPACE_ROOT !== undefined) {
-      process.env.WORKFLOW_WORKSPACE_ROOT = io.cwd;
-      io.env = process.env;
+  const route = async (routed) => {
+    if (wantsHelp(verbArgs)) {
+      const word = firstWord(verbArgs);
+      const sub = word === undefined ? undefined : findSubcommand(entry, word);
+      const asValue = helpAsValue(verbArgs, sub ? [sub.usage] : usageLines(entry));
+      if (asValue)
+        return emit(routed, fail2("invalid_input", asValue, {
+          unblock: `workit help ${entry.name}${sub ? ` ${sub.name}` : ""}`
+        }));
+      return help(routed, sub ? subcommandHelp(entry, sub) : verbHelp(entry));
+    }
+    const ended = endOfOptions(routed, entry, args);
+    if (typeof ended === "number")
+      return ended;
+    const checked = checkFlags(entry, ended);
+    if ("error" in checked)
+      return emit(routed, fail2("invalid_input", checked.error, { unblock: checked.unblock }));
+    if (parsed.cwd !== null) {
+      try {
+        process.chdir(routed.cwd);
+      } catch {
+        return emit(routed, fail2("invalid_input", `--cwd: cannot enter ${routed.cwd}`));
+      }
+      if (process.env.WORKFLOW_WORKSPACE_ROOT !== undefined) {
+        process.env.WORKFLOW_WORKSPACE_ROOT = routed.cwd;
+        routed.env = process.env;
+      }
     }
-  }
-  if (options.diagnostics)
-    (await Promise.resolve().then(() => (init_diagnostics(), exports_diagnostics))).installDiagnostics(command);
-  globalThis[Symbol.for("workit.migrationReporter")] = (report) => io.stderr(`workit: migrated ${report.tasks} task${report.tasks === 1 ? "" : "s"} from ${report.from} to ${report.to} (backup: ${report.backup})
+    if (options.diagnostics)
+      (await Promise.resolve().then(() => (init_diagnostics(), exports_diagnostics))).installDiagnostics(command);
+    globalThis[Symbol.for("workit.migrationReporter")] = (report) => routed.stderr(`workit: migrated ${report.tasks} task${report.tasks === 1 ? "" : "s"} from ${report.from} to ${report.to} (backup: ${report.backup})
 `);
-  const verb = await entry.load();
-  const runVerb = (target) => guarded(target, () => verb.run(checked.args, target));
-  if (!io.json)
-    return runVerb(io);
-  return runJsonPure(io, command, runVerb);
-}
+    const verb = await entry.load();
+    const runVerb = (target) => guarded(target, () => verb.run(checked.args, target));
+    return routed.json ? runJsonPure(routed, command, runVerb) : runVerb(routed);
+  };
+  if (io.json)
+    return route(io);
+  const verbWord = firstWord(verbArgs);
+  const outcome = verbWord ? OUTCOMES2[`${entry.name} ${verbWord}`] : undefined;
+  return withFailureLine(io, command, route, outcome);
+}
+var OUTCOMES2 = {
+  "pr merge": "PR not merged",
+  "pr create": "PR not created",
+  "stack land": "stack not landed",
+  "git push": "not pushed"
+};
 async function guarded(io, run) {
   try {
     return await run();
@@ -108895,7 +108995,9 @@ var describe4 = (entry) => ({
 });
 var unknown2 = (io, command) => emit(io, fail2("invalid_input", `unknown command "${command}"`, { unblock: commandUnblock(command) }));
 if (__require.main == __require.module) {
-  process.exit(await main(process.argv.slice(2), {}, { diagnostics: true }));
+  const code = await main(process.argv.slice(2), {}, { diagnostics: true });
+  await flushStreams();
+  process.exit(code);
 }
 export {
   main,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-claude-code",
-  "version": "8.40.0",
+  "version": "8.40.2",
   "private": false,
   "description": "Workit Claude Code plugin — session and per-turn task context, branch policy on git shell commands, workit method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-cli": "^8.40.0",
-    "@brainervirus/workit-core": "^8.40.0"
+    "@brainervirus/workit-cli": "^8.40.2",
+    "@brainervirus/workit-core": "^8.40.2"
   },
   "engines": {
     "node": ">=24"

package/skills/ship/SKILL.md

@@ -52,6 +52,7 @@ the same check. Fix round and recheck both failed: a decider (call the Skill too
    with `workit check`, fix the root cause, batch every fix in one push. A tool warning is a finding: fix it in this PR in the right layer, or record the false positive with evidence; pre-existing ones get their own PR.
 6. **Verified.** The lane in `workit pr status` decides: none, no verdict; self, your `--self` verdict; focused or full (or `verification: self|independent`), one non-author verifier per PR after the last push, never per push (call the Skill tool with `workit:review`), on Claude Code with the `model` and `effort` of `workit models show --role verifier`. A docs-only push (or test-only under a unit verdict) keeps the verdict (`carried`); `reverify: focused` re-checks only the new diff, reusing green CI; one verdict at a stack's top covers its unchanged lower PRs. Land only when
    granted: `workit stack land` or `workit pr merge`; `--unverified --reason` if user-asked.
+   Never pipe a delivery verb through `grep`: read its exit code, or use `--json`.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`. After a failed
    verdict or a check red 3+ times, at any endpoint: offer `/wk-retro` in one
    line of the final or stop report; never pause the babysit loop for it.