@brainervirus/workit-claude-code 8.40.1 → 8.40.2

package/dist/workit.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.40.1",
+    version: "8.40.2",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.40.1",
+      "@brainervirus/workit-cursor": "^8.40.2",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.40.1"
+      "@brainervirus/workit-core": "^8.40.2"
     },
     engines: {
       node: ">=24"
@@ -9779,34 +9779,20 @@ function configuredGrants(entry) {
   const legacy = fromAutoApprove(record.autoApprove);
   return legacy ? { grants: legacy, source: "autoApprove" } : { grants: {}, source: "default" };
 }
-function resolveAutonomy(cwd) {
-  const override = grantsOverride();
-  if (override)
-    return {
-      workspace: null,
-      grants: { ...DEFAULT_GRANTS },
-      configured: [],
-      source: "default",
-      accountConfigured: false,
-      defaultEndpoint: DEFAULT_ENDPOINT,
-      configuredEndpoint: null,
-      effectiveEndpoint: DEFAULT_ENDPOINT,
-      verification: DEFAULT_VERIFICATION,
-      note: override
-    };
-  const workspace = resolveWorkspaceFrom(cwd, grantsDir(), process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+function autonomyOf(workspace) {
   const { grants, source } = configuredGrants(workspace);
   const full = { ...DEFAULT_GRANTS, ...grants };
   const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
   const accountConfigured = Boolean(workspace?.vcs?.account);
+  const name = workspace?.name ?? null;
   return {
-    workspace: workspace?.name ?? null,
+    workspace: name,
     grants: full,
     configured,
     source,
     accountConfigured,
     ...endpointView(workspace, {
-      workspace: workspace?.name ?? null,
+      workspace: name,
       grants: full,
       configured,
       accountConfigured
@@ -9814,6 +9800,64 @@ function resolveAutonomy(cwd) {
     verification: verificationOf(workspace)
   };
 }
+function capByFolder(named, folder, name) {
+  if (folder?.workspace === named.workspace)
+    return named;
+  const nothing = !folder || folder.configured.length > 0 && !folder.accountConfigured;
+  const grants = { ...named.grants };
+  const lowered = [];
+  for (const kind of GRANT_KINDS) {
+    const floor = !nothing && folder.grants[kind];
+    if (!raises(kind, floor, grants[kind]))
+      continue;
+    grants[kind] = floor;
+    lowered.push(kind);
+  }
+  const ceiling = !nothing && folder.effectiveEndpoint || DEFAULT_ENDPOINT;
+  const endpoint = raisesEndpoint(ceiling, named.effectiveEndpoint);
+  if (endpoint)
+    lowered.push("defaultEndpoint");
+  const strict = folder?.verification ?? "independent";
+  const looser = VERIFICATION_MODES.indexOf(named.verification) < VERIFICATION_MODES.indexOf(strict);
+  if (looser)
+    lowered.push("verification");
+  if (lowered.length === 0)
+    return named;
+  return {
+    ...named,
+    grants,
+    ...endpoint ? { effectiveEndpoint: ceiling, endpointReason: undefined } : {},
+    verification: looser ? strict : named.verification,
+    note: `WORKFLOW_WORKSPACE_NAME=${name}: ${lowered.join(", ")} capped at ${folder ? `workspace ${folder.workspace}` : "nothing (tied workspaces)"}; a name never raises grants`
+  };
+}
+function resolveAutonomy(cwd) {
+  const override = grantsOverride();
+  if (override)
+    return {
+      workspace: null,
+      grants: { ...DEFAULT_GRANTS },
+      configured: [],
+      source: "default",
+      accountConfigured: false,
+      defaultEndpoint: DEFAULT_ENDPOINT,
+      configuredEndpoint: null,
+      effectiveEndpoint: DEFAULT_ENDPOINT,
+      verification: DEFAULT_VERIFICATION,
+      note: override
+    };
+  const name = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  const named = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir(), name));
+  if (name === undefined)
+    return named;
+  let folder;
+  try {
+    folder = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir()));
+  } catch {
+    folder = null;
+  }
+  return capByFolder(named, folder, name);
+}
 function requireGrant(cwd, kind, options = {}) {
   let autonomy;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-claude-code",
-  "version": "8.40.1",
+  "version": "8.40.2",
   "private": false,
   "description": "Workit Claude Code plugin — session and per-turn task context, branch policy on git shell commands, workit method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-cli": "^8.40.1",
-    "@brainervirus/workit-core": "^8.40.1"
+    "@brainervirus/workit-cli": "^8.40.2",
+    "@brainervirus/workit-core": "^8.40.2"
   },
   "engines": {
     "node": ">=24"