@brainervirus/workit-claude-code 8.40.1 → 8.40.3

package/dist/workit.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.40.1",
+    version: "8.40.3",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.40.1",
+      "@brainervirus/workit-cursor": "^8.40.3",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.40.1"
+      "@brainervirus/workit-core": "^8.40.3"
     },
     engines: {
       node: ">=24"
@@ -9779,34 +9779,20 @@ function configuredGrants(entry) {
   const legacy = fromAutoApprove(record.autoApprove);
   return legacy ? { grants: legacy, source: "autoApprove" } : { grants: {}, source: "default" };
 }
-function resolveAutonomy(cwd) {
-  const override = grantsOverride();
-  if (override)
-    return {
-      workspace: null,
-      grants: { ...DEFAULT_GRANTS },
-      configured: [],
-      source: "default",
-      accountConfigured: false,
-      defaultEndpoint: DEFAULT_ENDPOINT,
-      configuredEndpoint: null,
-      effectiveEndpoint: DEFAULT_ENDPOINT,
-      verification: DEFAULT_VERIFICATION,
-      note: override
-    };
-  const workspace = resolveWorkspaceFrom(cwd, grantsDir(), process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+function autonomyOf(workspace) {
   const { grants, source } = configuredGrants(workspace);
   const full = { ...DEFAULT_GRANTS, ...grants };
   const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
   const accountConfigured = Boolean(workspace?.vcs?.account);
+  const name = workspace?.name ?? null;
   return {
-    workspace: workspace?.name ?? null,
+    workspace: name,
     grants: full,
     configured,
     source,
     accountConfigured,
     ...endpointView(workspace, {
-      workspace: workspace?.name ?? null,
+      workspace: name,
       grants: full,
       configured,
       accountConfigured
@@ -9814,6 +9800,64 @@ function resolveAutonomy(cwd) {
     verification: verificationOf(workspace)
   };
 }
+function capByFolder(named, folder, name) {
+  if (folder?.workspace === named.workspace)
+    return named;
+  const nothing = !folder || folder.configured.length > 0 && !folder.accountConfigured;
+  const grants = { ...named.grants };
+  const lowered = [];
+  for (const kind of GRANT_KINDS) {
+    const floor = !nothing && folder.grants[kind];
+    if (!raises(kind, floor, grants[kind]))
+      continue;
+    grants[kind] = floor;
+    lowered.push(kind);
+  }
+  const ceiling = !nothing && folder.effectiveEndpoint || DEFAULT_ENDPOINT;
+  const endpoint = raisesEndpoint(ceiling, named.effectiveEndpoint);
+  if (endpoint)
+    lowered.push("defaultEndpoint");
+  const strict = folder?.verification ?? "independent";
+  const looser = VERIFICATION_MODES.indexOf(named.verification) < VERIFICATION_MODES.indexOf(strict);
+  if (looser)
+    lowered.push("verification");
+  if (lowered.length === 0)
+    return named;
+  return {
+    ...named,
+    grants,
+    ...endpoint ? { effectiveEndpoint: ceiling, endpointReason: undefined } : {},
+    verification: looser ? strict : named.verification,
+    note: `WORKFLOW_WORKSPACE_NAME=${name}: ${lowered.join(", ")} capped at ${folder ? `workspace ${folder.workspace}` : "nothing (tied workspaces)"}; a name never raises grants`
+  };
+}
+function resolveAutonomy(cwd) {
+  const override = grantsOverride();
+  if (override)
+    return {
+      workspace: null,
+      grants: { ...DEFAULT_GRANTS },
+      configured: [],
+      source: "default",
+      accountConfigured: false,
+      defaultEndpoint: DEFAULT_ENDPOINT,
+      configuredEndpoint: null,
+      effectiveEndpoint: DEFAULT_ENDPOINT,
+      verification: DEFAULT_VERIFICATION,
+      note: override
+    };
+  const name = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  const named = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir(), name));
+  if (name === undefined)
+    return named;
+  let folder;
+  try {
+    folder = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir()));
+  } catch {
+    folder = null;
+  }
+  return capByFolder(named, folder, name);
+}
 function requireGrant(cwd, kind, options = {}) {
   let autonomy;
   try {
@@ -18967,8 +19011,97 @@ var init_policy_resolver = __esm(() => {
   init_derive();
 });
 
-// packages/workit-core/src/core/task-engine.ts
+// packages/workit-core/src/core/task-view.ts
 import { realpathSync as realpathSync4 } from "node:fs";
+function contextRootError(store, context) {
+  try {
+    realpathSync4(context.root);
+    const root = checkoutRootOf(context.root);
+    if (root !== store.root && !sameDirectoryIdentity(root, store.root))
+      return failure2("invalid_input", "operation context root does not match the task store root");
+  } catch {
+    return failure2("invalid_input", "operation context root cannot be resolved");
+  }
+  return success(null, null, null);
+}
+function helperEntry(task, context, requireSession = false, requireActive = false) {
+  const workerId = context.workerId ?? null;
+  if (workerId === null)
+    return failure2("permission_denied", "operation is lead-only");
+  const worker = task.workers.find((entry) => entry.id === workerId);
+  if (!worker)
+    return failure2("permission_denied", "worker is not assigned to this task");
+  if (worker.data.session && !sameSession2(worker.data.session, context))
+    return failure2("permission_denied", "worker session does not match the caller");
+  if (requireSession && (!worker.data.session || !sameSession2(worker.data.session, context)))
+    return failure2("permission_denied", "worker session has not been observed");
+  if (requireActive && worker.data.state !== "running")
+    return failure2("permission_denied", "worker is not active");
+  return success(null, null, worker);
+}
+function helperTaskGuard(task, context, allowRead = false) {
+  if ((context.workerId ?? null) === null)
+    return success(null, null, null);
+  const worker = helperEntry(task, context);
+  if (!worker.ok)
+    return worker;
+  return allowRead ? success(null, null, null) : failure2("permission_denied", "helpers cannot control task lifecycle or scope");
+}
+function taskView(store, context, task, capture = true, freshness = treeFreshness(store.root)) {
+  const workspace = store.readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data)
+    return failure2("not_found", "workspace not found");
+  const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+  const current = historical ? success(null, null, historical) : capture ? captureCandidate(store.root, task.intent.data.scope, environment()) : success(null, null, task.candidates.at(-1) ?? null);
+  if (!current.ok)
+    return current;
+  const evaluationWorkspace = workspace.data;
+  const tree = freshness;
+  const requirements = evaluateRequirements(task, evaluationWorkspace, context.capabilities, current.data, store.root, context.caller, tree);
+  return success(task.revision, workspace.data.revision, {
+    task,
+    workspace: evaluationWorkspace,
+    capabilities: context.capabilities,
+    requirements,
+    evidence: evaluateEvidence(task, current.data, tree)
+  });
+}
+function compactContext(store, context, taskId, freshness, origin = null) {
+  const root = contextRootError(store, context);
+  if (!root.ok)
+    return root;
+  const base = origin && store.readStoreTask(origin.taskId);
+  const inherited = base?.ok && base.data ? {
+    origin: origin.origin,
+    taskId: base.data.id,
+    decisions: base.data.decisions.filter((entry) => entry.data.revoked === null)
+  } : null;
+  if (taskId === null)
+    return success(null, null, inherited?.decisions.length ? compactTaskContext(null, inherited) : "");
+  const task = store.readTask(taskId);
+  if (!task.ok)
+    return task;
+  const helper = helperTaskGuard(task.data, context, true);
+  if (!helper.ok)
+    return helper;
+  const view = taskView(store, context, task.data, false, freshness ?? signalFreshness(store.root));
+  if (!view.ok)
+    return view;
+  return success(view.revision, view.workspaceRevision, compactTaskContext(view.data, inherited));
+}
+var environment = () => [], sameSession2 = (value, context) => typeof value === "object" && value !== null && value.kind === "host" && value.host === context.caller.host && value.handle === context.caller.actor;
+var init_task_view = __esm(() => {
+  init_task_contract();
+  init_paths();
+  init_task_store();
+  init_task_context();
+  init_task_evaluation();
+});
+
+// packages/workit-core/src/core/task-engine.ts
+import { realpathSync as realpathSync5 } from "node:fs";
 
 class WorkitCore {
   store;
@@ -18982,15 +19115,7 @@ class WorkitCore {
     return this.context.workerId !== null && this.context.workerId !== undefined;
   }
   contextRootError() {
-    try {
-      realpathSync4(this.context.root);
-      const root = checkoutRootOf(this.context.root);
-      if (root !== this.store.root && !sameDirectoryIdentity(root, this.store.root))
-        return failure2("invalid_input", "operation context root does not match the task store root");
-    } catch {
-      return failure2("invalid_input", "operation context root cannot be resolved");
-    }
-    return success(null, null, null);
+    return contextRootError(this.store, this.context);
   }
   fillRevisions(input, task, workspace) {
     if (input.expectedRevision === undefined && task)
@@ -19038,27 +19163,10 @@ class WorkitCore {
     return success(null, null, { ...request, taskId: found.data.task.id });
   }
   helperEntry(task, requireSession = false, requireActive = false) {
-    const workerId = this.context.workerId ?? null;
-    if (workerId === null)
-      return failure2("permission_denied", "operation is lead-only");
-    const worker = task.workers.find((entry) => entry.id === workerId);
-    if (!worker)
-      return failure2("permission_denied", "worker is not assigned to this task");
-    if (worker.data.session && !sameSession2(worker.data.session, this.context))
-      return failure2("permission_denied", "worker session does not match the caller");
-    if (requireSession && (!worker.data.session || !sameSession2(worker.data.session, this.context)))
-      return failure2("permission_denied", "worker session has not been observed");
-    if (requireActive && worker.data.state !== "running")
-      return failure2("permission_denied", "worker is not active");
-    return success(null, null, worker);
+    return helperEntry(task, this.context, requireSession, requireActive);
   }
   helperTaskGuard(task, allowRead = false) {
-    if ((this.context.workerId ?? null) === null)
-      return success(null, null, null);
-    const worker = this.helperEntry(task);
-    if (!worker.ok)
-      return worker;
-    return allowRead ? success(null, null, null) : failure2("permission_denied", "helpers cannot control task lifecycle or scope");
+    return helperTaskGuard(task, this.context, allowRead);
   }
   activeWorkerBlocker(task) {
     if (task.workers.some((entry) => workerBlocksTransition("close", entry.data.state)))
@@ -19968,48 +20076,10 @@ class WorkitCore {
     });
   }
   compactContext(taskId, freshness, origin = null) {
-    const root = this.contextRootError();
-    if (!root.ok)
-      return root;
-    const base = origin && this.store.readStoreTask(origin.taskId);
-    const inherited = base?.ok && base.data ? {
-      origin: origin.origin,
-      taskId: base.data.id,
-      decisions: base.data.decisions.filter((entry) => entry.data.revoked === null)
-    } : null;
-    if (taskId === null)
-      return success(null, null, inherited?.decisions.length ? compactTaskContext(null, inherited) : "");
-    const task = this.store.readTask(taskId);
-    if (!task.ok)
-      return task;
-    const helper = this.helperTaskGuard(task.data, true);
-    if (!helper.ok)
-      return helper;
-    const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
-    if (!view.ok)
-      return view;
-    return success(view.revision, view.workspaceRevision, compactTaskContext(view.data, inherited));
+    return compactContext(this.store, this.context, taskId, freshness, origin);
   }
-  view(task, capture = true, freshness = treeFreshness(this.store.root)) {
-    const workspace = this.store.readWorkspace();
-    if (!workspace.ok)
-      return workspace;
-    if (!workspace.data)
-      return failure2("not_found", "workspace not found");
-    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
-    const current = historical ? success(null, null, historical) : capture ? captureCandidate(this.store.root, task.intent.data.scope, environment()) : success(null, null, task.candidates.at(-1) ?? null);
-    if (!current.ok)
-      return current;
-    const evaluationWorkspace = workspace.data;
-    const tree = freshness;
-    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller, tree);
-    return success(task.revision, workspace.data.revision, {
-      task,
-      workspace: evaluationWorkspace,
-      capabilities: this.context.capabilities,
-      requirements,
-      evidence: evaluateEvidence(task, current.data, tree)
-    });
+  view(task, capture = true, freshness) {
+    return taskView(this.store, this.context, task, capture, freshness);
   }
   reconcileResume(view, observations = []) {
     const root = this.contextRootError();
@@ -20020,7 +20090,7 @@ class WorkitCore {
     if (view.task.workspaceId !== view.workspace.id)
       return failure2("invalid_input", "task and workspace bindings are invalid");
     try {
-      if (realpathSync4(view.workspace.root) !== this.store.root)
+      if (realpathSync5(view.workspace.root) !== this.store.root)
         return failure2("invalid_input", "task view root does not match the task store");
     } catch {
       return failure2("invalid_input", "task view root cannot be resolved");
@@ -20280,7 +20350,7 @@ var MAX_JUDGED_REFS = 5, workspaceVerification = (root) => {
   host: context.caller.host,
   session: { kind: "host", host: context.caller.host, handle: context.caller.actor },
   workerId: context.workerId ?? null
-}), environment = () => [], sameSession2 = (value, context) => typeof value === "object" && value !== null && value.kind === "host" && value.host === context.caller.host && value.handle === context.caller.actor, verifiedWorkers, sameValue = (left, right) => {
+}), verifiedWorkers, sameValue = (left, right) => {
   try {
     return canonicalJson(left) === canonicalJson(right);
   } catch {
@@ -20599,8 +20669,7 @@ var init_task_engine = __esm(() => {
   init_ledger();
   init_rev();
   init_autonomy();
-  init_task_store();
-  init_paths();
+  init_task_view();
   init_store_lock();
   init_task_context();
   init_workers();
@@ -21242,10 +21311,10 @@ var init_context_read = __esm(() => {
 });
 
 // packages/workit-core/src/core.ts
-import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync8, realpathSync as realpathSync6 } from "node:fs";
 import path26 from "node:path";
 function resolveInside(root, candidate) {
-  const base = realpathSync5(root);
+  const base = realpathSync6(root);
   const target = path26.resolve(base, candidate);
   if (target !== base && !target.startsWith(base + path26.sep)) {
     throw new Error("path must stay inside repository root");
@@ -21253,7 +21322,7 @@ function resolveInside(root, candidate) {
   let ancestor = target;
   while (!existsSync8(ancestor))
     ancestor = path26.dirname(ancestor);
-  const canonicalAncestor = realpathSync5(ancestor);
+  const canonicalAncestor = realpathSync6(ancestor);
   if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path26.sep)) {
     throw new Error("path must stay inside repository root");
   }
@@ -66007,7 +66076,7 @@ import {
   existsSync as existsSync12,
   readFileSync as readFileSync13,
   readdirSync as readdirSync6,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   statSync as statSync2
 } from "node:fs";
 import os9 from "node:os";
@@ -66447,7 +66516,7 @@ var resolveWindowsShimScript = (shim) => {
   return found;
 }, isClaudeWorkitInstalled = (home, env = process.env, cwd = process.cwd()) => claudeWorkitInstalls(home, env, cwd).length > 0, findNpmCli = (npm) => {
   try {
-    const resolved = realpathSync6(npm);
+    const resolved = realpathSync7(npm);
     if (path33.basename(resolved) === "npm-cli.js")
       return resolved;
   } catch {}
@@ -66945,7 +67014,7 @@ import {
   readdirSync as readdirSync9,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync17,
-  realpathSync as realpathSync7,
+  realpathSync as realpathSync8,
   rmSync as rmSync3,
   statSync as statSync5
 } from "node:fs";
@@ -67168,7 +67237,7 @@ function applyHostPermissions(plan, options = {}) {
       continue;
     }
     try {
-      const target = change.before === null ? change.file : realpathSync7(change.file);
+      const target = change.before === null ? change.file : realpathSync8(change.file);
       if (change.before !== null) {
         const backups = path38.join(paths.stateDir, "host-permissions-backup");
         mkdirSync7(backups, { recursive: true, mode: 448 });
@@ -69983,7 +70052,7 @@ import {
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync19,
   readdirSync as readdirSync11,
-  realpathSync as realpathSync8,
+  realpathSync as realpathSync9,
   renameSync as renameSync5,
   rmSync as rmSync5,
   statSync as statSync7,
@@ -70429,7 +70498,7 @@ function applyOpenCode(root, res) {
   };
 }
 function copyPluginDir(src, dest) {
-  const realSrc = realpathSync8(src);
+  const realSrc = realpathSync9(src);
   const marker = path40.join(dest, ".workit-root");
   const destIsLink = existsSync17(dest) && lstatSync6(dest).isSymbolicLink();
   const synced = !destIsLink && readFileSafe(marker)?.trim() === realSrc && samePluginContent(realSrc, dest, dest);
@@ -70868,7 +70937,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return (require2.resolve.paths(name) ?? []).map((dir) => path40.join(dir, name));
 }, realRoot = (root) => {
   try {
-    return realpathSync8(root);
+    return realpathSync9(root);
   } catch {
     return root;
   }
@@ -71928,7 +71997,7 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync19, readFileSync as readFileSync21, realpathSync as realpathSync9, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
 import os14 from "node:os";
 import path43 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
@@ -72236,7 +72305,7 @@ var resolveUninstallPaths = (options = {}) => {
     return false;
   }
   try {
-    return realpathSync9(actionPath) === realpathSync9(expected);
+    return realpathSync10(actionPath) === realpathSync10(expected);
   } catch {
     return true;
   }
@@ -106830,7 +106899,7 @@ import {
   readdirSync as readdirSync15,
   readFileSync as readFileSync30,
   readlinkSync as readlinkSync3,
-  realpathSync as realpathSync10,
+  realpathSync as realpathSync11,
   renameSync as renameSync7,
   rmSync as rmSync9,
   statSync as statSync11,
@@ -106967,7 +107036,7 @@ function linkNodeModules(origin, target, repo, copy) {
     if (entry.isSymbolicLink()) {
       let real;
       try {
-        real = realpathSync10(from);
+        real = realpathSync11(from);
       } catch {
         continue;
       }
@@ -106983,11 +107052,11 @@ function linkNodeModules(origin, target, repo, copy) {
 function copySymlink(repo, tree, from, to) {
   let real = null;
   try {
-    real = realpathSync10(from);
+    real = realpathSync11(from);
   } catch {
     real = null;
   }
-  const realRepo = realpathSync10(repo);
+  const realRepo = realpathSync11(repo);
   if (real && inside5(realRepo, real)) {
     symlinkSync(path72.relative(path72.dirname(to), path72.join(tree, path72.relative(realRepo, real))), to);
     return;
@@ -107001,7 +107070,7 @@ function writeInside(copy, file, content) {
   const target = path72.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path72.dirname(target))))
+    if (!stat.isFile() || !inside5(realpathSync11(copy), realpathSync11(path72.dirname(target))))
       return false;
   } catch {
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-claude-code",
-  "version": "8.40.1",
+  "version": "8.40.3",
   "private": false,
   "description": "Workit Claude Code plugin — session and per-turn task context, branch policy on git shell commands, workit method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-cli": "^8.40.1",
-    "@brainervirus/workit-core": "^8.40.1"
+    "@brainervirus/workit-cli": "^8.40.3",
+    "@brainervirus/workit-core": "^8.40.3"
   },
   "engines": {
     "node": ">=24"