@brainervirus/workit-cli 0.10.0 → 0.11.0

package/assets/templates/execution-contract.md

@@ -24,10 +24,10 @@ This session is a handoff destination for a continued plan. The originating sess
 - Working state, briefs, ledgers, and review diffs live only under gitignored `<SDD_DIR>` in `docs/<slug>/sdd/` and use `workit_sdd_*` tools.
 - Use native `todowrite` for visible task state as well as the gitignored ledger.
 - Use native `question` for branch/stash choices and guarded external mutations; call mutation tools only after approval with `confirmed: true` (grounded in the recorded NativeChoiceEvidence).
-- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`) and subagent-driven execution is rejected as unsupported.
+- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`), Subagent-driven execution is supported through the one-time `coordinator_lease` and per-task `delegation_token` minted by `workit_delegate` (fail-closed validation; no `parentID` identity exists on Cursor), and Inline runs single-agent in the current session.
 - Delegated authority is direct-child-only: a worker is the session whose host `parentID` exactly equals the activating coordinator's recorded `coordinator_session_id`; missing, mismatched, or multi-owner lineage fails closed with `delegation_lineage_denied`, and nested `opencode` launches are denied during active delegated work. An authorized child receives only the compact worker contract (execute the supplied brief, follow TDD, land one contiguous non-empty commit range, report results) — never coordinator guidance, `wk-implement`, or ledger management; coordinator bookkeeping via `workit_sdd_*` stays with the coordinator session.
 - On Cursor, for every repository-scoped `workit_*` call, pass the active Cursor workspace as `workspace_root`; never rely on the MCP process default.
-- Use native `task` with only the built-in `explore` and `general` agents.
+- Use native `task` with only the built-in `explore` and `general` agents (OpenCode); on Cursor, Subagent-driven dispatches Cursor-native subagents with a task `delegation_token`, Inline runs single-agent in the current session.
 
 ## Flow gates (HARD)
 
@@ -51,7 +51,7 @@ For each top-level task absent from `completed_task_ids`:
 
 1. Mark it `in_progress` with `todowrite`.
 2. Create a working-state brief with `workit_sdd_task_brief` and `confirmed: true`.
-3. Delegate read-only discovery, when needed, to an `explore` agent. Delegate implementation to a fresh `general` agent. Product changes follow TDD.
+3. Route by the approved execution mode: **Subagent-driven** delegates read-only discovery to an `explore` (OpenCode) agent, delegates implementation to a fresh `general` (OpenCode) agent (on Cursor, the coordinator mints a `delegation_token` with `workit_delegate` and the subagent prompt carries the raw token — the worker passes it as `delegation_token` on its mutation calls, and appending progress revokes it), and the coordinator never edits product code; **Inline** executes every task in the current agent with no dispatch and no token minting. Product changes follow TDD.
 4. Create a working-state diff with `workit_sdd_review_package` and `confirmed: true`.
 5. Delegate spec-compliance review and code-quality review to separate `general` agents.
 6. **Blocking** findings (Critical, Important, or spec-compliance) may trigger at most **two** fix+re-review rounds per task. **Advisory** findings (Minor, style, YAGNI, taste) never pause the loop — append them with `workit_sdd_append_advisory` (`--task <id> --text <text>`, `confirmed: true`) instead of an unrestricted file edit.

package/assets/templates/plan-template.md

@@ -1,6 +1,6 @@
 # <Feature> Implementation Plan
 
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. On Cursor the two paths are: **Subagent-driven** — Cursor-native subagents dispatched by the coordinator, each carrying a task-scoped `delegation_token` minted with `workit_delegate` from the one-time `coordinator_lease`; **Inline** — `executing-plans` in the current session, single-agent, no dispatch, no token minting. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Spec:** `docs/<slug>/spec.md`
 **Branch:** `feature/<slug>`

package/assets/templates/superpowers-doc-contract.md

@@ -1,6 +1,6 @@
 # Superpowers document contract
 
-Use OpenCode's native `question` for every bounded user choice. Give concise choices and allow a custom answer; if the tool is unavailable, ask one concise plain-text question. Use `skill` to load workflow and Superpowers skills, `todowrite` for task state, and `task` for delegated work.
+Use OpenCode's native `question` for every bounded user choice. Give concise choices and allow a custom answer; if the tool is unavailable, ask one concise plain-text question. Use `skill` to load workflow and Superpowers skills, `todowrite` for task state, and `task` for delegated work (OpenCode) or the host-native equivalent — on Cursor, Subagent-driven dispatches Cursor-native subagents with a task `delegation_token`, Inline runs single-agent in the current session.
 
 ## Tracked document layout
 
@@ -35,7 +35,7 @@ Before writing **Branch:** into a new spec or plan, call `workit_docs_branch` an
 - Commits use `wk-commit` after its native `question` confirmation.
 - Continuation uses `wk-handoff`, whose `workit_handoff_session` creates and seeds the OpenCode session automatically.
 - Never use worktrees. Resolve the declared branch with `workit_resolve_branch`, preview dirty-tree stash choices with `question`, and apply an approved in-place checkout through `workit_branch_setup` with `confirmed: true` (grounded in the recorded NativeChoiceEvidence).
-- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`) and subagent-driven execution is rejected as unsupported.
+- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`), Subagent-driven execution is supported through the one-time `coordinator_lease` and per-task `delegation_token` minted by `workit_delegate` (fail-closed validation; no `parentID` identity exists on Cursor), and Inline runs single-agent in the current session.
 - Keep all SDD state under the gitignored `docs/<slug>/sdd/`; use `workit_sdd_context` and the registered `workit_sdd_*` tools.
 - After implementation, use `question` before an approved stash reapply through `workit_branch_setup` with `confirmed: true`.
 

package/dist/index.js

@@ -46979,7 +46979,7 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import path19 from "node:path";
 
 // packages/workit-core/src/core/docs-validate.ts
@@ -47970,7 +47970,6 @@ root: ${cwd2}
 
 // packages/workit-core/src/core/flow-state.ts
 var COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations to an authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
-var CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
 var MENU_CHOICES = [
   "subagent-driven",
   "inline",
@@ -48000,6 +47999,21 @@ var resolveDoc = (root, slug, docPath, kind) => {
     return { ok: false, error: resolved.error };
   return { ok: true, path: resolved.layout[kind === "spec" ? "spec" : "plan"] };
 };
+var normalizeDelegation = (v) => {
+  if (v === null || v === undefined)
+    return null;
+  if (!isRecord4(v))
+    return null;
+  const hash = (x) => typeof x === "string" && HEX64_RE.test(x) ? x : null;
+  return {
+    coordinator_lease_hash: hash(v.coordinator_lease_hash),
+    active_task_id: typeof v.active_task_id === "number" && Number.isSafeInteger(v.active_task_id) ? v.active_task_id : null,
+    token_hash: hash(v.token_hash),
+    token_workspace: typeof v.token_workspace === "string" ? v.token_workspace : null,
+    token_slug: typeof v.token_slug === "string" ? v.token_slug : null,
+    status: v.status === "active" ? "active" : "revoked"
+  };
+};
 var HEX64_RE = /^[0-9a-f]{64}$/;
 var FLOW_STATUSES = ["draft", "self_reviewed", "approved"];
 var EXECUTION_STATUSES = ["pending", "active", "paused", "completed"];
@@ -48124,7 +48138,8 @@ var validateState = (parsed, slug) => {
         status: execRaw?.status ?? "pending",
         mode: execRaw?.mode ?? null,
         evidence: execRaw?.evidence ?? null,
-        coordinator_session_id: execRaw?.coordinator_session_id ?? null
+        coordinator_session_id: execRaw?.coordinator_session_id ?? null,
+        ...execRaw?.delegation !== undefined ? { delegation: normalizeDelegation(execRaw.delegation) } : {}
       },
       handoff_destination: parsed.handoff_destination ?? false,
       updated_at: parsed.updated_at ?? Date.now()
@@ -48261,7 +48276,13 @@ var resetForSpecDrift = (state) => ({
   spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+  execution: {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null,
+    ...state.execution.delegation !== undefined ? { delegation: null } : {}
+  },
   handoff_destination: false,
   updated_at: Date.now()
 });
@@ -48311,7 +48332,12 @@ var deriveLegacyExecution = (root, slug, state) => {
       coordinator_session_id: null
     };
   }
-  return { status: "pending", mode: null, evidence: null, coordinator_session_id: null };
+  return {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null
+  };
 };
 var normalizeCompatibility = (root, slug, parsed, state) => {
   if (!isRecord4(parsed) || !("execution" in parsed)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": false,
   "description": "Workit interactive setup wizard (Ink TUI)",
   "keywords": [
@@ -34,9 +34,9 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^0.10.0",
-    "@brainervirus/workit-cursor": "^0.10.0",
-    "@brainervirus/workit-opencode": "^0.10.0",
+    "@brainervirus/workit-core": "^0.11.0",
+    "@brainervirus/workit-cursor": "^0.11.0",
+    "@brainervirus/workit-opencode": "^0.11.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"