@brainervirus/workit-cli 8.39.4 → 8.40.0

package/dist/index.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.39.4",
+    version: "8.40.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.39.4",
+      "@brainervirus/workit-cursor": "^8.40.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.39.4"
+      "@brainervirus/workit-core": "^8.40.0"
     },
     engines: {
       node: ">=24"
@@ -77034,6 +77034,7 @@ var init_uninstall2 = __esm(() => {
 // packages/workit-cli/src/verbs/grant.ts
 var exports_grant = {};
 __export(exports_grant, {
+  agentMarker: () => agentMarker,
   run: () => run10,
   runGrant: () => runGrant
 });
@@ -77372,7 +77373,90 @@ function set2(argv, io) {
     `${name}: ${changes.map((change) => change.path.join(".")).join(", ")} updated in ${written(data.path, data.backup)}`
   ]);
 }
-async function runWorkspace(argv, io) {
+async function rm(argv, io, deps) {
+  const [name, extra] = argv;
+  if (!name)
+    return usage3(io, "rm needs <name>");
+  if (extra)
+    return usage3(io, `unexpected argument ${extra}`);
+  const current = load(io);
+  if (typeof current === "number")
+    return current;
+  const entries = entriesOf(current);
+  const removed = entries.find((entry) => entry.name === name);
+  if (!removed)
+    return emit(io, fail2("not_found", `no workspace named "${name}" in ${current.path}`));
+  const remaining = entries.filter((entry) => entry !== removed);
+  if (remaining.length === 0)
+    return emit(io, fail2("blocked", `"${name}" is the last workspace in ${current.path}: it holds your vcs, policies and grants, and without it every folder falls back to the defaults; workspace rm does not remove it`, {
+      unblock: `add the workspace that should replace it first (workit workspace add <name> --glob <g> --from ${name}), or edit ${current.path} in your own editor`
+    }));
+  const before = deliveredCeilingOf(removed);
+  const defaults = ceilingOf({});
+  const nothing = {
+    grants: Object.fromEntries(GRANT_KINDS.map((kind) => [kind, false])),
+    endpoint: DEFAULT_ENDPOINT,
+    verification: STRICTNESS[0]
+  };
+  const specificity = globSpecificity(removed.glob);
+  const raised = [
+    { taker: "defaults", kinds: raisedKinds(before, defaults), reason: "no entry matches" },
+    ...remaining.map((entry) => ({
+      taker: entry.name,
+      kinds: raisedKinds(before, ceilingOf(entry)),
+      reason: "may match a folder it covered"
+    })),
+    ...remaining.filter((entry) => globSpecificity(entry.glob) === specificity).map((entry) => ({
+      taker: entry.name,
+      kinds: raisedKinds(nothing, ceilingOf(entry)),
+      reason: "equally specific: a folder both matched was ambiguous, with nothing granted"
+    }))
+  ].filter((raise) => raise.kinds.length > 0);
+  if (raised.length > 0) {
+    const kinds = [...new Set(raised.flatMap((raise) => raise.kinds))];
+    const detail = raised.map((raise) => `${raise.taker} (${raise.reason}): ${raise.kinds.join(", ")}`).join("; ");
+    const agent = agentMarker(io.env);
+    if (!deps.interactive() || agent)
+      return emit(io, fail2("blocked", `grant_raise_refused: removing "${name}" may raise ${kinds.join(", ")} for the folders it covered (${detail}); that needs the user at an interactive terminal${agent ? ` (this shell belongs to an agent: ${agent} is set)` : ""}; grants are never raised headless`, {
+        unblock: `ask the user to run, in a terminal outside the agent host (not Claude Code's \`!\` prefix or an agent shell): workit workspace rm ${name}`
+      }));
+    const answer = await askOrCancel(io, () => deps.ask(`Removing workspace "${name}" may raise ${kinds.join(", ")} for the folders it covered (${detail}). An agent there may then do more without asking. Type the workspace name to confirm: `));
+    if (answer === null)
+      return cancelled(io);
+    if (answer.trim() !== name)
+      return emit(io, fail2("blocked", "workspace removal not confirmed; nothing was written"));
+  }
+  const result = save(current, remaining);
+  if (!result.ok)
+    return emit(io, fail2("invalid_input", result.error));
+  const at = globRoot(removed.glob);
+  let covers;
+  try {
+    covers = { at, workspace: resolveWorkspaceFromEntries(at, remaining)?.name ?? null };
+  } catch (error) {
+    covers = { at, workspace: null, error: error instanceof Error ? error.message : String(error) };
+  }
+  const coveringCeiling = ceilingOf(remaining.find((entry) => entry.name === covers.workspace));
+  return emit(io, ok2({
+    path: result.path,
+    backup: result.backup,
+    removed,
+    covers: {
+      ...covers,
+      grants: coveringCeiling.grants,
+      defaultEndpoint: coveringCeiling.endpoint,
+      verification: coveringCeiling.verification
+    },
+    takers: overlappingEntries(removed.glob, remaining).map((entry) => entry.name),
+    raises: raised
+  }), (data) => [
+    `${name} (${removed.glob}) removed from ${written(data.path, data.backup)}`,
+    data.covers.error ? `  ${data.covers.at}: ${data.covers.error}` : `  ${data.covers.at} is now ${data.covers.workspace ? `workspace ${data.covers.workspace}` : "under the defaults (no workspace)"}: ${GRANT_KINDS.map((kind) => `${kind}=${String(data.covers.grants[kind])}`).join(" ")}; default endpoint ${data.covers.defaultEndpoint}; verification ${data.covers.verification}`,
+    ...data.takers.length ? [`  entries whose globs may cover its other folders: ${data.takers.join(", ")}`] : [],
+    "  workit workspace list --cwd <folder> shows which entry applies to a folder"
+  ]);
+}
+async function runWorkspace(argv, io, deps = defaultDeps2) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json" && arg !== "--");
   if (sub === undefined || sub === "list")
     return list2(rest, io);
@@ -77380,13 +77464,25 @@ async function runWorkspace(argv, io) {
     return add2(rest, io);
   if (sub === "set")
     return set2(rest, io);
+  if (sub === "rm")
+    return rm(rest, io, deps);
   return usage3(io, `unknown subcommand "${sub}"`);
 }
-var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>…", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
+var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>… | workspace rm <name>", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
   grants: { ...DEFAULT_GRANTS, ...configuredGrants(entry).grants },
   endpoint: isDefaultEndpoint(entry?.defaultEndpoint) ? entry.defaultEndpoint : DEFAULT_ENDPOINT,
   verification: verificationOf(entry)
-}), STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
+}), deliveredCeilingOf = (entry) => {
+  const ceiling = ceilingOf(entry);
+  const account = entry.vcs?.account;
+  if (Object.keys(configuredGrants(entry).grants).length === 0 || account)
+    return ceiling;
+  return {
+    grants: Object.fromEntries(GRANT_KINDS.map((kind) => [kind, false])),
+    endpoint: DEFAULT_ENDPOINT,
+    verification: ceiling.verification
+  };
+}, STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
   if (shadowed.length === 0)
     return null;
   const ceilings = shadowed.map(ceilingOf);
@@ -77406,7 +77502,11 @@ var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <p
     ...Object.keys(autonomy).length ? { autonomy } : {},
     ...looser(shadowed.verification, DEFAULT_VERIFICATION) ? { verification: shadowed.verification } : {}
   };
-}, usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
+}, defaultDeps2, raisedKinds = (before, after) => [
+  ...GRANT_KINDS.filter((kind) => raises(kind, before.grants[kind], after.grants[kind])),
+  ...raisesEndpoint(before.endpoint, after.endpoint) ? ["defaultEndpoint"] : [],
+  ...looser(before.verification, after.verification) ? ["verification"] : []
+], usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
 usage: ${USAGE5}`)), load = (io) => {
   const current = readWorkspacesResult();
   if (current.status === "malformed" || current.status === "invalid")
@@ -77455,6 +77555,8 @@ var init_workspace = __esm(() => {
   init_safe_write();
   init_workspaces();
   init_output();
+  init_prompt();
+  init_grant();
   INHERITED_KEYS = [
     "vcs",
     "issues",
@@ -77486,6 +77588,10 @@ var init_workspace = __esm(() => {
   SEGMENT = /^[A-Za-z0-9_-]+$/u;
   UNSAFE_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);
   STRICTNESS = ["independent", "self", "proportional"];
+  defaultDeps2 = {
+    interactive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+    ask: (question) => askLine(question)
+  };
 });
 
 // packages/workit-core/src/core/heavy-rules.ts
@@ -107882,7 +107988,7 @@ var VERBS = [
   withSubcommands({
     name: "workspace",
     group: "setup",
-    summary: "Edit workspace entries without the wizard; never raises a grant",
+    summary: "Edit workspace entries without the wizard; a raise (rm included) needs the user at a terminal",
     subcommands: [
       {
         name: "list",
@@ -107898,15 +108004,21 @@ var VERBS = [
         name: "set",
         usage: "workit workspace set <name> <key>=<value>…",
         summary: "Change non-grant keys (dotted paths, JSON values, null removes); grants stay with workit grant set"
+      },
+      {
+        name: "rm",
+        usage: "workit workspace rm <name>",
+        summary: "Remove an entry; if another entry or the defaults could grant its folders more, the user confirms at their own terminal"
       }
     ],
     examples: [
       "workit workspace list",
       "workit workspace add kit --glob '/home/me/work/libs/kit/**' --from work",
-      "workit workspace set kit branchPolicy.integration=merge"
+      "workit workspace set kit branchPolicy.integration=merge",
+      "workit workspace rm kit"
     ],
     notes: [
-      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. Remove an entry in your own editor. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
+      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. rm counts every other entry and the defaults as a possible taker of the removed folders: when any could grant more, it is refused in an agent or headless shell and the user types the name to confirm at their own terminal; it never removes the last entry. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
       "Every write keeps the previous file as workspaces.json.bak. `workit doctor` lists overlapping globs and which entry wins."
     ],
     load: () => Promise.resolve().then(() => (init_workspace(), exports_workspace))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.39.4",
+  "version": "8.40.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.39.4",
+    "@brainervirus/workit-cursor": "^8.40.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.39.4"
+    "@brainervirus/workit-core": "^8.40.0"
   },
   "engines": {
     "node": ">=24"