@brainervirus/workit-cli 8.39.4 → 8.40.1

package/dist/index.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.39.4",
+    version: "8.40.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.39.4",
+      "@brainervirus/workit-cursor": "^8.40.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.39.4"
+      "@brainervirus/workit-core": "^8.40.1"
     },
     engines: {
       node: ">=24"
@@ -21793,13 +21793,51 @@ function emit(io, envelope, human) {
   }
   return exitCodeFor(envelope.code);
 }
+async function withFailureLine(io, command, run, outcome) {
+  let wrote = false;
+  let reason = null;
+  const code = await run({
+    ...io,
+    stdout: (text) => {
+      wrote ||= text.length > 0;
+      io.stdout(text);
+    },
+    stderr: (text) => {
+      wrote ||= text.length > 0;
+      reason ??= /^workit: ([a-z][a-z_]*):/u.exec(text)?.[1] ?? null;
+      io.stderr(text);
+    }
+  });
+  if (code === 0)
+    return code;
+  if (outcome)
+    io.stderr(`workit: error: ${outcome} (${reason ?? EXIT_NAMES[code] ?? "failed"}, exit ${code})
+`);
+  else if (!wrote)
+    io.stderr(`workit: error: ${command} failed (exit ${code})
+`);
+  return code;
+}
 var EXIT, EXIT_BY_CODE, exitCodeFor = (code) => EXIT_BY_CODE[code], ok2 = (data) => ({ ok: true, code: "ok", data }), fail2 = (code, error, extra = {}) => ({
   ok: false,
   code,
   data: extra.data ?? {},
   error,
   ...extra.unblock ? { unblock: extra.unblock } : {}
-});
+}), EXIT_NAMES, flushStreams = async (streams = [process.stdout, process.stderr], timeoutMs = 2000) => {
+  await Promise.all(streams.map((stream) => new Promise((resolve) => {
+    const timer = setTimeout(resolve, timeoutMs);
+    const done = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    try {
+      stream.write("", done);
+    } catch {
+      done();
+    }
+  })));
+};
 var init_output = __esm(() => {
   EXIT = {
     ok: 0,
@@ -21820,6 +21858,13 @@ var init_output = __esm(() => {
     pending: EXIT.busy,
     unavailable: EXIT.unavailable
   };
+  EXIT_NAMES = {
+    1: "failed",
+    2: "invalid_input",
+    3: "blocked",
+    4: "busy",
+    5: "unavailable"
+  };
 });
 
 // packages/workit-cli/src/verbs/task.ts
@@ -77034,6 +77079,7 @@ var init_uninstall2 = __esm(() => {
 // packages/workit-cli/src/verbs/grant.ts
 var exports_grant = {};
 __export(exports_grant, {
+  agentMarker: () => agentMarker,
   run: () => run10,
   runGrant: () => runGrant
 });
@@ -77372,7 +77418,90 @@ function set2(argv, io) {
     `${name}: ${changes.map((change) => change.path.join(".")).join(", ")} updated in ${written(data.path, data.backup)}`
   ]);
 }
-async function runWorkspace(argv, io) {
+async function rm(argv, io, deps) {
+  const [name, extra] = argv;
+  if (!name)
+    return usage3(io, "rm needs <name>");
+  if (extra)
+    return usage3(io, `unexpected argument ${extra}`);
+  const current = load(io);
+  if (typeof current === "number")
+    return current;
+  const entries = entriesOf(current);
+  const removed = entries.find((entry) => entry.name === name);
+  if (!removed)
+    return emit(io, fail2("not_found", `no workspace named "${name}" in ${current.path}`));
+  const remaining = entries.filter((entry) => entry !== removed);
+  if (remaining.length === 0)
+    return emit(io, fail2("blocked", `"${name}" is the last workspace in ${current.path}: it holds your vcs, policies and grants, and without it every folder falls back to the defaults; workspace rm does not remove it`, {
+      unblock: `add the workspace that should replace it first (workit workspace add <name> --glob <g> --from ${name}), or edit ${current.path} in your own editor`
+    }));
+  const before = deliveredCeilingOf(removed);
+  const defaults = ceilingOf({});
+  const nothing = {
+    grants: Object.fromEntries(GRANT_KINDS.map((kind) => [kind, false])),
+    endpoint: DEFAULT_ENDPOINT,
+    verification: STRICTNESS[0]
+  };
+  const specificity = globSpecificity(removed.glob);
+  const raised = [
+    { taker: "defaults", kinds: raisedKinds(before, defaults), reason: "no entry matches" },
+    ...remaining.map((entry) => ({
+      taker: entry.name,
+      kinds: raisedKinds(before, ceilingOf(entry)),
+      reason: "may match a folder it covered"
+    })),
+    ...remaining.filter((entry) => globSpecificity(entry.glob) === specificity).map((entry) => ({
+      taker: entry.name,
+      kinds: raisedKinds(nothing, ceilingOf(entry)),
+      reason: "equally specific: a folder both matched was ambiguous, with nothing granted"
+    }))
+  ].filter((raise) => raise.kinds.length > 0);
+  if (raised.length > 0) {
+    const kinds = [...new Set(raised.flatMap((raise) => raise.kinds))];
+    const detail = raised.map((raise) => `${raise.taker} (${raise.reason}): ${raise.kinds.join(", ")}`).join("; ");
+    const agent = agentMarker(io.env);
+    if (!deps.interactive() || agent)
+      return emit(io, fail2("blocked", `grant_raise_refused: removing "${name}" may raise ${kinds.join(", ")} for the folders it covered (${detail}); that needs the user at an interactive terminal${agent ? ` (this shell belongs to an agent: ${agent} is set)` : ""}; grants are never raised headless`, {
+        unblock: `ask the user to run, in a terminal outside the agent host (not Claude Code's \`!\` prefix or an agent shell): workit workspace rm ${name}`
+      }));
+    const answer = await askOrCancel(io, () => deps.ask(`Removing workspace "${name}" may raise ${kinds.join(", ")} for the folders it covered (${detail}). An agent there may then do more without asking. Type the workspace name to confirm: `));
+    if (answer === null)
+      return cancelled(io);
+    if (answer.trim() !== name)
+      return emit(io, fail2("blocked", "workspace removal not confirmed; nothing was written"));
+  }
+  const result = save(current, remaining);
+  if (!result.ok)
+    return emit(io, fail2("invalid_input", result.error));
+  const at = globRoot(removed.glob);
+  let covers;
+  try {
+    covers = { at, workspace: resolveWorkspaceFromEntries(at, remaining)?.name ?? null };
+  } catch (error) {
+    covers = { at, workspace: null, error: error instanceof Error ? error.message : String(error) };
+  }
+  const coveringCeiling = ceilingOf(remaining.find((entry) => entry.name === covers.workspace));
+  return emit(io, ok2({
+    path: result.path,
+    backup: result.backup,
+    removed,
+    covers: {
+      ...covers,
+      grants: coveringCeiling.grants,
+      defaultEndpoint: coveringCeiling.endpoint,
+      verification: coveringCeiling.verification
+    },
+    takers: overlappingEntries(removed.glob, remaining).map((entry) => entry.name),
+    raises: raised
+  }), (data) => [
+    `${name} (${removed.glob}) removed from ${written(data.path, data.backup)}`,
+    data.covers.error ? `  ${data.covers.at}: ${data.covers.error}` : `  ${data.covers.at} is now ${data.covers.workspace ? `workspace ${data.covers.workspace}` : "under the defaults (no workspace)"}: ${GRANT_KINDS.map((kind) => `${kind}=${String(data.covers.grants[kind])}`).join(" ")}; default endpoint ${data.covers.defaultEndpoint}; verification ${data.covers.verification}`,
+    ...data.takers.length ? [`  entries whose globs may cover its other folders: ${data.takers.join(", ")}`] : [],
+    "  workit workspace list --cwd <folder> shows which entry applies to a folder"
+  ]);
+}
+async function runWorkspace(argv, io, deps = defaultDeps2) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json" && arg !== "--");
   if (sub === undefined || sub === "list")
     return list2(rest, io);
@@ -77380,13 +77509,25 @@ async function runWorkspace(argv, io) {
     return add2(rest, io);
   if (sub === "set")
     return set2(rest, io);
+  if (sub === "rm")
+    return rm(rest, io, deps);
   return usage3(io, `unknown subcommand "${sub}"`);
 }
-var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>…", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
+var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>… | workspace rm <name>", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
   grants: { ...DEFAULT_GRANTS, ...configuredGrants(entry).grants },
   endpoint: isDefaultEndpoint(entry?.defaultEndpoint) ? entry.defaultEndpoint : DEFAULT_ENDPOINT,
   verification: verificationOf(entry)
-}), STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
+}), deliveredCeilingOf = (entry) => {
+  const ceiling = ceilingOf(entry);
+  const account = entry.vcs?.account;
+  if (Object.keys(configuredGrants(entry).grants).length === 0 || account)
+    return ceiling;
+  return {
+    grants: Object.fromEntries(GRANT_KINDS.map((kind) => [kind, false])),
+    endpoint: DEFAULT_ENDPOINT,
+    verification: ceiling.verification
+  };
+}, STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
   if (shadowed.length === 0)
     return null;
   const ceilings = shadowed.map(ceilingOf);
@@ -77406,7 +77547,11 @@ var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <p
     ...Object.keys(autonomy).length ? { autonomy } : {},
     ...looser(shadowed.verification, DEFAULT_VERIFICATION) ? { verification: shadowed.verification } : {}
   };
-}, usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
+}, defaultDeps2, raisedKinds = (before, after) => [
+  ...GRANT_KINDS.filter((kind) => raises(kind, before.grants[kind], after.grants[kind])),
+  ...raisesEndpoint(before.endpoint, after.endpoint) ? ["defaultEndpoint"] : [],
+  ...looser(before.verification, after.verification) ? ["verification"] : []
+], usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
 usage: ${USAGE5}`)), load = (io) => {
   const current = readWorkspacesResult();
   if (current.status === "malformed" || current.status === "invalid")
@@ -77455,6 +77600,8 @@ var init_workspace = __esm(() => {
   init_safe_write();
   init_workspaces();
   init_output();
+  init_prompt();
+  init_grant();
   INHERITED_KEYS = [
     "vcs",
     "issues",
@@ -77486,6 +77633,10 @@ var init_workspace = __esm(() => {
   SEGMENT = /^[A-Za-z0-9_-]+$/u;
   UNSAFE_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);
   STRICTNESS = ["independent", "self", "proportional"];
+  defaultDeps2 = {
+    interactive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+    ask: (question) => askLine(question)
+  };
 });
 
 // packages/workit-core/src/core/heavy-rules.ts
@@ -81491,7 +81642,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return {
       ok: false,
       code: "failed",
-      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
+      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${state === "open" ? ", so it is not merged yet (a merge queue or auto-merge may hold it)" : ""}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
       unblock: `workit verify-delivery merged --pr ${doc.number}`,
       recorded
     };
@@ -107882,7 +108033,7 @@ var VERBS = [
   withSubcommands({
     name: "workspace",
     group: "setup",
-    summary: "Edit workspace entries without the wizard; never raises a grant",
+    summary: "Edit workspace entries without the wizard; a raise (rm included) needs the user at a terminal",
     subcommands: [
       {
         name: "list",
@@ -107898,15 +108049,21 @@ var VERBS = [
         name: "set",
         usage: "workit workspace set <name> <key>=<value>…",
         summary: "Change non-grant keys (dotted paths, JSON values, null removes); grants stay with workit grant set"
+      },
+      {
+        name: "rm",
+        usage: "workit workspace rm <name>",
+        summary: "Remove an entry; if another entry or the defaults could grant its folders more, the user confirms at their own terminal"
       }
     ],
     examples: [
       "workit workspace list",
       "workit workspace add kit --glob '/home/me/work/libs/kit/**' --from work",
-      "workit workspace set kit branchPolicy.integration=merge"
+      "workit workspace set kit branchPolicy.integration=merge",
+      "workit workspace rm kit"
     ],
     notes: [
-      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. Remove an entry in your own editor. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
+      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. rm counts every other entry and the defaults as a possible taker of the removed folders: when any could grant more, it is refused in an agent or headless shell and the user types the name to confirm at their own terminal; it never removes the last entry. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
       "Every write keeps the previous file as workspaces.json.bak. `workit doctor` lists overlapping globs and which entry wins."
     ],
     load: () => Promise.resolve().then(() => (init_workspace(), exports_workspace))
@@ -108643,43 +108800,54 @@ async function main(argv, overrides = {}, options = {}) {
   const entry = findVerb(command);
   if (!entry)
     return unknown2(io, command);
-  if (wantsHelp(verbArgs)) {
-    const word = firstWord(verbArgs);
-    const sub = word === undefined ? undefined : findSubcommand(entry, word);
-    const asValue = helpAsValue(verbArgs, sub ? [sub.usage] : usageLines(entry));
-    if (asValue)
-      return emit(io, fail2("invalid_input", asValue, {
-        unblock: `workit help ${entry.name}${sub ? ` ${sub.name}` : ""}`
-      }));
-    return help(io, sub ? subcommandHelp(entry, sub) : verbHelp(entry));
-  }
-  const ended = endOfOptions(io, entry, args);
-  if (typeof ended === "number")
-    return ended;
-  const checked = checkFlags(entry, ended);
-  if ("error" in checked)
-    return emit(io, fail2("invalid_input", checked.error, { unblock: checked.unblock }));
-  if (parsed.cwd !== null) {
-    try {
-      process.chdir(io.cwd);
-    } catch {
-      return emit(io, fail2("invalid_input", `--cwd: cannot enter ${io.cwd}`));
-    }
-    if (process.env.WORKFLOW_WORKSPACE_ROOT !== undefined) {
-      process.env.WORKFLOW_WORKSPACE_ROOT = io.cwd;
-      io.env = process.env;
+  const route = async (routed) => {
+    if (wantsHelp(verbArgs)) {
+      const word = firstWord(verbArgs);
+      const sub = word === undefined ? undefined : findSubcommand(entry, word);
+      const asValue = helpAsValue(verbArgs, sub ? [sub.usage] : usageLines(entry));
+      if (asValue)
+        return emit(routed, fail2("invalid_input", asValue, {
+          unblock: `workit help ${entry.name}${sub ? ` ${sub.name}` : ""}`
+        }));
+      return help(routed, sub ? subcommandHelp(entry, sub) : verbHelp(entry));
+    }
+    const ended = endOfOptions(routed, entry, args);
+    if (typeof ended === "number")
+      return ended;
+    const checked = checkFlags(entry, ended);
+    if ("error" in checked)
+      return emit(routed, fail2("invalid_input", checked.error, { unblock: checked.unblock }));
+    if (parsed.cwd !== null) {
+      try {
+        process.chdir(routed.cwd);
+      } catch {
+        return emit(routed, fail2("invalid_input", `--cwd: cannot enter ${routed.cwd}`));
+      }
+      if (process.env.WORKFLOW_WORKSPACE_ROOT !== undefined) {
+        process.env.WORKFLOW_WORKSPACE_ROOT = routed.cwd;
+        routed.env = process.env;
+      }
     }
-  }
-  if (options.diagnostics)
-    (await Promise.resolve().then(() => (init_diagnostics(), exports_diagnostics))).installDiagnostics(command);
-  globalThis[Symbol.for("workit.migrationReporter")] = (report) => io.stderr(`workit: migrated ${report.tasks} task${report.tasks === 1 ? "" : "s"} from ${report.from} to ${report.to} (backup: ${report.backup})
+    if (options.diagnostics)
+      (await Promise.resolve().then(() => (init_diagnostics(), exports_diagnostics))).installDiagnostics(command);
+    globalThis[Symbol.for("workit.migrationReporter")] = (report) => routed.stderr(`workit: migrated ${report.tasks} task${report.tasks === 1 ? "" : "s"} from ${report.from} to ${report.to} (backup: ${report.backup})
 `);
-  const verb = await entry.load();
-  const runVerb = (target) => guarded(target, () => verb.run(checked.args, target));
-  if (!io.json)
-    return runVerb(io);
-  return runJsonPure(io, command, runVerb);
-}
+    const verb = await entry.load();
+    const runVerb = (target) => guarded(target, () => verb.run(checked.args, target));
+    return routed.json ? runJsonPure(routed, command, runVerb) : runVerb(routed);
+  };
+  if (io.json)
+    return route(io);
+  const verbWord = firstWord(verbArgs);
+  const outcome = verbWord ? OUTCOMES2[`${entry.name} ${verbWord}`] : undefined;
+  return withFailureLine(io, command, route, outcome);
+}
+var OUTCOMES2 = {
+  "pr merge": "PR not merged",
+  "pr create": "PR not created",
+  "stack land": "stack not landed",
+  "git push": "not pushed"
+};
 async function guarded(io, run) {
   try {
     return await run();
@@ -108783,7 +108951,9 @@ var describe4 = (entry) => ({
 });
 var unknown2 = (io, command) => emit(io, fail2("invalid_input", `unknown command "${command}"`, { unblock: commandUnblock(command) }));
 if (__require.main == __require.module) {
-  process.exit(await main(process.argv.slice(2), {}, { diagnostics: true }));
+  const code = await main(process.argv.slice(2), {}, { diagnostics: true });
+  await flushStreams();
+  process.exit(code);
 }
 export {
   main,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.39.4",
+  "version": "8.40.1",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.39.4",
+    "@brainervirus/workit-cursor": "^8.40.1",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.39.4"
+    "@brainervirus/workit-core": "^8.40.1"
   },
   "engines": {
     "node": ">=24"