@brainervirus/workit-cli 8.40.6 → 8.40.8

package/dist/index.js

@@ -6389,7 +6389,7 @@ var init_zod = __esm(() => {
 // packages/workit-core/src/core/workspaces.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { existsSync as existsSync2, lstatSync, readFileSync as readFileSync2, realpathSync } from "node:fs";
 import path2 from "node:path";
 function workspaceDefaultTarget(cwd, globalDefault) {
   const ws = resolveRuntimeWorkspaceVcs(cwd);
@@ -6537,6 +6537,15 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     return cached;
   let dir = path2.resolve(cwd);
   while (!existsSync2(path2.join(dir, ".git"))) {
+    if (["HEAD", "objects", "refs"].every((name) => existsSync2(path2.join(dir, name)))) {
+      const real = realpathOf(dir);
+      const owner = ownInternals(real) === true ? gitDirOwner(real) : null;
+      if (owner === null)
+        return Error(`${cwd} is in a repository with no work tree at ${real}: no grants apply`);
+      const probe = { main: owner, superproject: null };
+      probes.set(cwd, probe);
+      return probe;
+    }
     const up = path2.dirname(dir);
     if (up === dir)
       return null;
@@ -6566,7 +6575,24 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   if (!gitDir || !common)
     return failed;
   let main = null;
-  if (path2.resolve(gitDir) !== path2.resolve(common)) {
+  if (path2.resolve(gitDir) === path2.resolve(common)) {
+    const real = realpathOf(common);
+    if (!ownGitDir(path2.join(dir, ".git"), real)) {
+      const owner = gitDirOwner(real);
+      if (owner === null)
+        return Error(`${cwd} uses the repository at ${real}, owned by no checkout workit can name`);
+      if (owner !== realpathOf(dir))
+        main = owner;
+    }
+    const lender = ownInternals(real);
+    if (lender === false)
+      return Error(`${cwd} borrows git internals from outside ${real} that no checkout owns`);
+    if (lender !== true && lender !== realpathOf(dir)) {
+      if (main !== null && main !== lender)
+        return Error(`${cwd} mixes the repositories of ${main} and ${lender}`);
+      main = lender;
+    }
+  } else {
     const list = git(["worktree", "list", "--porcelain"]);
     if (list === null)
       return failed;
@@ -6575,6 +6601,44 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const probe = { main, superproject: superproject || null };
   probes.set(cwd, probe);
   return probe;
+}, ownGitDir = (dotGit, real) => {
+  try {
+    return lstatSync(dotGit).isDirectory() && realpathOf(dotGit) === real;
+  } catch {
+    return false;
+  }
+}, INTERNALS, ownInternals = (real) => {
+  let lender = null;
+  for (const name of INTERNALS) {
+    const at = path2.join(real, name);
+    try {
+      lstatSync(at);
+    } catch {
+      continue;
+    }
+    let resolved;
+    try {
+      resolved = (realpathSync.native ?? realpathSync)(at);
+    } catch {
+      return false;
+    }
+    const rel = path2.relative(real, resolved);
+    if (rel && !rel.startsWith("..") && !path2.isAbsolute(rel))
+      continue;
+    const owner = path2.basename(resolved) === name ? gitDirOwner(path2.dirname(resolved)) : null;
+    if (owner === null || lender !== null && lender !== owner)
+      return false;
+    lender = owner;
+  }
+  return lender ?? true;
+}, gitDirOwner = (real) => {
+  const parts = real.split(/[\\/]/u);
+  const at = parts.lastIndexOf(".git");
+  if (at < 1)
+    return null;
+  const rest = parts.slice(at + 1);
+  const module = rest[0] === "modules" || rest[0] === "worktrees" && rest[2] === "modules";
+  return rest.length === 0 || module ? parts.slice(0, at).join(path2.sep) || path2.sep : null;
 }, mainCheckoutOf = (cwd) => {
   const probe = probeCheckout(cwd);
   return probe instanceof Error ? null : probe?.main ?? null;
@@ -7035,6 +7099,7 @@ var init_workspaces = __esm(() => {
     name = "WorkspaceConfigError";
   };
   probes = new Map;
+  INTERNALS = ["refs", "objects", "config", "packed-refs", "commondir"];
   runtimeWorkspaceIndexSchema = object({
     workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
   }).passthrough();
@@ -9352,7 +9417,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.40.6",
+    version: "8.40.8",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9390,13 +9455,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.40.6",
+      "@brainervirus/workit-cursor": "^8.40.8",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.40.6"
+      "@brainervirus/workit-core": "^8.40.8"
     },
     engines: {
       node: ">=24"
@@ -9662,7 +9727,7 @@ import {
   closeSync,
   fchmodSync,
   fsyncSync,
-  lstatSync,
+  lstatSync as lstatSync2,
   mkdirSync as mkdirSync3,
   openSync,
   renameSync,
@@ -9686,7 +9751,7 @@ function writeFileAtomic(file, content, mode) {
   const root = path10.parse(parent).root;
   for (;; ) {
     try {
-      if (lstatSync(parent).isSymbolicLink())
+      if (lstatSync2(parent).isSymbolicLink())
         throw new Error(`symlinked write path: ${parent}`);
     } catch (error) {
       if (error.code !== "ENOENT")
@@ -9701,7 +9766,7 @@ function writeFileAtomic(file, content, mode) {
   mkdirSync3(directory, { recursive: true });
   let existing = null;
   try {
-    existing = lstatSync(absolute);
+    existing = lstatSync2(absolute);
   } catch (error) {
     if (error.code !== "ENOENT")
       throw error;
@@ -18797,6 +18862,7 @@ var SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS
   let here = dir;
   const config = [...inherited];
   let gitDir = env.GIT_DIR;
+  let from = "GIT_DIR";
   let index = 0;
   for (;index < words.length; index++) {
     const word = words[index];
@@ -18804,18 +18870,21 @@ var SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS
       here = words[index + 1] ? joinDir(here, words[++index]) : here;
     else if (GIT_CONFIG_OPTIONS.has(word)) {
       if (word === "--git-dir")
-        gitDir = words[index + 1];
+        [gitDir, from] = [words[index + 1], "--git-dir"];
       if (words[index + 1] !== undefined)
         config.push(word, words[++index]);
     } else if (/^--(?:config-env|git-dir)=/.test(word)) {
       if (word.startsWith("--git-dir="))
-        gitDir = word.slice("--git-dir=".length);
+        [gitDir, from] = [word.slice("--git-dir=".length), "--git-dir"];
       config.push(word);
     } else if (GIT_VALUE_OPTIONS.has(word))
       index++;
     else if (!word.startsWith("-"))
       break;
   }
+  if (env.GIT_COMMON_DIR)
+    [gitDir, from] = [env.GIT_COMMON_DIR, "GIT_COMMON_DIR"];
+  const known = here !== undefined;
   if (gitDir)
     here = joinDir(here, gitDir.replace(/(?:^|[\\/]+)\.git[\\/]*$/, "") || ".");
   return {
@@ -18824,7 +18893,8 @@ var SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS
     args: words.slice(index),
     ...config.length ? { config } : {},
     ...Object.keys(env).length ? { env } : {},
-    ...stdin === undefined ? {} : { stdin }
+    ...stdin === undefined ? {} : { stdin },
+    ...known && here === undefined ? { redirect: from } : {}
   };
 }, RECENT, LAUNCHERS, WORKIT_PACKAGE, PACKAGE_RUNNERS, OUTPUT_FILTERS, WORKIT_GLOBAL, PUSH_VALUE_OPTIONS, VALUE_OPTIONS, API_VALUES, API_FIELDS, GIT_COMMANDS;
 var init_raw_git = __esm(() => {
@@ -66622,7 +66692,7 @@ import { spawnSync as spawnSync15 } from "node:child_process";
 import {
   chmodSync,
   existsSync as existsSync15,
-  lstatSync as lstatSync4,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync15,
   renameSync as renameSync3,
@@ -66833,7 +66903,7 @@ exit 0
   }
 }, exists = (file) => {
   try {
-    lstatSync4(file);
+    lstatSync5(file);
     return true;
   } catch {
     return false;
@@ -67667,7 +67737,7 @@ import { spawnSync as spawnSync16 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import {
   existsSync as existsSync17,
-  lstatSync as lstatSync5,
+  lstatSync as lstatSync6,
   mkdirSync as mkdirSync8,
   mkdtempSync,
   readdirSync as readdirSync10,
@@ -68145,7 +68215,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       const want = stampCodexAgent(readFileSync18(path39.join(source, file), "utf8"), version);
       let link = false;
       try {
-        link = lstatSync5(dest).isSymbolicLink();
+        link = lstatSync6(dest).isSymbolicLink();
       } catch {
         link = false;
       }
@@ -68872,7 +68942,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "cursor plugin not inspected on this host"
     };
   }
-  if (existsSync17(res.cursorPluginDir) && lstatSync5(res.cursorPluginDir).isSymbolicLink()) {
+  if (existsSync17(res.cursorPluginDir) && lstatSync6(res.cursorPluginDir).isSymbolicLink()) {
     let target = "";
     try {
       target = readlinkSync2(res.cursorPluginDir);
@@ -70086,7 +70156,7 @@ import {
   copyFileSync as copyFileSync5,
   cpSync as cpSync4,
   existsSync as existsSync18,
-  lstatSync as lstatSync6,
+  lstatSync as lstatSync7,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync19,
@@ -70539,7 +70609,7 @@ function applyOpenCode(root, res) {
 function copyPluginDir(src, dest) {
   const realSrc = realpathSync9(src);
   const marker = path40.join(dest, ".workit-root");
-  const destIsLink = existsSync18(dest) && lstatSync6(dest).isSymbolicLink();
+  const destIsLink = existsSync18(dest) && lstatSync7(dest).isSymbolicLink();
   const synced = !destIsLink && readFileSafe(marker)?.trim() === realSrc && samePluginContent(realSrc, dest, dest);
   if (synced)
     return "Skipped";
@@ -70566,7 +70636,7 @@ function copyPluginDir(src, dest) {
 `, "utf8");
     if (!samePluginContent(realSrc, stage, dest))
       throw new Error("staged adapter content is incomplete");
-    if (lstatSync6(stage).isSymbolicLink()) {
+    if (lstatSync7(stage).isSymbolicLink()) {
       throw new Error("staged adapter resolved to a symlink — refusing fragile cache install");
     }
     if (hadDir)
@@ -75660,7 +75730,7 @@ var init_apply = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade/plan.ts
-import { existsSync as existsSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync7, readFileSync as readFileSync23 } from "node:fs";
+import { existsSync as existsSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync8, readFileSync as readFileSync23 } from "node:fs";
 import path47 from "node:path";
 import os17 from "node:os";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
@@ -75970,7 +76040,7 @@ var codexRegistered = (configFile) => {
   }
   const packageFile = path47.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
   const installed = objectOrNull(packageFile);
-  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync7(path47.dirname(packageFile)).isSymbolicLink()) {
+  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync8(path47.dirname(packageFile)).isSymbolicLink()) {
     plan.skipped.push({
       host: "cli",
       reason: "no managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
@@ -106949,7 +107019,7 @@ var init_audit = __esm(() => {
 import { spawn as spawn2 } from "node:child_process";
 import {
   existsSync as existsSync29,
-  lstatSync as lstatSync8,
+  lstatSync as lstatSync9,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync15,
@@ -107059,7 +107129,7 @@ function removeStaleCopies(tmp = os23.tmpdir()) {
       continue;
     const dir = path72.join(tmp, name);
     try {
-      const stat = lstatSync8(dir);
+      const stat = lstatSync9(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
       const pid = Number(readFileSync30(path72.join(dir, PID_FILE), "utf8"));
@@ -107125,7 +107195,7 @@ function copySymlink(repo, tree, from, to) {
 function writeInside(copy, file, content) {
   const target = path72.join(copy, file);
   try {
-    const stat = lstatSync8(target);
+    const stat = lstatSync9(target);
     if (!stat.isFile() || !inside5(realpathSync11(copy), realpathSync11(path72.dirname(target))))
       return false;
   } catch {
@@ -107159,7 +107229,7 @@ function copyWorkingTree(repo) {
     const from = path72.join(repo, relative);
     let stat;
     try {
-      stat = lstatSync8(from);
+      stat = lstatSync9(from);
     } catch {
       continue;
     }
@@ -107956,10 +108026,28 @@ var init_handoff = __esm(() => {
   init_output();
 });
 
+// packages/workit-cli/src/main.ts
+import path77 from "node:path";
+
+// packages/workit-core/src/git/env-redirect.ts
+var GIT_REDIRECT_ENV = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_COMMON_DIR",
+  "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_NAMESPACE"
+];
+var gitRedirectsIn = (...envs) => GIT_REDIRECT_ENV.filter((name) => envs.some((env) => env[name] !== undefined));
+var gitRedirectRefusal = (names, verb, cwd) => ({
+  error: `git_env_redirect: ${names.join(", ")} ${names.length === 1 ? "is" : "are"} set, so git would act on the repository ${names.length === 1 ? "it names" : "they name"} while grants are checked for ${cwd}; workit ${verb} does not run`,
+  unblock: `unset ${names.join(" ")}, or cd into the repository and run workit ${verb} there`
+});
+
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path77 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -108942,6 +109030,14 @@ async function main(argv, overrides = {}, options = {}) {
     const checked = checkFlags(entry, ended);
     if ("error" in checked)
       return emit(routed, fail2("invalid_input", checked.error, { unblock: checked.unblock }));
+    const gated = gatedVerb(entry, checked.args);
+    if (gated) {
+      const redirects = gitRedirectsIn(routed.env, process.env);
+      if (redirects.length) {
+        const refusal = gitRedirectRefusal(redirects, gated, routed.cwd);
+        return emit(routed, fail2("blocked", refusal.error, { unblock: refusal.unblock }));
+      }
+    }
     if (parsed.cwd !== null) {
       try {
         process.chdir(routed.cwd);
@@ -108967,6 +109063,19 @@ async function main(argv, overrides = {}, options = {}) {
   const outcome = verbWord ? OUTCOMES2[`${entry.name} ${verbWord}`] : undefined;
   return withFailureLine(io, command, route, outcome);
 }
+var GRANT_GATED = {
+  git: new Set(["push"]),
+  release: new Set(["start", "finish", "publish"]),
+  pr: new Set(["create", "merge", "ready", "edit"]),
+  stack: new Set(["sync", "restack", "land"]),
+  ci: new Set(["rerun"])
+};
+var gatedVerb = (entry, args) => {
+  const word = firstWord(args);
+  const sub = word === undefined ? undefined : findSubcommand(entry, word);
+  const name = sub?.name ?? word;
+  return name !== undefined && GRANT_GATED[entry.name]?.has(name) ? `${entry.name} ${name}` : null;
+};
 var OUTCOMES2 = {
   "pr merge": "PR not merged",
   "pr create": "PR not created",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.40.6",
+  "version": "8.40.8",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.40.6",
+    "@brainervirus/workit-cursor": "^8.40.8",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.40.6"
+    "@brainervirus/workit-core": "^8.40.8"
   },
   "engines": {
     "node": ">=24"