@brainervirus/workit-codex 1.0.10 → 1.0.11

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -14420,10 +14420,11 @@ var decisionSchema = object({
     presented: text,
     approvedContent: text,
     displayed: text.optional(),
-    contentRefs: array(refSchema)
+    contentRefs: array(refSchema),
+    statedChoice: object({ ref: text, text }).strict().optional()
   }).strict(),
   digest,
-  response: _enum(["approved", "rejected"]),
+  response: _enum(["approved", "rejected", "stated"]),
   requirementIds: array(digest),
   revoked: object({ at: utc, reason: text }).strict().nullable(),
   consumption: object({
@@ -17275,7 +17276,7 @@ function evaluateEvidence(task, candidate) {
 }
 var scopeCovers2 = scopeCovers;
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
-var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && data.response === "approved" && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
+var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
   if (kind !== "passed")
     return false;
@@ -17351,7 +17352,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         status: "satisfied",
         evidenceIds: [],
         decisionIds: decisions.map((decision) => decision.id),
-        reason: "an applicable approved decision satisfies the requirement"
+        reason: "an applicable approved or stated decision satisfies the requirement"
       };
     const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
     if (limitations.length)
@@ -18717,7 +18718,12 @@ class WorkitCore {
     const input = parsed.data;
     if (nativeRequired && input.action !== "record")
       return failure("permission_denied", "native observation is only valid for recording decisions");
-    if (nativeRequired && nativeObservation === undefined)
+    const stated = input.action === "record" && input.response === "stated";
+    if (stated && input.purpose === "action")
+      return failure("permission_denied", "stated choices cannot authorize mutating actions");
+    if (stated && !input.binding?.statedChoice)
+      return failure("invalid_input", "stated choices require binding.statedChoice");
+    if (nativeRequired && nativeObservation === undefined && !stated)
       return failure("permission_denied", "native decision observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
@@ -18750,7 +18756,7 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired ? verifyNativeDecision(this.context.nativeAuthority, {
+      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,

package/dist/workit-hook.js

@@ -7574,10 +7574,11 @@ var decisionSchema = object({
     presented: text,
     approvedContent: text,
     displayed: text.optional(),
-    contentRefs: array(refSchema)
+    contentRefs: array(refSchema),
+    statedChoice: object({ ref: text, text }).strict().optional()
   }).strict(),
   digest,
-  response: _enum(["approved", "rejected"]),
+  response: _enum(["approved", "rejected", "stated"]),
   requirementIds: array(digest),
   revoked: object({ at: utc, reason: text }).strict().nullable(),
   consumption: object({
@@ -10368,7 +10369,7 @@ function evaluateEvidence(task, candidate) {
 }
 var scopeCovers2 = scopeCovers;
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
-var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && data.response === "approved" && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
+var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
   if (kind !== "passed")
     return false;
@@ -10444,7 +10445,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         status: "satisfied",
         evidenceIds: [],
         decisionIds: decisions.map((decision) => decision.id),
-        reason: "an applicable approved decision satisfies the requirement"
+        reason: "an applicable approved or stated decision satisfies the requirement"
       };
     const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
     if (limitations.length)
@@ -10777,6 +10778,23 @@ function shellRouteIntent(command) {
   }
   return null;
 }
+function hasLiveWorkitTask(dir) {
+  try {
+    if (typeof dir !== "string" || dir === "")
+      return false;
+    const listed = new TaskStore(dir).listTasks();
+    if (!listed.ok)
+      return false;
+    return listed.data.some((task) => task.status === "active" || task.status === "paused");
+  } catch {
+    return false;
+  }
+}
+function shouldDenyShellRoute(dir, command) {
+  if (!hasLiveWorkitTask(dir))
+    return null;
+  return shellRouteIntent(command);
+}
 // packages/workit-core/src/core/external-action.ts
 var externalActionSchema = discriminatedUnion("operation", [
   object({
@@ -12022,7 +12040,12 @@ class WorkitCore {
     const input = parsed.data;
     if (nativeRequired && input.action !== "record")
       return failure("permission_denied", "native observation is only valid for recording decisions");
-    if (nativeRequired && nativeObservation === undefined)
+    const stated = input.action === "record" && input.response === "stated";
+    if (stated && input.purpose === "action")
+      return failure("permission_denied", "stated choices cannot authorize mutating actions");
+    if (stated && !input.binding?.statedChoice)
+      return failure("invalid_input", "stated choices require binding.statedChoice");
+    if (nativeRequired && nativeObservation === undefined && !stated)
       return failure("permission_denied", "native decision observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
@@ -12055,7 +12078,7 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired ? verifyNativeDecision(this.context.nativeAuthority, {
+      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,
@@ -13386,7 +13409,7 @@ var handleCodexHook = (raw) => {
   if (input.hook_event_name === "PreToolUse") {
     if (["bash", "unified-exec"].includes(String(input.tool_name).toLowerCase())) {
       const command = record2(input.tool_input) ? input.tool_input.command : undefined;
-      const route = typeof command === "string" ? shellRouteIntent(command) : null;
+      const route = typeof command === "string" ? shouldDenyShellRoute(input.cwd, command) : null;
       if (route)
         return denied("PreToolUse", `direct branch or PR creation bypasses the Workit route; ${route.guidance}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, and fourteen method skills",
   "keywords": [
@@ -38,8 +38,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^1.0.10",
-    "@brainervirus/workit-mcp": "^1.0.10"
+    "@brainervirus/workit-core": "^1.0.11",
+    "@brainervirus/workit-mcp": "^1.0.11"
   },
   "engines": {
     "node": ">=24"