@brainervirus/workit-codex 1.3.0 → 1.3.2

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -14904,7 +14904,47 @@ function operationJsonSchema(family) {
   return toJSONSchema(operationSchemas[family], { target: "draft-2020-12" });
 }
 var OPERATION_SCHEMA_DEPTH = 1;
-var canonicalFieldsDescription = (fields) => `Canonical object fields: ${fields.join(", ")}. Workit validates the complete nested value.`;
+var schemaShapeDescription = (value, depth = 0) => {
+  if (!value || typeof value !== "object")
+    return "value";
+  const schema = value;
+  if (Array.isArray(schema.oneOf) || Array.isArray(schema.anyOf)) {
+    const options = Array.isArray(schema.oneOf) ? schema.oneOf : schema.anyOf;
+    return `(${options.map((option) => schemaShapeDescription(option, depth)).join("|")})`;
+  }
+  if (schema.const !== undefined)
+    return `=${JSON.stringify(schema.const)}`;
+  if (Array.isArray(schema.enum))
+    return `[${schema.enum.map(String).join("|")}]`;
+  const type = Array.isArray(schema.type) ? schema.type.join("/") : schema.type;
+  if (type === "array")
+    return `arr<${schemaShapeDescription(schema.items, depth)}>`;
+  if (type === "object" && schema.properties && typeof schema.properties === "object") {
+    if (depth >= 2)
+      return "obj";
+    const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+    const properties = schema.properties;
+    const fields = Object.entries(properties).map(([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child, depth + 1)}`);
+    return `obj{${fields.join(",")}}`;
+  }
+  if (typeof type !== "string")
+    return "?";
+  return type.split("/").map((part) => ({ string: "str", boolean: "bool", number: "num", null: "null" })[part] ?? part).join("|");
+};
+var canonicalFieldsDescription = (value) => {
+  if (Array.isArray(value))
+    return `Canonical object fields: ${value.join(", ")}. Workit validates the complete nested value.`;
+  const isZodType = (schema) => ("_zod" in schema) && typeof schema._zod === "object";
+  const schema = isZodType(value) ? toJSONSchema(value, { target: "draft-2020-12" }) : value;
+  if (!schema.properties || typeof schema.properties !== "object") {
+    const variants = Array.isArray(schema.oneOf) ? schema.oneOf : Array.isArray(schema.anyOf) ? schema.anyOf : null;
+    return variants ? `Canonical shapes: ${variants.map((variant) => schemaShapeDescription(variant)).join(" | ")}. Full nested value is validated.` : "Canonical nested value; Workit validates the complete value.";
+  }
+  const properties = schema.properties;
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  const fields = Object.entries(properties).map(([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child)}`);
+  return `Fields (! required): ${fields.join(", ")}. Full nested value is validated.`;
+};
 function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, stringifiedObjects = false) {
   const tolerate = (projected) => {
     if (!stringifiedObjects)
@@ -14928,9 +14968,10 @@ function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, s
       return node;
     const record = node;
     if (record.properties && typeof record.properties === "object") {
-      const fields = Object.keys(record.properties);
+      const properties = record.properties;
+      const fields = Object.keys(properties);
       if (currentDepth >= maxDepth || fields.length === 0) {
-        const description = stringifiedObjects ? `${canonicalFieldsDescription(fields)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(fields);
+        const description = stringifiedObjects ? `${canonicalFieldsDescription(record)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(record);
         return tolerate({ type: "object", description });
       }
       return tolerate({
@@ -17222,6 +17263,28 @@ var canonicalGlob = (glob) => {
   const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
   return real + (prefix.endsWith("/") ? "/" : "") + rest;
 };
+var globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length;
+var selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+  if (workspaceName !== undefined) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      return named[0];
+    if (named.length > 1)
+      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    if (matches.length > 0) {
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    }
+    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  }
+  if (matches.length < 2)
+    return matches[0];
+  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
+  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
+  if (mostSpecific.length > 1) {
+    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+  }
+  return mostSpecific[0];
+};
 var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
   const result = readWorkspacesResult(dir);
   if (result.status === "malformed" || result.status === "invalid")
@@ -17241,20 +17304,7 @@ var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
     if (matched)
       matches.push(ws);
   }
-  if (workspaceName !== undefined) {
-    const selected = matches.find((ws) => ws.name === workspaceName);
-    if (!selected && matches.length > 0) {
-      const matchingNames = matches.map((ws) => ws.name);
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matchingNames.join(", ")}`);
-    }
-    if (selected)
-      return selected;
-    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  }
-  if (matches.length > 1) {
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((ws) => ws.name).join(", ")}`);
-  }
-  return matches[0] ?? null;
+  return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
 };
 var runtimeWorkspacePolicySchema = (kind) => {
   const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
@@ -17311,21 +17361,7 @@ var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
     return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
-  let selected;
-  if (workspaceName) {
-    const named = matches.filter((entry) => entry.name === workspaceName);
-    if (named.length === 1)
-      selected = named[0];
-    else if (named.length > 1)
-      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
-    else if (matches.length)
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
-    else
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  } else if (matches.length > 1)
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((entry) => entry.name).join(", ")}`);
-  else
-    selected = matches[0];
+  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
   if (!selected)
     return null;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
@@ -19254,6 +19290,7 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }));
+  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
   if (signals.behaviorChange.value === true)
     requirements.push(requirement({
       ruleId: "behavioral-verification",
@@ -19265,14 +19302,14 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }), requirement({
-      ruleId: "fresh-context-review",
+      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
       dimension: "review",
       scope,
-      reason: "A non-mechanical behavior change requires fresh-context review.",
-      satisfaction: "A separate review context examines the current candidate and records its result.",
+      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
+      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
       before: "close",
       dependentAction: null,
-      acceptanceAllowed: false
+      acceptanceAllowed: !independentBehaviorReview
     }));
   else if (signals.mechanicalLowRisk.value === true)
     requirements.push(requirement({
@@ -27703,7 +27740,7 @@ var CHANGELOG_RULES = `- Use an [Unreleased] section.
 - Entries should be human-readable and user-facing.
 - Do not use raw commit messages as changelog bullets.
 - MERGE into existing ### Category under [Unreleased] — never append a second ### Added / ### Fixed block.
-- Apply with the native workit_changelog_apply tool only (not hand-edits under Unreleased).
+- Apply with the host-native editor, preserving the repository changelog conventions.
 - If Unreleased already has duplicate category headings, normalize_only first.`;
 function changelogContext(root, range) {
   const cwd = path13.resolve(repoRoot(root));

package/dist/workit-hook.js

@@ -10300,6 +10300,28 @@ var canonicalGlob = (glob) => {
   const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
   return real + (prefix.endsWith("/") ? "/" : "") + rest;
 };
+var globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length;
+var selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+  if (workspaceName !== undefined) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      return named[0];
+    if (named.length > 1)
+      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    if (matches.length > 0) {
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    }
+    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  }
+  if (matches.length < 2)
+    return matches[0];
+  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
+  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
+  if (mostSpecific.length > 1) {
+    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+  }
+  return mostSpecific[0];
+};
 var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
   const result = readWorkspacesResult(dir);
   if (result.status === "malformed" || result.status === "invalid")
@@ -10319,20 +10341,7 @@ var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
     if (matched)
       matches.push(ws);
   }
-  if (workspaceName !== undefined) {
-    const selected = matches.find((ws) => ws.name === workspaceName);
-    if (!selected && matches.length > 0) {
-      const matchingNames = matches.map((ws) => ws.name);
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matchingNames.join(", ")}`);
-    }
-    if (selected)
-      return selected;
-    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  }
-  if (matches.length > 1) {
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((ws) => ws.name).join(", ")}`);
-  }
-  return matches[0] ?? null;
+  return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
 };
 var runtimeWorkspacePolicySchema = (kind) => {
   const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
@@ -10389,21 +10398,7 @@ var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
     return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
-  let selected;
-  if (workspaceName) {
-    const named = matches.filter((entry) => entry.name === workspaceName);
-    if (named.length === 1)
-      selected = named[0];
-    else if (named.length > 1)
-      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
-    else if (matches.length)
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
-    else
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  } else if (matches.length > 1)
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((entry) => entry.name).join(", ")}`);
-  else
-    selected = matches[0];
+  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
   if (!selected)
     return null;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
@@ -11903,6 +11898,15 @@ need zero Workit task, assessment, or writer calls. Use one compact tracked
 record only when handoff, dependent steps, concurrent actors, or meaningful
 decisions make continuity useful; similar titles alone never merge tasks.
 
+For a routine user-authorized branch or commit, prefer native host Git/shell
+tools from the outset when managed coordination or outcome reconciliation is
+not needed. Inspect the actual target checkout and its configured conventions;
+use Workit's read-only context/policy tools when needed. Do not start a task,
+acquire a writer, or mint a decision receipt solely for a native Git action.
+Native permissions still apply. Never switch execution paths to evade a denial
+or repeat an uncertain managed effect. A local-commit endpoint does not imply
+PR readiness, a fresh review, or post-commit assessment/closure paperwork.
+
 For tracked work, inspect its current state and use the shared operations for
 task, policy, evidence, finding, decision, worker, writer, and state changes.
 Start a record once for an explicit tracked objective; assess or reassess only
@@ -11924,6 +11928,11 @@ Preserve uncertain external outcomes and reconcile repository/provider state
 before retrying. Internal reservations prevent duplicate or ambiguous effects;
 they are not permission tickets for every edit.
 
+On OpenCode V1 and V2, use native host tools for external mutations. Workit
+provides read-only workit_context; it has no managed external-action executor.
+Do not create proposals or request Workit approvals merely to invoke native
+tools. Old uncertain managed effects still require evidence before any retry.
+
 Use host-native authorization through the host's supported path. A native
 question receipt records an actual question interaction; it is not automatic
 host permission. Record a meaningful user choice once with provenance when
@@ -12355,6 +12364,7 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }));
+  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
   if (signals.behaviorChange.value === true)
     requirements.push(requirement({
       ruleId: "behavioral-verification",
@@ -12366,14 +12376,14 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }), requirement({
-      ruleId: "fresh-context-review",
+      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
       dimension: "review",
       scope,
-      reason: "A non-mechanical behavior change requires fresh-context review.",
-      satisfaction: "A separate review context examines the current candidate and records its result.",
+      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
+      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
       before: "close",
       dependentAction: null,
-      acceptanceAllowed: false
+      acceptanceAllowed: !independentBehaviorReview
     }));
   else if (signals.mechanicalLowRisk.value === true)
     requirements.push(requirement({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, and fourteen method skills",
   "keywords": [
@@ -38,8 +38,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^1.3.0",
-    "@brainervirus/workit-mcp": "^1.3.0"
+    "@brainervirus/workit-core": "^1.3.2",
+    "@brainervirus/workit-mcp": "^1.3.2"
   },
   "engines": {
     "node": ">=24"