@brainervirus/workit-codex 8.11.0 → 8.12.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "8.11.0",
+  "version": "8.12.0",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -18849,7 +18849,7 @@ function loadCheckConfig(cwd) {
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null };
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -19437,6 +19437,7 @@ var workspaceConfigSchema = object({
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
+  trailers: boolean2().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -19718,8 +19719,8 @@ var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd,
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var matchRuntimeWorkspace = (cwd) => {
-  const file = path10.join(configDir(), "workspaces.json");
+var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path10.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -19748,7 +19749,7 @@ var matchRuntimeWorkspace = (cwd) => {
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 };
 var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);

package/dist/{workit-hook-gtdf2ra8.js → workit-hook-yfq6yhse.js}

@@ -91,9 +91,9 @@ Autonomy contract:
   ship), go to the effective endpoint in \`workit grant show\`: \`pr\` opens
   the PR; \`green\` babysits it without asking (workit-ship) to merge-ready,
   never merging; \`merged\` also lands it with \`workit pr merge\`.
-  Merge and release need a workspace grant, which only the user raises from
-  their own terminal (a blocked verb names how); never edit workspaces.json or
-  route around a grant_required.
+  Merge and release need a workspace grant only the user raises from their
+  own terminal (a blocked verb names how); never edit workspaces.json or route
+  around a grant_required.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -102,17 +102,19 @@ Autonomy contract:
 - Author is not verifier: your own verdict is \`--self\`, shown as
   self-reviewed, never verified. High risk, \`verification: independent\` and
   merge need a verifier with its own host-derived session (a subagent's
-  \`<lead>:<child>\`, set by the host); never hand-mint one such as \`<lead>-v1\`.
+  \`<lead>:<child>\`); never hand-mint one (\`<lead>-v1\`).
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
 CLI first: if a step has one right answer, use the \`workit\` verb instead of
 hand-running git, gh or glab (\`workit git|pr|ci|check\`; \`workit help\` lists
-the rest; without \`workit\` on PATH, \`npx -y @brainervirus/workit-cli\`).
+the rest; lacking \`workit\`, \`npx -y @brainervirus/workit-cli\`).
+Add Co-Authored-By via \`workit git commit --trailer "K: v" -- <paths>\`, never
+an amend.
 The task families (task, policy, evidence, finding, decision, worker, state)
 are optional continuity for tracked work; each branch has one implicit task,
-created by the first recording, and a solo edit needs no task. A decision
+and a solo edit needs no task. A decision
 records a user choice; it never authorizes an effect. Judge work once with
 \`workit policy assess --judge risk= behavior= product-choice= plan=\`.
 Across repositories, bind each item to its checkout, branch and endpoint,
@@ -8960,7 +8962,7 @@ function loadCheckConfig(cwd) {
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null };
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -12506,6 +12508,7 @@ var workspaceConfigSchema = object({
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
+  trailers: boolean2().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -12787,8 +12790,8 @@ var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd,
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var matchRuntimeWorkspace = (cwd) => {
-  const file = path11.join(configDir(), "workspaces.json");
+var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path11.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -12817,12 +12820,30 @@ var matchRuntimeWorkspace = (cwd) => {
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 };
 var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
+var workspaceTrailers = (cwd, dir) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched)
+    return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null
+  };
+};
 var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -19400,7 +19421,7 @@ var workitRole = (descriptor, agentType) => {
 };
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
 var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
-var ISOLATED_GIT = 'Run git as plain, separate commands inside your worktree (`git switch -c <branch> <base>`, `git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a commit-msg hook that adds the trailer), never `workit git …`: Claude Code\'s worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (`workit check`, `workit ledger`, `workit pr`).';
+var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
@@ -19408,9 +19429,9 @@ var subagentStartText = (input, descriptor, event) => {
   const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
-    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
-    return `${ISOLATED_GIT}
+    return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;

package/dist/workit-hook.js

@@ -37,6 +37,6 @@ if (quiet)
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 else {
-  const { runCodexHook } = await import("./workit-hook-gtdf2ra8.js");
+  const { runCodexHook } = await import("./workit-hook-yfq6yhse.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.11.0",
+  "version": "8.12.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^8.11.0",
-    "@brainervirus/workit-mcp": "^8.11.0"
+    "@brainervirus/workit-core": "^8.12.0",
+    "@brainervirus/workit-mcp": "^8.12.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-fanout/references/brief.md

@@ -25,7 +25,7 @@ REPORT: branch, head SHA, files changed, each VERIFY command with its exit code,
   each ACCEPTANCE line met / not met, rulings you made (`workit ledger ruling`),
   anything out of scope as a follow-up, not a diff.
 STANDING: <the standing orders, verbatim: `workit ledger standing add` records each one>
-  export WORKIT_SESSION_ID=<lead>-w<n>   (set by the lead for a worker's commits; a verifier brief sets none: the host derives it)
+  <identity line, per the lead's host: see "Identity and git rules per host" below>
 ```
 
 ## Worked example
@@ -97,17 +97,32 @@ is the slice's STUCK threshold in `workit fanout status`. `"fanIn":
 }
 ```
 
+## Identity and git rules per host
+
+`workit fanout brief` renders the identity line and RULES 1 and 3 for the
+lead's host (`WORKIT_HOST`, or the host's own session variable):
+
+| Lead's host | Identity line | RULES 1 and 3 |
+| --- | --- | --- |
+| Claude Code | `Session: your env already has WORKIT_SESSION_ID (the lead's id)`; no `export`, no hand-minted id (SubagentStart issues `<lead>:<agent id>` only to verifiers and reviewers, never to an implementer, so the worker's commits carry the lead's id) | plain git: `git fetch origin && git switch -c <branch> origin/<base>` and `git commit -m <msg> --trailer "Workit-Session: <the env WORKIT_SESSION_ID>" --trailer "<host attribution>" -- <paths in SCOPE>`, because worktree isolation refuses every `workit git` form |
+| OpenCode, Pi, Codex | `Session: your host already sets WORKIT_SESSION_ID in your shell`; export nothing (the host derives the id and an export cannot replace it) | `workit git branch <branch> --base <base>`, `workit git commit -m <msg> -- <paths in SCOPE>` |
+| Cursor, CI, a plain terminal | `export WORKIT_SESSION_ID=<lead>-w-<slice>` (`+try<n>` for a race attempt): declared, not checked | the same `workit git` forms |
+
+`MODE: resume` is `git switch <branch>` on every host (the branch exists; the
+lead removed the dead worker's worktree after its exit, so the switch
+succeeds), then continue from its head. A race attempt (`--attempt <n>`)
+follows its host's row with the branch `<branch>-try<n>`.
+
 ## Worker rules (`workit fanout brief` appends them as RULES)
 
-1. First command. `MODE: new`: `workit git branch <branch> --base <base>` (the
-   worktree may start on a name that breaks branch policy). `MODE: resume`:
-   `git switch <branch>` (the branch exists; the lead removed the dead
-   worker's worktree after its exit, so the switch succeeds), then continue
-   from its head.
+1. First command: create the branch (`MODE: new`; the worktree may start on a
+   name that breaks branch policy) or `git switch` to it (`MODE: resume`),
+   as the table above says for your host.
 2. Decide ambiguities yourself and record them:
    `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`.
    Stop only for an irreversible action, a security-sensitive one, or a side
    effect outside the worktree.
-3. Commit with `workit git commit -m "<msg>" -- <paths in SCOPE>`; push only if
-   the brief says so.
+3. Commit as the table says (`workit git commit -m "<msg>" -- <paths in SCOPE>`,
+   or plain git with the trailers on Claude Code); push only if the brief says
+   so.
 4. Never record a verdict on your own work.

package/skills/workit-fanout/references/orchestration.md

@@ -73,8 +73,8 @@ Which session id a verdict carries, per host:
 - Claude Code: subagents inherit your `WORKIT_SESSION_ID`, so the
   SubagentStart hook names each `verifier` and `reviewer` its own session
   (`<lead>:<agent id>`), passed exactly as `--session`: the hook records the
-  ids it issues, and only those are accepted. An `implementer` uses the
-  session its brief exports for its workit commands.
+  ids it issues, and only those are accepted. An `implementer` is issued
+  none: it keeps your id in its env for its workit commands and commits.
 - Codex: the `workit-verifier` and `workit-reviewer` agents get the same
   issued `--session` from SubagentStart; any other verifier passes
   `--as verifier`.
@@ -84,8 +84,13 @@ Which session id a verdict carries, per host:
 - Cursor (no session id in the shell): the brief sets the verifier's
   `WORKIT_SESSION_ID=<lead>:verifier-<random hex>`, a fresh suffix per
   verifier. Cursor cannot check it: it is declared, not derived.
-- A worker's commits use `export WORKIT_SESSION_ID=<lead>-w-<slice>` from
-  `workit fanout brief`. A verdict under an id you made up (`<lead>-v1`,
+- A worker's commits: on Claude Code the lead's `WORKIT_SESSION_ID` already in
+  its env (SubagentStart issues no implementer id; plain git, no export, so the
+  lead authored those commits: a verifier or reviewer records the verdict, not
+  the lead); on OpenCode, Pi and Codex the id the host already
+  puts in its shell; on Cursor, CI and a plain terminal the brief's
+  `export WORKIT_SESSION_ID=<lead>-w-<slice>` (see `brief.md`, "Identity and
+  git rules per host"). A verdict under an id you made up (`<lead>-v1`,
   `<lead>:v1`) is refused as `forged_session` on Claude Code, Codex,
   OpenCode and Pi.