@brainervirus/workit-codex 8.14.0 → 8.15.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "8.14.0",
+  "version": "8.15.0",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -14236,6 +14236,8 @@ var text = string2().check((ctx) => {
     ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
 });
 var id = text.regex(uuidPattern, "expected lowercase UUID");
+var idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+var idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
 var digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
 var revision = text.regex(uuidPattern, "expected UUID revision");
 var validUtc = (value) => {
@@ -14613,7 +14615,7 @@ var workerReportSchema = object({
   outcome: _enum(["completed", "failed", "cancelled"]),
   summary: text,
   evidenceIds: array(id),
-  findingIds: array(id)
+  findingIds: array(idRef)
 }).strict();
 var workerSchema = object({
   assignment: assignmentSchema,
@@ -14859,7 +14861,7 @@ var findingOperations = {
     action: literal("resolve"),
     ...taskId,
     expectedRevision: revision.optional(),
-    findingId: id,
+    findingId: idRef,
     disposition: _enum(["open", "fixed", "dismissed", "deferred"]),
     reason: text,
     evidenceIds: array(id),
@@ -14900,7 +14902,7 @@ var workerOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     report: workerReportSchema
   }),
   cancel: operation({
@@ -14908,7 +14910,7 @@ var workerOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     reason: text
   })
 };
@@ -14958,6 +14960,16 @@ var success = (revisionValue, workspaceRevisionValue, data) => ({
   data
 });
 var failure2 = (code, error, details = {}) => ({ ok: false, schemaVersion: 1, code, error, details });
+function resolveIdRef(kind, ref, ids) {
+  if (ids.includes(ref))
+    return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1)
+    return success(null, null, matches[0]);
+  if (matches.length === 0)
+    return failure2("not_found", `${kind} not found`);
+  return failure2("invalid_input", `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`);
+}
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
@@ -17476,20 +17488,26 @@ class TaskStore {
     return success(null, null, { key: key.data, bound: bound.data });
   }
   taskForWorker(workerId) {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
     const listed = this.listTaskIndex();
     if (!listed.ok)
       return listed;
+    const owners = new Map;
     for (const entry of listed.data) {
       if (entry.status === "closed")
         continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok)
         return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? [])
+        owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok)
+      return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found")
+      return resolved;
     return success(null, null, null);
   }
   originTaskEntry() {
@@ -19609,20 +19627,19 @@ var workspaceConfigSchema = object({
     union([boolean2(), literal("verified")]).optional()
   ]))).passthrough().optional(),
   youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
-  issues: object({ provider: literal("github").optional(), link_on_pr: boolean2().optional() }).passthrough().optional(),
+  issues: object({
+    provider: _enum(["github", "gitlab", "youtrack"]).optional(),
+    link: boolean2().optional(),
+    relation: unknown().optional(),
+    backlink: boolean2().optional(),
+    link_on_pr: boolean2().optional()
+  }).passthrough().optional(),
   branchPolicy: workspaceBranchPolicySchema.optional(),
   commitPolicy: workspaceCommitPolicySchema.optional(),
   defaultProfile: nonBlank.optional(),
   profiles: record(nonBlank, workspaceProfileSchema).optional(),
   releaseTracks: record(nonBlank, releaseTrackSchema).optional()
 }).passthrough().superRefine((workspace, context) => {
-  if (workspace.issues && workspace.vcs?.provider !== "github") {
-    context.addIssue({
-      code: "custom",
-      path: ["issues"],
-      message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
-    });
-  }
   if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
     context.addIssue({
       code: "custom",
@@ -20462,6 +20479,44 @@ var readVcsConfig = () => {
   }
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
+var TRACKERS = new Set(["github", "gitlab", "youtrack"]);
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var flag = (value) => typeof value === "boolean" ? value : null;
+var text2 = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+function issueTrackerOf(issues, youtrack) {
+  const iss = asRecord(issues);
+  const yt = asRecord(youtrack);
+  const warnings = [];
+  const named = typeof iss.provider === "string" && TRACKERS.has(iss.provider.toLowerCase()) ? iss.provider.toLowerCase() : null;
+  if (iss.relation !== undefined && iss.relation !== "closes" && iss.relation !== "refs")
+    warnings.push(`issues.relation ${JSON.stringify(iss.relation)} is not closes or refs; read as closes`);
+  for (const key of ["repo", "host"])
+    if (iss[key] !== undefined && text2(iss[key]) === null)
+      warnings.push(`issues.${key} is not a non-empty string; ignored`);
+  const common = {
+    relation: iss.relation === "refs" ? "refs" : "closes",
+    backlink: iss.backlink === true,
+    baseUrl: text2(yt.baseUrl),
+    repo: text2(iss.repo)?.replace(/^\/+|\/+$/gu, "") ?? null,
+    host: text2(iss.host)?.toLowerCase() ?? null,
+    warnings
+  };
+  const legacyGithub = named === "github" && flag(iss.link) === null;
+  if (flag(yt.link_issues) === true && (named === null || legacyGithub))
+    return { provider: "youtrack", link: true, ...common, source: "youtrack.link_issues" };
+  if (named) {
+    const link = flag(iss.link) ?? flag(iss.link_on_pr) ?? (named === "youtrack" ? flag(yt.link_issues) : null) ?? false;
+    return {
+      provider: named,
+      link,
+      ...common,
+      source: flag(iss.link) === null && flag(iss.link_on_pr) !== null ? "issues.link_on_pr" : "issues"
+    };
+  }
+  if (common.baseUrl)
+    return { provider: "youtrack", link: false, ...common, source: "youtrack.baseUrl" };
+  return null;
+}
 var trackSummary = (resolution) => resolution.status === "resolved" ? {
   name: resolution.track?.name ?? null,
   source: resolution.source,
@@ -20482,6 +20537,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
   const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
   const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
+  const issueTracker = issueTrackerOf(wsIssues, wsYt);
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
@@ -20514,7 +20570,8 @@ function vcsConfig(mode, cwd, options = {}) {
       link_issues: linkIssues,
       youtrack_base_url: youtrackBaseUrl,
       issues_provider: issuesProvider,
-      link_on_pr: linkOnPr
+      link_on_pr: linkOnPr,
+      issue_tracker: issueTracker
     };
   }
   if (cfgStatus === "malformed") {
@@ -20540,7 +20597,8 @@ function vcsConfig(mode, cwd, options = {}) {
     link_issues: linkIssues,
     youtrack_base_url: youtrackBaseUrl,
     issues_provider: issuesProvider,
-    link_on_pr: linkOnPr
+    link_on_pr: linkOnPr,
+    issue_tracker: issueTracker
   };
   if (provider === "gitlab") {
     out.gitlab = {
@@ -20644,7 +20702,12 @@ var MAX_LINE_BYTES = 4096;
 var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
 var FAILING = new Set(["failed", "blocked"]);
 var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
-var PR_ROW_TYPES = new Set(["pr.created", "pr.status", "pr.merged"]);
+var PR_ROW_TYPES = new Set([
+  "pr.created",
+  "pr.status",
+  "pr.merged",
+  "pr.linked"
+]);
 var err = (code, error, unblock) => ({
   ok: false,
   code,
@@ -22781,7 +22844,7 @@ var RISK = {
 };
 var YES = new Set(["true", "yes", "y", "1", "on"]);
 var NO = new Set(["false", "no", "n", "0", "off", "none"]);
-var flag = (value, unknownAs) => {
+var flag2 = (value, unknownAs) => {
   if (typeof value === "boolean")
     return { ok: true, value };
   if (typeof value === "number" && (value === 0 || value === 1))
@@ -22847,12 +22910,12 @@ function normalizeJudgment(raw, previous) {
       const items = Array.isArray(value) ? value : [value];
       judgment.refs.push(...items.filter((item) => item !== null && item !== "").map(refOf));
     } else {
-      if (name === "needsPlan" && typeof value === "string" && !flag(value, false).ok && value.trim()) {
+      if (name === "needsPlan" && typeof value === "string" && !flag2(value, false).ok && value.trim()) {
         judgment.needsPlan = true;
         judgment.refs.push(refOf(value.trim()));
         continue;
       }
-      const parsed = flag(value, name === "behaviorChange");
+      const parsed = flag2(value, name === "behaviorChange");
       if (parsed.ok)
         judgment[name] = parsed.value;
       else
@@ -23207,6 +23270,8 @@ var TASK_SCOPED_ACTIONS = new Set([
   "worker.cancel",
   "state.export"
 ]);
+var ONLY_OWN_REPORT = "workers can submit only their own report";
+var NO_HELPER_CONTROL = "helpers cannot cancel or control workers";
 var WORKER_ADDRESSED_ACTIONS = new Set(["worker.cancel", "worker.report"]);
 var workerCommand = (taskId, request) => {
   const { action, workerId, reason, report } = request;
@@ -24104,6 +24169,10 @@ class WorkitCore {
     }
     if (helper?.ok)
       return failure2("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef("finding", input.findingId, task.data.findings.map((entry) => entry.id));
+    if (!findingRef.ok)
+      return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
       return failure2("not_found", "finding not found");
@@ -24255,15 +24324,31 @@ class WorkitCore {
         return changed;
       return success(changed.data.task.revision, changed.data.workspace.revision, changed.data.task.workers.at(-1));
     }
+    const workerRef = resolveIdRef("worker", input.workerId, helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId]);
+    if (!workerRef.ok)
+      return helperId === null ? workerRef : failure2("permission_denied", input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL);
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
       return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure2("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
+      const ownFindings = task.data.findings.filter((candidate) => candidate.provenance.workerId === helperId).map((candidate) => candidate.id);
+      const reported = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok)
+          reported.push(found.data);
+        else if (found.code === "not_found")
+          reported.push(findingRef);
+        else
+          return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
@@ -24291,7 +24376,7 @@ class WorkitCore {
       return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure2("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {

package/dist/{workit-hook-s8c0mzcq.js → workit-hook-v4a1y79w.js}

@@ -7966,6 +7966,8 @@ var text = string2().check((ctx) => {
     ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
 });
 var id = text.regex(uuidPattern, "expected lowercase UUID");
+var idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+var idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
 var digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
 var revision = text.regex(uuidPattern, "expected UUID revision");
 var validUtc = (value) => {
@@ -8343,7 +8345,7 @@ var workerReportSchema = object({
   outcome: _enum(["completed", "failed", "cancelled"]),
   summary: text,
   evidenceIds: array(id),
-  findingIds: array(id)
+  findingIds: array(idRef)
 }).strict();
 var workerSchema = object({
   assignment: assignmentSchema,
@@ -8589,7 +8591,7 @@ var findingOperations = {
     action: literal("resolve"),
     ...taskId,
     expectedRevision: revision.optional(),
-    findingId: id,
+    findingId: idRef,
     disposition: _enum(["open", "fixed", "dismissed", "deferred"]),
     reason: text,
     evidenceIds: array(id),
@@ -8630,7 +8632,7 @@ var workerOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     report: workerReportSchema
   }),
   cancel: operation({
@@ -8638,7 +8640,7 @@ var workerOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     reason: text
   })
 };
@@ -8688,6 +8690,16 @@ var success = (revisionValue, workspaceRevisionValue, data) => ({
   data
 });
 var failure2 = (code, error, details = {}) => ({ ok: false, schemaVersion: 1, code, error, details });
+function resolveIdRef(kind, ref, ids) {
+  if (ids.includes(ref))
+    return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1)
+    return success(null, null, matches[0]);
+  if (matches.length === 0)
+    return failure2("not_found", `${kind} not found`);
+  return failure2("invalid_input", `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`);
+}
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
@@ -9934,7 +9946,7 @@ var removeIfEmpty = (dir) => {
 };
 var tokenHash = (token) => createHash4("sha256").update(token).digest("hex");
 function recordIssuedSession(cwd, lead, issued) {
-  const token = randomBytes2(18).toString("base64url");
+  const token = randomBytes2(18).toString("hex");
   try {
     migrateRepoIssued(cwd);
     const own = hash(issued);
@@ -10937,20 +10949,26 @@ class TaskStore {
     return success(null, null, { key: key.data, bound: bound.data });
   }
   taskForWorker(workerId) {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
     const listed = this.listTaskIndex();
     if (!listed.ok)
       return listed;
+    const owners = new Map;
     for (const entry of listed.data) {
       if (entry.status === "closed")
         continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok)
         return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? [])
+        owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok)
+      return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found")
+      return resolved;
     return success(null, null, null);
   }
   originTaskEntry() {
@@ -12679,20 +12697,19 @@ var workspaceConfigSchema = object({
     union([boolean2(), literal("verified")]).optional()
   ]))).passthrough().optional(),
   youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
-  issues: object({ provider: literal("github").optional(), link_on_pr: boolean2().optional() }).passthrough().optional(),
+  issues: object({
+    provider: _enum(["github", "gitlab", "youtrack"]).optional(),
+    link: boolean2().optional(),
+    relation: unknown().optional(),
+    backlink: boolean2().optional(),
+    link_on_pr: boolean2().optional()
+  }).passthrough().optional(),
   branchPolicy: workspaceBranchPolicySchema.optional(),
   commitPolicy: workspaceCommitPolicySchema.optional(),
   defaultProfile: nonBlank.optional(),
   profiles: record(nonBlank, workspaceProfileSchema).optional(),
   releaseTracks: record(nonBlank, releaseTrackSchema).optional()
 }).passthrough().superRefine((workspace, context) => {
-  if (workspace.issues && workspace.vcs?.provider !== "github") {
-    context.addIssue({
-      code: "custom",
-      path: ["issues"],
-      message: `GitHub issue linking requires the github provider, got ${workspace.vcs?.provider ?? "unset"}`
-    });
-  }
   if (workspace.defaultProfile !== undefined && !Object.hasOwn(workspace.profiles ?? {}, workspace.defaultProfile)) {
     context.addIssue({
       code: "custom",
@@ -13494,6 +13511,44 @@ var readVcsConfig = () => {
   }
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
+var TRACKERS = new Set(["github", "gitlab", "youtrack"]);
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var flag = (value) => typeof value === "boolean" ? value : null;
+var text2 = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+function issueTrackerOf(issues, youtrack) {
+  const iss = asRecord(issues);
+  const yt = asRecord(youtrack);
+  const warnings = [];
+  const named = typeof iss.provider === "string" && TRACKERS.has(iss.provider.toLowerCase()) ? iss.provider.toLowerCase() : null;
+  if (iss.relation !== undefined && iss.relation !== "closes" && iss.relation !== "refs")
+    warnings.push(`issues.relation ${JSON.stringify(iss.relation)} is not closes or refs; read as closes`);
+  for (const key of ["repo", "host"])
+    if (iss[key] !== undefined && text2(iss[key]) === null)
+      warnings.push(`issues.${key} is not a non-empty string; ignored`);
+  const common = {
+    relation: iss.relation === "refs" ? "refs" : "closes",
+    backlink: iss.backlink === true,
+    baseUrl: text2(yt.baseUrl),
+    repo: text2(iss.repo)?.replace(/^\/+|\/+$/gu, "") ?? null,
+    host: text2(iss.host)?.toLowerCase() ?? null,
+    warnings
+  };
+  const legacyGithub = named === "github" && flag(iss.link) === null;
+  if (flag(yt.link_issues) === true && (named === null || legacyGithub))
+    return { provider: "youtrack", link: true, ...common, source: "youtrack.link_issues" };
+  if (named) {
+    const link = flag(iss.link) ?? flag(iss.link_on_pr) ?? (named === "youtrack" ? flag(yt.link_issues) : null) ?? false;
+    return {
+      provider: named,
+      link,
+      ...common,
+      source: flag(iss.link) === null && flag(iss.link_on_pr) !== null ? "issues.link_on_pr" : "issues"
+    };
+  }
+  if (common.baseUrl)
+    return { provider: "youtrack", link: false, ...common, source: "youtrack.baseUrl" };
+  return null;
+}
 var trackSummary = (resolution) => resolution.status === "resolved" ? {
   name: resolution.track?.name ?? null,
   source: resolution.source,
@@ -13514,6 +13569,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
   const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
   const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
+  const issueTracker = issueTrackerOf(wsIssues, wsYt);
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
@@ -13546,7 +13602,8 @@ function vcsConfig(mode, cwd, options = {}) {
       link_issues: linkIssues,
       youtrack_base_url: youtrackBaseUrl,
       issues_provider: issuesProvider,
-      link_on_pr: linkOnPr
+      link_on_pr: linkOnPr,
+      issue_tracker: issueTracker
     };
   }
   if (cfgStatus === "malformed") {
@@ -13572,7 +13629,8 @@ function vcsConfig(mode, cwd, options = {}) {
     link_issues: linkIssues,
     youtrack_base_url: youtrackBaseUrl,
     issues_provider: issuesProvider,
-    link_on_pr: linkOnPr
+    link_on_pr: linkOnPr,
+    issue_tracker: issueTracker
   };
   if (provider === "gitlab") {
     out.gitlab = {
@@ -13591,7 +13649,12 @@ var MAX_LINE_BYTES = 4096;
 var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
 var FAILING = new Set(["failed", "blocked"]);
 var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
-var PR_ROW_TYPES = new Set(["pr.created", "pr.status", "pr.merged"]);
+var PR_ROW_TYPES = new Set([
+  "pr.created",
+  "pr.status",
+  "pr.merged",
+  "pr.linked"
+]);
 var err = (code, error, unblock) => ({
   ok: false,
   code,
@@ -15741,7 +15804,7 @@ var RISK = {
 };
 var YES = new Set(["true", "yes", "y", "1", "on"]);
 var NO = new Set(["false", "no", "n", "0", "off", "none"]);
-var flag = (value, unknownAs) => {
+var flag2 = (value, unknownAs) => {
   if (typeof value === "boolean")
     return { ok: true, value };
   if (typeof value === "number" && (value === 0 || value === 1))
@@ -15807,12 +15870,12 @@ function normalizeJudgment(raw, previous) {
       const items = Array.isArray(value) ? value : [value];
       judgment.refs.push(...items.filter((item) => item !== null && item !== "").map(refOf));
     } else {
-      if (name === "needsPlan" && typeof value === "string" && !flag(value, false).ok && value.trim()) {
+      if (name === "needsPlan" && typeof value === "string" && !flag2(value, false).ok && value.trim()) {
         judgment.needsPlan = true;
         judgment.refs.push(refOf(value.trim()));
         continue;
       }
-      const parsed = flag(value, name === "behaviorChange");
+      const parsed = flag2(value, name === "behaviorChange");
       if (parsed.ok)
         judgment[name] = parsed.value;
       else
@@ -16294,6 +16357,8 @@ var TASK_SCOPED_ACTIONS = new Set([
   "worker.cancel",
   "state.export"
 ]);
+var ONLY_OWN_REPORT = "workers can submit only their own report";
+var NO_HELPER_CONTROL = "helpers cannot cancel or control workers";
 var WORKER_ADDRESSED_ACTIONS = new Set(["worker.cancel", "worker.report"]);
 var workerCommand = (taskId, request) => {
   const { action, workerId, reason, report } = request;
@@ -17191,6 +17256,10 @@ class WorkitCore {
     }
     if (helper?.ok)
       return failure2("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef("finding", input.findingId, task.data.findings.map((entry) => entry.id));
+    if (!findingRef.ok)
+      return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
       return failure2("not_found", "finding not found");
@@ -17342,15 +17411,31 @@ class WorkitCore {
         return changed;
       return success(changed.data.task.revision, changed.data.workspace.revision, changed.data.task.workers.at(-1));
     }
+    const workerRef = resolveIdRef("worker", input.workerId, helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId]);
+    if (!workerRef.ok)
+      return helperId === null ? workerRef : failure2("permission_denied", input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL);
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
       return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure2("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
+      const ownFindings = task.data.findings.filter((candidate) => candidate.provenance.workerId === helperId).map((candidate) => candidate.id);
+      const reported = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok)
+          reported.push(found.data);
+        else if (found.code === "not_found")
+          reported.push(findingRef);
+        else
+          return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
@@ -17378,7 +17463,7 @@ class WorkitCore {
       return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure2("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {

package/dist/workit-hook.js

@@ -37,6 +37,6 @@ if (quiet)
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 else {
-  const { runCodexHook } = await import("./workit-hook-s8c0mzcq.js");
+  const { runCodexHook } = await import("./workit-hook-v4a1y79w.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.14.0",
+  "version": "8.15.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.14.0",
-    "@brainervirus/workit-mcp": "^8.14.0"
+    "@brainervirus/workit-core": "^8.15.0",
+    "@brainervirus/workit-mcp": "^8.15.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-ship/SKILL.md

@@ -33,8 +33,8 @@ that repeats because the base keeps moving, or after 3 failed fix attempts on
 the same check.
 
 1. **Open.** `workit git push`, then `workit pr create --title "<title>"
-   --body-file <f|->` (idempotent; body: `references/pr-body.md`; edits:
-   `workit pr edit`). A stack: `workit stack plan <bottom> ... <top>`, one
+   --body-file <f|->` plus `--issue <#n|ID>` per issue (`--refs`: no close; idempotent;
+   body: `references/pr-body.md`; edits: `workit pr edit`). A stack: `workit stack plan <bottom> ... <top>`, one
    `workit pr create --base <parent> --fill` per branch, then
    `workit stack sync`. Finish the whole stack before babysitting any PR.
 2. **Read state** with `workit pr status --json`. `REVIEW` alone is a pending