@brainervirus/workit-codex 8.16.0 → 8.17.0

package/dist/workit-hook-rbb0m9zp.js

@@ -0,0 +1,282 @@
+#!/usr/bin/env node
+
+// packages/workit-core/src/core/heavy-words.ts
+import fs2 from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+
+// packages/workit-core/src/check-config.ts
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
+var CHECKS_FILE = "workit.checks.json";
+var checksConfigFile = (root) => path.join(root, CHECKS_FILE);
+function repoHeavyCommands(root) {
+  try {
+    const value = JSON.parse(fs.readFileSync(checksConfigFile(root), "utf8"));
+    const resources = isRecord(value) ? value.resources : undefined;
+    const list = isRecord(resources) ? resources.heavyCommands : undefined;
+    return Array.isArray(list) ? list.filter((item) => typeof item === "string") : [];
+  } catch {
+    return [];
+  }
+}
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
+function splitCommand(command) {
+  const argv = [];
+  let current = "";
+  let quote = null;
+  let started = false;
+  for (const char of command) {
+    if (quote) {
+      if (char === quote)
+        quote = null;
+      else
+        current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      started = true;
+      continue;
+    }
+    if (/\s/u.test(char)) {
+      if (started)
+        argv.push(current);
+      current = "";
+      started = false;
+      continue;
+    }
+    if (SHELL_META.test(char))
+      return new Error(`"${command}" uses shell syntax (${char}); configure an argv array instead`);
+    current += char;
+    started = true;
+  }
+  if (quote)
+    return new Error(`"${command}" has an unterminated quote`);
+  if (started)
+    argv.push(current);
+  return argv.length ? argv : new Error("empty command");
+}
+var git = (cwd, args) => {
+  const run = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const value = run.status === 0 ? (run.stdout ?? "").trim() : "";
+  return value || null;
+};
+function checkRoot(cwd) {
+  return path.resolve(git(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd);
+}
+var packageManager = (root) => {
+  const has = (file) => fs.existsSync(path.join(root, file));
+  if (has("bun.lock") || has("bun.lockb"))
+    return "bun";
+  if (has("pnpm-lock.yaml"))
+    return "pnpm";
+  if (has("yarn.lock"))
+    return "yarn";
+  return "npm";
+};
+var scriptCheck = (pm, name) => {
+  const argv = [pm, "run", name];
+  const accepts = [argv];
+  if (pm === "pnpm" || pm === "yarn" || pm === "npm" && name === "test")
+    accepts.push([pm, name]);
+  return { name, argv, accepts };
+};
+var CHECK_NAME = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
+function detectedChecks(root) {
+  const read = (file) => {
+    try {
+      return fs.readFileSync(path.join(root, file), "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const checks = [];
+  const add = (check) => {
+    if (!checks.some((item) => item.name === check.name))
+      checks.push(check);
+  };
+  const manifestText = read("package.json");
+  if (manifestText !== null) {
+    let manifest = null;
+    try {
+      manifest = JSON.parse(manifestText);
+    } catch {}
+    const scripts = isRecord(manifest) && isRecord(manifest.scripts) ? manifest.scripts : {};
+    const pm = packageManager(root);
+    for (const name of SCRIPT_CHECKS) {
+      const script = scripts[name];
+      if (typeof script === "string" && script.trim() !== "")
+        add(scriptCheck(pm, name));
+    }
+  }
+  const plain = (name, argv) => ({ name, argv, accepts: [argv] });
+  if (read("go.mod") !== null)
+    add(plain("test", ["go", "test", "./..."]));
+  if (read("Cargo.toml") !== null)
+    add(plain("test", ["cargo", "test"]));
+  if (read("pytest.ini") !== null || /\bpytest\b/u.test(read("pyproject.toml") ?? ""))
+    add(plain("test", ["pytest"]));
+  const makefile = read("Makefile") ?? read("makefile") ?? read("GNUmakefile");
+  if (makefile !== null && /^test\s*:(?!=)/mu.test(makefile))
+    add(plain("test", ["make", "test"]));
+  return checks;
+}
+var GATES = ["testing", "verification"];
+function loadCheckConfig(cwd) {
+  const root = checkRoot(cwd);
+  const file = checksConfigFile(root);
+  const none = (error = null) => ({
+    source: error ? CHECKS_FILE : "none",
+    root,
+    checks: [],
+    gates: {},
+    error
+  });
+  let text = null;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+  }
+  if (text === null) {
+    const checks = detectedChecks(root);
+    return checks.length ? { source: "defaults", root, checks, gates: {}, error: null } : none();
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return none(`${CHECKS_FILE} is not valid JSON`);
+  }
+  if (!isRecord(parsed) || !isRecord(parsed.checks))
+    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+  const checks = [];
+  for (const [name, value] of Object.entries(parsed.checks)) {
+    if (!CHECK_NAME.test(name))
+      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+    const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
+    if (argv instanceof Error)
+      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+    checks.push({ name, argv, accepts: [argv] });
+  }
+  const gates = {};
+  if (parsed.gates !== undefined) {
+    if (!isRecord(parsed.gates))
+      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+    for (const [gate, value] of Object.entries(parsed.gates)) {
+      if (!GATES.includes(gate))
+        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+      const names = typeof value === "string" ? [value] : value;
+      if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
+        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+      gates[gate] = names;
+    }
+  }
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+}
+var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
+function matchesNamedCheck(config, name, argv, cwd) {
+  if (config.error || name === null || cwd !== ".")
+    return false;
+  const check = config.checks.find((item) => item.name === name);
+  return Boolean(check?.accepts.some((accepted) => sameArgv(accepted, argv)));
+}
+function gateCheckNames(config, dimension) {
+  const explicit = config.gates[dimension];
+  if (explicit)
+    return explicit;
+  const names = config.checks.map((check) => check.name);
+  if (dimension === "testing")
+    return names.includes("test") ? ["test"] : [];
+  return names;
+}
+var workitOnPath;
+function workitAvailable(env = process.env) {
+  if (workitOnPath !== undefined)
+    return workitOnPath;
+  const windows = process.platform === "win32";
+  const exts = windows ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const dirs = (env.PATH ?? env.Path ?? "").split(path.delimiter).filter(Boolean);
+  workitOnPath = dirs.some((dir) => exts.some((ext) => {
+    try {
+      return fs.statSync(path.join(dir, `workit${ext}`)).isFile();
+    } catch {
+      return false;
+    }
+  }));
+  return workitOnPath;
+}
+function checkCommand(args, version, onPath = workitAvailable()) {
+  return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
+}
+
+// packages/workit-core/src/core/heavy-words.ts
+var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
+var wordsOf = (command) => command.split(/[\s;&|()<>`'"]+/u).map((word) => (word.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat)$/u, "")).filter(Boolean);
+var stateDir = (env) => {
+  if (env.WORKFLOW_TOOLKIT_STATE)
+    return env.WORKFLOW_TOOLKIT_STATE;
+  if (env.XDG_STATE_HOME)
+    return path2.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os.homedir();
+  if (process.platform === "darwin")
+    return path2.join(home, "Library", "Application Support", "workit");
+  if (process.platform === "win32")
+    return path2.join(env.LOCALAPPDATA ?? path2.join(home, "AppData", "Local"), "workit");
+  return path2.join(home, ".local", "state", "workit");
+};
+var readJson = (file) => {
+  try {
+    return JSON.parse(fs2.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+};
+var patternWords = (cwd, env) => {
+  const patterns = [];
+  const machine = readJson(path2.join(stateDir(env), "heavy-commands.json"));
+  if (Array.isArray(machine?.patterns))
+    patterns.push(...machine.patterns);
+  for (let dir = path2.resolve(cwd);; dir = path2.dirname(dir)) {
+    if (fs2.existsSync(path2.join(dir, ".git"))) {
+      patterns.push(...repoHeavyCommands(dir));
+      break;
+    }
+    if (path2.dirname(dir) === dir)
+      break;
+  }
+  const words = new Set;
+  for (const pattern of patterns) {
+    if (typeof pattern !== "string")
+      continue;
+    const first = wordsOf(pattern)[0];
+    if (!first || first.includes("*"))
+      return null;
+    words.add(first);
+  }
+  return words;
+};
+function maybeHeavy(command, cwd, env = process.env) {
+  try {
+    const words = wordsOf(command);
+    if (words.some((word) => HEAVY_WORDS.has(word) || /^python[\d.]*$/u.test(word)))
+      return true;
+    const extra = patternWords(cwd, env);
+    return extra === null || words.some((word) => extra.has(word));
+  } catch {
+    return true;
+  }
+}
+
+export { CHECKS_FILE, repoHeavyCommands, loadCheckConfig, matchesNamedCheck, gateCheckNames, checkCommand, maybeHeavy };

package/dist/workit-hook.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import {
+  maybeHeavy
+} from "./workit-hook-rbb0m9zp.js";
 
 // packages/workit-codex/hooks/launcher.ts
-import process from "node:process";
 var payload = "";
 for await (const chunk of process.stdin)
   payload += String(chunk);
@@ -27,7 +29,7 @@ var quietEvent = () => {
       return null;
     if (event === "PostToolUse")
       return /\bcommit\b/.test(text) ? null : event;
-    return /\b(?:git|gh|glab)\b/.test(text) ? null : event;
+    return /\b(?:git|gh|glab)\b/.test(text) || maybeHeavy(text, value.cwd) ? null : event;
   } catch {
     return null;
   }
@@ -37,6 +39,6 @@ if (quiet)
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 else {
-  const { runCodexHook } = await import("./workit-hook-71xrmyzh.js");
+  const { runCodexHook } = await import("./workit-hook-23t8ttjv.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.16.0",
+  "version": "8.17.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.16.0",
-    "@brainervirus/workit-mcp": "^8.16.0"
+    "@brainervirus/workit-core": "^8.17.0",
+    "@brainervirus/workit-mcp": "^8.17.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-fanout/SKILL.md

@@ -5,13 +5,13 @@ description: Run independent slices in parallel - one worker per isolated worktr
 
 # Fan out parallel workers
 
-Fan out only independent slices: disjoint files, no shared mutable state, each
-verifiable alone. Code-coupled work stays with one owner, who fans out after
-the blocking part lands. A worker whose whole job is re-running one command is
-ceremony; do it yourself. Workit never spawns agents; you do.
+Inline-first (workspace `delegation`): fan out only past a threshold, named as
+each slice's `reason` (explore, parallel, backstop, high-risk-verify): an
+explorer past ~3 tool calls or 10k tokens; parallel writers only for 2+ disjoint
+units of ~100+ lines each. Coupled work stays with one owner. Workit never spawns.
 
 1. **Plan the slices** (read the `workit-shape` skill's SKILL.md and follow it) in a plan file (`references/brief.md`):
-   per slice an id, branch, TIER, SCOPE globs, `owns` for shared files,
+   per slice an id, branch, REASON, TIER, SCOPE globs, `owns` for shared files,
    `dependsOn` only for a real dependency, and the brief fields. `workit fanout
    plan <plan.json>` refuses an empty or placeholder brief field (exit 2) and
    two slices that may write one file (exit 3) with a fix; apply it and re-run:
@@ -21,8 +21,8 @@ ceremony; do it yourself. Workit never spawns agents; you do.
 2. **Record standing orders** (`workit ledger standing add "<order>"`): every
    user directive all workers share. Directives decay across resumes.
 3. **Brief each worker verbatim** with `workit fanout brief <slice>`: plan
-   fields, standing orders, SCRATCH, session id, fan-in rule. Never hand-edit
-   it; change the plan or the standing orders and render again.
+   fields, standing orders, SCRATCH, session id, fan-in and heavy-lease rules.
+   Never hand-edit it; change the plan or the standing orders and render again.
 4. **Spawn in a rolling window**, in the background, each in its own worktree:
    keep 4-6 in flight and refill from `spawnable` in `workit fanout status` as
    each one finishes. Model: the brief's `model:` line, else TIER

package/skills/workit-fanout/references/brief.md

@@ -59,7 +59,8 @@ defaults to the trunk, or to the branch of a single `dependsOn` slice (a
 stack); `worktree` defaults to `../<repo>-wt/<id>`. `owns` claims a shared
 file another slice's glob also matches. Globs that match no file yet are compared
 through a sample path. Use `/` as the separator; a backslash only escapes
-literal brackets: `"app/\\[id\\]/page.tsx"`. A `timebox` such as `45 minutes`
+literal brackets: `"app/\\[id\\]/page.tsx"`. A `reason` (`explore`, `parallel`, `backstop` or `high-risk-verify`) is rendered as the brief's `REASON:` line and is
+required unless the workspace sets `delegation` to `lead-orchestrates`. A `timebox` such as `45 minutes`
 is the slice's STUCK threshold in `workit fanout status`. `"fanIn":
 "integration"` (with an integration branch as `trunk`) is the one-PR mode in
 `orchestration.md`; the default `"prs"` lands one PR per slice.
@@ -79,6 +80,7 @@ is the slice's STUCK threshold in `workit fanout status`. `"fanIn":
       "acceptance": ["Given no auth header, When GET /v1/usage, Then the status is 401"],
       "verify": ["workit check test"],
       "forbidden": ["no edits outside SCOPE", "no rebase or force-push"],
+      "reason": "parallel",
       "context": "docs/usage/spec.md Behavior",
       "timebox": "45 minutes"
     },

package/skills/workit-implement/SKILL.md

@@ -19,7 +19,9 @@ description: Build a requested change in small verified steps - follow local pat
    Mechanical change: the existing checks are enough. No tautological tests:
    a test must fail if the behavior breaks, never restate the implementation.
 4. Run the real checks: `workit check test` (and `lint`, `typecheck` when the
-   repo has them).
+   repo has them). Heavy work runs under one machine-wide lease: an ad-hoc
+   suite is `workit check --heavy -- <cmd>`, never a hand-made flock; a busy
+   lease waits and names its holder (`workit lock status`).
 5. Prove the feature on its real surface with the project's `verify-<app>`
    skill; none yet? Write one (read the `workit-verify-app` skill's SKILL.md and follow it). Tests show branch behavior,
    not that the feature works.
@@ -41,6 +43,11 @@ description: Build a requested change in small verified steps - follow local pat
 
 Independent slices that could run in parallel: fan them out (read the `workit-fanout` skill's SKILL.md and follow it).
 
+Stay inline by default (workspace `delegation: inline-first`). Hand work off
+only past the thresholds: an explorer after about 3 tool calls or 10k tokens
+of searching, parallel writers for 2 or more disjoint units of about 100+
+lines each.
+
 ## Example
 
 Bad: "Done - added the --since flag, tests pass." (no check ran this turn; the

package/skills/workit-review/SKILL.md

@@ -24,7 +24,8 @@ independent; `type-check-only` never proves a behavior change.
    - **Standards:** repo rules first (`CODING_STANDARDS.md` when present),
      then a smell baseline (unclear name, long function, duplicated logic,
      leaky abstraction). Judgment only; lint owns nits.
-4. **Tests:** `workit test-audit --diff`. Would each new test fail if the
+4. **Tests:** run suites under the heavy-check lease (`workit check test`,
+   `workit check --heavy -- <cmd>`); `workit test-audit --diff`. Would each new test fail if the
    behavior broke? Triage the findings (read the `workit-test-audit` skill's SKILL.md and follow it).
 5. **Blast radius:** for each touched contract, caller, config or migration,
    state the one fact it is safe because of and run the proof. Anything

package/skills/workit-verify-app/SKILL.md

@@ -21,6 +21,8 @@ way a user would.
    `.cursor/skills/`; other hosts: the directory their docs name). If the repo
    already has a project skills directory, use it:
    - **Launch:** one command, its ready signal (log line, port, exit 0), a timeout.
+     Builds, installs and e2e suites run under the heavy-check lease
+     (`workit check --heavy -- <cmd>`); a long-running server does not.
    - **Doctor:** each precondition and its fix (deps, env vars, ports, services).
    - **Drive:** how to exercise it: CLI invocations, `curl` against routes, a
      browser tool for UI, with fixture data.