@brainervirus/workit-codex 8.21.0 → 8.22.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "8.21.0",
+  "version": "8.22.0",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/agents/workit-verifier.toml

@@ -8,8 +8,8 @@ backward: what must be true, what must exist, what must be wired. The author's
 summary is a claim, not evidence; assume the goal is not met until you observe
 it.
 
-1. Pin the candidate in its own checkout (`cd` into the worker's worktree, or
-   pass `--cwd`): `git rev-parse HEAD` and `git status --short`. A dirty tree
+1. Pin the candidate in its own checkout (run workit with `--cwd <worktree>`;
+   never `cd` first): `git -C <worktree> rev-parse HEAD` and `git -C <worktree> status --short`. A dirty tree
    or a moving HEAD is itself a finding, and the ledger refuses a verdict on it.
 2. Read the brief: goal, acceptance (Given/When/Then), verify commands.
 3. Run every verify command through the CLI so the result is observed:

package/dist/launch-mcp.js

@@ -28828,6 +28828,9 @@ var WRITE_TOOLS = new Set([
 ]);
 // packages/workit-core/src/hooks/standing.ts
 var sinceStart = new Map;
+// packages/workit-core/src/hooks/cwd-normalize.ts
+var FILTERS = new Set(["tail", "head", "grep"]);
+
 // packages/workit-core/src/hooks/handle.ts
 var offered = new Set;
 var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);

package/dist/{workit-hook-xhk0gksg.js → workit-hook-vnqp9m7p.js}

@@ -125,6 +125,9 @@ Autonomy contract:
 CLI first: if a step has one right answer, use the \`workit\` verb instead of
 hand-running git, gh or glab (\`workit git|pr|ci|check|help\`;
 else \`npx -y @brainervirus/workit-cli\`).
+Other checkout: \`workit --cwd <dir> <verb>\` (Codex: \`<verb> --cwd <dir>\`); one workit
+verb per shell call, never \`cd <dir> && workit\`. zsh-safe: no \`echo =====\`
+(\`printf '%s\\n' ---\`), quote globs and URLs, no variable named \`status\` or \`path\`.
 Add Co-Authored-By via \`workit git commit --trailer "K: v" -- <paths>\`, never
 an amend.
 The task families (task, policy, evidence, finding, decision, worker, state)
@@ -22262,6 +22265,40 @@ var standingDelta = (input) => {
   }
 };
 var sinceStart = new Map;
+// packages/workit-core/src/hooks/cwd-normalize.ts
+var COMPOUND = /^\s*cd\s+([A-Za-z0-9_./@%+:,=-]+|'[^'$`\\\n]*'|"[^"$`\\!\n]*")\s*&&\s*(workit(?:\s[\s\S]*)?)$/u;
+var FILTERS = new Set(["tail", "head", "grep"]);
+var stdinOnly = (words) => {
+  const [name, ...args] = words;
+  const operands = args.filter((w) => !w.startsWith("-"));
+  if (name === "grep")
+    return operands.length <= 1 && !args.some((w) => /^-[^-]*[rRf]|^--(recursive|file)/u.test(w));
+  return operands.every((w) => /^\d+$/u.test(w)) && !args.some((w) => w.startsWith("--output"));
+};
+var cwdRewrite = (command) => {
+  const match = COMPOUND.exec(command);
+  const dir = match?.[1];
+  const rest = match?.[2];
+  if (!dir || !rest || dir.startsWith("-"))
+    return null;
+  if (/[&;<>`\n]/u.test(rest.replaceAll("2>&1", "")))
+    return null;
+  const segments = segmentsOf(rest);
+  const [head, ...filters] = segments;
+  if (!head || head.words[0] !== "workit")
+    return null;
+  if (head.words.some((w) => w === "--cwd" || w.startsWith("--cwd=")))
+    return null;
+  const clean = (s) => !s.unanalyzable && !s.group && !s.subs?.length && !s.stdin?.length && !s.redirects.length;
+  if (!segments.every(clean))
+    return null;
+  if (!segments.slice(0, -1).every((s) => s.pipe))
+    return null;
+  if (!filters.every((s) => FILTERS.has(s.words[0] ?? "") && stdinOnly(s.words)))
+    return null;
+  return `workit --cwd ${dir} ${rest.slice("workit".length).trimStart()}`.trimEnd();
+};
+
 // packages/workit-core/src/hooks/handle.ts
 var usable2 = (value) => value === "native" || value === "partial";
 var NONE5 = { kind: "none" };
@@ -22371,19 +22408,21 @@ function decide(input, deps) {
       if (plan.kind === "rewrite" && !rewrites && canDeny)
         return heavyDenial(event.command, plan);
       const lease = plan.kind === "rewrite" && rewrites ? plan : null;
+      const cwdCommand = !lease && rewrites && input.host === "claude_code" ? cwdRewrite(event.command) : null;
       const aside = plan.kind === "passthrough" ? plan.note : null;
       noteRawCommit(input, event.command, postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND);
-      const rewritten = (text) => lease ? {
+      const rewrittenTo = lease?.command ?? cwdCommand;
+      const rewritten = (text) => rewrittenTo ? {
         kind: "rewrite",
-        command: lease.command,
-        input: event.toolInput ? { ...event.toolInput, command: lease.command } : null,
+        command: rewrittenTo,
+        input: event.toolInput ? { ...event.toolInput, command: rewrittenTo } : null,
         text
       } : NONE5;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
       const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE5, aside), shipNudge(input, event.command));
       if (!lease)
-        return nudged;
+        return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
 `));
     }

package/dist/workit-hook.js

@@ -47,6 +47,6 @@ if (quiet)
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 else {
-  const { runCodexHook } = await import("./workit-hook-xhk0gksg.js");
+  const { runCodexHook } = await import("./workit-hook-vnqp9m7p.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.21.0",
+  "version": "8.22.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.21.0",
-    "@brainervirus/workit-mcp": "^8.21.0"
+    "@brainervirus/workit-core": "^8.22.0",
+    "@brainervirus/workit-mcp": "^8.22.0"
   },
   "engines": {
     "node": ">=24"