@brainervirus/workit-codex 8.22.3 → 8.23.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "8.22.3",
+  "version": "8.23.0",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/agents/workit-implementer.toml

@@ -1,36 +1,44 @@
 # Generated by Workit from packages/workit-claude-code/agents/implementer.md; edits are overwritten on the next plugin start.
 name = "workit-implementer"
-description = "Implements one scoped workit brief in an isolated git worktree and reports what changed and how it was checked. Use to delegate a well-defined slice (goal, scope, acceptance, verify, forbidden, report) so it can run in parallel with other work."
-developer_instructions = '''You are a workit implementer working in your own git worktree.
+description = "Implements one scoped workit brief in the git worktree its lead made with `workit fanout worktree create`, and reports what changed and how it was checked. Use to delegate a well-defined slice (goal, scope, acceptance, verify, forbidden, report, worktree) so it can run in parallel with other work."
+developer_instructions = '''You are a workit implementer. You work only in the git worktree your brief
+names (its WORKTREE line), which the lead made with
+`workit fanout worktree create <slice>` before spawning you; never in the
+lead's checkout.
 
 Refuse to start without a complete brief. It must state: goal, scope (files
 or areas you may touch), acceptance (observable outcomes), verify (exact
 commands), timebox, forbidden (what you must not touch or do), report (what to
-hand back), standing orders and mode (`new` or `resume`). If a field is
-missing, report which and stop.
+hand back), standing orders, mode (`new` or `resume`) and the worktree path.
+If a field is missing, report which and stop.
 
-1. Your worktree starts on a branch name you did not choose, which may break
-   the repository's branch policy. First command, `MODE: new`:
-   `workit git branch <branch> --base <base>` with the brief's branch and base.
-   `MODE: resume` (you replace a stopped worker): `git switch <branch>` and
-   continue from its head; never `workit git branch`, the branch exists. A hook denies
-   protected or non-compliant names; follow the unblock it prints.
-2. Stay inside the scope. Anything outside it is a follow-up in the report,
+1. Run each git and check command against the worktree, one verb per call:
+   `workit --cwd <worktree> git commit …`, `workit --cwd <worktree> check <name>`.
+   Never `cd <worktree> && …` chains, `$VAR` paths or compound commands. Edit
+   files by their path under the worktree. Workit's hooks deny an edit or a
+   mutating git command outside it.
+2. The worktree is already on the brief's branch. If it is not: `MODE: new`,
+   `workit --cwd <worktree> git branch <branch> --base <base>`; `MODE: resume`
+   (you replace a stopped worker), `git -C <worktree> switch <branch>` and
+   continue from its head. A hook denies protected or non-compliant names;
+   follow the unblock it prints.
+3. Stay inside the scope. Anything outside it is a follow-up in the report,
    not a diff. Follow the workit-implement skill (`$workit-implement`).
-3. Decide ambiguities yourself and record them:
+4. Decide ambiguities yourself and record them:
    `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`.
    Stop only for an irreversible or security-sensitive action, or a side effect
    outside your worktree.
-4. Commit in small steps with
-   `workit git commit -m "<conventional message>" -- <paths in scope>`.
-5. Run every verify command as `workit check …` and keep the real exit codes.
-6. Never record a verdict on your own work and never pass `--self`: a separate
+5. Commit in small steps with
+   `workit --cwd <worktree> git commit -m "<conventional message>" -- <paths in scope>`.
+6. Run every verify command as `workit --cwd <worktree> check …` and keep the
+   real exit codes.
+7. Never record a verdict on your own work and never pass `--self`: a separate
    verifier judges it. Never push, open a PR, rebase or merge unless the brief
    says so.
 
-Report: branch and head SHA, files changed, each verify command with its exit
-code, each acceptance item met or not, rulings recorded, and any deviation from
-the brief.
+Report: worktree, branch and head SHA, files changed, each verify command with
+its exit code, each acceptance item met or not, rulings recorded, and any
+deviation from the brief.
 
 Codex does not isolate subagents: the lead creates your worktree with `workit fanout worktree create <slice>` and names it in the brief. Work only there, never in the lead's checkout.
 '''

package/dist/launch-mcp.js

@@ -6622,7 +6622,7 @@ var require_dist = __commonJS(function(exports, module) {
 
 // packages/workit-codex/scripts/launch-mcp.ts
 import { existsSync as existsSync10, realpathSync as realpathSync7, statSync as statSync3 } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // packages/workit-core/src/core.ts
@@ -27108,6 +27108,9 @@ var EXEC = new Set(["exec", "x", "dlx"]);
 
 // packages/workit-core/src/core/heavy-words.ts
 var HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
+// packages/workit-core/src/hooks/write-gate.ts
+import path23 from "node:path";
+
 // packages/workit-core/src/core/live-session.ts
 import { spawnSync as spawnSync15 } from "node:child_process";
 var LIVE_SESSION_TTL_MS = 15 * 60000;
@@ -27120,7 +27123,7 @@ var PIDS = new Map;
 
 // packages/workit-core/src/hooks/write-gate.ts
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
-var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs", "busybox"]);
 var SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
 var cache2 = new Map;
 var MUTATING_GIT = new Set([
@@ -27147,6 +27150,7 @@ var MUTATING_WORKIT_GIT = new Set(["commit", "branch"]);
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
+var UNKNOWN_DIR = path23.resolve(path23.parse(process.cwd()).root, ".workit-unknown-dir");
 // packages/workit-core/src/core/skill-manifests.ts
 if (false) {}
 
@@ -27191,6 +27195,19 @@ var sinceStart = new Map;
 // packages/workit-core/src/hooks/cwd-normalize.ts
 var FILTERS = new Set(["tail", "head", "grep"]);
 
+// packages/workit-core/src/hooks/worktree-confine.ts
+var CASE_INSENSITIVE2 = process.platform === "darwin" || process.platform === "win32";
+var MUTATING_REMOTE = new Set([
+  "add",
+  "remove",
+  "rm",
+  "rename",
+  "set-url",
+  "set-head",
+  "set-branches",
+  "prune"
+]);
+
 // packages/workit-core/src/hooks/handle.ts
 var offered = new Set;
 var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
@@ -27356,14 +27373,14 @@ import {
   writeFileSync as writeFileSync3
 } from "node:fs";
 import os5 from "node:os";
-import path23 from "node:path";
+import path24 from "node:path";
 var CODEX_AGENT_MARKER = "# Generated by Workit";
 var codexHomeOfInstall = (pluginRoot) => {
-  const parts = path23.resolve(pluginRoot).split(path23.sep);
+  const parts = path24.resolve(pluginRoot).split(path24.sep);
   const cache = parts.length - 4;
-  return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path23.sep) || path23.sep : null;
+  return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path24.sep) || path24.sep : null;
 };
-var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path23.join(env.HOME || os5.homedir(), ".codex"));
+var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path24.join(env.HOME || os5.homedir(), ".codex"));
 var MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
 var agentMarkerVersion = (text) => MARKER_VERSION.exec(text)?.[1] ?? null;
 var stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content;
@@ -27377,7 +27394,7 @@ var versionAtLeast = (version, min) => {
 };
 var pluginVersion = (pluginRoot) => {
   try {
-    const version = JSON.parse(readFileSync7(path23.join(pluginRoot, "package.json"), "utf8")).version;
+    const version = JSON.parse(readFileSync7(path24.join(pluginRoot, "package.json"), "utf8")).version;
     return typeof version === "string" && /^\d+\.\d+\.\d+/.test(version) ? version.match(/^\d+\.\d+\.\d+/)[0] : null;
   } catch {
     return null;
@@ -27391,15 +27408,15 @@ var lstatOrNull = (file) => {
   }
 };
 var installCodexAgents = (pluginRoot, codexHome) => {
-  const source = path23.join(pluginRoot, "agents");
+  const source = path24.join(pluginRoot, "agents");
   if (!existsSync9(source))
     return [];
   const version = pluginVersion(pluginRoot);
-  const target = path23.join(codexHome, "agents");
+  const target = path24.join(codexHome, "agents");
   const results = [];
   for (const file of readdirSync5(source).filter((name) => name.endsWith(".toml")).toSorted()) {
-    const content = stampCodexAgent(readFileSync7(path23.join(source, file), "utf8"), version);
-    const dest = path23.join(target, file);
+    const content = stampCodexAgent(readFileSync7(path24.join(source, file), "utf8"), version);
+    const dest = path24.join(target, file);
     const stat = lstatOrNull(dest);
     if (stat?.isSymbolicLink()) {
       results.push({ file: dest, action: "skipped-symlink" });
@@ -27435,7 +27452,7 @@ var installCodexAgents = (pluginRoot, codexHome) => {
       results.push({ file: dest, action: "kept-newer-version" });
       continue;
     }
-    const temp = path23.join(target, `.${file}.${process.pid}.${Date.now()}.tmp`);
+    const temp = path24.join(target, `.${file}.${process.pid}.${Date.now()}.tmp`);
     writeFileSync3(temp, content, { flag: "wx" });
     try {
       renameSync2(temp, dest);
@@ -27457,8 +27474,8 @@ var codexQualification = (host) => host === "codex_cli" ? { surface: host, cli:
 var resolveCodexWorkspaceRoot = (pluginRoot, env) => {
   const explicit = env.WORKFLOW_WORKSPACE_ROOT;
   const inherited = env.PWD;
-  const candidate = explicit ?? (inherited && path24.resolve(inherited) !== path24.resolve(pluginRoot) ? inherited : undefined);
-  if (!candidate || !path24.isAbsolute(candidate) || !existsSync10(candidate))
+  const candidate = explicit ?? (inherited && path25.resolve(inherited) !== path25.resolve(pluginRoot) ? inherited : undefined);
+  if (!candidate || !path25.isAbsolute(candidate) || !existsSync10(candidate))
     return null;
   try {
     if (!statSync3(candidate).isDirectory())
@@ -27497,7 +27514,7 @@ var codexContextProvider = (host = detectCodexSurface(process.env), root) => ({
     };
   }
 });
-var pluginRoot = () => path24.resolve(path24.dirname(fileURLToPath3(import.meta.url)), "..");
+var pluginRoot = () => path25.resolve(path25.dirname(fileURLToPath3(import.meta.url)), "..");
 var syncCodexAgents = (root) => {
   const codexHome = codexHomeOfInstall(root);
   if (!codexHome)

package/dist/{workit-hook-73m7khyw.js → workit-hook-hegafjtc.js}

@@ -17683,6 +17683,24 @@ function workitInvocations(command, dialect = "posix", depth = 0) {
   }
   return found;
 }
+var WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
+function skipWorkitGlobals(args) {
+  let cwd = null;
+  let at = 0;
+  for (;at < args.length; at++) {
+    const match = WORKIT_GLOBAL.exec(args[at]);
+    if (match?.[1] === "=") {
+      if (args[at].startsWith("--cwd="))
+        cwd = args[at].slice(6);
+    } else if (match && args[at + 1] !== undefined) {
+      if (args[at] === "--cwd")
+        cwd = args[at + 1];
+      at++;
+    } else if (args[at] !== "--json")
+      break;
+  }
+  return { rest: args.slice(at), cwd };
+}
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var CURRENT_BRANCH = /^\$\(\s*git\s+(?:branch\s+--show-current|rev-parse\s+--abbrev-ref\s+HEAD|symbolic-ref\s+--short\s+HEAD)\s*\)$/;
 var pushDestination = (destination) => {
@@ -19443,7 +19461,7 @@ var splitDenial = (plan) => ({
   unblock: plan.unblock
 });
 // packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
 import os9 from "node:os";
 import path24 from "node:path";
 
@@ -19672,7 +19690,7 @@ var exempt = (cwd, root, file, plans) => {
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
-var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs", "busybox"]);
 var operands = (words) => words.filter((item) => !item.startsWith("-"));
 var SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
 var wrappedScript = (input) => {
@@ -19684,9 +19702,9 @@ var wrappedScript = (input) => {
     return null;
   if ("script" in tail)
     return tail.script;
-  const [shell, flag, script] = tail.argv;
-  if (SCRIPT_SHELLS.has((shell.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && /^-[a-z]*c$/.test(flag ?? ""))
-    return script ?? null;
+  const script = shellScript2(tail.argv);
+  if (SCRIPT_SHELLS.has((tail.argv[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && script)
+    return script;
   return tail.argv.map(quoteWord2).join(" ");
 };
 var editsOf = (input) => {
@@ -19765,6 +19783,94 @@ var editsOf = (input) => {
       return [];
   }
 };
+var shellScript2 = (words) => {
+  if (!SCRIPT_SHELLS.has((words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()))
+    return null;
+  for (let index = 1;index < words.length; index++) {
+    const word = words[index];
+    if (/^-[a-z]*c$/.test(word))
+      return words[index + 1] ?? null;
+    if (/^[-+][oO]$/.test(word))
+      index++;
+    else if (!/^[-+]/.test(word))
+      return null;
+  }
+  return null;
+};
+var XARGS_VALUE = /^-[IinLPdsEa]$/;
+var runsWriter = (words) => {
+  const filled = [...words.filter((word) => word !== "{}" && word !== ";" && word !== "+"), "x"];
+  const edits = editsOf(filled);
+  return edits === null || edits.length > 0 || opaqueWrites(filled) !== null;
+};
+var opaqueWrites = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0]))) {
+    if (words[0] === "xargs") {
+      let at = 1;
+      while (words[at]?.startsWith("-"))
+        at += XARGS_VALUE.test(words[at]) ? 2 : 1;
+      return runsWriter(words.slice(at)) ? ["."] : null;
+    }
+    words = words.slice(1);
+  }
+  const [verb, ...args] = words;
+  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  const files = operands(args);
+  const has = (pattern) => args.some((arg) => pattern.test(arg));
+  const listed = (named) => named.length ? named : ["."];
+  if (name === "unlink" || name === "shred")
+    return listed(files);
+  if (/^(?:chmod|chown|chgrp|chattr)$/.test(name))
+    return listed(has(/^--reference/) ? files : files.slice(1));
+  if (name === "rsync") {
+    const dest = files.at(-1);
+    const remote = /^[\w.@-]*:/.test(dest ?? "") && !/^[A-Za-z]:[\\/]/.test(dest ?? "");
+    return dest === undefined ? ["."] : remote ? [] : [dest];
+  }
+  if (name === "find") {
+    const exec = args.findIndex((arg) => /^-(?:exec|execdir|ok|okdir)$/.test(arg));
+    const writes = has(/^-(?:delete|fprint\w*|fls)$/) || exec >= 0 && runsWriter(args.slice(exec + 1));
+    const end = args.findIndex((arg) => /^[-(!]/.test(arg));
+    return writes ? listed(end < 0 ? args : args.slice(0, end)) : null;
+  }
+  if (/^g?awk$/.test(name)) {
+    if (!has(/^-i|^--include/))
+      return null;
+    const named = [];
+    let program = !has(/^-f$|^--file/);
+    for (let index = 0;index < args.length; index++)
+      if (/^(?:-[ifvF]|--(?:include|file|assign|field-separator))$/.test(args[index]))
+        index++;
+      else if (args[index].startsWith("-"))
+        continue;
+      else if (program)
+        program = false;
+      else
+        named.push(args[index]);
+    return listed(named);
+  }
+  if (name === "perl")
+    return has(/^-[a-zA-Z]*[eE]/) ? ["."] : null;
+  if (/^(?:python[\d.]*|node|bun|deno|ruby|php)$/.test(name))
+    return has(/^-[a-zA-Z]*[ce]$|^--eval$|^-p$/) ? ["."] : null;
+  return shellScript2(words) === null ? null : ["."];
+};
+var linkSources = (args, at) => {
+  const names = operands([...args]);
+  const into = args.indexOf("-t");
+  const dest = into >= 0 ? args[into + 1] : names.length > 1 ? names.at(-1) : ".";
+  const sources = names.filter((name, index) => into >= 0 ? name !== dest : index < names.length - 1 || names.length === 1);
+  const target = dest === undefined ? null : at(dest);
+  const symbolic = args.some((arg) => /^-[a-zA-Z]*s|^--symbolic$/.test(arg));
+  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync7(target) || /[\\/]$/.test(dest ?? "") ? target : path24.dirname(target);
+  return sources.flatMap((source) => {
+    if (symbolic && base !== null && !path24.isAbsolute(homeExpanded(source)))
+      return [path24.resolve(base, source)];
+    const resolved = at(source);
+    return resolved ? [resolved] : [];
+  });
+};
 var shellWrites = (command, depth = 0) => {
   const targets = [];
   let unknown = false;
@@ -19874,11 +19980,15 @@ var gitMutationDirs = (cwd, command, dialect) => {
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var cdInto = (dir, words) => {
+var UNKNOWN_DIR = path24.resolve(path24.parse(process.cwd()).root, ".workit-unknown-dir");
+var cdInto = (dir, words, strict = false) => {
+  const lost = strict ? UNKNOWN_DIR : undefined;
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
   const target = named === undefined ? undefined : homeExpanded(named);
-  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
-    return;
+  if (target === "-" || target && /^~|[$`*?]/.test(target))
+    return lost;
+  if (dir === undefined)
+    return lost;
   return target === undefined ? os9.homedir() : path24.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
@@ -19886,7 +19996,7 @@ var homeExpanded = (file) => {
   const match = /^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/.exec(file);
   return match ? (process.env.HOME || os9.homedir()) + file.slice(match[0].length) : file;
 };
-var segmentTargets = (cwd, command, dialect, depth = 0) => {
+var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
   const targets = [];
   let dir = cwd;
   let stack = [];
@@ -19910,21 +20020,35 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
     const words = lead < 0 ? [] : segment.words.slice(lead);
     const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
     if (CD2.has(name)) {
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (PUSHD2.has(name)) {
       stack.push(dir);
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (POPD2.has(name)) {
-      dir = stack.length ? stack.pop() : undefined;
+      dir = stack.length ? stack.pop() : strict ? UNKNOWN_DIR : undefined;
       continue;
     }
-    const inner = depth < 4 ? wrappedScript(words) : null;
+    const inner = depth < 4 ? wrappedScript(words) ?? (strict ? shellScript2(words) : null) : null;
     if (inner !== null && dir !== undefined)
-      targets.push(...segmentTargets(dir, inner, "posix", depth + 1));
+      targets.push(...segmentTargets(dir, inner, "posix", depth + 1, strict));
+    if (strict && dir !== undefined) {
+      const runIn = dir;
+      for (const sub of depth < 4 ? segment.subs ?? [] : [])
+        targets.push(...segmentTargets(runIn, sub, dialect, depth + 1, true));
+      const opaque = segment.unanalyzable ? ["."] : inner === null ? opaqueWrites(words) : null;
+      for (const file of opaque ?? []) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(file === "." ? path24.join(resolved, DIR_TARGET) : resolved);
+      }
+      const ln = words.findIndex((word) => /^ln$/i.test(word.split(/[\\/]/).at(-1) ?? ""));
+      if (ln >= 0 && words.slice(0, ln).every((word) => PREFIXES2.has(word)))
+        targets.push(...linkSources(words.slice(ln + 1), at));
+    }
     for (const file of segment.redirects)
       if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
         const resolved = at(file);
@@ -19941,11 +20065,29 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
         if (resolved)
           targets.push(resolved);
       }
-    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path24.join(dir, DIR_TARGET));
+    if (dir !== undefined)
+      for (const invocation of workitInvocations(segment.words.map(quoteWord2).join(" "), "posix")) {
+        const { at: runsIn, args } = workitCwd(dir, invocation);
+        if (args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), ""))
+          targets.push(path24.join(runsIn, DIR_TARGET));
+      }
   }
   return targets;
 };
+var workitCwd = (dir, args) => {
+  const { rest, cwd } = skipWorkitGlobals(args);
+  return { at: cwd === null ? dir : path24.resolve(dir, homeExpanded(cwd)), args: rest };
+};
+var shellMutationTargets = (cwd, command, dialect = "posix", strict = false) => {
+  try {
+    return [
+      ...segmentTargets(cwd, command, dialect, 0, strict),
+      ...gitMutationDirs(cwd, command, dialect).map((dir) => path24.join(dir, DIR_TARGET))
+    ];
+  } catch {
+    return [];
+  }
+};
 var overridden = (command, dialect) => {
   const segments = segmentsOf(command, dialect);
   if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
@@ -20051,16 +20193,8 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
   } catch {}
   const writes = shellWrites(command);
   let targets = [];
-  if (owner) {
-    try {
-      targets = [
-        ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path24.join(dir, DIR_TARGET))
-      ];
-    } catch {
-      targets = [];
-    }
-  }
+  if (owner)
+    targets = shellMutationTargets(cwd, command, dialect);
   if (owner && targets.length) {
     const live = liveGate(owner, targets, deps);
     if (live.kind !== "none") {
@@ -20527,13 +20661,13 @@ ${line}` };
   return decision;
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
-import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
 import path25 from "node:path";
 var isRecord5 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path25.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path25.isAbsolute(value) || !existsSync8(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -20736,9 +20870,266 @@ var cwdRewrite = (command) => {
   return `workit --cwd ${dir} ${rest.slice("workit".length).trimStart()}`.trimEnd();
 };
 
+// packages/workit-core/src/hooks/worktree-confine.ts
+import { createHash as createHash16 } from "node:crypto";
+import fs20 from "node:fs";
+import path27 from "node:path";
+var FANOUT_TOKEN_FILE = "workit-fanout-token";
+var NONE5 = { kind: "none" };
+var CASE_INSENSITIVE2 = process.platform === "darwin" || process.platform === "win32";
+var canonical3 = (file) => {
+  let rest = "";
+  for (let dir = path27.resolve(file);; dir = path27.dirname(dir)) {
+    try {
+      return path27.join(fs20.realpathSync.native(dir), rest);
+    } catch {
+      if (path27.dirname(dir) === dir)
+        return path27.resolve(file);
+      rest = rest ? path27.join(path27.basename(dir), rest) : path27.basename(dir);
+    }
+  }
+};
+var within = (child, parent) => {
+  const fold = (value) => CASE_INSENSITIVE2 ? value.toLowerCase() : value;
+  const relative = path27.relative(fold(parent), fold(child));
+  return relative === "" || !relative.startsWith("..") && !path27.isAbsolute(relative);
+};
+var checkoutOf2 = (file) => {
+  for (let dir = canonical3(file);; dir = path27.dirname(dir)) {
+    const dotGit = path27.join(dir, ".git");
+    if (fs20.existsSync(dotGit)) {
+      if (!fs20.statSync(dotGit).isFile())
+        return { root: dir, workit: false };
+      const admin = /^gitdir:\s*(.+)$/mu.exec(fs20.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+      return {
+        root: dir,
+        workit: Boolean(admin) && fs20.existsSync(path27.join(path27.resolve(dir, admin), FANOUT_TOKEN_FILE))
+      };
+    }
+    if (path27.dirname(dir) === dir)
+      return null;
+  }
+};
+var workitWorktreeOf = (file) => {
+  try {
+    const checkout = checkoutOf2(file);
+    return checkout?.workit ? checkout.root : null;
+  } catch {
+    return null;
+  }
+};
+var bindingDir = () => path27.join(resolveStateDir(), "worktree-bind");
+var bindingFile = (session, agentId) => path27.join(bindingDir(), `${createHash16("sha256").update(`${session}\x00${agentId}`).digest("hex").slice(0, 32)}.json`);
+var readBinding = (file) => {
+  try {
+    const value = JSON.parse(fs20.readFileSync(file, "utf8"));
+    return typeof value.worktree === "string" ? value : null;
+  } catch {
+    return null;
+  }
+};
+var boundWorktree = (input) => {
+  const agentId = input.session.agentId;
+  if (!agentId)
+    return null;
+  const binding = readBinding(bindingFile(input.session.id, agentId));
+  return binding && workitWorktreeOf(binding.worktree) === binding.worktree ? binding.worktree : null;
+};
+var bind = (input, worktree) => {
+  const agentId = input.session.agentId;
+  const file = bindingFile(input.session.id, agentId);
+  const binding = {
+    worktree,
+    session: input.session.id,
+    agentId,
+    at: new Date().toISOString()
+  };
+  fs20.mkdirSync(path27.dirname(file), { recursive: true });
+  fs20.writeFileSync(file, JSON.stringify(binding));
+  try {
+    if (inWorkitWorkspace(input.cwd))
+      appendHookObserved(input.cwd, {
+        type: "worktree.bound",
+        actor: { host: input.host, session: input.session.id, agentId },
+        agentType: input.session.agentType,
+        worktree
+      });
+  } catch {}
+};
+var hostIsolated = (cwd, agentId) => {
+  try {
+    if (agentId === null)
+      return false;
+    const checkout = checkoutOf2(cwd);
+    if (!checkout)
+      return false;
+    const dotGit = path27.join(checkout.root, ".git");
+    if (!fs20.statSync(dotGit).isFile())
+      return false;
+    const admin = /^gitdir:\s*(.+)$/mu.exec(fs20.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+    if (!admin)
+      return false;
+    const adminDir = path27.resolve(checkout.root, admin);
+    const back = fs20.readFileSync(path27.join(adminDir, "gitdir"), "utf8").trim();
+    if (path27.relative(canonical3(path27.resolve(adminDir, back)), canonical3(dotGit)) !== "")
+      return false;
+    const common = path27.join(adminDir, "commondir");
+    const gitDir = fs20.existsSync(common) ? path27.resolve(adminDir, fs20.readFileSync(common, "utf8").trim()) : adminDir;
+    const expected = path27.join(path27.dirname(canonical3(gitDir)), ".claude", "worktrees", `agent-${agentId}`);
+    return path27.relative(canonical3(expected), checkout.root) === "";
+  } catch {
+    return false;
+  }
+};
+var shown = (target) => path27.basename(target) === ".workit-live-target" ? path27.dirname(target) : target;
+var unboundDeny = (input, target) => {
+  const unblock = "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit --cwd <worktree> git commit -m … -- <paths>`, `workit --cwd <worktree> check <name>`). If your brief names no worktree, stop and report that to the lead.";
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} is not working in a Workit worktree yet, and ${shown(target)} is outside every worktree \`workit fanout worktree create\` made, so it would change the lead's checkout. ${unblock}`,
+    unblock
+  };
+};
+var outsideDeny = (input, worktree, target) => {
+  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit --cwd ${worktree} git commit -m … -- <paths>\`, \`workit --cwd ${worktree} check <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} is bound to the worktree ${worktree}, and ${shown(target)} is outside it. ${unblock}`,
+    unblock
+  };
+};
+var unknownDirDeny = (input, worktree) => {
+  const wt = worktree ?? "<worktree>";
+  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit --cwd ${wt}\`.`;
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} writes after an unknown directory change. ${unblock}`,
+    unblock
+  };
+};
+function confineImplementer(input, targets) {
+  try {
+    if (!input.session.agentId || hostIsolated(input.cwd, input.session.agentId))
+      return NONE5;
+    if (targets.some((target) => within(path27.resolve(target), UNKNOWN_DIR)))
+      return unknownDirDeny(input, boundWorktree(input));
+    const bindings = canonical3(bindingDir());
+    const judged = targets.map((named) => ({ named, real: canonical3(named) })).filter(({ real }) => within(real, bindings) || checkoutOf2(real) !== null);
+    if (judged.length === 0)
+      return NONE5;
+    let worktree = boundWorktree(input);
+    if (!worktree) {
+      for (const { real } of judged) {
+        worktree = within(real, bindings) ? null : workitWorktreeOf(real);
+        if (worktree)
+          break;
+      }
+      if (!worktree)
+        return unboundDeny(input, judged[0].named);
+      bind(input, worktree);
+    }
+    const root = canonical3(worktree);
+    const outside = judged.find(({ real }) => !within(real, root) || within(real, bindings));
+    return outside ? outsideDeny(input, worktree, outside.named) : NONE5;
+  } catch {
+    return NONE5;
+  }
+}
+var MUTATING_REMOTE = new Set([
+  "add",
+  "remove",
+  "rm",
+  "rename",
+  "set-url",
+  "set-head",
+  "set-branches",
+  "prune"
+]);
+var CONFIG_READ = /^(?:--get(?:-all|-regexp|-urlmatch)?|--list|-l|get|list)$/;
+var CONFIG_WRITE = /^(?:--(?:unset(?:-all)?|add|replace-all|rename-section|remove-section|edit)|-e|set|unset|rename-section|remove-section|edit)$/;
+var CONFIG_VALUE = /^(?:--file|-f|--blob|--type|--default|--comment)$/;
+var leadOwnedGit = (args) => {
+  const [sub = "", ...rest] = args;
+  if (rest.some((arg) => arg === "--help" || arg === "-h"))
+    return false;
+  const names = rest.filter((arg) => !arg.startsWith("-"));
+  const flag = (pattern) => rest.some((arg) => pattern.test(arg));
+  switch (sub) {
+    case "worktree":
+      return names[0] !== undefined && names[0] !== "list";
+    case "update-ref":
+      return true;
+    case "symbolic-ref":
+      return names.length > 1 || flag(/^(?:-d|--delete)$/);
+    case "branch":
+      return flag(/^-[a-zA-Z]*[dDfmMcC]|^--(?:delete|force|move|copy)$/);
+    case "tag":
+      return flag(/^-[a-zA-Z]*[df]|^--(?:delete|force)$/);
+    case "push": {
+      if (flag(/^(?:-d|--delete|--mirror|--prune)$/))
+        return true;
+      const refspecs = names.slice(1);
+      return refspecs.some((name) => name.includes(":") || name.startsWith("+")) || refspecs.length > 0 && flag(/^-[a-zA-Z]*f|^--force/);
+    }
+    case "replace":
+    case "filter-branch":
+    case "gc":
+    case "prune":
+    case "repack":
+    case "sparse-checkout":
+      return true;
+    case "notes":
+    case "reflog":
+    case "submodule":
+      return !/^(?:list|show|status|exists)$/.test(names[0] ?? "list");
+    case "stash":
+      return names[0] === "drop" || names[0] === "clear";
+    case "remote":
+      return MUTATING_REMOTE.has(names[0] ?? "");
+    case "config": {
+      if (rest.some((arg) => CONFIG_READ.test(arg)))
+        return false;
+      if (rest.some((arg) => CONFIG_WRITE.test(arg)))
+        return true;
+      let operands = 0;
+      for (let index = 0;index < rest.length; index++)
+        if (CONFIG_VALUE.test(rest[index]))
+          index++;
+        else if (!rest[index].startsWith("-"))
+          operands++;
+      return operands > 1;
+    }
+    default:
+      return false;
+  }
+};
+var leadOwnedWorkit = (args) => !args.includes("--help") && args.some((_, start) => {
+  if (start > 0 && !/(?:^|[\\/])workit(?:\.exe|\.cmd)?$/.test(args[start - 1]))
+    return false;
+  const [verb, sub] = skipWorkitGlobals(args.slice(start)).rest;
+  return verb === "fanout" && /^(?:plan|worktree)$/.test(sub ?? "");
+});
+var leadOwnedDeny = (input, command) => {
+  const unblock = "Worktrees, branches other than your own, refs, tags, remotes, git config, the shared stash and the fan-out plan belong to the lead: report what you need changed as a follow-up instead.";
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} may not run \`${command.slice(0, 160)}\`. ${unblock}`,
+    unblock
+  };
+};
+function confineImplementerShell(input, command, dialect = "posix") {
+  try {
+    if (!input.session.agentId || hostIsolated(input.cwd, input.session.agentId))
+      return NONE5;
+    if (rawInvocations(command, dialect).some((invocation) => invocation.tool === "git" && leadOwnedGit(invocation.args)) || workitInvocations(command, dialect).some(leadOwnedWorkit))
+      return leadOwnedDeny(input, command);
+  } catch {}
+  return confineImplementer(input, shellMutationTargets(input.cwd, command, dialect, true));
+}
+
 // packages/workit-core/src/hooks/handle.ts
 var usable2 = (value) => value === "native" || value === "partial";
-var NONE5 = { kind: "none" };
+var NONE6 = { kind: "none" };
 var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
 var offered = new Set;
 var ROLES = {
@@ -20751,6 +21142,7 @@ var workitRole = (descriptor, agentType) => {
   const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
   return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
 };
+var implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer";
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
 var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
 var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
@@ -20758,7 +21150,7 @@ var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
-  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
+  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(input.cwd, event.agentId) : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
@@ -20766,7 +21158,7 @@ var subagentStartText = (input, descriptor, event) => {
     return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit --cwd <worktree> git commit -m "<message>" -- <paths>\`, \`workit --cwd <worktree> check <name>\`. The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit --cwd <worktree> git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
@@ -20797,7 +21189,7 @@ function decide(input, deps) {
   switch (event.kind) {
     case "session.start": {
       if (!usable2(descriptor.context.sessionStart))
-        return NONE5;
+        return NONE6;
       const key = input.session.id ? `${input.host}\x00${input.session.id}` : null;
       const offer = event.source === "startup" && (key === null || !offered.has(key));
       if (offer && key !== null)
@@ -20812,26 +21204,31 @@ function decide(input, deps) {
     }
     case "context.turn": {
       if (!usable2(descriptor.context.perTurn))
-        return NONE5;
+        return NONE6;
       const current = turnContextText(input, descriptor);
       const text = resendsOnChange(descriptor) ? changedTurnContext(input, current) : current;
-      return withContextLine(text ? { kind: "context", text } : NONE5, promptNudge(input, event.prompt));
+      return withContextLine(text ? { kind: "context", text } : NONE6, promptNudge(input, event.prompt));
     }
     case "shell.pre": {
       const skillRead = skillReadIn(event.command, event.dialect);
       if (skillRead)
         recordSkillLoad(input, skillRead, "read");
       const canDeny = usable2(descriptor.shellPolicy.deny);
-      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE5;
+      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE6;
       if (policy.kind !== "none")
         return policy;
       const postTool = usable2(descriptor.events["shell.post"].support);
       if (!postTool)
         settlePendingCommit(input);
-      const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE5;
+      const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE6;
       if (raw.kind === "deny")
         return raw;
-      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE5;
+      if (canDeny && implementerAgent(input, descriptor)) {
+        const confined = confineImplementerShell(input, event.command, event.dialect);
+        if (confined.kind === "deny")
+          return confined;
+      }
+      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE6;
       if (gate.kind === "deny")
         return gate;
       const plan = heavyGate(input.cwd, event.command, {
@@ -20854,10 +21251,10 @@ function decide(input, deps) {
         command: rewrittenTo,
         input: event.toolInput ? { ...event.toolInput, command: rewrittenTo } : null,
         text
-      } : NONE5;
+      } : NONE6;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
-      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE5, aside), shipNudge(input, event.command));
+      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE6, aside), shipNudge(input, event.command));
       if (!lease)
         return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
@@ -20866,9 +21263,17 @@ function decide(input, deps) {
     case "shell.post":
       if (usable2(descriptor.events["shell.post"].support))
         rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
-      return NONE5;
-    case "write.pre":
-      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
+      return NONE6;
+    case "write.pre": {
+      if (!usable2(descriptor.events["write.pre"].support))
+        return NONE6;
+      if (implementerAgent(input, descriptor)) {
+        const confined = confineImplementer(input, liveTargets(input.cwd, event.paths));
+        if (confined.kind === "deny")
+          return confined;
+      }
+      return writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport));
+    }
     case "subagent.start":
       if (workitRole(descriptor, event.agentType) === "judge")
         trackJudge(input, event.agentId, true);
@@ -20885,22 +21290,22 @@ function decide(input, deps) {
     case "tool.pre":
       if (event.skill)
         recordSkillLoad(input, event.skill, "tool");
-      return NONE5;
+      return NONE6;
     case "stop":
-      return usable2(descriptor.events.stop.support) ? stopDecision(input, descriptor) : NONE5;
+      return usable2(descriptor.events.stop.support) ? stopDecision(input, descriptor) : NONE6;
     case "subagent.stop":
       trackJudge(input, event.agentId, false);
-      return NONE5;
+      return NONE6;
     case "prompt.submit":
-      return NONE5;
+      return NONE6;
   }
 }
 var failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
-    return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE5;
+    return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE6;
   if (event === "session.start" || event === "subagent.start")
     return { kind: "context", text: `[workit diagnostic: ${error}]` };
-  return NONE5;
+  return NONE6;
 };
 var dispatchHook = (adapter, raw, env = process.env) => {
   const parsed = adapter.parse(raw, env);
@@ -20926,7 +21331,7 @@ var dispatchHook = (adapter, raw, env = process.env) => {
 };
 // packages/workit-core/src/hooks/deadline.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 var HOOK_SKIP_TEXT = "workit context skipped: host under load";
 var HOOK_DEADLINE_MS = 8000;
 var HOST_DEADLINES = {
@@ -20944,7 +21349,7 @@ var hookDeadlineMs = (env, host = "", native) => {
   const row = HOST_DEADLINES[host];
   return override(env) ?? (row ? native === undefined ? Math.min(...Object.values(row)) : row[native] ?? row[""] : HOOK_DEADLINE_MS);
 };
-var skipsFile = (stateDir) => path27.join(stateDir, HOOK_SKIPS_FILE);
+var skipsFile = (stateDir) => path28.join(stateDir, HOOK_SKIPS_FILE);
 var recordHookSkip = (skip, stateDir = resolveStateDir()) => {
   try {
     mkdirSync3(stateDir, { recursive: true });
@@ -20962,7 +21367,7 @@ var QUIET = new Set([
 ]);
 var skipDecision = (event) => QUIET.has(event) ? { kind: "none" } : { kind: "context", text: HOOK_SKIP_TEXT };
 var TIMED_OUT = Symbol("timed out");
-var within = async (work, ms) => {
+var within2 = async (work, ms) => {
   let timer;
   const expired = new Promise((resolve) => {
     timer = setTimeout(() => resolve(TIMED_OUT), Math.max(0, ms));
@@ -20993,7 +21398,7 @@ var readWithin = async (stdin, budget) => {
       text += String(chunk);
     return text;
   })();
-  const text = await within(read, budget.startedAt + budget.deadlineMs - budget.now());
+  const text = await within2(read, budget.startedAt + budget.deadlineMs - budget.now());
   return isTimedOut(text) ? null : text;
 };
 var note = (adapter, raw, env, budget, outcome, stage) => {
@@ -21022,7 +21427,7 @@ var dispatchWithin = async (adapter, raw, env, budget, dispatch = dispatchHook)
   if (budget.host !== null && typeof native === "string")
     budget.deadlineMs = hookDeadlineMs(env, budget.host, native);
   const remaining = () => budget.startedAt + budget.deadlineMs - budget.now();
-  const result = remaining() > 0 ? await within(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
+  const result = remaining() > 0 ? await within2(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
   if (isTimedOut(result))
     return skippedHook(adapter, raw, env, budget, "dispatch");
   if (remaining() < 0)
@@ -21588,8 +21993,8 @@ var codexAdapter = {
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs20 from "node:fs";
-import path28 from "node:path";
+import fs21 from "node:fs";
+import path29 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -21786,17 +22191,17 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path28.isAbsolute(file))
+  if (!file || !path29.isAbsolute(file))
     return null;
   try {
-    const size = fs20.statSync(file).size;
+    const size = fs21.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs20.openSync(file, "r");
+    const fd = fs21.openSync(file, "r");
     try {
-      fs20.readSync(fd, buffer, 0, buffer.length, start);
+      fs21.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs20.closeSync(fd);
+      fs21.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -21823,7 +22228,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path28.sep) ? root : `${root}${path28.sep}`);
+var within3 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path29.sep) ? root : `${root}${path29.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
@@ -21832,7 +22237,7 @@ var hookCwd = (input) => {
 };
 var cursorWorkspaceRoot = (input) => {
   const cwd = existingDirectory(input.cwd);
-  return cwd && input.workspace_roots.find((root) => within2(root, cwd)) || input.workspace_roots[0];
+  return cwd && input.workspace_roots.find((root) => within3(root, cwd)) || input.workspace_roots[0];
 };
 var cursorDeny = (reason) => ({
   permission: "deny",

package/dist/workit-hook.js

@@ -28,6 +28,8 @@ var quietEvent = () => {
     const tool = value.tool_name.toLowerCase();
     if (event === "PreToolUse" && WRITE_TOOLS.has(tool.replace(/[_-]/g, "")))
       return null;
+    if (event === "PreToolUse" && value.agent_type === "workit-implementer")
+      return null;
     const shell = SHELL_TOOLS.has(tool);
     const command = value.tool_input?.command;
     const text = Array.isArray(command) ? command.join(" ") : String(command ?? "");
@@ -47,6 +49,6 @@ if (quiet)
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 else {
-  const { runCodexHook } = await import("./workit-hook-73m7khyw.js");
+  const { runCodexHook } = await import("./workit-hook-hegafjtc.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.22.3",
+  "version": "8.23.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.22.3",
-    "@brainervirus/workit-mcp": "^8.22.3"
+    "@brainervirus/workit-core": "^8.23.0",
+    "@brainervirus/workit-mcp": "^8.23.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-fanout/SKILL.md

@@ -20,14 +20,14 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
    PR (`references/orchestration.md`).
 2. **Record standing orders** (`workit ledger standing add "<order>"`): every
    user directive all workers share. Directives decay across resumes.
-3. **Brief each worker verbatim** with `workit fanout brief <slice>`: plan
-   fields, standing orders, SCRATCH, session id, fan-in and heavy-lease rules.
+3. **Brief each worker verbatim**: `workit fanout worktree create <slice>`
+   (every host), then `workit fanout brief <slice>` (WORKTREE, SCRATCH, rules).
    Never hand-edit it; change the plan or the standing orders and render again.
 4. **Spawn in a rolling window**, in the background, each in its own worktree:
    keep 4-6 in flight and refill from `spawnable` in `workit fanout status` as
    each one finishes. Model: the brief's `model:` line, else TIER
-   (`references/orchestration.md`). Claude Code: the `implementer` agent;
-   elsewhere first `workit fanout worktree create <slice>`.
+   (`references/orchestration.md`). Claude Code: the `implementer` agent, never
+   with `isolation: "worktree"`; Workit's hooks confine it to its WORKTREE.
 5. **Judge liveness by side effects only:** `workit fanout status` (head age,
    PR, CI, verdict, landed; STUCK past the TIMEBOX). Stop a stuck worker and
    observe that it exited (a timeout is not proof). Removing a worktree drops

package/skills/workit-fanout/references/brief.md

@@ -25,6 +25,7 @@ REPORT: branch, head SHA, files changed, each VERIFY command with its exit code,
   each ACCEPTANCE line met / not met, rulings you made (`workit ledger ruling`),
   anything out of scope as a follow-up, not a diff.
 STANDING: <the standing orders, verbatim: `workit ledger standing add` records each one>
+WORKTREE: <the path `workit fanout worktree create <slice>` made; the worker runs `workit --cwd <it> …` there>
   <identity line, per the lead's host: see "Identity and git rules per host" below>
 ```
 
@@ -48,6 +49,7 @@ FORBIDDEN: no edits outside SCOPE; no schema migration; no new packages
 FAN-IN: one PR per slice. Never rebase, retarget, merge or force-push: the lead owns topology.
 REPORT: as in the template
 STANDING: conventional commits; no comments that restate code; ask nothing, record rulings instead
+WORKTREE: ../app-wt/usage-endpoint  (made by `workit fanout worktree create usage-endpoint`; yours alone)
 ```
 
 ## Plan file
@@ -106,25 +108,29 @@ lead's host (`WORKIT_HOST`, or the host's own session variable):
 
 | Lead's host | Identity line | RULES 1 and 3 |
 | --- | --- | --- |
-| Claude Code | `Session: your env already has WORKIT_SESSION_ID (the lead's id)`; no `export`, no hand-minted id (SubagentStart issues `<lead>:<agent id>` only to verifiers and reviewers, never to an implementer, so the worker's commits carry the lead's id) | plain git: `git fetch origin && git switch -c <branch> origin/<base>` and `git commit -m <msg> --trailer "Workit-Session: <the env WORKIT_SESSION_ID>" --trailer "<host attribution>" -- <paths in SCOPE>`, because worktree isolation refuses every `workit git` form |
+| Claude Code | `Session: your env already has WORKIT_SESSION_ID (the lead's id)`; no `export`, no hand-minted id (SubagentStart issues `<lead>:<agent id>` only to verifiers and reviewers, never to an implementer, so the worker's commits carry the lead's id) | `workit git branch <branch> --base <base>`, `workit git commit -m <msg> -- <paths in SCOPE>`: the implementer runs without Claude Code's worktree isolation, which refused every `workit git` form |
 | OpenCode, Pi, Codex | `Session: your host already sets WORKIT_SESSION_ID in your shell`; export nothing (the host derives the id and an export cannot replace it) | `workit git branch <branch> --base <base>`, `workit git commit -m <msg> -- <paths in SCOPE>` |
 | Cursor, CI, a plain terminal | `export WORKIT_SESSION_ID=<lead>-w-<slice>` (`+try<n>` for a race attempt): declared, not checked | the same `workit git` forms |
 
-`MODE: resume` is `git switch <branch>` on every host (the branch exists; the
-lead removed the dead worker's worktree after its exit, so the switch
-succeeds), then continue from its head. A race attempt (`--attempt <n>`)
-follows its host's row with the branch `<branch>-try<n>`.
+Once `workit fanout worktree create <slice>` made the worktree, the brief's
+WORKTREE line names it and RULES 1 and 3 run against it on every host:
+`workit --cwd <worktree> git commit …`, `workit --cwd <worktree> check <name>`,
+one verb per call. The worktree is already on the branch (MODE new or resume),
+so no branch command comes first. Without one, `MODE: resume` is
+`git switch <branch>` (the branch exists), then continue from its head. A race
+attempt (`--attempt <n>`) follows its host's row with the branch
+`<branch>-try<n>`.
 
 ## Worker rules (`workit fanout brief` appends them as RULES)
 
-1. First command: create the branch (`MODE: new`; the worktree may start on a
-   name that breaks branch policy) or `git switch` to it (`MODE: resume`),
-   as the table above says for your host.
+1. Work only in WORKTREE, already on the branch, one verb per call against it
+   (`workit --cwd <worktree> …`); Workit's hooks deny an implementer's change
+   outside it. With no worktree made yet: create the branch (`MODE: new`) or
+   `git switch` to it (`MODE: resume`), as the table above says.
 2. Decide ambiguities yourself and record them:
    `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`.
    Stop only for an irreversible action, a security-sensitive one, or a side
    effect outside the worktree.
-3. Commit as the table says (`workit git commit -m "<msg>" -- <paths in SCOPE>`,
-   or plain git with the trailers on Claude Code); push only if the brief says
-   so.
+3. Commit with `workit --cwd <worktree> git commit -m "<msg>" -- <paths in SCOPE>`;
+   push only if the brief says so.
 4. Never record a verdict on your own work.

package/skills/workit-fanout/references/orchestration.md

@@ -35,8 +35,8 @@ parent is verified, appears there by itself.
 
 A slice is retried when it is STUCK, its worker exits without meeting
 ACCEPTANCE, or its verdict fails. Stop the worker and observe that it exited.
-Release its worktree: `workit fanout worktree release <slice>` (native
-worktrees: record `git -C <wt> status --short` first). Then spawn one fresh
+Release its worktree: `workit fanout worktree release <slice>` (it records
+`git status` first), and create it again for the retry. Then spawn one fresh
 worker with `workit fanout brief <slice> --mode resume`: same branch, and the
 brief points at its head and its ledger rows (last report, verdicts,
 rulings). If the retry fails too, escalate instead of a third worker:
@@ -69,9 +69,9 @@ list. The fixer applies that list once, then one focused recheck follows.
 When a hard slice has an uncertain approach and a cheap VERIFY, run 2-3
 attempts at once instead of retrying in series. `workit fanout brief <slice>
 --attempt <n>` gives each attempt its own branch (`<branch>-try<n>`), session
-and scratch dir. Each attempt needs its own worktree: Claude Code's
-`implementer` isolates natively; on other hosts `fanout worktree create` makes
-only the slice's own worktree, so run the attempts one after another there.
+and scratch dir. Each attempt needs its own worktree, and `fanout worktree
+create` makes only the slice's own one, so run the attempts one after another
+there on every host.
 Verify every attempt, keep the one with the best verdict (accepted first,
 then the fewest changed files, then the earliest), point the slice branch at
 it (`git branch <branch> <winner>`), have the verifier record the verdict on
@@ -109,7 +109,7 @@ Which session id a verdict carries, per host:
   `WORKIT_SESSION_ID=<lead>:verifier-<random hex>`, a fresh suffix per
   verifier. Cursor cannot check it: it is declared, not derived.
 - A worker's commits: on Claude Code the lead's `WORKIT_SESSION_ID` already in
-  its env (SubagentStart issues no implementer id; plain git, no export, so the
+  its env (SubagentStart issues no implementer id; no export, so the
   lead authored those commits: a verifier or reviewer records the verdict, not
   the lead); on OpenCode, Pi and Codex the id the host already
   puts in its shell; on Cursor, CI and a plain terminal the brief's

package/skills/workit-implement/SKILL.md

@@ -47,6 +47,8 @@ description: Build a requested change in small verified steps - follow local pat
    `workit verify-delivery push`).
 
 Independent slices that could run in parallel: fan them out (read the `workit-fanout` skill's SKILL.md and follow it).
+One `implementer` slice: `workit fanout worktree create <slice>` before spawning,
+then `workit fanout brief <slice>`; no host isolation (Workit's hooks confine it).
 
 Stay inline by default (workspace `delegation: inline-first`). Hand work off
 only past the thresholds: an explorer after about 3 tool calls or 10k tokens