@brainervirus/workit-codex 8.25.0 → 8.26.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "8.25.0",
+  "version": "8.26.1",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -14864,6 +14864,7 @@ var workspaceConfigSchema = object({
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
   fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -14890,7 +14891,10 @@ var workspaceConfigSchema = object({
     });
   }
 });
-var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+var workspacesFileSchema = object({
+  workspaces: array(workspaceConfigSchema).optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional()
+}).passthrough().superRefine((file, context) => {
   const names = new Set;
   for (const [index, workspace] of (file.workspaces ?? []).entries()) {
     if (names.has(workspace.name)) {
@@ -15180,6 +15184,34 @@ var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
+var modelSources = (cwd, dir) => {
+  const out = [];
+  try {
+    const matched = matchRuntimeWorkspace(cwd, dir);
+    if (matched) {
+      const enclosing = matched.matches.filter((entry) => entry !== matched.selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+      for (const entry of [matched.selected, ...enclosing])
+        out.push({
+          name: entry.name,
+          global: false,
+          models: entry.models,
+          tierModels: entry.fanout?.tierModels
+        });
+    }
+  } catch {}
+  try {
+    const document = JSON.parse(readFileSync2(path4.join(dir ?? configDir(), "workspaces.json"), "utf8"));
+    if (document && typeof document === "object" && !Array.isArray(document))
+      out.push({
+        name: "global",
+        global: true,
+        models: document.models,
+        tierModels: undefined
+      });
+  } catch {}
+  return out;
+};
+var hostFamily = (host) => host.replace(/_(?:cli|desktop)$/u, "");
 var TIER_KEYS = new Set(["mundane", "standard", "hard"]);
 var TIER_HOSTS = new Set([
   "claude_code",
@@ -28343,6 +28375,92 @@ var codexCapabilities = (host, availability = {}) => capabilitiesFor(codexDescri
 if (false)
   ;
 
+// packages/workit-core/src/core/role-models.ts
+var MODEL_ROLES = [
+  "decider",
+  "implementer",
+  "verifier",
+  "reviewer",
+  "explore",
+  "babysit"
+];
+var MODEL_TIERS = ["mundane", "standard", "hard"];
+var HOST_KEYS = new Set([
+  "claude_code",
+  "opencode",
+  "codex",
+  "codex_cli",
+  "codex_desktop",
+  "cursor",
+  "pi",
+  "default"
+]);
+var BUILT_IN_CLAUDE_CODE = {
+  decider: { model: "fable", effort: "high" },
+  "implementer.hard": { model: "opus" },
+  "implementer.standard": { model: "sonnet" },
+  "implementer.mundane": { model: "haiku" },
+  verifier: { model: "sonnet" },
+  reviewer: { model: "opus" },
+  explore: { model: "haiku" },
+  babysit: { model: "haiku" }
+};
+var isObject7 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var name = (value) => typeof value === "string" && value.trim() ? value.trim() : null;
+var leaf = (value) => {
+  const text = name(value);
+  if (text)
+    return { model: text, effort: null };
+  if (!isObject7(value))
+    return null;
+  const model = name(value.model);
+  return model ? { model, effort: name(value.effort) } : null;
+};
+var isFlat = (value) => typeof value === "string" || isObject7(value) && Object.hasOwn(value, "model");
+var forHost = (value, host) => {
+  if (isFlat(value))
+    return leaf(value);
+  if (!isObject7(value))
+    return null;
+  const family = host ? hostFamily(host) : null;
+  for (const key of [family, host, "default"])
+    if (key && Object.hasOwn(value, key)) {
+      const found = leaf(value[key]);
+      if (found)
+        return found;
+    }
+  return null;
+};
+var rolesOf = (models) => isObject7(models) && isObject7(models.roles) ? models.roles : null;
+var resolveRoleModel = (cwd, selector, host, dir) => {
+  const { role, tier } = selector;
+  for (const source of modelSources(cwd, dir)) {
+    const where = source.global ? "the global default" : `workspace ${source.name}`;
+    const roles = rolesOf(source.models);
+    const configured = roles && Object.hasOwn(roles, role) ? roles[role] : undefined;
+    const fromRoles = role === "implementer" ? tier && isObject7(configured) && Object.hasOwn(configured, tier) ? forHost(configured[tier], host) : null : forHost(configured, host);
+    if (fromRoles)
+      return { ...fromRoles, source: `models.roles in ${where}` };
+    if (role === "implementer" && tier && isObject7(source.tierModels)) {
+      const fromTiers = Object.hasOwn(source.tierModels, tier) ? forHost(source.tierModels[tier], host) : null;
+      if (fromTiers)
+        return { model: fromTiers.model, effort: null, source: `fanout.tierModels in ${where}` };
+    }
+  }
+  if (host && hostFamily(host) === "claude_code") {
+    const builtIn = BUILT_IN_CLAUDE_CODE[tier ? `${role}.${tier}` : role];
+    if (builtIn)
+      return { model: builtIn.model, effort: builtIn.effort ?? null, source: "built-in" };
+  }
+  return null;
+};
+var uniformImplementerModel = (cwd, host, dir) => {
+  const tiers = MODEL_TIERS.map((tier) => resolveRoleModel(cwd, { role: "implementer", tier }, host, dir));
+  const [first] = tiers;
+  return first && tiers.every((t) => t?.model === first.model && t.effort === first.effort) ? first : null;
+};
+var ROLE_SELECTORS = MODEL_ROLES.flatMap((role) => role === "implementer" ? MODEL_TIERS.map((tier) => ({ role, tier })) : [{ role }]);
+
 // packages/workit-codex/scripts/agents.ts
 import {
   existsSync as existsSync10,
@@ -28356,13 +28474,26 @@ import {
 } from "node:fs";
 import os5 from "node:os";
 import path25 from "node:path";
+var CODEX_AGENT_ROLES = ["verifier", "reviewer", "implementer"];
 var CODEX_AGENT_MARKER = "# Generated by Workit";
+var codexAgentName = (role) => `workit-${role}`;
+var codexAgentFile = (role) => `${codexAgentName(role)}.toml`;
+var tomlString = (value) => JSON.stringify(value);
 var codexHomeOfInstall = (pluginRoot) => {
   const parts = path25.resolve(pluginRoot).split(path25.sep);
   const cache = parts.length - 4;
   return cache >= 2 && parts[cache] === "cache" && parts[cache - 1] === "plugins" ? parts.slice(0, cache - 1).join(path25.sep) || path25.sep : null;
 };
 var codexHomeFor = (pluginRoot, env) => codexHomeOfInstall(pluginRoot) ?? (env.CODEX_HOME || path25.join(env.HOME || os5.homedir(), ".codex"));
+var withRoleModel = (content, file, models) => {
+  const role = CODEX_AGENT_ROLES.find((candidate) => codexAgentFile(candidate) === file);
+  const chosen = role ? models[role] : undefined;
+  if (!chosen)
+    return content;
+  return content.replace(/^(description = .*)$/m, (line) => `${line}
+model = ${tomlString(chosen.model)}${chosen.effort ? `
+model_reasoning_effort = ${tomlString(chosen.effort)}` : ""}`);
+};
 var MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
 var agentMarkerVersion = (text) => MARKER_VERSION.exec(text)?.[1] ?? null;
 var stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content;
@@ -28389,7 +28520,7 @@ var lstatOrNull = (file) => {
     return null;
   }
 };
-var installCodexAgents = (pluginRoot, codexHome) => {
+var installCodexAgents = (pluginRoot, codexHome, models = {}) => {
   const source = path25.join(pluginRoot, "agents");
   if (!existsSync10(source))
     return [];
@@ -28397,7 +28528,7 @@ var installCodexAgents = (pluginRoot, codexHome) => {
   const target = path25.join(codexHome, "agents");
   const results = [];
   for (const file of readdirSync5(source).filter((name) => name.endsWith(".toml")).toSorted()) {
-    const content = stampCodexAgent(readFileSync8(path25.join(source, file), "utf8"), version);
+    const content = withRoleModel(stampCodexAgent(readFileSync8(path25.join(source, file), "utf8"), version), file, models);
     const dest = path25.join(target, file);
     const stat = lstatOrNull(dest);
     if (stat?.isSymbolicLink()) {
@@ -28497,12 +28628,24 @@ var codexContextProvider = (host = detectCodexSurface(process.env), root) => ({
   }
 });
 var pluginRoot = () => path26.resolve(path26.dirname(fileURLToPath3(import.meta.url)), "..");
-var syncCodexAgents = (root) => {
+var codexRoleModels = (cwd) => {
+  const out = {};
+  for (const role of ["verifier", "reviewer"]) {
+    const found = resolveRoleModel(cwd, { role }, "codex");
+    if (found)
+      out[role] = { model: found.model, effort: found.effort };
+  }
+  const implementer = uniformImplementerModel(cwd, "codex");
+  if (implementer)
+    out.implementer = { model: implementer.model, effort: implementer.effort };
+  return out;
+};
+var syncCodexAgents = (root, cwd) => {
   const codexHome = codexHomeOfInstall(root);
   if (!codexHome)
     return;
   try {
-    installCodexAgents(root, codexHome);
+    installCodexAgents(root, codexHome, codexRoleModels(cwd ?? resolveCodexWorkspaceRoot(root, process.env) ?? process.cwd()));
   } catch {}
 };
 if (__require.main == __require.module) {
@@ -28523,6 +28666,7 @@ if (__require.main == __require.module) {
 export {
   codexContextProvider,
   codexQualification,
+  codexRoleModels,
   resolveCodexWorkspaceRoot,
   syncCodexAgents
 };

package/dist/{workit-hook-7a6v1719.js → workit-hook-sza2zvq6.js}

@@ -8472,6 +8472,7 @@ var workspaceConfigSchema = object({
   trailers: boolean2().optional(),
   liveSessionGuard: boolean2().optional(),
   fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -8498,7 +8499,10 @@ var workspaceConfigSchema = object({
     });
   }
 });
-var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).optional() }).passthrough().superRefine((file, context) => {
+var workspacesFileSchema = object({
+  workspaces: array(workspaceConfigSchema).optional(),
+  models: object({ roles: unknown().optional() }).passthrough().optional()
+}).passthrough().superRefine((file, context) => {
   const names = new Set;
   for (const [index, workspace] of (file.workspaces ?? []).entries()) {
     if (names.has(workspace.name)) {
@@ -19743,7 +19747,6 @@ var ALLOWED = new Set(WORKIT_ALLOWED_VERBS);
 var isBypass = (word) => WORKIT_BYPASS_FLAGS.some((flag) => word === flag || word.startsWith(`${flag}=`));
 var isWorkitWord = (word) => /^(?:.*[\\/])?workit(?:-cli)?$/u.test(word);
 var bypassReason = (flag) => `Workit: \`${flag}\` overrides a Workit gate, so the user decides this call (no allow rule covers it).`;
-var EXPANSION_REASON = "Workit: an expansion before `--` could become a bypass flag, so the user decides this call (no allow rule covers it).";
 var workitBypassFlag = (command, dialect = "posix") => {
   for (const segment of segmentsOf(command, dialect)) {
     if (segment.unanalyzable) {
@@ -19761,9 +19764,6 @@ var workitBypassFlag = (command, dialect = "posix") => {
     const flag = (end < 0 ? words : words.slice(0, end)).find(isBypass);
     if (flag)
       return bypassReason(flag.split("=")[0] ?? flag);
-    const limit = start + 1 + (end < 0 ? words.length : end);
-    if (segment.expands?.some((index) => index > start && index < limit))
-      return EXPANSION_REASON;
   }
   return null;
 };

package/dist/workit-hook.js

@@ -49,6 +49,6 @@ if (quiet)
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 else {
-  const { runCodexHook } = await import("./workit-hook-7a6v1719.js");
+  const { runCodexHook } = await import("./workit-hook-sza2zvq6.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.25.0",
+  "version": "8.26.1",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.25.0",
-    "@brainervirus/workit-mcp": "^8.25.0"
+    "@brainervirus/workit-core": "^8.26.1",
+    "@brainervirus/workit-mcp": "^8.26.1"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-fanout/SKILL.md

@@ -25,8 +25,8 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
    Never hand-edit it; change the plan or the standing orders and render again.
 4. **Spawn in a rolling window**, in the background, each in its own worktree:
    keep 4-6 in flight and refill from `spawnable` in `workit fanout status` as
-   each one finishes. Model: the brief's `model:` line, else TIER
-   (`references/orchestration.md`). Claude Code: the `implementer` agent, never
+   each one finishes. Model: the brief's `model:` and `effort:` lines (`workit models show`),
+   else TIER (`references/orchestration.md`). Claude Code: the `implementer` agent, never
    with `isolation: "worktree"`; Workit's hooks confine it to its WORKTREE.
 5. **Judge liveness by side effects only:** `workit fanout status` (head age,
    PR, CI, verdict, landed; STUCK past the TIMEBOX). Stop a stuck worker and
@@ -40,12 +40,12 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
    chain resumes. A fix round and recheck that both fail: a decider, not a
    third round; product choices go to the user (`references/orchestration.md`).
 7. **Verify by the workspace `verification` setting** (`workit grant show`).
-   A report is a pointer, never evidence. `proportional` (default): each slice's lane (`workit pr status`) decides; none needs no verdict, self the author's `--self`, focused (cheap model: Claude Code `model: sonnet`) and full a verifier after the last push; one verdict at a stack's top covers its unchanged lower PRs, and a stale one with `reverify: focused` re-checks only the new diff, reusing green CI. `self`: a verifier that wrote none
+   A report is a pointer, never evidence. `proportional` (default): each slice's lane (`workit pr status`) decides; none needs no verdict, self the author's `--self`, focused and full a verifier (Claude Code: the `model` and `effort` of `workit models show --role verifier`) after the last push; one verdict at a stack's top covers its unchanged lower PRs, and a stale one with `reverify: focused` re-checks only the new diff, reusing green CI. `self`: a verifier that wrote none
    of the slices, or you if you wrote none. `independent` or high risk: a
    separate verifier session, never yours (doctrine: the ledger only refuses
    authors). One verifier may take a batch of slices, one verdict per branch
    (`workit ledger verdict <result> --branch <b> --how "<evidence>"`), in a
-   session never chosen by the author. A review panel on separate models only at high risk.
+   session never chosen by the author. Spawn it with the brief's `verifier:` model (`workit models show --role verifier`). A review panel on separate models only at high risk.
 8. **Fan in** with `workit fanout check`: out-of-scope files (any file outside
    it stops the fan-in) and `git merge-tree` conflicts with trunk and between
    siblings. Fix what it names until it exits 0; a merged slice reads as

package/skills/workit-fanout/references/orchestration.md

@@ -5,22 +5,31 @@ and fans in. Workit records and checks; the host's own subagents run the work.
 
 ## TIER to model
 
-TIER is a field of each slice and of its brief. When the workspace sets
-`fanout.tierModels`, the brief has a `model:` line under TIER and `workit
-fanout status` names the model next to each spawnable slice: use that model.
-Without one, map TIER where the host lets you pick a model per spawn:
-
-| TIER | Claude Code (`model` on the Agent call) | Hosts without a per-spawn model |
-| --- | --- | --- |
-| scouting (read-only search, not a slice) | `haiku` | host default |
-| mundane | `sonnet` | host default |
-| standard | omit it (inherits yours) | host default |
-| hard | omit it (inherits yours); consider a race | host default |
-
-OpenCode takes a subagent's model from its agent config: pick a configured
-agent whose model fits the TIER, else the default. Codex, Cursor and Pi run
-every worker on the host's model, so TIER only sizes the timebox and decides
-whether to race.
+TIER is a field of each slice and of its brief. Role models come from the
+workspace (`models.roles`; `fanout.tierModels` still feeds the implementer
+tiers) and, on Claude Code, built-in defaults: the brief has a `model:` line
+(with `effort:` when set) under TIER and a `verifier:` line; `workit fanout
+status` names the model next to each spawnable slice; `workit models show
+[--role r] [--host h] --json` lists every role (decider, implementer tiers,
+verifier, reviewer, explore, babysit). Pass exactly that `model` (and `effort`
+where the host's spawn call takes one) on the spawn call: a subagent that
+passes none inherits your model. Scouting and PR babysitting use the `explore`
+and `babysit` roles. A role with no model (other hosts without config) runs
+on the host's model, and TIER only sizes the timebox and decides whether to
+race. Claude Code's built-in defaults, when nothing is configured:
+
+| Role or TIER | `model` on the Agent call |
+| --- | --- |
+| decider | `fable`, effort `high` |
+| hard | `opus` |
+| standard | `sonnet` |
+| mundane | `haiku` |
+| verifier | `sonnet` |
+| reviewer | `opus` |
+| explore, babysit | `haiku` |
+
+OpenCode takes a subagent's model from its agent config: pick a
+configured agent whose model fits the TIER, else the default.
 
 ## Rolling window
 
@@ -53,7 +62,7 @@ reversibility (the option cheapest to undo wins a tie), and the exact change
 list. The fixer applies that list once, then one focused recheck follows.
 
 - Hard call (shared contract, security, migration): two deciders on different
-  models (Claude Code: a different `model` on the Agent call; OpenCode: a
+  models (Claude Code: the `decider` role model, the other a different `model` on the Agent call; OpenCode: a
   child session on another configured agent; Codex, Cursor and Pi: one
   decider, since the host picks no model). If they disagree, you take the
   more reversible option.

package/skills/workit-implement/SKILL.md

@@ -40,7 +40,7 @@ description: Build a requested change in small verified steps - follow local pat
    status`). Lane none: no verdict. Lane self: after `workit check test` passes,
    record `workit ledger verdict tests-verified --self --how "<what you ran>"`;
    it reads self-reviewed, never verified, and is enough. Focused, full, high
-   risk or `verification: self|independent` merges: one fresh verifier per PR after the last push, its own host-derived session (Claude Code: the `verifier` agent, `model: sonnet` when focused; Codex:
+   risk or `verification: self|independent` merges: one fresh verifier per PR after the last push, its own host-derived session (Claude Code: the `verifier` agent with the `model` (and `effort`) of `workit models show --role verifier`; Codex:
    the `verifier` agent; OpenCode: a child session; Pi: a supervised worker),
    never a hand-minted id. Before saying done, reconcile
    every named deliverable against the target checkout and observe it (for a push:

package/skills/workit-review/SKILL.md

@@ -9,7 +9,8 @@ Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
 review to a fresh agent with its own host-derived session: Claude Code and
 Codex, the `reviewer` or `verifier` agent (`--session` and `--token` from SubagentStart);
-OpenCode, a child session; Pi, a supervised worker. Never hand-mint one such
+OpenCode, a child session; Pi, a supervised worker. On Claude Code pass the
+`model` and `effort` of `workit models show --role <verifier|reviewer>`. Never hand-mint one such
 as `<lead>-v1`: it is refused as `forged_session`.
 An author's `--self` verdict reads self-reviewed and never counts as
 independent; `type-check-only` never proves a behavior change.

package/skills/workit-ship/SKILL.md

@@ -51,7 +51,7 @@ the same check. Fix round and recheck both failed: a decider (read the `workit-f
    allows; no sleep loop. Red: read `logTail`, classify. Flake or infra: one
    `workit ci rerun --failed --reason flake|infra` per head. Real: reproduce
    with `workit check`, fix the root cause, batch every fix in one push.
-6. **Verified.** The lane in `workit pr status` decides: none, no verdict; self, your `--self` verdict; focused or full (or `verification: self|independent`), one non-author verifier per PR after the last push, never per push (read the `workit-review` skill's SKILL.md and follow it), on Claude Code `model: sonnet` when focused. A docs-only push (or test-only under a unit verdict) keeps the verdict (`carried`); `reverify: focused` re-checks only the new diff, reusing green CI; one verdict at a stack's top covers its unchanged lower PRs. Land only when
+6. **Verified.** The lane in `workit pr status` decides: none, no verdict; self, your `--self` verdict; focused or full (or `verification: self|independent`), one non-author verifier per PR after the last push, never per push (read the `workit-review` skill's SKILL.md and follow it), on Claude Code with the `model` and `effort` of `workit models show --role verifier`. A docs-only push (or test-only under a unit verdict) keeps the verdict (`carried`); `reverify: focused` re-checks only the new diff, reusing green CI; one verdict at a stack's top covers its unchanged lower PRs. Land only when
    granted: `workit stack land` or `workit pr merge`; `--unverified --reason` if user-asked.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`. After a failed
    verdict or a check red 3+ times, at any endpoint: offer `/wk-retro` in one