@brainervirus/workit-codex 8.35.0 → 8.36.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "8.35.0",
+  "version": "8.36.0",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -14926,7 +14926,11 @@ var releaseTrackSchema = object({
     ["requiredChecks", track.requiredChecks ?? []]
   ]) {
     if (new Set(values).size !== values.length) {
-      context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: "entries must be unique"
+      });
     }
   }
   if (track.versionSource?.kind === "package-json" && (path4.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
@@ -14959,7 +14963,10 @@ var workspaceConfigSchema = object({
     kind,
     union([boolean2(), literal("verified")]).optional()
   ]))).passthrough().optional(),
-  youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
+  youtrack: object({
+    baseUrl: nonBlank.optional(),
+    link_issues: boolean2().optional()
+  }).passthrough().optional(),
   issues: object({
     provider: _enum(["github", "gitlab", "youtrack"]).optional(),
     link: boolean2().optional(),
@@ -15000,9 +15007,16 @@ var workspacesFileSchema = object({
 var workspacesRevision = (contents) => createHash2("sha256").update(contents ?? "<missing>").digest("hex");
 var validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} is not a JSON object`
+    };
   }
-  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  const validated = workspacesFileSchema.safeParse(parsed, {
+    reportInput: true
+  });
   if (!validated.success) {
     const detail = validated.error.issues.map((issue) => {
       const field = String(issue.path[issue.path.length - 1] ?? "");
@@ -15042,7 +15056,12 @@ var readWorkspacesResult = (dir = configDir()) => {
     raw = readFileSync2(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
-      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+      return {
+        status: "missing",
+        path: file,
+        entries: [],
+        revision: workspacesRevision(null)
+      };
     return {
       status: "malformed",
       path: file,
@@ -15062,7 +15081,10 @@ var readWorkspacesResult = (dir = configDir()) => {
       error: `${file} is not valid JSON`
     };
   }
-  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
+  return {
+    ...validateWorkspacesDocument(parsed, file),
+    revision: workspacesRevision(raw)
+  };
 };
 var globToRegExp = (glob) => {
   let out = "";
@@ -15273,7 +15295,10 @@ var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
 };
 var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
-  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+  return matched ? {
+    workspace: matched.selected.name,
+    releaseTracks: matched.selected.releaseTracks
+  } : null;
 };
 var modelSources = (cwd, dir) => {
   const out = [];
@@ -20644,7 +20669,12 @@ function readLedger(cwd, options = {}) {
     });
   return {
     ok: true,
-    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
+    value: {
+      path: file.value,
+      rows,
+      skipped,
+      integrity: options.integrity ? integrity : null
+    }
   };
 }
 var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
@@ -20737,7 +20767,10 @@ var renameAwareBranch = (scopeOf, branch) => {
     return scopeOf(own)({ branch: theirs, at: target.at });
   };
 };
-function authorSessions(cwd, rows, branch, range = { base: null, head: null }, scope = branchScope(cwd, branch)) {
+function authorSessions(cwd, rows, branch, range = {
+  base: null,
+  head: null
+}, scope = branchScope(cwd, branch)) {
   const sessions = new Set;
   for (const row of rows) {
     if (!scope(row) || row.type !== "commit.recorded" && row.type !== "task.opened")
@@ -20848,12 +20881,13 @@ function restackCarries(exactIn, rows, branch, from, to) {
     const cwd = exactIn;
     let known = restackExact.get(row);
     if (known === undefined) {
-      known = typeof row.fromBase === "string" && typeof row.toBase === "string" && sameOwnChange(cwd, {
+      const range = typeof row.fromBase === "string" && typeof row.toBase === "string" ? {
         from: fromHead,
         to: head,
         fromBase: row.fromBase,
         toBase: row.toBase
-      });
+      } : null;
+      known = range !== null && (sameOwnChange(cwd, range) || cleanRebase(cwd, range));
       restackExact.set(row, known);
     }
     return known;
@@ -20888,7 +20922,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     const cacheKey = `${base}\x00${at}`;
     let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      key = {
+        patchId: patchId(cwd, base, at),
+        diffHash: diffHash(cwd, base, at)
+      };
       keyCache.set(cacheKey, key);
     }
     return key;
@@ -20928,7 +20965,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
   };
   const exactCarry = (row) => FAILING.has(String(row.result)) || exactMatch(row) !== null;
   const keyBasis = (row) => {
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    const basis = verdictBasis(row, {
+      head,
+      ...keyFor(row.base ?? fallbackBase)
+    });
     return basis === "carried" && !exactCarry(row) ? "stale" : basis;
   };
   const rebaseNote = (row) => row.head && head && row.head !== head && !FAILING.has(String(row.result)) && keyBasis(row) === "carried" && exactMatch(row) === "rebase" ? { rule: "rebase", since: row.head, files: [] } : null;
@@ -21033,7 +21073,11 @@ function checkVerdicts(cwd, branch, ledgerRows) {
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? {
+    accepted: false,
+    verdict: null,
+    reasons: ["ledger_tampered"]
+  } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
@@ -21051,7 +21095,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     selfVerdict: accepted.accepted ? null : selfEntry?.verdict ?? null,
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
-    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    current: {
+      basis: newestCurrent?.basis ?? "none",
+      verdict: newestCurrent?.verdict ?? null
+    },
     carry: carryEntry?.carry ?? null,
     reverify,
     accepted,

package/dist/{workit-hook-h4ryf1zq.js → workit-hook-7dqgrrwd.js}

@@ -6261,7 +6261,11 @@ var releaseTrackSchema = object({
     ["requiredChecks", track.requiredChecks ?? []]
   ]) {
     if (new Set(values).size !== values.length) {
-      context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: "entries must be unique"
+      });
     }
   }
   if (track.versionSource?.kind === "package-json" && (path2.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
@@ -6294,7 +6298,10 @@ var workspaceConfigSchema = object({
     kind,
     union([boolean2(), literal("verified")]).optional()
   ]))).passthrough().optional(),
-  youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
+  youtrack: object({
+    baseUrl: nonBlank.optional(),
+    link_issues: boolean2().optional()
+  }).passthrough().optional(),
   issues: object({
     provider: _enum(["github", "gitlab", "youtrack"]).optional(),
     link: boolean2().optional(),
@@ -6335,9 +6342,16 @@ var workspacesFileSchema = object({
 var workspacesRevision = (contents) => createHash("sha256").update(contents ?? "<missing>").digest("hex");
 var validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} is not a JSON object`
+    };
   }
-  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  const validated = workspacesFileSchema.safeParse(parsed, {
+    reportInput: true
+  });
   if (!validated.success) {
     const detail = validated.error.issues.map((issue) => {
       const field = String(issue.path[issue.path.length - 1] ?? "");
@@ -6377,7 +6391,12 @@ var readWorkspacesResult = (dir = configDir()) => {
     raw = readFileSync2(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
-      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+      return {
+        status: "missing",
+        path: file,
+        entries: [],
+        revision: workspacesRevision(null)
+      };
     return {
       status: "malformed",
       path: file,
@@ -6397,7 +6416,10 @@ var readWorkspacesResult = (dir = configDir()) => {
       error: `${file} is not valid JSON`
     };
   }
-  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
+  return {
+    ...validateWorkspacesDocument(parsed, file),
+    revision: workspacesRevision(raw)
+  };
 };
 var globToRegExp = (glob) => {
   let out = "";
@@ -6608,7 +6630,10 @@ var matchRuntimeWorkspace = (cwd, dir = configDir()) => {
 };
 var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
-  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+  return matched ? {
+    workspace: matched.selected.name,
+    releaseTracks: matched.selected.releaseTracks
+  } : null;
 };
 var inheritedSetting = (cwd, dir, has) => {
   let matched;
@@ -6621,7 +6646,10 @@ var inheritedSetting = (cwd, dir, has) => {
     return null;
   const { selected, matches } = matched;
   const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+  return {
+    workspace: selected.name,
+    source: [selected, ...enclosing].find(has) ?? null
+  };
 };
 var workspaceTrailers = (cwd, dir) => {
   const found = inheritedSetting(cwd, dir, (entry) => typeof entry.trailers === "boolean");
@@ -13458,7 +13486,12 @@ function readLedger(cwd, options = {}) {
     });
   return {
     ok: true,
-    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
+    value: {
+      path: file.value,
+      rows,
+      skipped,
+      integrity: options.integrity ? integrity : null
+    }
   };
 }
 var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
@@ -13551,7 +13584,10 @@ var renameAwareBranch = (scopeOf, branch) => {
     return scopeOf(own)({ branch: theirs, at: target.at });
   };
 };
-function authorSessions(cwd, rows, branch, range = { base: null, head: null }, scope = branchScope(cwd, branch)) {
+function authorSessions(cwd, rows, branch, range = {
+  base: null,
+  head: null
+}, scope = branchScope(cwd, branch)) {
   const sessions = new Set;
   for (const row of rows) {
     if (!scope(row) || row.type !== "commit.recorded" && row.type !== "task.opened")
@@ -13662,12 +13698,13 @@ function restackCarries(exactIn, rows, branch, from, to) {
     const cwd = exactIn;
     let known = restackExact.get(row);
     if (known === undefined) {
-      known = typeof row.fromBase === "string" && typeof row.toBase === "string" && sameOwnChange(cwd, {
+      const range = typeof row.fromBase === "string" && typeof row.toBase === "string" ? {
         from: fromHead,
         to: head,
         fromBase: row.fromBase,
         toBase: row.toBase
-      });
+      } : null;
+      known = range !== null && (sameOwnChange(cwd, range) || cleanRebase(cwd, range));
       restackExact.set(row, known);
     }
     return known;
@@ -13702,7 +13739,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     const cacheKey = `${base}\x00${at}`;
     let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      key = {
+        patchId: patchId(cwd, base, at),
+        diffHash: diffHash(cwd, base, at)
+      };
       keyCache.set(cacheKey, key);
     }
     return key;
@@ -13742,7 +13782,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
   };
   const exactCarry = (row) => FAILING.has(String(row.result)) || exactMatch(row) !== null;
   const keyBasis = (row) => {
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    const basis = verdictBasis(row, {
+      head,
+      ...keyFor(row.base ?? fallbackBase)
+    });
     return basis === "carried" && !exactCarry(row) ? "stale" : basis;
   };
   const rebaseNote = (row) => row.head && head && row.head !== head && !FAILING.has(String(row.result)) && keyBasis(row) === "carried" && exactMatch(row) === "rebase" ? { rule: "rebase", since: row.head, files: [] } : null;
@@ -13847,7 +13890,11 @@ function checkVerdicts(cwd, branch, ledgerRows) {
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? {
+    accepted: false,
+    verdict: null,
+    reasons: ["ledger_tampered"]
+  } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
@@ -13865,7 +13912,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     selfVerdict: accepted.accepted ? null : selfEntry?.verdict ?? null,
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
-    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    current: {
+      basis: newestCurrent?.basis ?? "none",
+      verdict: newestCurrent?.verdict ?? null
+    },
     carry: carryEntry?.carry ?? null,
     reverify,
     accepted,
@@ -17439,7 +17489,10 @@ function entryCompactContext(store, entry, session, context) {
   const task = entry ? store.readTask(entry.id) : null;
   if (task && !task.ok)
     return null;
-  const freshness = { mode: "signal", current: () => recentSignal(store.root) };
+  const freshness = {
+    mode: "signal",
+    current: () => recentSignal(store.root)
+  };
   const observed = task?.data.evidence.some(isObservedCheck) ?? false;
   const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path18.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
@@ -17505,7 +17558,10 @@ var checkoutAt = (cwd) => {
     if (fs13.existsSync(dotGit)) {
       const admin = fs13.statSync(dotGit).isFile() ? path18.resolve(dir, /^gitdir:\s*(.+)$/mu.exec(fs13.readFileSync(dotGit, "utf8"))?.[1]?.trim() ?? "") : dotGit;
       const head = fs13.readFileSync(path18.join(admin, "HEAD"), "utf8").trim();
-      return { root: dir, branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null };
+      return {
+        root: dir,
+        branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null
+      };
     }
     if (path18.dirname(dir) === dir)
       return null;

package/dist/workit-hook.js

@@ -82,6 +82,6 @@ if (quiet) {
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: quiet } })}
 `);
 } else {
-  const { runCodexHook } = await import("./workit-hook-h4ryf1zq.js");
+  const { runCodexHook } = await import("./workit-hook-7dqgrrwd.js");
   await runCodexHook([payload]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "8.35.0",
+  "version": "8.36.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.35.0",
-    "@brainervirus/workit-mcp": "^8.35.0"
+    "@brainervirus/workit-core": "^8.36.0",
+    "@brainervirus/workit-mcp": "^8.36.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-implement/SKILL.md

@@ -23,7 +23,7 @@ description: Build a requested change in small verified steps - follow local pat
    (`workit check test`, plus `lint` and `typecheck` when the repo has them),
    not after every edit. Heavy work runs under one machine-wide lease: an ad-hoc
    suite is `workit check --heavy -- <cmd>`, never a hand-made flock; a busy
-   lease waits and names its holder (`workit lock status`).
+   lease waits and names its holder (`workit lock status`). A tool warning is a finding: fix it in this PR in the right layer, or record the false positive with evidence; pre-existing ones get their own PR.
 5. Prove the feature on its real surface with the project's `verify-<app>`
    skill; none yet? Write one (read the `workit-verify-app` skill's SKILL.md and follow it). Tests show branch behavior,
    not that the feature works. The report carries what you observed: a UI

package/skills/workit-ship/SKILL.md

@@ -49,7 +49,7 @@ the same check. Fix round and recheck both failed: a decider (read the `workit-f
 5. **CI.** Local gates mirror CI: push and continue; `workit ci wait` once on
    the final head, in the background where the host allows. Red: read `logTail`, classify. Flake or infra: one
    `workit ci rerun --failed --reason flake|infra` per head. Real: reproduce
-   with `workit check`, fix the root cause, batch every fix in one push.
+   with `workit check`, fix the root cause, batch every fix in one push. A tool warning is a finding: fix it in this PR in the right layer, or record the false positive with evidence; pre-existing ones get their own PR.
 6. **Verified.** The lane in `workit pr status` decides: none, no verdict; self, your `--self` verdict; focused or full (or `verification: self|independent`), one non-author verifier per PR after the last push, never per push (read the `workit-review` skill's SKILL.md and follow it), on Claude Code with the `model` and `effort` of `workit models show --role verifier`. A docs-only push (or test-only under a unit verdict) keeps the verdict (`carried`); `reverify: focused` re-checks only the new diff, reusing green CI; one verdict at a stack's top covers its unchanged lower PRs. Land only when
    granted: `workit stack land` or `workit pr merge`; `--unverified --reason` if user-asked.
 7. **Observe it landed:** `workit verify-delivery pr` or `merge`. After a failed