@brainervirus/workit-core 0.10.0 → 1.0.0

package/src/core/init.ts

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { spawnSync } from "node:child_process";
 import { configDir, isConfigObject } from "./config";
 import { PLUGIN_ROOT } from "./scripts";
 import { writeFileExclusive } from "./safe-write";
@@ -27,6 +28,28 @@ const isPlaceholder = (text: string): boolean =>
 const modeOk = (p: string): boolean =>
   process.platform === "win32" || (fs.statSync(p).mode & 0o777) === 0o600;
 
+/** Provider for a fresh vcs.json: explicit env, else origin remote, else null
+ *  (no silent default — a tool for everyone must not assume a provider). */
+export const resolveInitProvider = (cwd?: string): string | null => {
+  const env = process.env.WORKFLOW_VCS_PROVIDER?.trim();
+  if (env) return env.toLowerCase();
+  const root = cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
+  try {
+    const out = spawnSync("git", ["remote", "get-url", "origin"], {
+      cwd: root,
+      encoding: "utf8",
+    });
+    if (out.status === 0) {
+      const url = (out.stdout ?? "").trim();
+      if (/github\.com[:/]/.test(url)) return "github";
+      if (/gitlab\.com[:/]/.test(url)) return "gitlab";
+    }
+  } catch {
+    /* no git: unresolvable, caller omits the field */
+  }
+  return null;
+};
+
 const resolvePath = (p: string): string => {
   try {
     return fs.realpathSync(p);
@@ -161,7 +184,9 @@ export function initStatusData(configDirPath = configDir()): Record<string, any>
   let tokenCreateUrls: Record<string, any> | null = null;
   const vcsParsed = readJson(vcsJson);
   if (vcsParsed) {
-    const provider = String(vcsParsed.provider ?? "gitlab").toLowerCase();
+    const rawProvider = vcsParsed.provider;
+    const provider =
+      typeof rawProvider === "string" && rawProvider.trim() ? rawProvider.toLowerCase() : null;
     const tokenFiles: Record<string, string> = {};
     for (const k of ["gitlab", "github"]) {
       tokenFiles[k] = String(vcsParsed[k]?.tokenFile ?? path.join(configDirPath, `${k}.token`));
@@ -261,18 +286,29 @@ export async function toolkitStatusData(configDirPath = configDir()): Promise<Re
   const placeholder = Boolean(tokenItem.placeholder);
 
   const vcsCfg = (status.vcs_config ?? {}) as Record<string, any>;
-  const provider = String(vcsCfg.provider ?? "gitlab").toLowerCase();
-  const vcsTokenId = provider === "gitlab" ? "gitlab_token" : "github_token";
-  const vcsTokenItem = status.items.find((i: Record<string, any>) => i.id === vcsTokenId) ?? {};
-  const vcsPlaceholder = vcsTokenItem.placeholder ?? true;
+  const provider =
+    typeof vcsCfg.provider === "string" && vcsCfg.provider.trim()
+      ? vcsCfg.provider.toLowerCase()
+      : null;
+  const vcsTokenId =
+    provider === "gitlab" ? "gitlab_token" : provider === "github" ? "github_token" : null;
+  const vcsTokenItem =
+    (vcsTokenId ? status.items.find((i: Record<string, any>) => i.id === vcsTokenId) : null) ?? {};
+  const vcsPlaceholder = vcsTokenId ? (vcsTokenItem.placeholder ?? true) : true;
   const vcsJsonOk = Boolean(status.items.find((i: Record<string, any>) => i.id === "vcs_json")?.ok);
 
   const verify = placeholder
     ? { ok: false, error: "token still placeholder YOUR_TOKEN_HERE" }
     : await youTrackVerifyToken();
-  const vcsVerify = vcsPlaceholder
-    ? { ok: false, error: "vcs token still placeholder YOUR_TOKEN_HERE" }
-    : await vcsVerifyToken();
+  const vcsVerify =
+    provider === null
+      ? {
+          ok: false,
+          error: "vcs provider unconfigured — set provider to gitlab or github in vcs.json",
+        }
+      : vcsPlaceholder
+        ? { ok: false, error: "vcs token still placeholder YOUR_TOKEN_HERE" }
+        : await vcsVerifyToken();
   const youTrackHealth = ("data" in verify ? verify.data : verify) as Record<string, any>;
 
   status.youtrack_verify = verify;
@@ -340,27 +376,33 @@ const youtrackJsonContent = (dir: string): Record<string, any> => ({
   },
 });
 
-const vcsJsonContent = (dir: string): Record<string, any> => ({
-  provider: process.env.WORKFLOW_VCS_PROVIDER ?? "gitlab",
-  defaultTargetBranch: process.env.WORKFLOW_VCS_TARGET_BRANCH ?? "develop",
-  gitlab: {
-    host: process.env.WORKFLOW_GITLAB_HOST ?? "gitlab.com",
-    apiUrl: process.env.WORKFLOW_GITLAB_API_URL ?? "https://gitlab.com/api/v4",
-    tokenFile: path.join(dir, "gitlab.token"),
-  },
-  github: {
-    host: process.env.WORKFLOW_GITHUB_HOST ?? "github.com",
-    tokenFile: path.join(dir, "github.token"),
-  },
-  pr: { squashOnMerge: true, removeSourceBranch: true, pushBranch: true, confirmSkip: true },
-  tokenDefaults: {
-    name: "workit",
-    description: "OpenCode workit — /wk-pr and glab/gh",
-    gitlabScopes: ["api"],
-    githubPermissions: { pull_requests: "write", contents: "write", metadata: "read" },
-    githubClassicScopes: ["repo"],
-  },
-});
+const vcsJsonContent = (dir: string, cwd?: string): Record<string, any> => {
+  // Explicit provider at init: env wins, else the checkout's origin remote
+  // (same RL-03b rule as vcs-config). Unresolvable means the field is
+  // omitted — never a silent assumption downstream.
+  const provider = resolveInitProvider(cwd);
+  return {
+    ...(provider ? { provider } : {}),
+    defaultTargetBranch: process.env.WORKFLOW_VCS_TARGET_BRANCH ?? "develop",
+    gitlab: {
+      host: process.env.WORKFLOW_GITLAB_HOST ?? "gitlab.com",
+      apiUrl: process.env.WORKFLOW_GITLAB_API_URL ?? "https://gitlab.com/api/v4",
+      tokenFile: path.join(dir, "gitlab.token"),
+    },
+    github: {
+      host: process.env.WORKFLOW_GITHUB_HOST ?? "github.com",
+      tokenFile: path.join(dir, "github.token"),
+    },
+    pr: { squashOnMerge: true, removeSourceBranch: true, pushBranch: true, confirmSkip: true },
+    tokenDefaults: {
+      name: "workit",
+      description: "OpenCode workit — /wk-pr and glab/gh",
+      gitlabScopes: ["api"],
+      githubPermissions: { pull_requests: "write", contents: "write", metadata: "read" },
+      githubClassicScopes: ["repo"],
+    },
+  };
+};
 
 /** Port of scripts/init/apply.sh — confirmed scaffold actions. */
 export function initApplyData(
@@ -466,10 +508,16 @@ export function initApplyData(
       process.env.WORKFLOW_VCS_CONFIG = configPath;
       try {
         const cfg = readJson(configPath) ?? {};
-        const provider = String(cfg.provider ?? "gitlab");
+        const rawProvider = cfg.provider;
+        const provider = typeof rawProvider === "string" && rawProvider.trim() ? rawProvider : null;
         const tokenUrls = vcsTokenCreateUrls();
         const active = tokenUrls.active ?? {};
-        const activePath = provider === "gitlab" ? path.resolve(glPath) : path.resolve(ghPath);
+        const activePath =
+          provider === "gitlab"
+            ? path.resolve(glPath)
+            : provider === "github"
+              ? path.resolve(ghPath)
+              : null;
         return {
           action,
           ok: true,
@@ -491,7 +539,10 @@ export function initApplyData(
             switchHint: 'Change "provider" to "github" when you migrate — token files are separate',
             skill: "/wk-pr",
           },
-          instruction: `Open the create-token URL for ${provider}, click Create, paste into ${activePath}, then /wk-status.`,
+          instruction:
+            provider === null
+              ? `No provider resolved — set provider to gitlab or github in ${configPath}, then /wk-status.`
+              : `Open the create-token URL for ${provider}, click Create, paste into ${activePath}, then /wk-status.`,
         };
       } finally {
         if (prev === undefined) delete process.env.WORKFLOW_VCS_CONFIG;

package/src/core/methods.ts

@@ -0,0 +1,125 @@
+import type { Assurance, Capability, Dimension, Policy } from "./task-contract";
+
+export type MethodId =
+  | "workit-challenge"
+  | "workit-behavioral-tdd"
+  | "workit-review"
+  | "workit-plan"
+  | "workit-implement"
+  | "workit-debug"
+  | "workit-handoff"
+  | "workit-deslop";
+
+type MethodDefinition = {
+  dimensions?: readonly Dimension[];
+  ruleIds?: readonly string[];
+};
+
+export const METHODS: Readonly<Record<MethodId, MethodDefinition>> = {
+  "workit-challenge": { dimensions: ["challenge", "decisions"] },
+  "workit-behavioral-tdd": { dimensions: ["testing"] },
+  "workit-review": { dimensions: ["review"] },
+  "workit-plan": { dimensions: ["artifacts", "continuity"] },
+  "workit-implement": { dimensions: ["delegation"] },
+  "workit-debug": { ruleIds: ["root-cause-investigation"] },
+  "workit-handoff": { ruleIds: ["durable-handoff"] },
+  "workit-deslop": { ruleIds: ["pre-pr-cleanup"] },
+};
+
+export type SelectedMethod = {
+  id: MethodId;
+  reason: string;
+  assurance: Assurance;
+};
+
+const methodMatches = (
+  id: MethodId,
+  definition: MethodDefinition,
+  requirement: Policy["requirements"][number],
+): boolean =>
+  (definition.dimensions?.includes(requirement.dimension) === true &&
+    !(id === "workit-review" && requirement.ruleId === "self-review")) ||
+  definition.ruleIds?.includes(requirement.ruleId) === true;
+
+const assuranceFor = (
+  id: MethodId,
+  definition: MethodDefinition,
+  capabilities: Capability[],
+): { assurance: Assurance; reasons: string[] } => {
+  const keys = new Set<string>([
+    id,
+    ...(definition.dimensions ?? []),
+    ...(definition.ruleIds ?? []),
+  ]);
+  const matches = capabilities.filter(
+    (capability) => keys.has(capability.name) || keys.has(capability.surface),
+  );
+  if (id === "workit-review" && matches.length === 0)
+    return { assurance: "unavailable", reasons: ["independent review capability is unavailable"] };
+  if (matches.some((capability) => capability.assurance === "unavailable"))
+    return {
+      assurance: "unavailable",
+      reasons: matches
+        .filter((capability) => capability.assurance === "unavailable")
+        .map((capability) => capability.reason),
+    };
+  if (matches.some((capability) => capability.assurance === "enforced"))
+    return { assurance: "enforced", reasons: matches.map((capability) => capability.reason) };
+  return { assurance: "agent_guided", reasons: matches.map((capability) => capability.reason) };
+};
+
+export function selectMethods(policy: Policy, capabilities: Capability[]): SelectedMethod[] {
+  return (Object.entries(METHODS) as [MethodId, MethodDefinition][]).flatMap(([id, definition]) => {
+    const requirements = policy.requirements.filter((requirement) =>
+      methodMatches(id, definition, requirement),
+    );
+    if (requirements.length === 0) return [];
+    const capability = assuranceFor(id, definition, capabilities);
+    const reasons = [
+      ...new Set(requirements.map((requirement) => requirement.reason)),
+      ...capability.reasons,
+    ];
+    if (capability.assurance === "unavailable")
+      reasons.unshift("required capability is unavailable");
+    return [{ id, reason: reasons.join("; "), assurance: capability.assurance }];
+  });
+}
+
+export const invariantBootstrap = (): string =>
+  `
+Workit keeps one accountable lead and one shared task state. Inspect current task
+state before acting. An empty task.list means no session yet, not permission to
+skip Workit; for user-requested product, debug, or behavior work with no active
+or paused task, run task.start then policy.assess before other product mutations.
+Omitted expectedRevision, expectedWorkspaceRevision, and writer workerId default
+to the current records; explicit values are still concurrency-checked, so never
+copy revisions between calls. Happy path: task.list, task.start {intent} with no
+revisions, policy.assess {assessment: {facts, signals, consequences,
+verification}} where facts are inferred or observed with file refs,
+writer.acquire {taskId} before product writes, evidence.record {evidence} where
+check and review kinds auto-bind the current tree and need no digests. Record
+verification evidence last: later evidence or commits can reopen fixed findings
+for re-verification, so verify, resolve, then close with nothing in between.
+decision.record {binding with taskId/workspaceId from inspect plus presented and
+approvedContent} only through a native approval question, task.close {outcome,
+summary, decisionIds}. A completed native subagent run stops its bound worker
+by itself; if a worker strands in cancelling with its run verifiably over,
+repeat worker.cancel {reason} to confirm the stop. Check and review evidence
+without a bound candidate goes stale; findings close only as fixed with passing
+verification, dismissed with supporting evidence, or deferred under an approved
+limitation. Use only the
+shared operations for task, policy, evidence, finding, decision, worker, writer,
+and state changes. Authority is bounded by the requested scope, current
+revision, caller/session provenance, and observed capabilities. Never claim host
+enforcement or evidence that the host cannot provide. Shell-executed writes are
+unattested agent-guided work even when a writer is held. Preserve unresolved
+requirements, gaps, and uncertain workers. Skill routing: slash aliases /wk-*
+always load on demand. Model-invoked: new instructions, interruptions, or
+forgotten items mid-task → load workit-steer before responding; about to open
+a PR or fresh from implementing → load workit-deslop; CI red → load
+workit-green-run; small-looking change before close or merge → load
+workit-blast-radius; ambiguous, consequential, or disputed proposal before
+recommending → load workit-challenge; spec or plan needs a flow diagram →
+load workit-diagram, a UI sketch → load workit-mockup. Load the skill; never
+act from memory of it.
+`.trim();