@brainervirus/workit-core 0.11.0 → 1.0.0

package/src/core/repo-context.ts

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { vcsConfig, mergedPrStyle } from "./vcs-config";
+import { gitRevisionParts, resolveGitRevision } from "../core";
 
 // Ports of scripts/_shared/common.sh + the four maintained context generators
 // (pr-ready-context.sh, changelog-context.sh, docs-refresh-context.sh,
@@ -10,6 +11,37 @@ import { vcsConfig, mergedPrStyle } from "./vcs-config";
 
 export type ContextResult = { stdout: string; stderr: string; exitCode: number; cwd: string };
 
+// Range/revision values are passed as positional git arguments.  Reject option
+// syntax and control characters before any context generator invokes git; the
+// trailing `--` used for file paths cannot protect an earlier revision arg.
+export const isSafeContextRange = (value: string): boolean =>
+  value.length <= 4096 &&
+  (() => {
+    try {
+      gitRevisionParts(value);
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+
+const isResolvableContextRange = (cwd: string, value: string): boolean => {
+  if (!isSafeContextRange(value)) return false;
+  try {
+    resolveGitRevision(cwd, value);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const invalidRange = (cwd: string): ContextResult => ({
+  stdout: "",
+  stderr: "ERROR: invalid revision range\n",
+  exitCode: 2,
+  cwd,
+});
+
 const runGit = (
   cwd: string,
   args: string[],
@@ -238,6 +270,7 @@ const readTrimmed = (file: string, maxLines: number): string => {
 /** Port of pr-ready-context.sh — PR-ready repository context. */
 export function prReadyContext(root: string, range?: string): ContextResult {
   const cwd = path.resolve(repoRoot(root));
+  if (range !== undefined && !isResolvableContextRange(cwd, range)) return invalidRange(cwd);
   let stdout = "";
   const autoRange = range === undefined;
 
@@ -306,7 +339,7 @@ export function prReadyContext(root: string, range?: string): ContextResult {
   const vc = vcsConfig("resolve", cwd);
   if (vc.ok) {
     stdout += `workspace: ${String(vc.workspace_name ?? "none")}\n`;
-    stdout += `provider: ${String(vc.provider ?? "gitlab")}\n`;
+    stdout += `provider: ${String(vc.provider ?? "unconfigured")}\n`;
   } else {
     // RL-01: never report silent defaults for malformed vcs.json — surface the
     // exact-path diagnostic instead.
@@ -336,7 +369,9 @@ const CHANGELOG_RULES = `- Use an [Unreleased] section.
 /** Port of changelog-context.sh — changelog update context. */
 export function changelogContext(root: string, range?: string): ContextResult {
   const cwd = path.resolve(repoRoot(root));
+  if (range !== undefined && !isResolvableContextRange(cwd, range)) return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
+  if (!isResolvableContextRange(cwd, resolvedRange)) return invalidRange(cwd);
   let stdout = "";
 
   stdout += printSection("Repository");
@@ -370,7 +405,9 @@ export function changelogContext(root: string, range?: string): ContextResult {
 /** Port of docs-refresh-context.sh — documentation refresh context. */
 export function docsRefreshContext(root: string, range?: string): ContextResult {
   const cwd = path.resolve(repoRoot(root));
+  if (range !== undefined && !isResolvableContextRange(cwd, range)) return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(range, cwd);
+  if (!isResolvableContextRange(cwd, resolvedRange)) return invalidRange(cwd);
   let stdout = "";
 
   stdout += printSection("Repository");
@@ -416,7 +453,9 @@ export function releaseNotesContext(root: string, rangeOrTag: string): ContextRe
   if (!rangeOrTag) {
     return { stdout: "", stderr: "ERROR: release tag or range required\n", exitCode: 1, cwd };
   }
+  if (!isResolvableContextRange(cwd, rangeOrTag)) return invalidRange(cwd);
   const resolvedRange = rangeArgOrDefault(rangeOrTag, cwd);
+  if (!isResolvableContextRange(cwd, resolvedRange)) return invalidRange(cwd);
   let stdout = "";
 
   stdout += printSection("Repository");
@@ -443,5 +482,24 @@ export function releaseNotesContext(root: string, rangeOrTag: string): ContextRe
     if (existsSync(path.join(cwd, rel))) stdout += rel + "\n";
   }
 
+  // A deterministic draft is useful to every read-only host surface. It is
+  // derived only from the already-resolved range; publication and file edits
+  // remain separate, writer-guarded actions.
+  stdout += printSection("Release Notes Draft");
+  stdout += `## Release notes (${resolvedRange})\n\n`;
+  const commits = commitLogForRange(cwd, resolvedRange)
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+  stdout += commits.length
+    ? `${commits.map((line) => `- ${line}`).join("\n")}\n`
+    : "- No commits in range.\n";
+  stdout += "\n### Changed files\n\n";
+  const files = changedFilesForRange(cwd, resolvedRange)
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+  stdout += files.length ? `${files.map((line) => `- ${line}`).join("\n")}\n` : "- None.\n";
+
   return { stdout, stderr: "", exitCode: 0, cwd };
 }

package/src/core/setup.ts

@@ -1231,3 +1231,31 @@ export function applyWorkspaceBranchPolicy(opts: {
     config_path: wsPath,
   };
 }
+
+export {
+  applyCutover,
+  applyRollback,
+  classifyHostGeneration,
+  readCutoverReceipt,
+  detectCursorLatest,
+  detectSourceLinkedOpenCode,
+  previewCutover,
+  previewRollback,
+  readGenerationState,
+  type CutoverDecision,
+  type CutoverHost,
+  type CutoverPaths,
+  type CutoverPlan,
+  type CutoverReceipt,
+  type GenerationState,
+  type RollbackPreview,
+} from "./cutover";
+export {
+  applyConversionConfig,
+  previewConversion,
+  redactConversionPreview,
+  type ConversionApplyResult,
+  type ConversionInput,
+  type ConversionMapping,
+  type ConversionPreview,
+} from "./config-conversion";

package/src/core/skill-manifests.ts

@@ -1,37 +1,40 @@
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path from "node:path";
 
-export const CANONICAL_SKILLS = {
-  superpowers: [
-    "brainstorming",
-    "dispatching-parallel-agents",
-    "executing-plans",
-    "finishing-a-development-branch",
-    "receiving-code-review",
-    "requesting-code-review",
-    "subagent-driven-development",
-    "systematic-debugging",
-    "test-driven-development",
-    "using-git-worktrees",
-    "using-superpowers",
-    "verification-before-completion",
-    "writing-plans",
-    "writing-skills",
-  ],
-  workit: [
-    "wk-changelog",
-    "wk-commit",
-    "wk-docs-refresh",
-    "wk-handoff",
-    "wk-implement",
-    "wk-init",
-    "wk-issue-update",
-    "wk-meetings",
-    "wk-pr",
-    "wk-release-notes",
-    "wk-status",
-    "wk-verify",
-  ],
+export const WORKIT_METHOD_SKILLS = [
+  "workit-challenge",
+  "workit-behavioral-tdd",
+  "workit-review",
+  "workit-plan",
+  "workit-implement",
+  "workit-debug",
+  "workit-handoff",
+  "workit-babysit",
+  "workit-blast-radius",
+  "workit-deslop",
+  "workit-diagram",
+  "workit-mockup",
+  "workit-green-run",
+  "workit-steer",
+] as const;
+
+/** wk- slash aliases (one per skill): alias → method skill. An alias routes
+ * through policy to model skills; an alias never calls another alias. */
+export const WORKIT_SKILL_ALIASES = {
+  "wk-challenge": "workit-challenge",
+  "wk-babysit": "workit-babysit",
+  "wk-implement": "workit-implement",
+  "wk-plan": "workit-plan",
+  "wk-debug": "workit-debug",
+  "wk-review": "workit-review",
+  "wk-handoff": "workit-handoff",
+  "wk-tdd": "workit-behavioral-tdd",
+  "wk-blast-radius": "workit-blast-radius",
+  "wk-deslop": "workit-deslop",
+  "wk-diagram": "workit-diagram",
+  "wk-mockup": "workit-mockup",
+  "wk-green-run": "workit-green-run",
+  "wk-steer": "workit-steer",
 } as const;
 
 export const skillManifestNames = (root: string): string[] =>
@@ -54,22 +57,17 @@ export const validateSkillManifests = (
     : `${label} mismatch at ${root} (missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"})`;
 };
 
-export const validateCursorSkills = (pluginDir: string): string | null => {
+export const validateCursorSkills = (
+  pluginDir: string,
+  expected: readonly string[] = WORKIT_METHOD_SKILLS,
+): string | null => {
   const workit = validateSkillManifests(
     path.join(pluginDir, "skills"),
-    CANONICAL_SKILLS.workit,
+    expected,
     "Cursor Workit skills",
   );
   if (workit) return workit;
-  const vendor = path.join(pluginDir, "vendor/superpowers/skills");
-  const superpowers = validateSkillManifests(
-    vendor,
-    CANONICAL_SKILLS.superpowers,
-    "Cursor Superpowers skills",
-  );
-  if (superpowers) return superpowers;
-
-  const pending = [vendor];
+  const pending = [path.join(pluginDir, "skills")];
   while (pending.length > 0) {
     const dir = pending.pop()!;
     for (const entry of readdirSync(dir, { withFileTypes: true })) {

package/src/core/support-matrix.ts

@@ -5,8 +5,13 @@
 // Deno is intentionally not part of the matrix (PT-12): nothing advertises a
 // host that has no executable artifact/test evidence.
 export const SUPPORT_MATRIX = {
-  bun: "1.3.14",
-  node: { minimum: "22", current: "22" },
-  opencode: { minimum: "1.15.0", current: "1.17.7" },
+  bun: "1.4.1",
+  node: { minimum: "24", current: "24.20.0" },
+  opencode: { minimum: "1.15.0", current: "1.18.30" },
+  // Codex is a qualification host, not a runtime dependency: the CLI version
+  // below is the one live qualification evidence covers. The doctor warns when
+  // an installed CLI drifts ahead so a fresh install never silently outruns
+  // the qualification pin.
+  codex: { cli: "0.153.4", desktopPackage: "26.901.20858", bundledCodexCli: "0.153.0-alpha.5" },
   os: ["ubuntu-latest", "macos-latest", "windows-latest"],
 } as const;

package/src/core/sync-runtime.ts

@@ -165,10 +165,15 @@ export async function syncRuntime(options: SyncRuntimeOptions = {}): Promise<Syn
     }
 
     const cursorSrc = path.join(src, "packages/workit-cursor");
-    const cursorEntries = ["mcp-server.js", "cursor-session-start.js"];
+    const cursorEntries = ["mcp-server.js", "cursor-session-start.js", "workit-hook.js"];
     const bun = resolveBun(env, home);
     if (!bun.ok) return bun;
-    const dependencies = ["@brainervirus/workit-core", "@modelcontextprotocol/sdk", "zod"];
+    const dependencies = [
+      "@brainervirus/workit-core",
+      "@brainervirus/workit-mcp",
+      "@modelcontextprotocol/sdk",
+      "zod",
+    ];
     if (
       dependencies.some((dependency) => !existsSync(path.join(src, "node_modules", dependency)))
     ) {
@@ -183,6 +188,13 @@ export async function syncRuntime(options: SyncRuntimeOptions = {}): Promise<Syn
         };
       }
     }
+    const mcpBuild = run(bun.path, [path.join(src, "packages/workit-mcp/scripts/build.ts")], {
+      cwd: src,
+      env: { ...env, PATH: `${path.dirname(bun.path)}${path.delimiter}${env.PATH ?? ""}` },
+    });
+    if (mcpBuild.exitCode !== 0) {
+      return { ok: false, error: `FATAL: shared MCP build failed in ${src}: ${mcpBuild.stderr}` };
+    }
     const build = run(bun.path, [path.join(cursorSrc, "scripts/build.ts")], {
       cwd: src,
       env: { ...env, PATH: `${path.dirname(bun.path)}${path.delimiter}${env.PATH ?? ""}` },
@@ -301,7 +313,7 @@ export async function syncRuntime(options: SyncRuntimeOptions = {}): Promise<Syn
           dependencies?: Record<string, string>;
         };
         data.dependencies = data.dependencies ?? {};
-        data.dependencies["@opencode-ai/plugin"] ??= "1.17.7";
+        data.dependencies["@opencode-ai/plugin"] ??= "1.18.30";
         writeFileSync(pkg, JSON.stringify(data, null, 2) + "\n");
       } catch {
         /* best-effort */

package/src/core/task-context.ts

@@ -0,0 +1,179 @@
+import {
+  POLICY_VERSION,
+  failure,
+  sha256,
+  success,
+  type Candidate,
+  type Decision,
+  type Provenance,
+  type Progress,
+  type Ref,
+  type Result,
+  type TaskView,
+  type Utc,
+} from "./task-contract";
+import { captureCandidate, evaluateEvidence } from "./task-evaluation";
+import type { NativeWorkerObservation } from "./workers";
+
+export type ResumeObservation = {
+  observation: NativeWorkerObservation;
+  authority: Provenance | null;
+};
+export type ResumeObservationInput = ResumeObservation | NativeWorkerObservation;
+
+export type ResumeReconciliation = {
+  candidate: Candidate;
+  staleEvidenceIds: string[];
+  workerUpdates: NativeWorkerObservation[];
+  blockers: Progress["blockers"];
+  reassessmentRequired: boolean;
+};
+
+export function reconcileResume(
+  view: TaskView,
+  observations: ResumeObservationInput[] = [],
+): Result<ResumeReconciliation> {
+  if (observations.length > 0)
+    return failure("permission_denied", "worker observations require native host verification");
+  const candidate = captureCandidate(view.workspace.root, view.task.intent.data.scope, []);
+  if (!candidate.ok) return candidate as Result<never>;
+  const staleEvidenceIds = evaluateEvidence(view.task, candidate.data)
+    .filter((entry) => entry.status === "stale")
+    .map((entry) => entry.evidenceId);
+  const blockers = [...view.task.progress.blockers];
+  if (
+    view.task.workers.some((entry) =>
+      ["running", "cancelling", "unknown"].includes(entry.data.state),
+    )
+  )
+    blockers.push({
+      reason: "worker state requires reconciliation",
+      dependentAction: "resume",
+      refs: [],
+    });
+  return success(null, null, {
+    candidate: candidate.data,
+    staleEvidenceIds,
+    workerUpdates: [],
+    blockers,
+    reassessmentRequired: view.task.policy?.policyVersion !== POLICY_VERSION,
+  });
+}
+
+type CompactReference = { kind: Ref["kind"] } & Partial<
+  Pick<Extract<Ref, { kind: "file" }>, "path">
+> &
+  Partial<Pick<Extract<Ref, { kind: "record" }>, "collection" | "id">>;
+type CompactDecision = {
+  id: string;
+  purpose: Decision["purpose"];
+  status: Decision["response"];
+  digest: string;
+  references: CompactReference[];
+};
+export type CompactTaskContext = {
+  objective: string;
+  status: TaskView["task"]["status"];
+  decisions: CompactDecision[];
+  gaps: string[];
+  nextAction: string | null;
+};
+
+const COMPACT_MAX_BYTES = 4096;
+const COMPACT_MAX_ITEMS = 8;
+const COMPACT_TEXT_BYTES = 128;
+const sensitiveUrl = /\bhttps?:\/\/[^/\s:@]+:[^@\s]+@/gi;
+const sensitiveValue =
+  /(?:token|secret|password|passwd|api[-_ ]?key|private[-_ ]?key|authorization)\s*[:=]\s*(?:bearer\s+)?\S+|\bbearer\s+\S+/gi;
+const privateKey = /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi;
+const compactText = (value: string | null, limit: number): string | null =>
+  value === null
+    ? null
+    : value
+        .replace(privateKey, "<redacted-private-key>")
+        .replace(sensitiveUrl, "<redacted-url>")
+        .replace(sensitiveValue, (match) => {
+          const separator = match.search(/[:=]/u);
+          if (separator >= 0) return `${match.slice(0, separator)}=<redacted>`;
+          const space = match.search(/\s/u);
+          return `${match.slice(0, space)} <redacted>`;
+        })
+        .slice(0, limit);
+const compactBytes = (value: string): number => new TextEncoder().encode(value).byteLength;
+const compactReference = (ref: Ref): CompactReference => {
+  if (ref.kind === "file")
+    return {
+      kind: "file",
+      path: compactText(ref.path, COMPACT_TEXT_BYTES) ?? "",
+    };
+  if (ref.kind === "record")
+    return {
+      kind: "record",
+      collection: ref.collection,
+      id: ref.id,
+    };
+  return { kind: ref.kind };
+};
+
+export function compactTaskContext(view: TaskView): string {
+  const decisions: CompactDecision[] = view.task.decisions
+    .slice()
+    .sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0))
+    .slice(0, COMPACT_MAX_ITEMS)
+    .map((entry) => ({
+      id: entry.id,
+      purpose: entry.data.purpose,
+      status: entry.data.response,
+      digest: entry.data.digest,
+      references: entry.data.binding.contentRefs.slice(0, 1).map(compactReference),
+    }));
+  const gaps = Array.from(
+    new Set([
+      ...view.evidence
+        .filter((entry) => entry.status === "stale")
+        .map((entry) => `stale evidence: ${entry.evidenceId}`),
+      ...view.requirements
+        .filter((entry) => entry.status !== "satisfied")
+        .map((entry) => entry.reason),
+      ...view.task.progress.blockers.map((entry) => entry.reason),
+    ]),
+  )
+    .sort()
+    .slice(0, COMPACT_MAX_ITEMS)
+    .map((gap) => compactText(gap, COMPACT_TEXT_BYTES)!);
+  const context: CompactTaskContext = {
+    objective: compactText(view.task.intent.data.objective, COMPACT_TEXT_BYTES) ?? "",
+    status: view.task.status,
+    decisions,
+    gaps,
+    nextAction: compactText(view.task.progress.nextAction, COMPACT_TEXT_BYTES),
+  };
+  let encoded = JSON.stringify(context);
+  while (
+    compactBytes(encoded) > COMPACT_MAX_BYTES &&
+    (context.decisions.length || context.gaps.length)
+  ) {
+    if (context.gaps.length) context.gaps.pop();
+    else context.decisions.pop();
+    encoded = JSON.stringify(context);
+  }
+  if (compactBytes(encoded) > COMPACT_MAX_BYTES) {
+    context.objective = compactText(context.objective, 64) ?? "";
+    context.nextAction = compactText(context.nextAction, 64);
+    encoded = JSON.stringify(context);
+  }
+  return encoded;
+}
+
+export const exportDigest = (bundle: {
+  schemaVersion: 1;
+  exportedAt: Utc;
+  sourceWorkspaceId: string;
+  task: unknown;
+}): string =>
+  sha256({
+    schemaVersion: bundle.schemaVersion,
+    exportedAt: bundle.exportedAt,
+    sourceWorkspaceId: bundle.sourceWorkspaceId,
+    task: bundle.task,
+  });