@brainervirus/workit-core 0.11.0 → 1.0.0

package/src/core/tracker-issues.ts

@@ -0,0 +1,237 @@
+import fs from "node:fs";
+import { spawnSync } from "node:child_process";
+import { vcsConfig } from "./vcs-config";
+import { hostingCliAvailable, parseGhIssue } from "./pr-create";
+
+// Read-only issue fetches for context.read (GitHub + GitLab), mirroring the
+// YouTrack triple shape. CLI-first: the native gh/glab CLI serves the read
+// when installed (per-directory identity comes free); token files are the
+// fallback and fail closed without one. No writes, no new secret files.
+
+export type TrackerIssueBody = {
+  id: string;
+  title: string;
+  body: string | null;
+  state: string | null;
+};
+
+export type TrackerIssueFailure = {
+  error: string;
+  kind: "creds" | "request" | "input";
+};
+
+export type TrackerRequest = (
+  url: string,
+  init: { method: string; headers: Record<string, string> },
+) => Promise<{ status: number; stdout: string; stderr: string }>;
+
+export const trackerRequest: TrackerRequest = async (url, init) => {
+  try {
+    const res = await fetch(url, { method: init.method, headers: init.headers });
+    const text = await res.text();
+    if (!res.ok) return { status: res.status, stdout: "", stderr: text.slice(0, 200) };
+    return { status: 0, stdout: text, stderr: "" };
+  } catch (err) {
+    return { status: 1, stdout: "", stderr: err instanceof Error ? err.message : "network error" };
+  }
+};
+
+/** Full repo path from an origin URL (scp-style, https, or bare); subgroups kept. */
+export const repoPathFromRemote = (remote: string): string | null => {
+  let rest = (remote || "").trim().replace(/\/+$/, "");
+  if (!rest) return null;
+  if (rest.endsWith(".git")) rest = rest.slice(0, -4);
+  const scp = /^[^@/]+@[^:]+:(.+)$/.exec(rest);
+  if (scp) return scp[1].replace(/^\//, "") || null;
+  try {
+    const url = new URL(rest.includes("://") ? rest : `https://${rest}`);
+    return url.pathname.replace(/^\//, "") || null;
+  } catch {
+    return null;
+  }
+};
+
+export type TrackerCli = (
+  args: string[],
+  root: string,
+) => Promise<{ status: number; stdout: string; stderr: string }> | null;
+
+export type TrackerDeps = {
+  creds?: (root: string) => TrackerCreds;
+  request?: TrackerRequest;
+  remote?: (root: string) => string | null;
+  cli?: TrackerCli;
+};
+
+/** Native CLI runner (gh/glab) when installed; null when absent. */
+const defaultCli = (bin: string, available: boolean): TrackerCli | null => {
+  if (!available) return null;
+  return (args, root) => {
+    const out = spawnSync(bin, args, { cwd: root, encoding: "utf8" });
+    return Promise.resolve({
+      status: out.status ?? 1,
+      stdout: out.stdout ?? "",
+      stderr: (out.error as Error | undefined)?.message ?? out.stderr ?? "",
+    });
+  };
+};
+
+const tryCliTriple = async (
+  cli: TrackerCli | null | undefined,
+  args: string[],
+  root: string,
+  id: string,
+  idKeys: string[],
+  bodyKeys: string[],
+): Promise<TrackerIssueBody | null> => {
+  if (!cli) return null;
+  const run = cli(args, root);
+  if (!run) return null;
+  const out = await run;
+  if (out.status !== 0) return null;
+  try {
+    return parseTriple(JSON.parse(out.stdout) as Record<string, unknown>, id, idKeys, bodyKeys);
+  } catch {
+    return null;
+  }
+};
+
+const originRemote = (root: string): string | null => {
+  const out = spawnSync("git", ["remote", "get-url", "origin"], { cwd: root, encoding: "utf8" });
+  return out.status === 0 ? (out.stdout ?? "").trim() || null : null;
+};
+
+type TrackerCreds = { token: string; api: string } | { error: string };
+
+const trackerCreds = (root: string, provider: "github" | "gitlab"): TrackerCreds => {
+  const cfg = vcsConfig("load", root) as Record<string, unknown>;
+  if (!cfg || cfg.provider !== provider || typeof cfg.tokenPath !== "string" || !cfg.tokenPath)
+    return { error: `unconfigured ${provider} provider` };
+  let token = "";
+  try {
+    token = fs.readFileSync(cfg.tokenPath, "utf8").trim();
+  } catch {
+    return { error: `missing ${provider} token` };
+  }
+  if (!token) return { error: `empty ${provider} token file` };
+  if (provider === "gitlab") {
+    const gitlab = cfg.gitlab as Record<string, unknown> | undefined;
+    const apiUrl = String(gitlab?.apiUrl ?? "https://gitlab.com/api/v4").replace(/\/+$/, "");
+    return { token, api: apiUrl };
+  }
+  const github = cfg.github as Record<string, unknown> | undefined;
+  const host = String(github?.host ?? "github.com").toLowerCase();
+  return {
+    token,
+    api: host === "github.com" ? "https://api.github.com" : `https://${host}/api/v3`,
+  };
+};
+
+const parseTriple = (
+  parsed: Record<string, unknown>,
+  id: string,
+  idKeys: string[],
+  bodyKeys: string[],
+): TrackerIssueBody | null => {
+  const title = parsed.title;
+  if (typeof title !== "string") return null;
+  const pick = (keys: string[]): string | null => {
+    for (const key of keys) {
+      const value = parsed[key];
+      if (typeof value === "string") return value;
+      if (typeof value === "number") return String(value);
+    }
+    return null;
+  };
+  const foundId = pick(idKeys) ?? id;
+  const state = typeof parsed.state === "string" ? parsed.state : null;
+  return { id: foundId, title, body: pick(bodyKeys), state };
+};
+
+/** Fetch a GitHub issue triple for context.read: gh CLI first, token fallback (fail-closed). */
+export const fetchGitHubIssueBody = async (
+  ref: string,
+  root: string,
+  deps: TrackerDeps = {},
+): Promise<{ data: TrackerIssueBody } | TrackerIssueFailure> => {
+  const id = parseGhIssue(ref);
+  if (!/^\d+$/.test(id)) return { error: `invalid GitHub issue ref "${ref}"`, kind: "input" };
+  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  if (!repo) return { error: "no origin remote to resolve the repository", kind: "input" };
+  const viaCli = await tryCliTriple(
+    deps.cli ?? defaultCli("gh", hostingCliAvailable("github")),
+    ["issue", "view", id, "--repo", repo, "--json", "number,title,body,state"],
+    root,
+    id,
+    ["number"],
+    ["body"],
+  );
+  if (viaCli) return { data: viaCli };
+  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "github")))(root);
+  if ("error" in credentials) return { ...credentials, kind: "creds" as const };
+  const out = await (deps.request ?? trackerRequest)(
+    `${credentials.api}/repos/${repo}/issues/${id}`,
+    {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${credentials.token}`,
+        Accept: "application/vnd.github+json",
+      },
+    },
+  );
+  if (out.status !== 0)
+    return { error: out.stderr || "GitHub issue fetch failed", kind: "request" };
+  try {
+    const triple = parseTriple(
+      JSON.parse(out.stdout) as Record<string, unknown>,
+      id,
+      ["number"],
+      ["body"],
+    );
+    if (!triple) return { error: "unexpected GitHub issue shape", kind: "request" };
+    return { data: triple };
+  } catch {
+    return { error: "invalid GitHub issue response", kind: "request" };
+  }
+};
+
+/** Fetch a GitLab issue triple for context.read: glab CLI first, token fallback (fail-closed). */
+export const fetchGitLabIssueBody = async (
+  ref: string,
+  root: string,
+  deps: TrackerDeps = {},
+): Promise<{ data: TrackerIssueBody } | TrackerIssueFailure> => {
+  const id = parseGhIssue(ref);
+  if (!/^\d+$/.test(id)) return { error: `invalid GitLab issue ref "${ref}"`, kind: "input" };
+  const repo = repoPathFromRemote((deps.remote ?? originRemote)(root) ?? "");
+  if (!repo) return { error: "no origin remote to resolve the project", kind: "input" };
+  const viaCli = await tryCliTriple(
+    deps.cli ?? defaultCli("glab", hostingCliAvailable("gitlab")),
+    ["issue", "view", id, "-R", repo, "-F", "json"],
+    root,
+    id,
+    ["iid"],
+    ["description"],
+  );
+  if (viaCli) return { data: viaCli };
+  const credentials = (deps.creds ?? ((r) => trackerCreds(r, "gitlab")))(root);
+  if ("error" in credentials) return { ...credentials, kind: "creds" as const };
+  const out = await (deps.request ?? trackerRequest)(
+    `${credentials.api}/projects/${encodeURIComponent(repo)}/issues/${id}`,
+    { method: "GET", headers: { "PRIVATE-TOKEN": credentials.token } },
+  );
+  if (out.status !== 0)
+    return { error: out.stderr || "GitLab issue fetch failed", kind: "request" };
+  try {
+    const triple = parseTriple(
+      JSON.parse(out.stdout) as Record<string, unknown>,
+      id,
+      ["iid"],
+      ["description"],
+    );
+    if (!triple) return { error: "unexpected GitLab issue shape", kind: "request" };
+    return { data: triple };
+  } catch {
+    return { error: "invalid GitLab issue response", kind: "request" };
+  }
+};

package/src/core/uninstall.ts

@@ -11,7 +11,7 @@ import os from "node:os";
 import path from "node:path";
 import { isWorkitPlugin } from "./registration";
 
-export type UninstallHost = "opencode" | "cursor";
+export type UninstallHost = "opencode" | "cursor" | "codex" | "pi";
 
 export type UninstallAction =
   | { kind: "edit-json-remove"; path: string; detail: string }
@@ -56,6 +56,8 @@ type ResolvedUninstall = {
   cursorSettings: string;
   cursorMcp: string;
   cursorPluginDir: string;
+  codexPluginDir: string;
+  piConfig: string;
 };
 
 const resolveUninstallPaths = (options: UninstallPaths = {}): ResolvedUninstall => {
@@ -70,6 +72,8 @@ const resolveUninstallPaths = (options: UninstallPaths = {}): ResolvedUninstall
     cursorMcp: options.cursorMcp ?? path.join(home, ".cursor", "mcp.json"),
     cursorPluginDir:
       options.cursorPluginDir ?? path.join(home, ".cursor", "plugins", "local", "workit"),
+    codexPluginDir: path.join(home, ".codex", "plugins", "workit"),
+    piConfig: path.join(home, ".pi", "config.json"),
   };
 };
 
@@ -192,10 +196,38 @@ type JsonCleaner = (record: Record<string, unknown>) => {
   changed: boolean;
 };
 
+function cleanPiConfig(config: Record<string, unknown>): {
+  next: Record<string, unknown>;
+  changed: boolean;
+} {
+  const next = { ...config };
+  let changed = false;
+  for (const key of ["extensions", "skills"] as const) {
+    const value = next[key];
+    if (!Array.isArray(value)) continue;
+    const kept = value.filter((entry) => !String(entry).includes("workit"));
+    if (kept.length !== value.length) {
+      next[key] = kept;
+      changed = true;
+    }
+  }
+  const pi = isRecord(next.pi) ? { ...(next.pi as Record<string, unknown>) } : null;
+  if (pi && Array.isArray(pi.extensions)) {
+    const kept = pi.extensions.filter((entry) => !String(entry).includes("workit"));
+    if (kept.length !== pi.extensions.length) {
+      pi.extensions = kept;
+      next.pi = pi;
+      changed = true;
+    }
+  }
+  return { next, changed };
+}
+
 const jsonCleanerFor = (target: string, res: ResolvedUninstall): JsonCleaner | null => {
   if (target === res.opencodeConfig) return cleanOpenCodeConfig;
   if (target === res.cursorSettings) return (r) => cleanCursorSettings(r, res.cursorPluginDir);
   if (target === res.cursorMcp) return cleanCursorMcp;
+  if (target === res.piConfig) return cleanPiConfig;
   return null;
 };
 
@@ -262,7 +294,34 @@ export function planUninstall(paths: UninstallPaths = {}): UninstallPlan {
     actions,
   };
 
-  return { hosts: [opencode, cursor] };
+  const codexInstalled = existsSync(res.codexPluginDir);
+  const codex: UninstallHostPlan = {
+    host: "codex",
+    installed: codexInstalled,
+    actions: codexInstalled
+      ? [{ kind: "remove-dir", path: res.codexPluginDir, detail: "remove Codex workit plugin dir" }]
+      : [],
+  };
+
+  const piExisting = readJsonRecord(res.piConfig);
+  const piDirty =
+    piExisting.kind === "malformed" ||
+    (piExisting.kind === "record" && cleanPiConfig(piExisting.value).changed);
+  const pi: UninstallHostPlan = {
+    host: "pi",
+    installed: piDirty,
+    actions: piDirty
+      ? [
+          {
+            kind: "edit-json-remove",
+            path: res.piConfig,
+            detail: "remove workit pi extension/skills entries",
+          },
+        ]
+      : [],
+  };
+
+  return { hosts: [opencode, cursor, codex, pi] };
 }
 
 // CA-14 traversal guard: rm -rf is permitted ONLY on the exact resolved
@@ -344,7 +403,12 @@ export function applyUninstall(plan: UninstallPlan, paths: UninstallPaths = {}):
       if (action.kind === "remove-dir") {
         // Resolve before comparing so ".."/symlink tricks can never widen the rm.
         const resolved = path.resolve(action.path);
-        if (!canonicalRemoveDirAllowed(resolved, res)) {
+        const allowed =
+          canonicalRemoveDirAllowed(resolved, res) ||
+          (resolved === path.resolve(res.codexPluginDir) &&
+            path.basename(resolved) === "workit" &&
+            path.basename(path.dirname(resolved)) === "plugins");
+        if (!allowed) {
           status = "failed";
           detail = `refusing to remove non-canonical plugin directory: ${resolved}`;
         } else if (!existsSync(resolved)) {

package/src/core/vcs-config.ts

@@ -15,7 +15,7 @@ export const vcsConfigPath = (): string =>
 const workspacesPath = (): string => path.join(configDir(), "workspaces.json");
 
 const vcsCwd = (cwd?: string): string =>
-  process.env.WORKFLOW_WORKSPACE_ROOT ?? cwd ?? process.cwd();
+  cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 
 // RL-03b: the origin remote is the ground truth for PR creation. A stale global
 // provider (e.g. gitlab from another repo) must not drive glab on a
@@ -81,9 +81,16 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   // contaminate host-agnostic reads.
   const root = vcsCwd(cwd);
   const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
-  const provider = String(
-    wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? "gitlab",
-  ).toLowerCase();
+  // No silent default: a provider resolves from the workspace, the origin
+  // remote, or the global config — otherwise it is null, explicitly. Branch
+  // policy never needed a provider (preset defaults apply); credential and
+  // PR flows fail closed on null instead of assuming a host.
+  const rawProvider =
+    wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
+  const provider =
+    rawProvider === null || rawProvider === undefined
+      ? null
+      : String(rawProvider).toLowerCase() || null;
   // CA-05: workspace/global explicit target wins; when unset the resolved
   // branch-policy preset supplies the default (gitflow->develop,
   // github-flow->main, trunk-based->master, custom->develop). Shared by load
@@ -140,9 +147,26 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   if (cfgStatus === "missing") {
     return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
   }
+  // Credentials cannot resolve without a provider: fail closed instead of
+  // assuming a host. Branch policy (resolve mode above) never needed one.
+  if (provider === null) {
+    return {
+      ok: false,
+      error: `no vcs provider configured (set vcs.provider in ${cfgPath}, match a workspace entry, or run inside a checkout with a recognized origin remote)`,
+      configPath: cfgPath,
+    };
+  }
 
   const prov = (cfg[provider] ?? {}) as Record<string, any>;
-  const tokenFile = String(prov.tokenFile ?? path.join(configDir(), `${provider}.token`));
+  // Workspace-tight tokens: an explicit workspace vcs.tokenFile wins (per-area
+  // accounts without collisions), else the global provider tokenFile, else the
+  // default <provider>.token path. Same order as the per-workspace
+  // commitPolicy/branchPolicy overrides.
+  const wsTokenFile =
+    typeof wsVcs.tokenFile === "string" && wsVcs.tokenFile.trim() !== "" ? wsVcs.tokenFile : null;
+  const tokenFile = String(
+    wsTokenFile ?? prov.tokenFile ?? path.join(configDir(), `${provider}.token`),
+  );
   const tokenPath = path.resolve(tokenFile);
   let tokenOk = false;
   if (fs.existsSync(tokenPath)) {
@@ -281,24 +305,31 @@ export function vcsTokenCreateUrls(): Record<string, any> {
     : ["repo"];
   const githubClassicUrl = `https://github.com/settings/tokens/new?${new URLSearchParams({ description: name, scopes: classicScopes.join(",") })}`;
 
-  const provider = String(cfg.provider ?? "gitlab").toLowerCase();
+  const rawProvider = cfg.provider;
+  // Display-only URL helper: both providers' URLs are always returned, but
+  // nothing is preselected without an explicit provider — no silent default.
+  const provider =
+    typeof rawProvider === "string" && rawProvider.trim() ? rawProvider.toLowerCase() : null;
   const active =
-    {
-      gitlab: {
-        tokenFile: gitlab.tokenFile ?? path.join(configDir(), "gitlab.token"),
-        createUrl: gitlabUrl,
-        scopes: gitlabScopes,
-        name,
-      },
-      github: {
-        tokenFile:
-          (cfg.github as Record<string, any>)?.tokenFile ?? path.join(configDir(), "github.token"),
-        createUrl: githubFineUrl,
-        createUrlClassic: githubClassicUrl,
-        permissions: githubPerms,
-        name,
-      },
-    }[provider] ?? {};
+    provider === null
+      ? undefined
+      : ({
+          gitlab: {
+            tokenFile: gitlab.tokenFile ?? path.join(configDir(), "gitlab.token"),
+            createUrl: gitlabUrl,
+            scopes: gitlabScopes,
+            name,
+          },
+          github: {
+            tokenFile:
+              (cfg.github as Record<string, any>)?.tokenFile ??
+              path.join(configDir(), "github.token"),
+            createUrl: githubFineUrl,
+            createUrlClassic: githubClassicUrl,
+            permissions: githubPerms,
+            name,
+          },
+        }[provider] ?? {});
 
   return {
     tokenName: name,

package/src/core/workers.ts

@@ -0,0 +1,166 @@
+import {
+  canonicalJson,
+  failure,
+  success,
+  type Caller,
+  type Id,
+  type Owner,
+  type Provenance,
+  type Ref,
+  type Result,
+  type Revision,
+  type TaskRecord,
+  type Worker,
+  type WorkspaceRecord,
+} from "./task-contract";
+import { TaskStore } from "./task-store";
+
+export type WorkerState = Worker["state"];
+export type HostSession = Extract<Ref, { kind: "host" }>;
+
+/** The adapter-owned caller identity used by all writer checks. */
+export type CallerContext = Caller & {
+  workerId?: Id | null;
+  session?: HostSession;
+};
+
+export type NativeWorkerObservation = {
+  taskId: Id;
+  workerId: Id;
+  expectedRevision: Revision;
+  expectedWorkspaceRevision: Revision;
+  state: WorkerState;
+  session: HostSession | null;
+  observation: unknown;
+};
+
+export type NativeWorkerVerification = {
+  observation: unknown;
+  expected: Omit<NativeWorkerObservation, "observation"> & {
+    workspaceId: Id;
+  };
+  caller: Caller;
+};
+
+/**
+ * Host attestation for a worker that has no session yet: `prepare` claims the launch
+ * slot, `not_started` claims that no child was ever created for that same reservation.
+ */
+export type WorkerDispatchStage = "prepare" | "not_started";
+
+export type NativeWorkerDispatchVerification = {
+  observation: unknown;
+  expected: {
+    taskId: Id;
+    workspaceId: Id;
+    workerId: Id;
+    expectedRevision: Revision;
+    expectedWorkspaceRevision: Revision;
+    stage: WorkerDispatchStage;
+  };
+  caller: Caller;
+};
+
+export type NativeWorkerVerifier = {
+  verifyWorker: (input: NativeWorkerVerification) => Result<Provenance>;
+  /** Hosts that can observe their own launch surface also attest dispatch stages. */
+  verifyDispatch?: (input: NativeWorkerDispatchVerification) => Result<Provenance>;
+};
+
+declare const workerDispatch: unique symbol;
+/** Opaque in-process launch reservation. Adapters hold it; it is never serialized. */
+export type WorkerDispatch = { readonly [workerDispatch]: true };
+
+export type WorkerDispatchRequest = {
+  taskId: Id;
+  workerId: Id;
+  expectedRevision: Revision;
+  expectedWorkspaceRevision: Revision;
+  observation: unknown;
+};
+
+export type WorkerDispatchCommit = WorkerDispatchRequest & {
+  dispatch: WorkerDispatch;
+  outcome: "started" | "not_started";
+  session: HostSession | null;
+};
+
+const same = (left: unknown, right: unknown): boolean => {
+  try {
+    return canonicalJson(left) === canonicalJson(right);
+  } catch {
+    return false;
+  }
+};
+
+const callerSession = (caller: CallerContext): HostSession =>
+  caller.session ?? { kind: "host", host: caller.host, handle: caller.actor };
+
+const validPath = (value: unknown): value is string =>
+  typeof value === "string" &&
+  value.length > 0 &&
+  ![...value].some((char) => {
+    const code = char.charCodeAt(0);
+    return code < 32 || code === 127;
+  }) &&
+  !value.split(/[\\/]/).includes("..");
+
+const callerValue = (value: CallerContext): Caller => ({ host: value.host, actor: value.actor });
+const workerIdOf = (value: CallerContext): Id | null => value.workerId ?? null;
+
+export type ProductWriteInput = {
+  task: TaskRecord;
+  workspace: WorkspaceRecord;
+  caller: CallerContext;
+  paths: string[];
+  store?: TaskStore;
+};
+
+/** Check the authoritative workspace owner and the caller's role. File paths
+ *  are host-policy territory: only malformed paths are rejected here, never
+ *  out-of-scope ones. */
+export function assertProductWriteAllowed(input: ProductWriteInput): Result<Owner> {
+  if (!Array.isArray(input.paths) || input.paths.some((path) => !validPath(path)))
+    return failure("invalid_input", "invalid product write path");
+  if (!input.store) return failure("permission_denied", "write authorization requires core state");
+  const task = input.store.readTask(input.task.id);
+  if (!task.ok) return task as Result<never>;
+  const workspace = input.store.readWorkspace();
+  if (!workspace.ok) return workspace as Result<never>;
+  if (!workspace.data) return failure("not_found", "workspace not found");
+  const workspaceRecord = workspace.data;
+  if (task.data.status !== "active")
+    return failure("invalid_transition", "paused or closed tasks cannot own product writes");
+  if (workspaceRecord.id !== task.data.workspaceId || workspaceRecord.root.length === 0)
+    return failure("recovery_required", "task and workspace bindings are invalid");
+  const writer = workspaceRecord.writer;
+  if (!writer) return failure("permission_denied", "checkout has no writer owner");
+  if (writer.state === "uncertain")
+    return failure("recovery_required", "checkout writer requires recovery", {
+      owner: writer.owner,
+    });
+  const caller = callerValue(input.caller);
+  const workerId = workerIdOf(input.caller);
+  const owner = writer.owner;
+  if (
+    owner.taskId !== task.data.id ||
+    owner.workerId !== workerId ||
+    owner.session.host !== caller.host ||
+    owner.session.handle !== caller.actor
+  )
+    return failure("writer_conflict", "checkout is owned by another validated actor", { owner });
+  const worker =
+    workerId === null ? null : task.data.workers.find((entry) => entry.id === workerId);
+  if (workerId !== null && (!worker || worker.data.assignment.role !== "implementer"))
+    return failure("permission_denied", "only implementers can own product writes");
+  if (
+    workerId !== null &&
+    (!worker?.data.session ||
+      worker.data.state === "cancelling" ||
+      worker.data.state === "unknown" ||
+      worker.data.state === "stopped" ||
+      !same(worker.data.session, callerSession(input.caller)))
+  )
+    return failure("recovery_required", "worker session is not an active writer");
+  return success(null, workspaceRecord.revision, owner);
+}

package/src/core/workspaces.ts

@@ -1,6 +1,7 @@
 import { readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { configDir, isConfigObject, type BranchPreset } from "./config";
+import type { CommitFlavorPreset } from "./commit-flavors";
 
 export type VcsProvider = "gitlab" | "github";
 
@@ -18,10 +19,11 @@ export type WorkspaceBranchPolicy = {
 export type WorkspaceConfig = {
   name: string;
   glob: string;
-  vcs?: { provider: VcsProvider; defaultTargetBranch?: string };
+  vcs?: { provider: VcsProvider; defaultTargetBranch?: string; tokenFile?: string };
   youtrack?: { baseUrl?: string; link_issues?: boolean };
   issues?: { provider?: "github"; link_on_pr?: boolean };
   branchPolicy?: WorkspaceBranchPolicy;
+  commitPolicy?: { preset: CommitFlavorPreset; pattern?: string };
 };
 
 export const workspacesPath = (): string => path.join(configDir(), "workspaces.json");

package/src/core/youtrack-tools.ts

@@ -93,6 +93,7 @@ type PostInput = {
   issueId: string;
   markdown: string;
   minutes?: number;
+  dateMs?: number;
   workspace_root?: string;
 };
 
@@ -147,6 +148,7 @@ export async function postUpdate(
       const time = await operations.logTime({
         issueId: input.issueId,
         minutes: input.minutes,
+        ...(input.dateMs === undefined ? {} : { dateMs: input.dateMs }),
         text: "workit update",
         workspace_root: input.workspace_root,
       });