@brainervirus/workit-core 0.6.1 → 0.7.0

package/src/core/git.ts

@@ -2,7 +2,13 @@ import { execFileSync } from "node:child_process";
 
 const run = (cwd: string, args: string[]): { stdout: string; stderr: string; exitCode: number } => {
   try {
-    const stdout = execFileSync("git", args, { cwd, encoding: "utf8" });
+    const stdout = execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      // AR-14: expected negative fixtures (non-repo dirs, unborn HEADs, bogus
+      // shas) must not inherit raw git usage/fatal stderr into the suite output.
+      stdio: ["pipe", "pipe", "pipe"],
+    });
     return { stdout: stdout.trimEnd(), stderr: "", exitCode: 0 };
   } catch (error) {
     const e = error as { stdout?: string; stderr?: string; status?: number };
@@ -16,8 +22,18 @@ const run = (cwd: string, args: string[]): { stdout: string; stderr: string; exi
 
 export const gitContext = (workspaceRoot: string, paths: string[] = []) => {
   const cwd = workspaceRoot;
-  const branch = run(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]).stdout || "unknown";
-  const status_short = run(cwd, ["status", "--porcelain"]).stdout;
+  let failure: { stderr: string; exitCode: number } | undefined;
+
+  const runHere = (args: string[]) => {
+    const result = run(cwd, args);
+    if (!failure && result.exitCode !== 0) {
+      failure = { stderr: result.stderr, exitCode: result.exitCode };
+    }
+    return result.stdout;
+  };
+
+  const branch = runHere(["rev-parse", "--abbrev-ref", "HEAD"]) || "unknown";
+  const status_short = runHere(["status", "--porcelain"]);
 
   const staged: string[] = [];
   const unstaged: string[] = [];
@@ -35,8 +51,8 @@ export const gitContext = (workspaceRoot: string, paths: string[] = []) => {
   }
 
   const pathArgs = paths.length ? ["--", ...paths] : [];
-  const diff_stat = run(cwd, ["diff", "--stat", ...pathArgs]).stdout;
-  const cached_stat = run(cwd, ["diff", "--cached", "--stat", ...pathArgs]).stdout;
+  const diff_stat = runHere(["diff", "--stat", ...pathArgs]);
+  const cached_stat = runHere(["diff", "--cached", "--stat", ...pathArgs]);
 
   const stagedSet = new Set(staged);
   const unstagedSet = new Set(unstaged);
@@ -52,5 +68,6 @@ export const gitContext = (workspaceRoot: string, paths: string[] = []) => {
     diff_stat: [diff_stat, cached_stat].filter(Boolean).join("\n"),
     partial_staged: partial_staged.length > 0,
     partial_staged_files: partial_staged,
+    ...(failure ? { stderr: failure.stderr, exitCode: failure.exitCode } : {}),
   };
 };

package/src/{tools/handoff.ts → core/handoff-tools.ts}

@@ -1,10 +1,7 @@
 import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { tool, type PluginInput } from "@opencode-ai/plugin";
 import { fail, ok, type Result } from "../core";
-import { assertFlowGates } from "../core/flow-state";
-import { resolveWorkflowPaths, buildHandoffContract } from "../core/handoff-context";
-import { WorkflowStateStore } from "../state";
+import { resolveWorkflowPaths, buildHandoffContract } from "./handoff-context";
+import { assetRoot } from "./package-root";
 
 type ApiResponse<T> = { data?: T; error?: unknown };
 type ApiResult<T> = Promise<ApiResponse<T>>;
@@ -31,20 +28,6 @@ export type HandoffClient = {
   };
 };
 
-export const adaptPluginHandoffClient = (client: PluginInput["client"]): HandoffClient => ({
-  session: {
-    create: (input) => client.session.create(input),
-    promptAsync: (input) => client.session.promptAsync(input),
-  },
-  tui: {
-    selectSession: ({ body, query }) =>
-      client.tui.publish({
-        body: { type: "tui.session.select", properties: { sessionID: body.sessionID } } as never,
-        query,
-      }),
-  },
-});
-
 export type HandoffRequest = {
   directory: string;
   title: string;
@@ -59,13 +42,13 @@ type HandoffData = {
   stage?: "create" | "seed" | "select";
 };
 
-const message = (error: unknown) =>
+export const message = (error: unknown) =>
   error instanceof Error
     ? error.message
     : typeof error === "object" && error !== null && "message" in error
       ? String(error.message)
       : String(error);
-const apiError = (response: ApiResponse<unknown> | void) => response?.error;
+export const apiError = (response: ApiResponse<unknown> | void) => response?.error;
 
 export async function handoffSession(
   client: HandoffClient,
@@ -110,8 +93,6 @@ export async function handoffSession(
   }
 }
 
-const output = (value: unknown) => JSON.stringify(value, null, 2);
-
 export type HandoffContextResult =
   | { prompt: string; spec: string; plan: string; sdd: string }
   | { error: string };
@@ -119,10 +100,7 @@ export type HandoffContextResult =
 export const buildHandoffPrompt = (root: string, message: string): HandoffContextResult => {
   const resolved = resolveWorkflowPaths(root, message);
   if ("error" in resolved) return { error: resolved.error };
-  const templatePath = path.resolve(
-    path.dirname(fileURLToPath(import.meta.url)),
-    "../../templates/execution-contract.md",
-  );
+  const templatePath = path.join(assetRoot(), "templates", "execution-contract.md");
   const contract = buildHandoffContract({
     root,
     spec: resolved.spec,
@@ -133,33 +111,3 @@ export const buildHandoffPrompt = (root: string, message: string): HandoffContex
   const sdd = `docs/${path.basename(path.dirname(resolved.plan))}/sdd`;
   return { prompt: contract.prompt, spec: resolved.spec, plan: resolved.plan, sdd };
 };
-
-export function createHandoffTools(client: HandoffClient, state: WorkflowStateStore) {
-  return {
-    workflow_handoff_session: tool({
-      description:
-        "Create, seed, and select a continuation session; --stay in the message skips selection",
-      args: { message: tool.schema.string() },
-      execute: async ({ message: userMessage }, context) => {
-        const built = buildHandoffPrompt(context.directory, userMessage);
-        if ("error" in built) return output(fail(built.error));
-        const active = built;
-        try {
-          const gate = assertFlowGates(context.directory, active.plan);
-          if (!gate.ok) return output(fail(gate.error));
-          state.set(context.sessionID, { spec: active.spec, plan: active.plan, sdd: active.sdd });
-          return output(
-            await handoffSession(client, {
-              directory: context.directory,
-              title: `Continue ${path.basename(path.dirname(active.plan))}`,
-              prompt: active.prompt,
-              stay: /(?:^|\s)--stay(?:\s|$)/.test(userMessage),
-            }),
-          );
-        } catch (error) {
-          return output(fail(message(error)));
-        }
-      },
-    }),
-  };
-}

package/src/core/hygiene.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { changelogUnreleasedStats } from "./changelog";
+import { assetRoot } from "./package-root";
 
 export type HygieneFile =
   | "CHANGELOG.md"
@@ -12,7 +12,7 @@ export type HygieneFile =
   | "CONTRIBUTING.md";
 type State = "missing" | "invalid" | "ok" | "skip";
 
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const repoRoot = assetRoot();
 const templatesDir = () => path.join(repoRoot, "templates", "hygiene");
 
 const packageJson = (root: string): Record<string, unknown> | null => {
@@ -75,25 +75,39 @@ export const hygieneFiles = (
   return { state, openSource };
 };
 
-export const ensureHygieneFiles = (
+// Pure planner: which hygiene files would be created and with what content,
+// without touching the filesystem. Drives the wizard preview (WZ-08) and the
+// apply path; ensureHygieneFiles is just "plan then write".
+export const planHygieneFiles = (
   root: string,
-  opts: { confirmed: boolean; includeOpenSource?: boolean },
-): { ok: true; created: string[] } | { ok: false; error: string } => {
-  if (!opts.confirmed) return { ok: false, error: "confirmed: true required" };
+  opts: { includeOpenSource?: boolean } = {},
+): Array<{ path: string; content: string }> => {
+  const openSource = opts.includeOpenSource ?? isOpenSource(root);
   const files = ["CHANGELOG.md", "README.md", ".editorconfig", ".gitattributes"] as HygieneFile[];
-  if (opts.includeOpenSource) files.push("LICENSE", "CONTRIBUTING.md");
-  const created: string[] = [];
-  const tplDir = templatesDir();
+  if (openSource) files.push("LICENSE", "CONTRIBUTING.md");
+  const planned: Array<{ path: string; content: string }> = [];
   for (const file of files) {
     if (existsSync(path.join(root, file))) continue;
-    const tpl = path.join(tplDir, file);
+    const tpl = path.join(templatesDir(), file);
     if (!existsSync(tpl)) continue; // skip missing template, never fail
     const content = readFileSync(tpl, "utf8")
       .replace(/<PROJECT>/g, path.basename(root))
       .replace(/<YEAR>/g, String(new Date().getFullYear()))
       .replace(/<HOLDER>\s*/g, licenseHolder(root));
-    writeFileSync(path.join(root, file), content, "utf8");
-    created.push(file);
+    planned.push({ path: path.join(root, file), content });
+  }
+  return planned;
+};
+
+export const ensureHygieneFiles = (
+  root: string,
+  opts: { confirmed: boolean; includeOpenSource?: boolean },
+): { ok: true; created: string[] } | { ok: false; error: string } => {
+  if (!opts.confirmed) return { ok: false, error: "confirmed: true required" };
+  const created: string[] = [];
+  for (const planned of planHygieneFiles(root, opts)) {
+    writeFileSync(planned.path, planned.content, "utf8");
+    created.push(path.basename(planned.path));
   }
   return { ok: true, created };
 };

package/src/core/init.ts

@@ -1,16 +1,21 @@
 import fs from "node:fs";
 import path from "node:path";
-import { configDir } from "./config";
+import { configDir, isConfigObject } from "./config";
 import { PLUGIN_ROOT } from "./scripts";
+import { writeFileExclusive } from "./safe-write";
 import { resolveWorkspace, workspacesPath } from "./workspaces";
+import { applyWorkspaceBranchPolicy } from "./setup";
 import { vcsTokenCreateUrls, vcsVerifyToken } from "./vcs-config";
 import { youTrackTokenCreateUrl, youTrackVerifyToken } from "./youtrack";
 
 const TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
 
+// AR-07/CA-37: a parseable non-object (null, scalar, array) is not a config
+// file — never display it as configured (fail-open) nor as unconfigured.
 const readJson = (p: string): Record<string, any> | null => {
   try {
-    return JSON.parse(fs.readFileSync(p, "utf8")) as Record<string, any>;
+    const parsed: unknown = JSON.parse(fs.readFileSync(p, "utf8"));
+    return isConfigObject(parsed) ? (parsed as Record<string, any>) : null;
   } catch {
     return null;
   }
@@ -97,7 +102,18 @@ export function initStatusData(configDirPath = configDir()): Record<string, any>
       youtrackConfig.tokenCreate = youtrackTokenCreate;
     }
   } else if (fs.existsSync(ytJson)) {
-    youtrackConfig = { config_edit_path: resolvePath(ytJson), error: "invalid youtrack.json" };
+    // Distinguish parse failure (legacy message, path in config_edit_path) from a
+    // parseable non-object, which gets the shared shape diagnostic with the path.
+    let parseFailed = false;
+    try {
+      JSON.parse(fs.readFileSync(ytJson, "utf8"));
+    } catch {
+      parseFailed = true;
+    }
+    youtrackConfig = {
+      config_edit_path: resolvePath(ytJson),
+      error: parseFailed ? "invalid youtrack.json" : `${resolvePath(ytJson)} is not a JSON object`,
+    };
   }
 
   items.push({
@@ -239,7 +255,7 @@ export function initStatusData(configDirPath = configDir()): Record<string, any>
 }
 
 /** Port of scripts/init/toolkit-status.sh — filesystem + API health check. */
-export function toolkitStatusData(configDirPath = configDir()): Record<string, any> {
+export async function toolkitStatusData(configDirPath = configDir()): Promise<Record<string, any>> {
   const status = initStatusData(configDirPath);
   const tokenItem = status.items.find((i: Record<string, any>) => i.id === "youtrack_token") ?? {};
   const placeholder = Boolean(tokenItem.placeholder);
@@ -253,13 +269,14 @@ export function toolkitStatusData(configDirPath = configDir()): Record<string, a
 
   const verify = placeholder
     ? { ok: false, error: "token still placeholder YOUR_TOKEN_HERE" }
-    : youTrackVerifyToken();
+    : await youTrackVerifyToken();
   const vcsVerify = vcsPlaceholder
     ? { ok: false, error: "vcs token still placeholder YOUR_TOKEN_HERE" }
-    : vcsVerifyToken();
+    : await vcsVerifyToken();
+  const youTrackHealth = ("data" in verify ? verify.data : verify) as Record<string, any>;
 
   status.youtrack_verify = verify;
-  status.youtrack_ok = placeholder ? false : Boolean((verify as Record<string, any>).ok);
+  status.youtrack_ok = placeholder ? false : Boolean(youTrackHealth.ok);
   status.vcs_verify = vcsVerify;
   status.vcs_ok =
     vcsJsonOk && !vcsPlaceholder ? Boolean((vcsVerify as Record<string, any>).ok) : false;
@@ -361,7 +378,9 @@ export function initApplyData(
     }
     case "youtrack_token_placeholder": {
       const p = path.join(dir, "youtrack.token");
-      fs.writeFileSync(p, TOKEN_PLACEHOLDER + "\n", { encoding: "utf8", mode: 0o600 });
+      // wx + EEXIST-as-preserved (CA-13): an existing real token is never
+      // clobbered — shared with the CLI wizard's ensureToken via safe-write.
+      const preserved = writeFileExclusive(p, TOKEN_PLACEHOLDER + "\n", 0o600) === "preserved";
       const abs = path.resolve(p);
       return {
         action,
@@ -369,6 +388,7 @@ export function initApplyData(
         path: abs,
         token_edit_path: abs,
         placeholder: TOKEN_PLACEHOLDER,
+        preserved,
         instruction: `Open ${abs} in your editor, replace YOUR_TOKEN_HERE with your YouTrack permanent token, save, then run /wk-status`,
       };
     }
@@ -376,7 +396,8 @@ export function initApplyData(
       const jsonOut = path.join(dir, "youtrack.json");
       const tokenOut = path.join(dir, "youtrack.token");
       fs.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + "\n", "utf8");
-      fs.writeFileSync(tokenOut, TOKEN_PLACEHOLDER + "\n", { encoding: "utf8", mode: 0o600 });
+      const preserved =
+        writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER + "\n", 0o600) === "preserved";
       const configPath = path.resolve(jsonOut);
       const tokenPath = path.resolve(tokenOut);
       const prev = process.env.WORKFLOW_YOUTRACK_CONFIG;
@@ -397,6 +418,7 @@ export function initApplyData(
           token_create: tokenCreate,
           config_edit_path: configPath,
           placeholder: TOKEN_PLACEHOLDER,
+          preserved,
           youtrack_config: {
             config_edit_path: configPath,
             baseUrl: base,
@@ -433,8 +455,11 @@ export function initApplyData(
       fs.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(dir), null, 2) + "\n", "utf8");
       const glPath = path.join(dir, "gitlab.token");
       const ghPath = path.join(dir, "github.token");
+      const preservedTokens: string[] = [];
       for (const p of [glPath, ghPath]) {
-        fs.writeFileSync(p, TOKEN_PLACEHOLDER + "\n", { encoding: "utf8", mode: 0o600 });
+        if (writeFileExclusive(p, TOKEN_PLACEHOLDER + "\n", 0o600) === "preserved") {
+          preservedTokens.push(path.resolve(p));
+        }
       }
       const configPath = path.resolve(jsonOut);
       const prev = process.env.WORKFLOW_VCS_CONFIG;
@@ -455,6 +480,7 @@ export function initApplyData(
           token_edit_path: activePath,
           token_create_url: active.createUrl,
           token_create_urls: tokenUrls,
+          preserved_tokens: preservedTokens,
           vcs_config: {
             config_edit_path: configPath,
             provider,
@@ -472,6 +498,12 @@ export function initApplyData(
         else process.env.WORKFLOW_VCS_CONFIG = prev;
       }
     }
+    case "branch_policy": {
+      const root = env.WORKFLOW_WORKSPACE_ROOT?.trim()
+        ? env.WORKFLOW_WORKSPACE_ROOT
+        : process.cwd();
+      return applyWorkspaceBranchPolicy({ workspace_root: root, env });
+    }
     default: {
       return {
         error: `unknown action ${action} (youtrack_scaffold|youtrack_json|youtrack_token_placeholder|vcs_scaffold)`,
@@ -488,7 +520,7 @@ export function initStatus(): Record<string, any> {
   };
 }
 
-export function toolkitStatus(): Record<string, any> {
+export async function toolkitStatus(): Promise<Record<string, any>> {
   return toolkitStatusData();
 }