@brainervirus/workit-core 1.0.11 → 1.1.0

package/src/core/route-intent.ts

@@ -1,7 +1,7 @@
 import { TaskStore } from "./task-store";
 
 export type ShellRouteIntent = {
-  route: "git.branch_setup" | "hosting.pull_request";
+  route: "git.branch_setup" | "hosting.pull_request" | "hosting.merge";
   guidance: string;
 };
 
@@ -10,6 +10,8 @@ const GUIDANCE: Record<ShellRouteIntent["route"], string> = {
     "use the Workit git.branch_setup action (workit_external_action in hosts, or `workit action git.branch_setup --payload '{}' --confirm --json` in the CLI)",
   "hosting.pull_request":
     "use the Workit hosting.pull_request action (workit_external_action in hosts, or `workit action hosting.pull_request --payload '{...}' --confirm --json` in the CLI), then drive the created PR through workit-babysit",
+  "hosting.merge":
+    "use the Workit hosting.merge action (workit_external_action in hosts, or `workit action hosting.merge --payload '{...}' --confirm --json` in the CLI)",
 };
 
 const unbalancedQuotes = (segment: string): boolean => {
@@ -48,6 +50,10 @@ export function shellRouteIntent(command: string): ShellRouteIntent | null {
       return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
     if (head === "glab" && second === "mr" && third === "create")
       return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
+    if (head === "gh" && second === "pr" && third === "merge")
+      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
+    if (head === "glab" && second === "mr" && third === "merge")
+      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
   }
   return null;
 }

package/src/core/runtime-identity.ts

@@ -0,0 +1,33 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+/** sha256 of the exact bytes, lowercase hex. */
+export const sha256Hex = (bytes: string | Uint8Array): string =>
+  createHash("sha256").update(bytes).digest("hex");
+
+/** sha256 of a bundle file's bytes, or null when it cannot be read. */
+export const bundleHashOfFile = (file: string): string | null => {
+  try {
+    return sha256Hex(readFileSync(file));
+  } catch {
+    return null;
+  }
+};
+
+// Segments of package-manager ephemeral caches (pnpm dlx, npx, pacquet).
+// Installs resolving through these break when the cache is cleared; one
+// table here replaces the per-callsite substring lists.
+const EPHEMERAL_CACHE_SEGMENTS = [
+  "/caches/pnpm/dlx/",
+  "/.cache/pnpm/dlx/",
+  "/_npx/",
+  "/.pacquet/",
+  "/library/caches/pnpm/",
+];
+
+/** True when the entry resolves through a package-manager ephemeral cache. */
+export const isEphemeralCachePath = (entry: string): boolean => {
+  if (!entry) return false;
+  const normalized = entry.replaceAll("\\", "/").toLowerCase();
+  return EPHEMERAL_CACHE_SEGMENTS.some((segment) => normalized.includes(segment));
+};

package/src/core/task-contract.ts

@@ -144,9 +144,129 @@ export const refSchema = z.discriminatedUnion("kind", [
     .strict(),
   z.object({ kind: z.literal("host"), host: hostSchema, handle: nonEmpty }).strict(),
   z.object({ kind: z.literal("external"), url: text.url() }).strict(),
+  // Standing auto-approval receipt: authorizes without a live question while
+  // the referenced workspace rule covers the operation class. Verified live
+  // at reserve time against current config; dropped on export/import (a rule
+  // from another machine must never authorize here). Scalar-only shape keeps
+  // advertised operation schemas within provider depth limits.
+  z
+    .object({
+      kind: z.literal("standing"),
+      workspace: nonEmpty,
+      class: nonEmpty,
+      configDigest: nullableDigest,
+    })
+    .strict(),
 ]);
 export type Ref = z.infer<typeof refSchema>;
 
+/** Maps one reference during record traversal. Returning null marks the
+ * reference unportable: arrays drop it, nullable fields null it, and
+ * non-nullable positions propagate the drop to their owner. */
+export type RefMap = (ref: Ref) => Ref | null;
+
+type RewriteOutcome = { drop: boolean; value?: unknown };
+
+const rewriteUnknown = (value: unknown, map: RefMap): RewriteOutcome => {
+  if (Array.isArray(value)) {
+    const out: unknown[] = [];
+    for (const item of value) {
+      const rewritten = rewriteUnknown(item, map);
+      if (!rewritten.drop) out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (typeof value === "object" && value !== null) {
+    if (refSchema.safeParse(value).success) {
+      const mapped = map(value as Ref);
+      return mapped === null ? { drop: true } : { drop: false, value: mapped };
+    }
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(value)) {
+      const rewritten = rewriteUnknown(item, map);
+      out[key] = rewritten.drop ? null : rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+};
+
+const rewriteNode = (value: unknown, schema: z.ZodType, map: RefMap): RewriteOutcome => {
+  // Note: this zod version's classic accessors return core types, hence the
+  // casts below. Runtime behavior is identical; only the annotations differ.
+  if (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    refSchema.safeParse(value).success
+  ) {
+    const mapped = map(value as Ref);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  let node: z.ZodType = schema;
+  while (
+    node instanceof z.ZodNullable ||
+    node instanceof z.ZodOptional ||
+    node instanceof z.ZodDefault
+  ) {
+    node = node.unwrap() as z.ZodType;
+  }
+  if (node === refSchema) {
+    if (!refSchema.safeParse(value).success) return { drop: false, value };
+    const mapped = map(value as Ref);
+    return mapped === null ? { drop: true } : { drop: false, value: mapped };
+  }
+  if (node instanceof z.ZodArray) {
+    if (!Array.isArray(value)) return { drop: false, value };
+    const out: unknown[] = [];
+    for (const item of value) {
+      const rewritten = rewriteNode(item, node.element as z.ZodType, map);
+      if (!rewritten.drop) out.push(rewritten.value);
+    }
+    return { drop: false, value: out };
+  }
+  if (node instanceof z.ZodObject) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      return { drop: false, value };
+    const shape = node.shape as Record<string, z.ZodType>;
+    const record = value as Record<string, unknown>;
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(record)) {
+      if (!(key in shape)) {
+        const scrubbed = rewriteUnknown(item, map);
+        out[key] = scrubbed.drop ? null : scrubbed.value;
+        continue;
+      }
+      const child = shape[key];
+      const rewritten = rewriteNode(item, child, map);
+      if (rewritten.drop) {
+        if (child instanceof z.ZodOptional || child instanceof z.ZodDefault) continue;
+        if (child instanceof z.ZodNullable) {
+          out[key] = null;
+          continue;
+        }
+        return { drop: true };
+      }
+      out[key] = rewritten.value;
+    }
+    return { drop: false, value: out };
+  }
+  return { drop: false, value };
+};
+
+/**
+ * Schema-driven reference rewrite over an already-validated record subtree.
+ * Every `Ref` anywhere in the value is mapped; unportable references are
+ * dropped from arrays, nulled in nullable fields, and propagated upward
+ * anywhere else — so a new ref-bearing field can never silently slip
+ * through export or import. Unknown (schema-absent) keys are scrubbed the
+ * same way. Returns null only when the root itself is an unportable ref.
+ */
+export const rewriteRecordRefs = (value: unknown, schema: z.ZodType, map: RefMap): unknown => {
+  const rewritten = rewriteNode(value, schema, map);
+  return rewritten.drop ? null : rewritten.value;
+};
+
 export const provenanceSchema = z
   .object({
     kind: z.enum(["host_observed", "agent_reported", "imported"]),
@@ -456,6 +576,7 @@ export const decisionSchema = z
         displayed: text.optional(),
         contentRefs: z.array(refSchema),
         statedChoice: z.object({ ref: text, text: text }).strict().optional(),
+        standing: z.object({ workspace: nonEmpty, class: nonEmpty }).strict().optional(),
       })
       .strict(),
     digest,