@brainervirus/workit-core 2.4.0 → 2.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/scripts/analyze-release-scope.ts

@@ -6,6 +6,7 @@
 // them; merge-backs and the release's own manifest sync never do.
 import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
+import BUNDLED_DEPS_JSON from "./bundled-deps.json" with { type: "json" };
 
 export const RELEASE_PACKAGES = [
   "workit-core",
@@ -15,8 +16,90 @@ export const RELEASE_PACKAGES = [
   "workit-cursor",
   "workit-codex",
   "workit-pi",
+  "workit-claude-code",
 ] as const;
 
+type ReleasePackage = (typeof RELEASE_PACKAGES)[number];
+
+/**
+ * Sources a package's published dist/ inlines from OUTSIDE its own directory.
+ * Every adapter build is a no-external `bun build`, so whatever it imports
+ * from another workspace package is copied into its bundle: a runtime
+ * dependency on that package does not reach the shipped code. A change in
+ * these sources must therefore republish the bundling package too. Verified
+ * against the build entries' metafiles by
+ * test/workit-core/bundled-sources.test.ts.
+ */
+const CORE = "packages/workit-core/"; // sources, skills, templates and package.json
+// Cursor and Codex inline the MCP transport and its declared dependencies.
+const MCP = ["packages/workit-mcp/src/", "packages/workit-mcp/package.json"];
+// The bundled CLI inlines its sources, package.json (`workit --version`) and
+// its third-party dependencies.
+const CLI = ["packages/workit-cli/src/", "packages/workit-cli/package.json"];
+export const BUNDLED_SOURCES: Partial<Record<ReleasePackage, readonly string[]>> = {
+  "workit-mcp": [CORE],
+  "workit-cli": [CORE],
+  "workit-opencode": [CORE],
+  "workit-cursor": [CORE, ...MCP],
+  "workit-codex": [CORE, ...MCP],
+  "workit-pi": [CORE],
+  "workit-claude-code": [CORE, ...CLI],
+};
+
+/**
+ * Third-party packages each dist/ inlines, as bun.lock `packages` keys
+ * (`zod`, or `@opencode-ai/plugin/zod` for a nested copy). A lockfile change
+ * republishes a package only when one of these resolves to a different
+ * version, so dev-tooling bumps never release. Kept in sync with the bundle
+ * metafiles by test/workit-core/bundled-sources.test.ts.
+ */
+export const BUNDLED_DEPS = BUNDLED_DEPS_JSON as Partial<Record<ReleasePackage, string[]>>;
+
+const LOCKFILE = "bun.lock";
+
+/** `packages` key → resolved `name@version` from a bun.lock text (JSONC). */
+export const lockResolutions = (text: string): Map<string, string> => {
+  // bun.lock is JSON with trailing commas.
+  const parsed = JSON.parse(text.replace(/,(\s*[}\]])/g, "$1")) as {
+    packages?: Record<string, unknown>;
+  };
+  const resolved = new Map<string, string>();
+  for (const [key, entry] of Object.entries(parsed.packages ?? {}))
+    if (Array.isArray(entry) && typeof entry[0] === "string") resolved.set(key, entry[0]);
+  return resolved;
+};
+
+const lockAt = (root: string, rev: string): Map<string, string> | null => {
+  try {
+    return lockResolutions(
+      execFileSync("git", ["show", `${rev}:${LOCKFILE}`], {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 64 * 1024 * 1024,
+      }),
+    );
+  } catch {
+    return null;
+  }
+};
+
+/** Packages whose inlined third-party resolutions differ between two revisions. */
+export const lockChangedPackages = (root: string, from: string, to: string): ReleasePackage[] => {
+  const before = lockAt(root, from);
+  const after = lockAt(root, to);
+  if (before === null && after === null) return [];
+  return RELEASE_PACKAGES.filter((pkg) =>
+    (BUNDLED_DEPS[pkg] ?? []).some((key) => before?.get(key) !== after?.get(key)),
+  );
+};
+
+/** Every repository path whose change alters `pkg`'s published payload. */
+export const payloadPaths = (pkg: ReleasePackage): string[] => [
+  `packages/${pkg}/`,
+  ...(BUNDLED_SOURCES[pkg] ?? []),
+];
+
 /** The release pipeline's own version-sync commit: never a release trigger. */
 const RELEASE_SYNC = /^chore\(release\): sync manifests\b/;
 
@@ -56,11 +139,15 @@ const subjectLevel = (commit: string): Level | null => {
 // combined diff drops files identical to either parent — e.g. hotfix-branch
 // back-merges), and -z returns raw NUL-delimited paths so spaces/non-ASCII
 // are never C-quoted. NUL is fine in captured output, never in argv.
-const commitsSince = (root: string, from: string): { message: string; files: string[] }[] => {
+const commitsSince = (
+  root: string,
+  from: string,
+): { hash: string; message: string; files: string[] }[] => {
   const hashes = g(root, ["log", "--reverse", "--format=%H", `${from}..HEAD`])
     .split("\n")
     .filter(Boolean);
   return hashes.map((h) => ({
+    hash: h,
     message: g(root, ["show", "-s", "--format=%B", h]),
     files: g(root, ["diff-tree", "--no-commit-id", "--name-only", "-r", "-m", "--root", "-z", h])
       .split("\0")
@@ -80,20 +167,24 @@ export function analyzeReleaseScope(root = process.cwd()): {
   const levels: Level[] = [];
   const pkgs = new Set<string>();
   let payloadOnly = false;
-  for (const { message, files } of commits) {
+  for (const { hash, message, files } of commits) {
     const subject = (message.split("\n")[0] ?? "").trim();
     if (RELEASE_SYNC.test(subject)) continue;
     const touched = files.filter((f) =>
-      RELEASE_PACKAGES.some((p) => f.startsWith(`packages/${p}/`)),
+      RELEASE_PACKAGES.some((p) => payloadPaths(p).some((prefix) => f.startsWith(prefix))),
     );
-    if (touched.length === 0) continue;
+    // A lockfile edit counts only for packages whose inlined deps moved.
+    const relocked = files.includes(LOCKFILE) ? lockChangedPackages(root, `${hash}^`, hash) : [];
+    if (touched.length === 0 && relocked.length === 0) continue;
     const lvl = subjectLevel(message);
     if (lvl) levels.push(lvl);
     else if (!subject.startsWith("Merge ")) payloadOnly = true;
-    for (const f of touched) {
-      const pkg = RELEASE_PACKAGES.find((p) => f.startsWith(`packages/${p}/`));
-      if (pkg) pkgs.add(pkg);
-    }
+    for (const pkg of RELEASE_PACKAGES)
+      if (
+        relocked.includes(pkg) ||
+        touched.some((f) => payloadPaths(pkg).some((prefix) => f.startsWith(prefix)))
+      )
+        pkgs.add(pkg);
   }
   if (levels.length === 0) return { level: payloadOnly ? "patch" : null, productPkgs: [...pkgs] };
   const level = levels.reduce<Level>(

package/scripts/bundled-deps.json

@@ -0,0 +1,133 @@
+{
+  "workit-mcp": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-cli": [
+    "@alcalzone/ansi-tokenize",
+    "@inkjs/ui",
+    "@openclaw/fs-safe",
+    "ansi-escapes",
+    "ansi-regex",
+    "ansi-styles",
+    "auto-bind",
+    "chalk",
+    "cli-boxes",
+    "cli-cursor",
+    "cli-truncate",
+    "code-excerpt",
+    "convert-to-spaces",
+    "deepmerge",
+    "environment",
+    "es-toolkit",
+    "escape-string-regexp",
+    "figures",
+    "get-east-asian-width",
+    "indent-string",
+    "ink",
+    "is-fullwidth-code-point",
+    "is-in-ci",
+    "is-unicode-supported",
+    "patch-console",
+    "react",
+    "react-devtools-core",
+    "react-reconciler",
+    "restore-cursor",
+    "restore-cursor/onetime",
+    "restore-cursor/onetime/mimic-fn",
+    "scheduler",
+    "signal-exit",
+    "slice-ansi",
+    "stack-utils",
+    "string-width",
+    "strip-ansi",
+    "terminal-size",
+    "widest-line",
+    "wrap-ansi",
+    "ws",
+    "yoga-layout",
+    "zod"
+  ],
+  "workit-opencode": [
+    "@openclaw/fs-safe",
+    "@opencode-ai/plugin",
+    "@opencode-ai/plugin/zod",
+    "@opencode/plugin",
+    "zod"
+  ],
+  "workit-cursor": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-codex": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-pi": ["@openclaw/fs-safe", "zod"],
+  "workit-claude-code": [
+    "@alcalzone/ansi-tokenize",
+    "@inkjs/ui",
+    "@openclaw/fs-safe",
+    "ansi-escapes",
+    "ansi-regex",
+    "ansi-styles",
+    "auto-bind",
+    "chalk",
+    "cli-boxes",
+    "cli-cursor",
+    "cli-truncate",
+    "code-excerpt",
+    "convert-to-spaces",
+    "deepmerge",
+    "environment",
+    "es-toolkit",
+    "escape-string-regexp",
+    "figures",
+    "get-east-asian-width",
+    "indent-string",
+    "ink",
+    "is-fullwidth-code-point",
+    "is-in-ci",
+    "is-unicode-supported",
+    "patch-console",
+    "react",
+    "react-devtools-core",
+    "react-reconciler",
+    "restore-cursor",
+    "restore-cursor/onetime",
+    "restore-cursor/onetime/mimic-fn",
+    "scheduler",
+    "signal-exit",
+    "slice-ansi",
+    "stack-utils",
+    "string-width",
+    "strip-ansi",
+    "terminal-size",
+    "widest-line",
+    "wrap-ansi",
+    "ws",
+    "yoga-layout",
+    "zod"
+  ]
+}

package/scripts/publish-changed-packages.ts

@@ -4,7 +4,12 @@
 // package so release logs answer "what shipped?" without leaving the terminal.
 import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
-import { latestTag, RELEASE_PACKAGES } from "./analyze-release-scope";
+import {
+  latestTag,
+  lockChangedPackages,
+  payloadPaths,
+  RELEASE_PACKAGES,
+} from "./analyze-release-scope";
 
 const git = (root: string, args: string[]): string =>
   execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
@@ -12,8 +17,13 @@ const git = (root: string, args: string[]): string =>
 export function changedPackages(root: string, fromTag: string): string[] {
   // Committed state only: <tag>..HEAD, never the working tree — unreviewed
   // local edits must not decide what ships.
+  // Plus packages whose inlined third-party deps resolve differently in the
+  // lockfile (BUNDLED_DEPS); a dev-tooling-only lockfile bump changes none.
+  const relocked = new Set<string>(lockChangedPackages(root, fromTag, "HEAD"));
   return RELEASE_PACKAGES.filter((pkg) => {
-    const out = git(root, ["diff", "--name-only", `${fromTag}..HEAD`, "--", `packages/${pkg}`]);
+    if (relocked.has(pkg)) return true;
+    // Own directory plus any sources bundled into its dist/ (BUNDLED_SOURCES).
+    const out = git(root, ["diff", "--name-only", `${fromTag}..HEAD`, "--", ...payloadPaths(pkg)]);
     return out !== "";
   });
 }
@@ -38,20 +48,15 @@ export function publishChanged(opts: {
       execFileSync(cmd, args, { cwd: o.cwd, encoding: "utf8", stdio: "inherit" }));
   const tag =
     opts.fromTag !== undefined ? (opts.fromTag === "" ? null : opts.fromTag) : latestTag(root);
-  if (tag === null) {
-    // First-ever release: everything ships.
-    const published: string[] = [];
-    for (const pkg of RELEASE_PACKAGES) {
-      const cwd = resolve(root, "packages", pkg);
-      if (!dryRun) run("npm", ["publish", "--access", "public"], { cwd });
-      published.push(pkg);
-      console.log(`published ${pkg} @ ${cwd}`);
-    }
-    return { published, skipped: [], tag: null };
-  }
-  const changed = new Set(changedPackages(root, tag));
+  // First-ever release: everything ships.
+  const changed =
+    tag === null ? new Set<string>(RELEASE_PACKAGES) : new Set(changedPackages(root, tag));
   const published: string[] = [];
   const skipped: string[] = [];
+  const failed: Array<{ pkg: string; error: string }> = [];
+  // Every changed package is attempted even after a failure: one package that
+  // cannot publish (e.g. a first publish of a new npm name the token does not
+  // cover) must not leave the others unreleased. Failures throw at the end.
   for (const pkg of RELEASE_PACKAGES) {
     if (!changed.has(pkg)) {
       skipped.push(pkg);
@@ -62,12 +67,19 @@ export function publishChanged(opts: {
     try {
       if (!dryRun) run("npm", ["publish", "--access", "public"], { cwd });
     } catch (e) {
-      console.log(`publish failed ${pkg}: ${e instanceof Error ? e.message : String(e)}`);
-      throw e;
+      const error = e instanceof Error ? e.message : String(e);
+      failed.push({ pkg, error });
+      console.log(`publish failed ${pkg}: ${error}`);
+      continue;
     }
     published.push(pkg);
     console.log(`published ${pkg} @ ${cwd}`);
   }
+  if (failed.length > 0) {
+    const summary = `publish failed for ${failed.length} package(s): ${failed.map((f) => f.pkg).join(", ")}; published: ${published.join(", ") || "none"}. A first publish of a new @brainervirus package needs an npm token allowed to create packages in the scope.`;
+    console.log(summary);
+    throw new Error(summary);
+  }
   return { published, skipped, tag };
 }
 

package/scripts/rewrite-workspace-deps.ts

@@ -25,14 +25,19 @@ for (const pkg of [
   "workit-cursor",
   "workit-codex",
   "workit-pi",
+  "workit-claude-code",
 ]) {
   const file = resolve(root, `packages/${pkg}/package.json`);
   const data = JSON.parse(readFileSync(file, "utf8"));
-  const deps = data.dependencies;
-  if (!deps) continue;
-  for (const name of Object.keys(deps)) {
-    if (name.startsWith("@brainervirus/")) deps[name] = `^${core.version}`;
-  }
+  // devDependencies too: the Claude Code plugin bundles core and the CLI into
+  // dist/, so they are build-time only, but a published manifest must still
+  // never carry workspace:*.
+  const groups = [data.dependencies, data.devDependencies].filter(Boolean);
+  if (groups.length === 0) continue;
+  for (const deps of groups)
+    for (const name of Object.keys(deps)) {
+      if (name.startsWith("@brainervirus/")) deps[name] = `^${core.version}`;
+    }
   writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
 }
 // The root marketplace index carries no release version; only the package
@@ -40,6 +45,7 @@ for (const pkg of [
 for (const file of [
   resolve(root, "packages/workit-cursor/.cursor-plugin/plugin.json"),
   resolve(root, "packages/workit-codex/.codex-plugin/plugin.json"),
+  resolve(root, "packages/workit-claude-code/.claude-plugin/plugin.json"),
 ]) {
   const data = JSON.parse(readFileSync(file, "utf8"));
   data.version = core.version;

package/scripts/sync-release-manifests.ts

@@ -9,7 +9,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const SYNC_MANIFEST_PATHS = [
+export const SYNC_MANIFEST_PATHS = [
   "package.json",
   "packages/workit-core/package.json",
   "packages/workit-mcp/package.json",
@@ -18,9 +18,13 @@ const SYNC_MANIFEST_PATHS = [
   "packages/workit-cursor/package.json",
   "packages/workit-codex/package.json",
   "packages/workit-pi/package.json",
+  "packages/workit-claude-code/package.json",
   // Kept in lockstep with packages/workit-core/package.json by contract test.
   "packages/workit-cursor/.cursor-plugin/plugin.json",
   "packages/workit-codex/.codex-plugin/plugin.json",
+  // Claude Code reads the plugin version from here (the marketplace entry
+  // carries none), so it must track the published npm version.
+  "packages/workit-claude-code/.claude-plugin/plugin.json",
 ];
 
 export type ManifestSyncResult = { version: string; changed: string[] };

package/src/autonomy.ts

@@ -0,0 +1,135 @@
+// Autonomy grants (D4, D15; design §0 #12, §4.2): the per-workspace ceiling on
+// what an agent may deliver without asking. S11 introduces the reader and the
+// one seam every delivery verb consults, `requireGrant(kind)`; S16 adds
+// `workit grant`, the D4 defaults and the legacy `autoApprove` mapping.
+//
+// Today (S11):
+// - Grants are read only from the matched workspace entry in the user's
+//   `~/.config/workit/workspaces.json` (`"autonomy": {"push": true, "pr": true,
+//   "merge": false | true | "verified", "release": false}`), never from a repo
+//   file, and nothing here writes them (D15: never raised headless).
+// - An explicit value is honored: `false` denies with `grant_required`, `true`
+//   allows, and `merge: "verified"` allows only with an accepted independent
+//   verdict (S13). `merge: true` is the only way to merge without one.
+// - An absent grant is allowed on the host's own authority (`source:
+//   "host_authority"`): the host permission prompt is the ceiling, and a merge
+//   still needs an accepted verdict. S16 replaces that default with the D4
+//   ceiling `{push: true, pr: true, merge: false, release: false}`.
+// - Grants require an account (design §2.0 Identity): a workspace with any
+//   grant but no `vcs.account` cannot push, open or merge through a forge,
+//   so a personal grant never rides a work credential.
+import { resolveRuntimeWorkspaceVcs } from "./core/workspaces";
+
+export type GrantKind = "push" | "pr" | "merge" | "release";
+const GRANT_KINDS: readonly GrantKind[] = ["push", "pr", "merge", "release"];
+
+/** One grant as configured: `"verified"` means allowed with an accepted verdict. */
+export type GrantValue = boolean | "verified";
+
+export type Autonomy = {
+  workspace: string | null;
+  /** Explicitly configured grants; a kind that is absent falls back to host authority. */
+  grants: Partial<Record<GrantKind, GrantValue>>;
+  source: "autonomy" | "host_authority";
+  accountConfigured: boolean;
+};
+
+export type GrantDecision =
+  | {
+      allowed: true;
+      kind: GrantKind;
+      /** Where the permission came from. */
+      source: "autonomy" | "host_authority";
+      /** A merge must also have an accepted independent verdict (S13). */
+      requireVerdict: boolean;
+      workspace: string | null;
+    }
+  | {
+      allowed: false;
+      kind: GrantKind;
+      reason: "grant_required" | "account_required" | "config_invalid";
+      error: string;
+      unblock: string;
+      workspace: string | null;
+    };
+
+const isGrantValue = (value: unknown): value is GrantValue =>
+  value === true || value === false || value === "verified";
+
+/** The grants for the workspace `cwd` belongs to (read-only). */
+export function resolveAutonomy(cwd: string): Autonomy {
+  const workspace = resolveRuntimeWorkspaceVcs(cwd);
+  const raw = (workspace as { autonomy?: unknown } | null)?.autonomy;
+  const grants: Autonomy["grants"] = {};
+  if (raw && typeof raw === "object" && !Array.isArray(raw))
+    for (const kind of GRANT_KINDS) {
+      const value = (raw as Record<string, unknown>)[kind];
+      if (isGrantValue(value)) grants[kind] = value;
+    }
+  return {
+    workspace: workspace?.name ?? null,
+    grants,
+    source: Object.keys(grants).length > 0 ? "autonomy" : "host_authority",
+    accountConfigured: Boolean(workspace?.vcs?.account),
+  };
+}
+
+const grantHint = (workspace: string | null, kind: GrantKind): string =>
+  `ask the user to set "autonomy": {"${kind}": ${kind === "merge" ? '"verified"' : "true"}} for workspace "${workspace ?? "?"}" in ~/.config/workit/workspaces.json (S16: workit grant set ${workspace ?? "<workspace>"} ${kind}=${kind === "merge" ? "verified" : "true"})`;
+
+/**
+ * The seam every delivery verb consults before an external effect. `forge`
+ * says the effect goes through a GitHub/GitLab account (a push to a local
+ * path does not).
+ */
+export function requireGrant(
+  cwd: string,
+  kind: GrantKind,
+  options: { forge?: boolean } = {},
+): GrantDecision {
+  let autonomy: Autonomy;
+  try {
+    autonomy = resolveAutonomy(cwd);
+  } catch (error) {
+    return {
+      allowed: false,
+      kind,
+      reason: "config_invalid",
+      error: `grant_unreadable: ${error instanceof Error ? error.message : String(error)}`,
+      unblock: "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
+      workspace: null,
+    };
+  }
+  const { workspace } = autonomy;
+  const value = autonomy.grants[kind];
+  if (value === false)
+    return {
+      allowed: false,
+      kind,
+      reason: "grant_required",
+      error: `grant_required: ${kind} is not granted for workspace "${workspace ?? "?"}"`,
+      unblock: grantHint(workspace, kind),
+      workspace,
+    };
+  if (
+    autonomy.source === "autonomy" &&
+    !autonomy.accountConfigured &&
+    options.forge !== false &&
+    kind !== "release"
+  )
+    return {
+      allowed: false,
+      kind,
+      reason: "account_required",
+      error: `account_required: workspace "${workspace ?? "?"}" has autonomy grants but no vcs.account, so the credential cannot be checked`,
+      unblock: `set vcs.account for workspace "${workspace ?? "?"}" in ~/.config/workit/workspaces.json`,
+      workspace,
+    };
+  return {
+    allowed: true,
+    kind,
+    source: value === undefined ? "host_authority" : "autonomy",
+    requireVerdict: kind === "merge" && value !== true,
+    workspace,
+  };
+}

package/src/core/detect-hosts.ts

@@ -9,6 +9,7 @@ import { planUninstall, type UninstallPaths } from "./uninstall";
 import {
   findHostExecutable,
   installedHostApp,
+  isClaudeWorkitInstalled,
   isCodexWorkitInstalled,
   isPiWorkitInstalled,
   type HostId,
@@ -24,7 +25,7 @@ export type HostDetection = {
 
 export type DetectHostsOptions = UninstallPaths;
 
-const HOSTS: HostId[] = ["opencode", "cursor", "codex", "pi"];
+const HOSTS: HostId[] = ["opencode", "cursor", "codex", "pi", "claude-code"];
 
 /** Hosts the setup wizard configures through their native install paths. */
 export const WIZARD_HOSTS: HostId[] = [...HOSTS];
@@ -40,6 +41,7 @@ export function emptyDetection(): Record<HostId, HostDetection> {
     cursor: { detected: false, configured: false },
     codex: { detected: false, configured: false },
     pi: { detected: false, configured: false },
+    "claude-code": { detected: false, configured: false },
   };
 }
 
@@ -52,8 +54,10 @@ export function detectHosts(options: DetectHostsOptions = {}): Record<HostId, Ho
   const configuredByHost = new Map(plan.hosts.map((h) => [h.host, h.installed]));
   const found = emptyDetection();
   for (const host of HOSTS) {
+    // Claude Code ships as the `claude` CLI (the desktop app embeds it).
+    const executable = host === "claude-code" ? "claude" : host;
     const detected =
-      findHostExecutable(host, { home, env }) !== null || installedHostApp(host, home, env);
+      findHostExecutable(executable, { home, env }) !== null || installedHostApp(host, home, env);
     found[host] = {
       detected,
       configured:
@@ -61,7 +65,9 @@ export function detectHosts(options: DetectHostsOptions = {}): Record<HostId, Ho
           ? isCodexWorkitInstalled(home, env) || (configuredByHost.get(host) ?? false)
           : host === "pi"
             ? isPiWorkitInstalled(home, env) || (configuredByHost.get(host) ?? false)
-            : (configuredByHost.get(host) ?? false),
+            : host === "claude-code"
+              ? isClaudeWorkitInstalled(home, env)
+              : (configuredByHost.get(host) ?? false),
     };
   }
   return found;