@brainervirus/workit-core 2.5.0 → 2.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "2.5.0",
+  "version": "2.7.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/scripts/analyze-release-scope.ts

@@ -6,6 +6,7 @@
 // them; merge-backs and the release's own manifest sync never do.
 import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
+import BUNDLED_DEPS_JSON from "./bundled-deps.json" with { type: "json" };
 
 export const RELEASE_PACKAGES = [
   "workit-core",
@@ -15,8 +16,90 @@ export const RELEASE_PACKAGES = [
   "workit-cursor",
   "workit-codex",
   "workit-pi",
+  "workit-claude-code",
 ] as const;
 
+type ReleasePackage = (typeof RELEASE_PACKAGES)[number];
+
+/**
+ * Sources a package's published dist/ inlines from OUTSIDE its own directory.
+ * Every adapter build is a no-external `bun build`, so whatever it imports
+ * from another workspace package is copied into its bundle: a runtime
+ * dependency on that package does not reach the shipped code. A change in
+ * these sources must therefore republish the bundling package too. Verified
+ * against the build entries' metafiles by
+ * test/workit-core/bundled-sources.test.ts.
+ */
+const CORE = "packages/workit-core/"; // sources, skills, templates and package.json
+// Cursor and Codex inline the MCP transport and its declared dependencies.
+const MCP = ["packages/workit-mcp/src/", "packages/workit-mcp/package.json"];
+// The bundled CLI inlines its sources, package.json (`workit --version`) and
+// its third-party dependencies.
+const CLI = ["packages/workit-cli/src/", "packages/workit-cli/package.json"];
+export const BUNDLED_SOURCES: Partial<Record<ReleasePackage, readonly string[]>> = {
+  "workit-mcp": [CORE],
+  "workit-cli": [CORE],
+  "workit-opencode": [CORE],
+  "workit-cursor": [CORE, ...MCP],
+  "workit-codex": [CORE, ...MCP],
+  "workit-pi": [CORE],
+  "workit-claude-code": [CORE, ...CLI],
+};
+
+/**
+ * Third-party packages each dist/ inlines, as bun.lock `packages` keys
+ * (`zod`, or `@opencode-ai/plugin/zod` for a nested copy). A lockfile change
+ * republishes a package only when one of these resolves to a different
+ * version, so dev-tooling bumps never release. Kept in sync with the bundle
+ * metafiles by test/workit-core/bundled-sources.test.ts.
+ */
+export const BUNDLED_DEPS = BUNDLED_DEPS_JSON as Partial<Record<ReleasePackage, string[]>>;
+
+const LOCKFILE = "bun.lock";
+
+/** `packages` key → resolved `name@version` from a bun.lock text (JSONC). */
+export const lockResolutions = (text: string): Map<string, string> => {
+  // bun.lock is JSON with trailing commas.
+  const parsed = JSON.parse(text.replace(/,(\s*[}\]])/g, "$1")) as {
+    packages?: Record<string, unknown>;
+  };
+  const resolved = new Map<string, string>();
+  for (const [key, entry] of Object.entries(parsed.packages ?? {}))
+    if (Array.isArray(entry) && typeof entry[0] === "string") resolved.set(key, entry[0]);
+  return resolved;
+};
+
+const lockAt = (root: string, rev: string): Map<string, string> | null => {
+  try {
+    return lockResolutions(
+      execFileSync("git", ["show", `${rev}:${LOCKFILE}`], {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 64 * 1024 * 1024,
+      }),
+    );
+  } catch {
+    return null;
+  }
+};
+
+/** Packages whose inlined third-party resolutions differ between two revisions. */
+export const lockChangedPackages = (root: string, from: string, to: string): ReleasePackage[] => {
+  const before = lockAt(root, from);
+  const after = lockAt(root, to);
+  if (before === null && after === null) return [];
+  return RELEASE_PACKAGES.filter((pkg) =>
+    (BUNDLED_DEPS[pkg] ?? []).some((key) => before?.get(key) !== after?.get(key)),
+  );
+};
+
+/** Every repository path whose change alters `pkg`'s published payload. */
+export const payloadPaths = (pkg: ReleasePackage): string[] => [
+  `packages/${pkg}/`,
+  ...(BUNDLED_SOURCES[pkg] ?? []),
+];
+
 /** The release pipeline's own version-sync commit: never a release trigger. */
 const RELEASE_SYNC = /^chore\(release\): sync manifests\b/;
 
@@ -56,11 +139,15 @@ const subjectLevel = (commit: string): Level | null => {
 // combined diff drops files identical to either parent — e.g. hotfix-branch
 // back-merges), and -z returns raw NUL-delimited paths so spaces/non-ASCII
 // are never C-quoted. NUL is fine in captured output, never in argv.
-const commitsSince = (root: string, from: string): { message: string; files: string[] }[] => {
+const commitsSince = (
+  root: string,
+  from: string,
+): { hash: string; message: string; files: string[] }[] => {
   const hashes = g(root, ["log", "--reverse", "--format=%H", `${from}..HEAD`])
     .split("\n")
     .filter(Boolean);
   return hashes.map((h) => ({
+    hash: h,
     message: g(root, ["show", "-s", "--format=%B", h]),
     files: g(root, ["diff-tree", "--no-commit-id", "--name-only", "-r", "-m", "--root", "-z", h])
       .split("\0")
@@ -80,20 +167,24 @@ export function analyzeReleaseScope(root = process.cwd()): {
   const levels: Level[] = [];
   const pkgs = new Set<string>();
   let payloadOnly = false;
-  for (const { message, files } of commits) {
+  for (const { hash, message, files } of commits) {
     const subject = (message.split("\n")[0] ?? "").trim();
     if (RELEASE_SYNC.test(subject)) continue;
     const touched = files.filter((f) =>
-      RELEASE_PACKAGES.some((p) => f.startsWith(`packages/${p}/`)),
+      RELEASE_PACKAGES.some((p) => payloadPaths(p).some((prefix) => f.startsWith(prefix))),
     );
-    if (touched.length === 0) continue;
+    // A lockfile edit counts only for packages whose inlined deps moved.
+    const relocked = files.includes(LOCKFILE) ? lockChangedPackages(root, `${hash}^`, hash) : [];
+    if (touched.length === 0 && relocked.length === 0) continue;
     const lvl = subjectLevel(message);
     if (lvl) levels.push(lvl);
     else if (!subject.startsWith("Merge ")) payloadOnly = true;
-    for (const f of touched) {
-      const pkg = RELEASE_PACKAGES.find((p) => f.startsWith(`packages/${p}/`));
-      if (pkg) pkgs.add(pkg);
-    }
+    for (const pkg of RELEASE_PACKAGES)
+      if (
+        relocked.includes(pkg) ||
+        touched.some((f) => payloadPaths(pkg).some((prefix) => f.startsWith(prefix)))
+      )
+        pkgs.add(pkg);
   }
   if (levels.length === 0) return { level: payloadOnly ? "patch" : null, productPkgs: [...pkgs] };
   const level = levels.reduce<Level>(

package/scripts/bundled-deps.json

@@ -0,0 +1,133 @@
+{
+  "workit-mcp": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-cli": [
+    "@alcalzone/ansi-tokenize",
+    "@inkjs/ui",
+    "@openclaw/fs-safe",
+    "ansi-escapes",
+    "ansi-regex",
+    "ansi-styles",
+    "auto-bind",
+    "chalk",
+    "cli-boxes",
+    "cli-cursor",
+    "cli-truncate",
+    "code-excerpt",
+    "convert-to-spaces",
+    "deepmerge",
+    "environment",
+    "es-toolkit",
+    "escape-string-regexp",
+    "figures",
+    "get-east-asian-width",
+    "indent-string",
+    "ink",
+    "is-fullwidth-code-point",
+    "is-in-ci",
+    "is-unicode-supported",
+    "patch-console",
+    "react",
+    "react-devtools-core",
+    "react-reconciler",
+    "restore-cursor",
+    "restore-cursor/onetime",
+    "restore-cursor/onetime/mimic-fn",
+    "scheduler",
+    "signal-exit",
+    "slice-ansi",
+    "stack-utils",
+    "string-width",
+    "strip-ansi",
+    "terminal-size",
+    "widest-line",
+    "wrap-ansi",
+    "ws",
+    "yoga-layout",
+    "zod"
+  ],
+  "workit-opencode": [
+    "@openclaw/fs-safe",
+    "@opencode-ai/plugin",
+    "@opencode-ai/plugin/zod",
+    "@opencode/plugin",
+    "zod"
+  ],
+  "workit-cursor": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-codex": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-pi": ["@openclaw/fs-safe", "zod"],
+  "workit-claude-code": [
+    "@alcalzone/ansi-tokenize",
+    "@inkjs/ui",
+    "@openclaw/fs-safe",
+    "ansi-escapes",
+    "ansi-regex",
+    "ansi-styles",
+    "auto-bind",
+    "chalk",
+    "cli-boxes",
+    "cli-cursor",
+    "cli-truncate",
+    "code-excerpt",
+    "convert-to-spaces",
+    "deepmerge",
+    "environment",
+    "es-toolkit",
+    "escape-string-regexp",
+    "figures",
+    "get-east-asian-width",
+    "indent-string",
+    "ink",
+    "is-fullwidth-code-point",
+    "is-in-ci",
+    "is-unicode-supported",
+    "patch-console",
+    "react",
+    "react-devtools-core",
+    "react-reconciler",
+    "restore-cursor",
+    "restore-cursor/onetime",
+    "restore-cursor/onetime/mimic-fn",
+    "scheduler",
+    "signal-exit",
+    "slice-ansi",
+    "stack-utils",
+    "string-width",
+    "strip-ansi",
+    "terminal-size",
+    "widest-line",
+    "wrap-ansi",
+    "ws",
+    "yoga-layout",
+    "zod"
+  ]
+}

package/scripts/publish-changed-packages.ts

@@ -4,7 +4,12 @@
 // package so release logs answer "what shipped?" without leaving the terminal.
 import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
-import { latestTag, RELEASE_PACKAGES } from "./analyze-release-scope";
+import {
+  latestTag,
+  lockChangedPackages,
+  payloadPaths,
+  RELEASE_PACKAGES,
+} from "./analyze-release-scope";
 
 const git = (root: string, args: string[]): string =>
   execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
@@ -12,8 +17,13 @@ const git = (root: string, args: string[]): string =>
 export function changedPackages(root: string, fromTag: string): string[] {
   // Committed state only: <tag>..HEAD, never the working tree — unreviewed
   // local edits must not decide what ships.
+  // Plus packages whose inlined third-party deps resolve differently in the
+  // lockfile (BUNDLED_DEPS); a dev-tooling-only lockfile bump changes none.
+  const relocked = new Set<string>(lockChangedPackages(root, fromTag, "HEAD"));
   return RELEASE_PACKAGES.filter((pkg) => {
-    const out = git(root, ["diff", "--name-only", `${fromTag}..HEAD`, "--", `packages/${pkg}`]);
+    if (relocked.has(pkg)) return true;
+    // Own directory plus any sources bundled into its dist/ (BUNDLED_SOURCES).
+    const out = git(root, ["diff", "--name-only", `${fromTag}..HEAD`, "--", ...payloadPaths(pkg)]);
     return out !== "";
   });
 }
@@ -38,20 +48,15 @@ export function publishChanged(opts: {
       execFileSync(cmd, args, { cwd: o.cwd, encoding: "utf8", stdio: "inherit" }));
   const tag =
     opts.fromTag !== undefined ? (opts.fromTag === "" ? null : opts.fromTag) : latestTag(root);
-  if (tag === null) {
-    // First-ever release: everything ships.
-    const published: string[] = [];
-    for (const pkg of RELEASE_PACKAGES) {
-      const cwd = resolve(root, "packages", pkg);
-      if (!dryRun) run("npm", ["publish", "--access", "public"], { cwd });
-      published.push(pkg);
-      console.log(`published ${pkg} @ ${cwd}`);
-    }
-    return { published, skipped: [], tag: null };
-  }
-  const changed = new Set(changedPackages(root, tag));
+  // First-ever release: everything ships.
+  const changed =
+    tag === null ? new Set<string>(RELEASE_PACKAGES) : new Set(changedPackages(root, tag));
   const published: string[] = [];
   const skipped: string[] = [];
+  const failed: Array<{ pkg: string; error: string }> = [];
+  // Every changed package is attempted even after a failure: one package that
+  // cannot publish (e.g. a first publish of a new npm name the token does not
+  // cover) must not leave the others unreleased. Failures throw at the end.
   for (const pkg of RELEASE_PACKAGES) {
     if (!changed.has(pkg)) {
       skipped.push(pkg);
@@ -62,12 +67,19 @@ export function publishChanged(opts: {
     try {
       if (!dryRun) run("npm", ["publish", "--access", "public"], { cwd });
     } catch (e) {
-      console.log(`publish failed ${pkg}: ${e instanceof Error ? e.message : String(e)}`);
-      throw e;
+      const error = e instanceof Error ? e.message : String(e);
+      failed.push({ pkg, error });
+      console.log(`publish failed ${pkg}: ${error}`);
+      continue;
     }
     published.push(pkg);
     console.log(`published ${pkg} @ ${cwd}`);
   }
+  if (failed.length > 0) {
+    const summary = `publish failed for ${failed.length} package(s): ${failed.map((f) => f.pkg).join(", ")}; published: ${published.join(", ") || "none"}. A first publish of a new @brainervirus package needs an npm token allowed to create packages in the scope.`;
+    console.log(summary);
+    throw new Error(summary);
+  }
   return { published, skipped, tag };
 }
 

package/scripts/rewrite-workspace-deps.ts

@@ -25,14 +25,19 @@ for (const pkg of [
   "workit-cursor",
   "workit-codex",
   "workit-pi",
+  "workit-claude-code",
 ]) {
   const file = resolve(root, `packages/${pkg}/package.json`);
   const data = JSON.parse(readFileSync(file, "utf8"));
-  const deps = data.dependencies;
-  if (!deps) continue;
-  for (const name of Object.keys(deps)) {
-    if (name.startsWith("@brainervirus/")) deps[name] = `^${core.version}`;
-  }
+  // devDependencies too: the Claude Code plugin bundles core and the CLI into
+  // dist/, so they are build-time only, but a published manifest must still
+  // never carry workspace:*.
+  const groups = [data.dependencies, data.devDependencies].filter(Boolean);
+  if (groups.length === 0) continue;
+  for (const deps of groups)
+    for (const name of Object.keys(deps)) {
+      if (name.startsWith("@brainervirus/")) deps[name] = `^${core.version}`;
+    }
   writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
 }
 // The root marketplace index carries no release version; only the package
@@ -40,6 +45,7 @@ for (const pkg of [
 for (const file of [
   resolve(root, "packages/workit-cursor/.cursor-plugin/plugin.json"),
   resolve(root, "packages/workit-codex/.codex-plugin/plugin.json"),
+  resolve(root, "packages/workit-claude-code/.claude-plugin/plugin.json"),
 ]) {
   const data = JSON.parse(readFileSync(file, "utf8"));
   data.version = core.version;

package/scripts/sync-release-manifests.ts

@@ -9,7 +9,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const SYNC_MANIFEST_PATHS = [
+export const SYNC_MANIFEST_PATHS = [
   "package.json",
   "packages/workit-core/package.json",
   "packages/workit-mcp/package.json",
@@ -18,9 +18,13 @@ const SYNC_MANIFEST_PATHS = [
   "packages/workit-cursor/package.json",
   "packages/workit-codex/package.json",
   "packages/workit-pi/package.json",
+  "packages/workit-claude-code/package.json",
   // Kept in lockstep with packages/workit-core/package.json by contract test.
   "packages/workit-cursor/.cursor-plugin/plugin.json",
   "packages/workit-codex/.codex-plugin/plugin.json",
+  // Claude Code reads the plugin version from here (the marketplace entry
+  // carries none), so it must track the published npm version.
+  "packages/workit-claude-code/.claude-plugin/plugin.json",
 ];
 
 export type ManifestSyncResult = { version: string; changed: string[] };

package/skills/workit-behavioral-tdd/SKILL.md

@@ -16,12 +16,16 @@ Use this method when assessment selects the `testing` dimension.
 2. State one behavior and its observable result. Choose the narrowest stable
    boundary a caller or user depends on; avoid private helpers and incidental
    representations.
-3. Write one vertical RED slice that fails for the missing behavior, run it, and
-   preserve the actual failure as evidence. Implement the smallest change, then
-   run the same slice GREEN and record its result. Close enforces the order: a
-   testing requirement with GREEN but no preceding RED evidence stays unsatisfied.
-4. Add only another slice for a distinct behavior or risk. Reconcile stale
-   evidence if the candidate changes.
+3. Write one vertical RED slice that fails for the missing behavior and run it
+   through the CLI so the failure is observed: `workit check test` (the repo's
+   configured `test` check; `npx -y @brainervirus/workit-cli check test` when
+   `workit` is not on PATH). Implement the smallest change, then run the same
+   check GREEN. Close accepts only a fresh passing run of the configured check
+   that `workit check` observed; a recorded "tests pass" is a note, and an
+   ad-hoc `workit check -- <cmd>` never satisfies the gate. If no `test` check
+   is configured or detected, add `workit.checks.json` (committed) with it.
+4. Add only another slice for a distinct behavior or risk. Any edit makes the
+   observed check stale: re-run `workit check test` before closing.
 
 ## Reject noisy tests
 
@@ -36,8 +40,10 @@ Use this method when assessment selects the `testing` dimension.
   type-only or CSS-class coupling. If the test still passes when every
   imported function returns undefined, rewrite the assertion or delete it.
 
-Use shared `evidence` operations for RED/GREEN results. Do not add a second
-lifecycle, approval chain, or test workflow outside the current task state.
+Run RED/GREEN through `workit check`, which records the observed result on the
+current task; shared `evidence` operations are for notes and non-test evidence.
+Do not add a second lifecycle, approval chain, or test workflow outside the
+current task state.
 
 ## Common mistakes
 
@@ -45,4 +51,4 @@ lifecycle, approval chain, or test workflow outside the current task state.
 | --- | --- |
 | "The pin changed, so assert the new string" | Exercise the affected consumer behavior. |
 | "The code is obvious" | A small vertical slice still proves the contract. |
-| Keeping a passing test after the boundary moved | Mark it stale and retest the current candidate. |
+| Keeping a passing test after the boundary moved | Re-run `workit check test` on the current tree. |

package/skills/workit-debug/SKILL.md

@@ -19,7 +19,8 @@ established root cause.
    inferences, and unknowns with references; trace the failing value and all
    relevant callers before editing.
 3. State the root-cause hypothesis and the smallest in-scope fix. Write a focused
-   regression at the boundary when practical, then run RED and GREEN checks.
+   regression at the boundary when practical, then run RED and GREEN through
+   `workit check <name>` so the results are observed, not reported.
 4. Acquire writer authority through `writer` before mutation. Reconcile the
    candidate, evidence, and findings after the change; investigate sibling paths
    and stale conclusions rather than assuming the first patch worked.