@brainervirus/workit-core 2.9.0 → 3.0.0

package/README.md

@@ -30,7 +30,8 @@ Adapters map host-native surfaces to `src/core/`; they never re-implement core l
 ## Exports
 
 - Main entry: `./src/core.ts`.
-- Subpath exports: `./src/*.ts` (e.g. `@brainervirus/workit-core/src/core/doctor`), plus `./package.json`.
+- Subpath exports: `./src/*.ts` (e.g. `@brainervirus/workit-core/src/core/task-store`), plus `./package.json`.
+- Setup, doctor, upgrade, uninstall and host-install code lives in `@brainervirus/workit-cli` (`src/admin/`), not here, so host hooks and plugins never bundle it.
 
 ## Package scripts
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "2.9.0",
+  "version": "3.0.0",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/scripts/bundled-deps.json

@@ -56,13 +56,7 @@
     "yoga-layout",
     "zod"
   ],
-  "workit-opencode": [
-    "@openclaw/fs-safe",
-    "@opencode-ai/plugin",
-    "@opencode-ai/plugin/zod",
-    "@opencode/plugin",
-    "zod"
-  ],
+  "workit-opencode": ["@openclaw/fs-safe", "@opencode/plugin", "zod"],
   "workit-cursor": [
     "@modelcontextprotocol/sdk",
     "@openclaw/fs-safe",

package/scripts/install-codex-plugin.sh

@@ -19,10 +19,9 @@ fi
 mkdir -p "$PLUGIN_DIR"
 rsync -a --delete "$SOURCE/packages/workit-codex/" "$PLUGIN_DIR/"
 
-if ! bun "$ROOT/packages/workit-core/scripts/doctor-check.ts" cli; then
+if ! bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" cli; then
   echo "FATAL: post-install doctor found problems after Codex plugin sync" >&2
   exit 1
 fi
 
 echo "Codex plugin installed at $PLUGIN_DIR"
-echo "Complete an explicit v1 cutover before treating this as a generation switch."

package/scripts/install-cursor-plugin.sh

@@ -50,7 +50,7 @@ fi
 # The check reads only workit-owned files, so a healthy install is byte-untouched;
 # a registry-unreachable comparison reports registry_unreachable, never stale
 # (CA-04) — no false stale_install and no install failure.
-if bun "$ROOT/packages/workit-core/scripts/doctor-check.ts" cursor --stale; then
+if bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" cursor --stale; then
   :
 elif [ $? -eq 2 ]; then
   echo "workit: stale Cursor plugin install detected — self-healing (refresh + canonical re-registration)" >&2
@@ -70,7 +70,7 @@ if [ -d "$SKILLS_DIR" ]; then
 fi
 
 PLUGIN_DIR="$HOME/.cursor/plugins/local/workit"
-REGISTRATION_TS="$ROOT/packages/workit-core/src/core/registration.ts"
+REGISTRATION_TS="$ROOT/packages/workit-cli/src/admin/registration.ts"
 CURSOR_SETTINGS="$HOME/.cursor/settings.json" CURSOR_MCP="$HOME/.cursor/mcp.json" PLUGIN_DIR="$PLUGIN_DIR" REGISTRATION_TS="$REGISTRATION_TS" LOCAL_DIST="$LOCAL_DIST" bun -e '
 import fs from "node:fs";
 import path from "node:path";
@@ -120,7 +120,7 @@ if (localDist) {
 '
 
 # DG-09: verify the just-written Cursor registration with the shared offline doctor.
-if ! bun "$ROOT/packages/workit-core/scripts/doctor-check.ts" cursor; then
+if ! bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" cursor; then
   echo "FATAL: post-install doctor found an unhealthy Cursor registration" >&2
   exit 1
 fi
@@ -140,6 +140,5 @@ if [ -d "$LEGACY_PLUGIN_DIR" ] && [ "$LEGACY_PLUGIN_DIR" != "$PLUGIN_DIR" ]; the
 fi
 
 echo "Cursor plugin installed + auto-sync enabled (sessionStart)."
-echo "Generation switches require an explicit cutover preview/apply — install alone is not a cutover."
 echo "Share: $SHARE"
 ls "$HOME/.cursor/plugins/local/workit/skills" | grep '^wk-' || true

package/scripts/install-opencode-plugin.sh

@@ -38,7 +38,7 @@ mkdir -p "$(dirname "$CONFIG")"
 
 # Merge/dedupe registrations via the shared core helper (RR-06): one dev pin,
 # no legacy/current duplicates, unrelated user settings preserved.
-CONFIG_PATH="$CONFIG" PIN_PATH="$PIN" REGISTRATION_TS="$ROOT/packages/workit-core/src/core/registration.ts" bun -e '
+CONFIG_PATH="$CONFIG" PIN_PATH="$PIN" REGISTRATION_TS="$ROOT/packages/workit-cli/src/admin/registration.ts" bun -e '
 import fs from "node:fs";
 const { mergeOpenCodeConfig } = await import(process.env.REGISTRATION_TS!);
 const path = process.env.CONFIG_PATH!;
@@ -71,10 +71,9 @@ if [ ! -s "$PLUGIN_ENTRY" ]; then
 fi
 
 # DG-09: verify the just-written registration with the shared offline doctor.
-if ! bun "$ROOT/packages/workit-core/scripts/doctor-check.ts" opencode; then
+if ! bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" opencode; then
   echo "FATAL: post-install doctor found an unhealthy OpenCode registration" >&2
   exit 1
 fi
 
 echo "OpenCode install done. Fully quit all opencode processes, then restart."
-echo "Generation switches require an explicit cutover preview/apply — install alone is not a cutover."

package/scripts/install-pi-package.sh

@@ -19,8 +19,8 @@ fi
 # pi 0.85.1 loads extensions from the settings `packages` list, not from
 # ~/.pi/config.json below. Register the absolute package dir there (honoring
 # PI_CODING_AGENT_DIR) so `pi list` picks it up; the config.json write stays
-# because uninstall/cutover/detection still key pi state off it — migrating
-# those three off config.json is a separate contract change.
+# because uninstall and detection still key pi state off it — migrating
+# those two off config.json is a separate contract change.
 AGENT_DIR="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
 SETTINGS="$AGENT_DIR/settings.json"
 mkdir -p "$AGENT_DIR"
@@ -53,4 +53,3 @@ console.log("Registered Pi extension:", process.env.EXT);
 '
 
 echo "Pi package registered in $SETTINGS (and legacy $PI_CONFIG)"
-echo "Complete an explicit v1 cutover before treating this as a generation switch."

package/scripts/sync-runtime.sh

@@ -153,19 +153,6 @@ fi
 # Remove broken TLA live-loader if present (OpenCode ignored it; /wk-* vanished)
 rm -f "${OPENCODE_PLUGINS}/workflow-toolkit.ts"
 
-# Ensure OpenCode has plugin peer dep
-PKG="${HOME}/.config/opencode/package.json"
-if [ -f "$PKG" ]; then
-  PKG_PATH="$PKG" "$BUN_BIN" -e '
-import fs from "node:fs";
-const path = process.env.PKG_PATH!;
-const data = JSON.parse(fs.readFileSync(path, "utf8"));
-data.dependencies = data.dependencies ?? {};
-data.dependencies["@opencode-ai/plugin"] = data.dependencies["@opencode-ai/plugin"] ?? "1.18.30";
-fs.writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
-' || true
-fi
-
 # Drop bun package cache so old github/file installs cannot shadow file:// plugin.ts
 rm -rf "${HOME}/.cache/opencode/packages/workflow-toolkit-opencode@"* 2>/dev/null || true
 

package/src/core/init.ts

@@ -3,7 +3,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { configDir, isConfigObject } from "./config";
 import { writeFileExclusive } from "./safe-write";
-import { applyWorkspaceBranchPolicy } from "./setup";
+import { applyWorkspaceBranchPolicy } from "./workspace-branch-policy";
 import { youTrackTokenCreateUrl } from "./youtrack";
 
 const TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";

package/src/core/support-matrix.ts

@@ -7,10 +7,10 @@
 export const SUPPORT_MATRIX = {
   bun: "1.4.1",
   node: { minimum: "24", current: "24.20.0" },
-  // The object-form dual entry (server() + setup()) only loads from
-  // 1.18.29+; the supported floor is 1.18.30 so no host can pass doctor while
-  // being unable to load the entry shape.
-  opencode: { minimum: "1.18.30", current: "1.18.34" },
+  // OpenCode V2 plugin API only: the entry exports `setup()` (Workit 3.0
+  // retired the V1 `server()` adapter), so 1.x hosts cannot load it. 2.0.18 is
+  // the `@opencode/plugin` contract the adapter is built and tested against.
+  opencode: { minimum: "2.0.18", current: "2.0.18" },
   // Codex is a qualification host, not a runtime dependency: the CLI version
   // below is the one live qualification evidence covers. The doctor warns when
   // an installed CLI drifts ahead so a fresh install never silently outruns

package/src/core/workspace-branch-policy.ts

@@ -0,0 +1,123 @@
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { detectBranchPolicy } from "./branch-policy";
+import { configDir } from "./config";
+import {
+  readWorkspacesResult,
+  resolveWorkspaceFrom,
+  validateWorkspaceGlob,
+  validateWorkspacesDocument,
+  workspacesRevision,
+  type WorkspaceConfig,
+} from "./workspaces";
+
+const readFileSafe = (p: string): string | null => {
+  try {
+    return readFileSync(p, "utf8");
+  } catch {
+    return null;
+  }
+};
+
+// The one proposal→write path for a workspace branch policy, shared by the
+// OpenCode `workit_init_apply` branch_policy action (init.ts) and the CLI
+// wizard, so both produce byte-identical workspaces.json writes.
+export function applyWorkspaceBranchPolicy(opts: {
+  workspace_root: string;
+  env?: NodeJS.ProcessEnv;
+}): Record<string, any> {
+  const { workspace_root, env = process.env } = opts;
+  const dir = path.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const {
+    status,
+    path: wsPath,
+    entries,
+    document,
+    revision,
+    error: workspacesError,
+  } = readWorkspacesResult(dir);
+  if (status === "malformed" || status === "invalid")
+    return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
+  const detection = detectBranchPolicy(workspace_root);
+  const name = String(env.WORKFLOW_BP_NAME ?? path.basename(workspace_root));
+  const integration = (env.WORKFLOW_BP_INTEGRATION ?? detection.integration) as "pr" | "merge";
+  const policy = {
+    preset: detection.preset,
+    developBranch: env.WORKFLOW_BP_DEVELOP ?? detection.developBranch ?? undefined,
+    prefixes: detection.prefixes,
+    allowed: detection.allowed,
+    protected: detection.protected,
+    integration,
+  };
+  const glob = `${workspace_root.replace(/[\\/]+$/, "")}/**`;
+  if (!validateWorkspaceGlob(glob).ok)
+    return { ok: false, error: `invalid workspace glob: ${glob}` };
+  let existing: WorkspaceConfig | null;
+  try {
+    existing = resolveWorkspaceFrom(workspace_root, dir);
+  } catch (error) {
+    const selectedName = env.WORKFLOW_BP_NAME?.trim();
+    if (!selectedName)
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    try {
+      existing = resolveWorkspaceFrom(workspace_root, dir, selectedName);
+    } catch (selectionError) {
+      return {
+        ok: false,
+        error: selectionError instanceof Error ? selectionError.message : String(selectionError),
+      };
+    }
+  }
+  if (existing?.branchPolicy && isDeepStrictEqual(existing.branchPolicy, policy)) {
+    return {
+      ok: true,
+      status: "already-configured",
+      workspace: existing,
+      policy,
+      config_path: wsPath,
+    };
+  }
+  const next = existing
+    ? entries.map((w) => (w.name === existing?.name ? { ...w, branchPolicy: policy } : w))
+    : [...entries, { name, glob, branchPolicy: policy }];
+  if (!existing && entries.some((entry) => entry.name === name))
+    return { ok: false, error: `workspace name ${JSON.stringify(name)} is already configured` };
+  const proposed = validateWorkspacesDocument({ ...document, workspaces: next }, wsPath);
+  if (proposed.status !== "valid") return { ok: false, error: proposed.error };
+  if (workspacesRevision(readFileSafe(wsPath)) !== revision)
+    return {
+      ok: false,
+      error: `workspaces.json changed while applying the branch policy: ${wsPath}`,
+    };
+  mkdirSync(path.dirname(wsPath), { recursive: true });
+  const tmp = `${wsPath}.${process.pid}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify({ ...document, workspaces: next }, null, 2) + "\n", "utf8");
+    if (workspacesRevision(readFileSafe(wsPath)) !== revision) {
+      rmSync(tmp, { force: true });
+      return {
+        ok: false,
+        error: `workspaces.json changed while applying the branch policy: ${wsPath}`,
+      };
+    }
+    renameSync(tmp, wsPath);
+  } catch (error) {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {}
+    return {
+      ok: false,
+      error: `failed to write ${wsPath}: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+  return {
+    ok: true,
+    status: existing ? "updated" : "configured",
+    workspace: existing
+      ? { ...existing, branchPolicy: policy }
+      : { name, glob, branchPolicy: policy },
+    policy,
+    config_path: wsPath,
+  };
+}

package/src/hooks/hosts/opencode.ts

@@ -4,8 +4,8 @@ import type { HostDescriptor } from "../descriptor";
 export const OPENCODE_DESCRIPTOR: HostDescriptor = {
   host: "opencode",
   label: "OpenCode",
-  verifiedAgainst: "@opencode-ai/plugin 1.18.30",
-  docs: ["https://opencode.ai/docs/plugins/"],
+  verifiedAgainst: "@opencode/plugin 2.0.18",
+  docs: ["https://opencode.ai/v2/docs/build/plugins/"],
   transport: "in-process-plugin",
   events: {
     // No separate start event: context is injected on every agent-loop call.

package/scripts/doctor-check.ts

@@ -1,37 +0,0 @@
-#!/usr/bin/env bun
-// DG-09: installers run the shared offline doctor after writing configuration and
-// return nonzero when a required registration/config check fails. `installer:
-// true` limits the enforced checks to the ones the installer just guaranteed, so
-// a dev/stub checkout without built assets does not fail a post-install run.
-// CA-02: `cursor --stale` is the installer's self-heal pre-check — it exits 2
-// when the doctor's stale_install check fails and 0 otherwise. A
-// registry-unreachable comparison warns as registry_unreachable and is NOT
-// stale (CA-04): no false stale_install and no install failure. Other check
-// failures are left to the post-install gate.
-import { runDoctor } from "../src/core/doctor";
-
-const hostArg = process.argv[2];
-const host = hostArg === "cursor" ? "cursor" : hostArg === "cli" ? "cli" : "opencode";
-const staleOnly = process.argv.includes("--stale");
-const report = runDoctor({ host, installer: true });
-
-if (staleOnly) {
-  const stale = report.checks.find((c) => c.id === "stale_install");
-  if (stale?.status === "fail") {
-    process.stderr.write(`STALE: ${stale.detail}\n`);
-    if (stale.fix) process.stderr.write(`  fix: ${stale.fix}\n`);
-    process.exit(2);
-  }
-  process.exit(0);
-}
-
-if (report.exitCode !== 0) {
-  for (const check of report.checks) {
-    if (check.status === "fail") {
-      process.stderr.write(`FATAL: workit doctor ${check.id}: ${check.detail}\n`);
-      if (check.fix) process.stderr.write(`  fix: ${check.fix}\n`);
-    }
-  }
-  process.exit(1);
-}
-process.exit(0);

package/src/core/config-conversion.ts

@@ -1,180 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { isConfigObject, mergePreset, type BranchPreset, type ToolkitConfig } from "./config";
-import { writeFileAtomic } from "./safe-write";
-
-export type ConversionInput = {
-  configDir: string;
-};
-
-export type ConversionMapping = {
-  key: string;
-  from: unknown;
-  to: unknown;
-  note?: string;
-};
-
-export type ConversionUnresolved = {
-  key: string;
-  reason: string;
-};
-
-export type ConversionPreview = {
-  mappings: ConversionMapping[];
-  preserved: string[];
-  unresolved: ConversionUnresolved[];
-};
-
-const REDACT_KEYS = /token|secret|password|credential/i;
-
-const readJsonObject = (file: string): Record<string, unknown> | null => {
-  if (!existsSync(file)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync(file, "utf8"));
-    return isConfigObject(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-};
-
-const redactValue = (key: string, value: unknown): unknown => {
-  if (REDACT_KEYS.test(key)) return "[redacted]";
-  if (typeof value === "string" && value.length > 8 && !value.includes(" ")) return "[redacted]";
-  return value;
-};
-
-export const redactConversionPreview = (preview: ConversionPreview): ConversionPreview => ({
-  mappings: preview.mappings.map((m) => ({
-    ...m,
-    from: redactValue(m.key, m.from),
-    to: redactValue(m.key, m.to),
-  })),
-  preserved: preview.preserved,
-  unresolved: preview.unresolved,
-});
-
-export function previewConversion(input: ConversionInput): ConversionPreview {
-  const configFile = path.join(input.configDir, "config.json");
-  const config = readJsonObject(configFile);
-  const mappings: ConversionMapping[] = [];
-  const unresolved: ConversionUnresolved[] = [];
-  const preserved: string[] = [];
-
-  if (config) {
-    if (config.locale !== undefined) {
-      mappings.push({ key: "locale", from: config.locale, to: config.locale });
-    }
-    if (config.branchPolicy !== undefined && isConfigObject(config.branchPolicy)) {
-      const bp = config.branchPolicy as ToolkitConfig["branchPolicy"] & {
-        allowed?: string[];
-        protected?: string[];
-      };
-      const preset = bp.preset ?? "gitflow";
-      const merged = mergePreset(
-        preset,
-        {
-          allowed: Array.isArray(bp.allowed) ? bp.allowed : undefined,
-          protectedNames: Array.isArray(bp.protected) ? bp.protected : undefined,
-        },
-        { branchPolicy: bp },
-      );
-      mappings.push({
-        key: "branchPolicy",
-        from: config.branchPolicy,
-        to: merged,
-        note: "preset-derived allowed/protected reset through mergePreset",
-      });
-      if (preset === "custom" && Array.isArray(bp.allowed)) {
-        if (bp.allowed.includes("*")) {
-          unresolved.push({
-            key: "branchPolicy.allowed",
-            reason: 'unsupported permissive value "*" requires an explicit v1 choice',
-          });
-        }
-      }
-    }
-    if (config.workflowMode !== undefined) {
-      unresolved.push({
-        key: "legacyWorkflowMode",
-        reason: "0.x workflow mode has no automatic v1 equivalent; choose how to continue",
-      });
-    }
-  }
-
-  for (const name of ["youtrack.json", "vcs.json", "workspaces.json"]) {
-    const file = path.join(input.configDir, name);
-    if (!existsSync(file)) continue;
-    const parsed = readJsonObject(file);
-    if (parsed)
-      mappings.push({ key: name, from: parsed, to: parsed, note: "carry forward unchanged" });
-  }
-
-  for (const token of ["youtrack.token", "gitlab.token", "github.token"]) {
-    const file = path.join(input.configDir, token);
-    if (existsSync(file)) preserved.push(file);
-  }
-
-  return { mappings, preserved, unresolved };
-}
-
-export const conversionDigest = (preview: ConversionPreview): string =>
-  createHash("sha256")
-    .update(JSON.stringify(redactConversionPreview(preview)))
-    .digest("hex");
-
-export type ConversionApplyResult = {
-  configPath: string;
-  choicesPath: string;
-};
-
-/** Apply approved conversion mappings and record explicit resolution choices. */
-export function applyConversionConfig(
-  configDir: string,
-  preview: ConversionPreview,
-  resolutions: Record<string, string>,
-): ConversionApplyResult {
-  const configFile = path.join(configDir, "config.json");
-  const raw = readJsonObject(configFile) ?? {};
-  const next: Record<string, unknown> = { ...raw };
-
-  for (const mapping of preview.mappings) {
-    if (mapping.key === "locale") {
-      next[mapping.key] = mapping.to;
-    }
-    if (mapping.key === "branchPolicy" && !resolutions["branchPolicy.allowed"]) {
-      next.branchPolicy = mapping.to;
-    }
-  }
-
-  if (resolutions["branchPolicy.allowed"]) {
-    const bp = isConfigObject(next.branchPolicy)
-      ? (next.branchPolicy as ToolkitConfig["branchPolicy"])
-      : { preset: "custom" as BranchPreset, allowed: [], protected: [] };
-    const preset = bp.preset ?? "custom";
-    next.branchPolicy = mergePreset(
-      preset,
-      {
-        allowed: resolutions["branchPolicy.allowed"]
-          .split(",")
-          .map((s) => s.trim())
-          .filter(Boolean),
-      },
-      { branchPolicy: bp },
-    );
-  }
-
-  if (resolutions["legacyWorkflowMode"]) {
-    delete next.workflowMode;
-  }
-
-  writeFileAtomic(configFile, JSON.stringify(next, null, 2) + "\n");
-
-  const choicesPath = path.join(configDir, "cutover-choices.json");
-  writeFileAtomic(
-    choicesPath,
-    JSON.stringify({ resolutions, applied_at: new Date().toISOString() }, null, 2) + "\n",
-  );
-
-  return { configPath: configFile, choicesPath };
-}