@brainervirus/workit-core 8.1.0 → 8.3.0

package/src/forge/resolve.ts

@@ -2,7 +2,8 @@
 // §2.0 Identity).
 //
 // - The push remote host decides GitHub vs GitLab. A workspace provider that
-//   disagrees is `blocked`, never silently overridden.
+//   disagrees is `blocked` for the forge verbs, never silently overridden;
+//   `git push` (checkPushIdentity) only needs git, so it pushes with a note.
 // - PRs/MRs live in the base repository: an `upstream` remote on the same
 //   forge, else the push repo's fork parent, else the push repo itself.
 // - Every API call carries the workspace's credential explicitly, so the
@@ -23,9 +24,10 @@ import {
   type ForgeHosts,
   type SshConfig,
 } from "../git/rev";
-import { FORGE_TIMEOUTS, systemRunner, type ForgeRunner } from "./exec";
+import { FORGE_TIMEOUTS, isNetworkError, systemRunner, type ForgeRunner } from "./exec";
 import { createGitHubForge } from "./github";
 import { createGitLabForge } from "./gitlab";
+import { redactText } from "./redact";
 import { failure, success, type Forge, type ForgeResult, type Identity } from "./types";
 
 export type CredentialSource = "workspace_token_file" | "gh_account_token" | "cli_login";
@@ -62,51 +64,103 @@ export type ResolveOptions = {
   now?: () => number;
   /** ssh_config for Host aliases (default: the user's ~/.ssh/config). */
   sshConfig?: string | SshConfig;
+  /** Absolute deadline (`now()` clock) for every call, resolution included; null = none. */
+  deadline?: number | null;
 };
 
-const configuredHosts = (): ForgeHosts => {
-  const vcs = readVcsConfig();
-  if (vcs.status !== "valid") return {};
-  const host = (kind: "github" | "gitlab"): string[] => {
-    const value = (vcs.config[kind] as { host?: unknown } | undefined)?.host;
-    return typeof value === "string" && value.trim() ? [value.trim()] : [];
+// Per-process memo of credential lookups and /user answers (a long-lived MCP
+// server re-asks after the TTL). Scoped by runner, so an injected test runner
+// never sees another's answers, and keyed by the gh/glab config location, so
+// another GH_CONFIG_DIR never reuses them; only successes are kept.
+const MEMO_TTL_MS = 5 * 60_000;
+const SYSTEM_SCOPE = {};
+const memoScopes = new WeakMap<object, Map<string, { at: number; value: unknown }>>();
+
+type MemoScope = { owner: object; key: string };
+
+const memoScope = (runner: ForgeRunner | undefined, env: NodeJS.ProcessEnv): MemoScope => ({
+  owner: runner ?? SYSTEM_SCOPE,
+  key: [env.GH_CONFIG_DIR, env.GLAB_CONFIG_DIR, env.XDG_CONFIG_HOME, env.HOME]
+    .map((value) => value ?? "")
+    .join("|"),
+});
+
+function memo<T>(
+  scope: MemoScope,
+  key: string,
+  compute: () => { keep: boolean; value: T },
+  now = Date.now,
+): T {
+  let entries = memoScopes.get(scope.owner);
+  if (!entries) memoScopes.set(scope.owner, (entries = new Map()));
+  const full = `${scope.key} ${key}`;
+  const hit = entries.get(full);
+  if (hit && now() - hit.at < MEMO_TTL_MS) return hit.value as T;
+  const { keep, value } = compute();
+  if (keep) entries.set(full, { at: now(), value });
+  return value;
+}
+
+/** A runner whose calls are clamped to `limits.deadline`, carrying `token`. */
+function clampedRunner(
+  base: ForgeRunner,
+  limits: { deadline: number | null },
+  now: () => number,
+  token?: string,
+): ForgeRunner {
+  return (bin, args, callOptions) => {
+    let timeoutMs = callOptions.timeoutMs;
+    if (limits.deadline !== null) {
+      const remaining = limits.deadline - now();
+      if (remaining <= 0)
+        return {
+          status: null,
+          stdout: "",
+          stderr: "",
+          timedOut: true,
+          missing: false,
+          timeoutMs: 0,
+        };
+      timeoutMs = Math.min(timeoutMs, remaining);
+    }
+    const run = base(bin, args, { ...callOptions, timeoutMs, ...(token ? { token } : {}) });
+    return run.timedOut && run.timeoutMs === undefined ? { ...run, timeoutMs } : run;
+  };
+}
+
+/**
+ * `forge.identity` answered once per explicit credential per TTL (push, then
+ * pr create, …). The CLI's own login (`cli_login`) is never memoized: a
+ * `glab auth login` / `gh auth switch` must show on the next call.
+ */
+const memoizedIdentity = (forge: Forge, scope: MemoScope, credential: Credential): Forge => {
+  if (credential.credential === "cli_login") return forge;
+  const identity = (expected: string | null) => forge.identity(expected);
+  return {
+    ...forge,
+    identity: (expected: string | null) =>
+      memo(
+        scope,
+        `identity ${forge.kind} ${forge.apiHost} ${credential.credential} ${credential.token ?? ""} ${expected ?? ""}`,
+        () => {
+          const value = identity(expected);
+          return { keep: value.ok, value };
+        },
+      ),
   };
-  return { github: host("github"), gitlab: host("gitlab") };
 };
 
-const createForge = (derived: DerivedForge, repo: string, runner: ForgeRunner): Forge =>
-  derived.kind === "github"
-    ? createGitHubForge({ apiHost: derived.apiHost, repo, runner })
-    : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+type Credential = { token: string | undefined; credential: CredentialSource };
 
-export function resolveForge(
-  cwd: string,
-  options: ResolveOptions = {},
-): ForgeResult<ResolvedForge> {
-  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
-  try {
-    workspace = resolveRuntimeWorkspaceVcs(cwd);
-  } catch (error) {
-    return failure(
-      "blocked",
-      error instanceof Error ? error.message : String(error),
-      "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
-    );
-  }
-  const hosts = configuredHosts();
-  const pushed = pushForge(cwd, { branch: options.branch, hosts, sshConfig: options.sshConfig });
-  if (!pushed.ok) return failure(pushed.code, pushed.error, pushed.unblock);
-  const conflict = forgeConflict(pushed.forge, workspace?.vcs?.provider);
-  if (conflict) return failure("blocked", conflict.error, conflict.unblock);
-  const derived = pushed.forge;
+/** The credential every API call carries (see the header). */
+function resolveCredential(
+  workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>,
+  derived: DerivedForge,
+  run: ForgeRunner,
+  scope: MemoScope,
+): ForgeResult<Credential> {
   const { kind, apiHost } = derived;
-  const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
-  const now = options.now ?? Date.now;
   const expectedAccount = workspace?.vcs?.account ?? null;
-
-  // The credential for every call.
-  let token: string | undefined;
-  let credential: CredentialSource = "cli_login";
   const tokenFile = (workspace?.vcs as { tokenFile?: unknown } | undefined)?.tokenFile;
   if (typeof tokenFile === "string" && tokenFile.trim()) {
     // A stored token goes only to the host it is for: the public forge (also
@@ -127,6 +181,7 @@ export function resolveForge(
         `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`,
         `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`,
       );
+    let token = "";
     try {
       token = fs.readFileSync(tokenFile.trim(), "utf8").trim();
     } catch {
@@ -142,42 +197,108 @@ export function resolveForge(
         `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`,
         "fix vcs.tokenFile in ~/.config/workit/workspaces.json",
       );
-    credential = "workspace_token_file";
-  } else if (expectedAccount && kind === "github") {
-    const issued = base("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
+    return success({ token, credential: "workspace_token_file" });
+  }
+  // glab keeps one login per host, so a GitLab account is checked, not selected.
+  if (!expectedAccount || kind !== "github")
+    return success({ token: undefined, credential: "cli_login" });
+  return memo(scope, `token ${apiHost} ${expectedAccount}`, () => {
+    const issued = run("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
       timeoutMs: FORGE_TIMEOUTS.api,
     });
-    if (issued.missing)
-      return failure(
-        "unavailable",
-        "gh is not installed",
-        "install the GitHub CLI (https://cli.github.com) and run: gh auth login",
-      );
-    token = issued.status === 0 ? issued.stdout.trim() : "";
-    if (!token)
-      return failure(
-        "blocked",
-        `identity_unavailable: gh has no login for ${expectedAccount} on ${apiHost} (workspace ${workspace?.name ?? "?"})`,
-        `gh auth login --hostname ${apiHost}  # sign in as ${expectedAccount}; workit passes that account's token per call and never switches the active account`,
-      );
-    credential = "gh_account_token";
-  }
+    const value = authTokenResult(issued, apiHost, expectedAccount, workspace?.name ?? "?");
+    return { keep: value.ok, value };
+  });
+}
 
-  const limits: { deadline: number | null } = { deadline: null };
-  const runner: ForgeRunner = (bin, args, callOptions) => {
-    let timeoutMs = callOptions.timeoutMs;
-    if (limits.deadline !== null) {
-      const remaining = limits.deadline - now();
-      if (remaining <= 0)
-        return { status: null, stdout: "", stderr: "", timedOut: true, missing: false };
-      timeoutMs = Math.min(timeoutMs, remaining);
-    }
-    return base(bin, args, { ...callOptions, timeoutMs, ...(token ? { token } : {}) });
+/**
+ * `gh auth token --user`: a timeout or a transport error is `unavailable`
+ * (exit 5, retry); only gh saying it has no such login is identity_unavailable.
+ */
+function authTokenResult(
+  issued: ReturnType<ForgeRunner>,
+  apiHost: string,
+  account: string,
+  workspace: string,
+): ForgeResult<Credential> {
+  if (issued.missing)
+    return failure(
+      "unavailable",
+      "gh is not installed",
+      "install the GitHub CLI (https://cli.github.com) and run: gh auth login",
+    );
+  if (issued.timedOut)
+    return failure(
+      "unavailable",
+      `gh auth token ${issued.timeoutMs === 0 ? "not attempted: the time budget ran out" : `timed out after ${issued.timeoutMs ?? FORGE_TIMEOUTS.api} ms`} (looking up the ${account} login on ${apiHost})`,
+      "gh auth status  # check gh and the network, then retry",
+    );
+  const token = issued.status === 0 ? issued.stdout.trim() : "";
+  if (token) return success({ token, credential: "gh_account_token" });
+  const stderr = redactText(issued.stderr).trim();
+  const first = stderr.split(/\r?\n/u).find((line) => line.trim()) ?? "";
+  if (issued.status !== 0 && first && !/no oauth token|not logged in|no account/iu.test(stderr))
+    return failure(
+      "unavailable",
+      `gh auth token failed${isNetworkError(stderr) ? " (network)" : ""}: ${first.slice(0, 200)}`,
+      "gh auth status  # check gh and the network, then retry",
+    );
+  return failure(
+    "blocked",
+    `identity_unavailable: gh has no login for ${account} on ${apiHost} (workspace ${workspace})`,
+    `gh auth login --hostname ${apiHost}  # sign in as ${account}; workit passes that account's token per call and never switches the active account`,
+  );
+}
+
+const configuredHosts = (): ForgeHosts => {
+  const vcs = readVcsConfig();
+  if (vcs.status !== "valid") return {};
+  const host = (kind: "github" | "gitlab"): string[] => {
+    const value = (vcs.config[kind] as { host?: unknown } | undefined)?.host;
+    return typeof value === "string" && value.trim() ? [value.trim()] : [];
   };
+  return { github: host("github"), gitlab: host("gitlab") };
+};
+
+const createForge = (derived: DerivedForge, repo: string, runner: ForgeRunner): Forge =>
+  derived.kind === "github"
+    ? createGitHubForge({ apiHost: derived.apiHost, repo, runner })
+    : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+
+export function resolveForge(
+  cwd: string,
+  options: ResolveOptions = {},
+): ForgeResult<ResolvedForge> {
+  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure(
+      "blocked",
+      error instanceof Error ? error.message : String(error),
+      "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
+    );
+  }
+  const hosts = configuredHosts();
+  const pushed = pushForge(cwd, { branch: options.branch, hosts, sshConfig: options.sshConfig });
+  if (!pushed.ok) return failure(pushed.code, pushed.error, pushed.unblock);
+  const conflict = forgeConflict(pushed.forge, workspace?.vcs?.provider);
+  if (conflict) return failure("blocked", conflict.error, conflict.unblock);
+  const derived = pushed.forge;
+  const { kind, apiHost } = derived;
+  const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  // The deadline covers resolution too, so a verb's --timeout bounds it all.
+  const limits: { deadline: number | null } = { deadline: options.deadline ?? null };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok) return credential;
+  const runner = clampedRunner(base, limits, now, credential.data.token);
 
   // Base repository: an `upstream` remote on the same forge, else the fork parent.
   const headRepo = derived.repo;
-  const probe = createForge(derived, headRepo, runner);
+  const probe = memoizedIdentity(createForge(derived, headRepo, runner), scope, credential.data);
   const info = probe.repoInfo(headRepo);
   if (!info.ok && info.code !== "not_found") return info;
   const headProjectId = info.ok ? info.data.id : null;
@@ -201,13 +322,16 @@ export function resolveForge(
       : (remotes.find((name) => repoOfRemote(name) === baseRepo) ?? pushed.remote);
 
   return success({
-    forge: baseRepo === headRepo ? probe : createForge(derived, baseRepo, runner),
+    forge:
+      baseRepo === headRepo
+        ? probe
+        : memoizedIdentity(createForge(derived, baseRepo, runner), scope, credential.data),
     remote: pushed.remote,
     url: pushed.url,
     derived,
     workspace: workspace?.name ?? null,
     expectedAccount,
-    credential,
+    credential: credential.data.credential,
     headRepo,
     headProjectId,
     fork: baseRepo !== headRepo,
@@ -225,16 +349,142 @@ export function checkIdentity(resolved: ResolvedForge): ForgeResult<Identity> {
   const { forge, expectedAccount } = resolved;
   const identity = forge.identity(expectedAccount);
   if (!identity.ok) return identity;
-  if (identity.data.matches === false) {
-    const bin = forge.kind === "github" ? "gh" : "glab";
-    const where = `workspace ${resolved.workspace ?? "?"}`;
+  if (identity.data.matches === false)
+    return mismatch(resolved, identity.data.login ?? "?", resolved.workspace);
+  return identity;
+}
+
+const mismatch = <T>(
+  resolved: Pick<ResolvedForge, "forge" | "credential" | "expectedAccount">,
+  login: string,
+  workspace: string | null,
+): ForgeResult<T> => {
+  const { forge, expectedAccount } = resolved;
+  const bin = forge.kind === "github" ? "gh" : "glab";
+  const where = `workspace ${workspace ?? "?"}`;
+  const fileFix = `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`;
+  return failure(
+    "blocked",
+    `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${login} but ${where} expects ${expectedAccount}`,
+    resolved.credential === "workspace_token_file"
+      ? fileFix
+      : forge.kind === "github"
+        ? `gh auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`
+        : // glab keeps one login per host; switching it would change every repo.
+          `${fileFix} (glab keeps one login per host, so workit never switches it)`,
+  );
+};
+
+/** The forge could not answer at all, as opposed to answering against the account. */
+const unreachable = (result: { code: string; error: string }): boolean =>
+  result.code === "unavailable" && !/ is not authenticated for /u.test(result.error);
+
+/** Total budget for the identity check before a push (B1). */
+export const PUSH_IDENTITY_BUDGET_MS = 5_000;
+
+export type PushIdentity = {
+  /**
+   * verified: the forge says the credential is the workspace account.
+   * no_account: the workspace names no vcs.account, so there is nothing to check.
+   * skipped: the check could not run (forge down, slow, unknown, misconfigured);
+   * git pushes anyway and `reason` says why.
+   */
+  status: "verified" | "no_account" | "skipped";
+  forge: "github" | "gitlab" | null;
+  account: string | null;
+  login: string | null;
+  reason?: string;
+  unblock?: string;
+};
+
+/**
+ * The best-effort identity check before `git push`: git decides the transport,
+ * so a forge that cannot answer (missing, slow, offline, unknown, another
+ * provider) pushes with `status: "skipped"` and the reason (S10, B1). Positive
+ * evidence still blocks: another account, no gh login for the workspace
+ * account, a broken token file or a rejected credential. All calls share one
+ * `budgetMs`; explicit credentials are memoized.
+ */
+export function checkPushIdentity(
+  cwd: string,
+  options: Omit<ResolveOptions, "deadline"> & { budgetMs?: number } = {},
+): ForgeResult<PushIdentity> {
+  let workspace: ReturnType<typeof resolveRuntimeWorkspaceVcs>;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
     return failure(
       "blocked",
-      `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${identity.data.login} but ${where} expects ${expectedAccount}`,
-      resolved.credential === "workspace_token_file"
-        ? `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`
-        : `${bin} auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`,
+      error instanceof Error ? error.message : String(error),
+      "fix ~/.config/workit/workspaces.json (workit init → Workspaces)",
     );
   }
-  return identity;
+  const account = workspace?.vcs?.account ?? null;
+  const skipped = (forge: PushIdentity["forge"], reason: string, unblock?: string) =>
+    success<PushIdentity>({
+      status: "skipped",
+      forge,
+      account,
+      login: null,
+      reason,
+      ...(unblock ? { unblock } : {}),
+    });
+  const pushed = pushForge(cwd, {
+    branch: options.branch,
+    hosts: configuredHosts(),
+    sshConfig: options.sshConfig,
+  });
+  if (!pushed.ok) {
+    const host = /^unsupported_forge: .*?"([^"]+)"/u.exec(pushed.error)?.[1];
+    const what = /could not resolve ssh alias/u.test(pushed.error)
+      ? `could not resolve ssh alias ${host} to GitHub or GitLab`
+      : pushed.error.startsWith("unsupported_forge: ssh host")
+        ? `ssh host ${host} is not a GitHub/GitLab host or an alias workit can resolve`
+        : `${host} is not a GitHub or GitLab host workit knows`;
+    return skipped(
+      null,
+      host
+        ? `unsupported_forge: ${what}; account checks skipped, pushed with git only (no PR or CI verbs)`
+        : pushed.error,
+      pushed.unblock,
+    );
+  }
+  const derived = pushed.forge;
+  const conflict = forgeConflict(derived, workspace?.vcs?.provider);
+  if (conflict) return skipped(derived.kind, conflict.error, conflict.unblock);
+  if (!account) return success({ status: "no_account", forge: derived.kind, account, login: null });
+
+  const base =
+    options.runner ?? systemRunner(derived.kind, derived.apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const limits = { deadline: now() + (options.budgetMs ?? PUSH_IDENTITY_BUDGET_MS) };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  // A forge that cannot answer (missing CLI, timeout, transport) is skipped;
+  // local evidence against the account (no gh login for it, a broken
+  // vcs.tokenFile, a rejected credential) still blocks: over HTTPS git would
+  // push with whatever account gh's credential helper has active.
+  if (!credential.ok)
+    return unreachable(credential)
+      ? skipped(derived.kind, credential.error, credential.unblock)
+      : credential;
+  const forge = memoizedIdentity(
+    createForge(derived, derived.repo, clampedRunner(base, limits, now, credential.data.token)),
+    scope,
+    credential.data,
+  );
+  const identity = forge.identity(account);
+  if (!identity.ok)
+    return unreachable(identity)
+      ? skipped(derived.kind, identity.error, identity.unblock)
+      : identity;
+  if (identity.data.matches === false)
+    return mismatch(
+      { forge, credential: credential.data.credential, expectedAccount: account },
+      identity.data.login ?? "?",
+      workspace?.name ?? null,
+    );
+  if (identity.data.matches === null)
+    return skipped(derived.kind, identity.data.note ?? "the credential cannot read /user");
+  return success({ status: "verified", forge: derived.kind, account, login: identity.data.login });
 }

package/src/forge/types.ts

@@ -140,6 +140,28 @@ export type MergeResult = {
   mergeSha: string | null;
 };
 
+/** The editable fields of a PR/MR (`workit pr ready|edit`). */
+export type PrMeta = {
+  number: number;
+  url: string;
+  state: PrState;
+  draft: boolean;
+  title: string;
+  base: string;
+  headBranch: string;
+};
+
+/** What `workit pr edit` changes; unset fields are left alone. */
+export type PrEdit = {
+  title?: string;
+  body?: string;
+  base?: string;
+  addLabels: string[];
+  removeLabels: string[];
+  /** Logins; on GitHub `org/team` requests a team. */
+  addReviewers: string[];
+};
+
 /** A repository as the forge sees it: id and the repo it was forked from. */
 export type RepoInfo = { id: number | null; parent: string | null };
 
@@ -163,4 +185,14 @@ export interface Forge {
   merge(n: number, options: { sha: string; method: MergeMethod }): ForgeResult<MergeResult>;
   /** Retarget a PR/MR to another base branch (S12 stacks). */
   updateBase(n: number, base: string): ForgeResult<void>;
+  /** Title, draft flag, base and state of one PR/MR. */
+  prMeta(n: number): ForgeResult<PrMeta>;
+  /** Mark a draft ready (`draft: false`) or convert it back to a draft. */
+  setDraft(n: number, draft: boolean): ForgeResult<void>;
+  editPr(n: number, edit: PrEdit): ForgeResult<void>;
+  /** Reply to a review thread (GitHub review thread id, GitLab discussion id). */
+  replyThread(n: number, thread: string, body: string): ForgeResult<{ url: string | null }>;
+  resolveThread(n: number, thread: string): ForgeResult<void>;
+  /** One review thread of PR `n` read directly: null when it is not on that PR. */
+  threadState(n: number, thread: string): ForgeResult<"open" | "resolved" | null>;
 }

package/src/git/ops.ts

@@ -823,6 +823,8 @@ export function executePush(
     setUpstream?: boolean;
     actor: LedgerActor;
     timeoutMs?: number;
+    /** The pre-push identity check's outcome, kept on the ledger row. */
+    identity?: Record<string, unknown>;
   },
 ): ForgeResult<PushOutcome> {
   const before = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.branch}`);
@@ -940,6 +942,7 @@ export function executePush(
     previous: before.sha,
     pushed,
     forced,
+    ...(input.identity ? { identity: input.identity } : {}),
   });
   return success({
     remote: plan.remote,

package/src/git/rev.ts

@@ -879,15 +879,20 @@ export function pushForge(
   const forge = deriveForge(url, options);
   if (!forge) {
     // Never echo the raw URL: it may carry a token (https://user:tok@…).
-    const host = parseRemoteUrl(url)?.host || null;
+    const parsed = parseRemoteUrl(url);
+    const host = parsed?.host || null;
     return {
       ok: false,
       code: "unavailable",
       error: host
-        ? `cannot tell whether push host "${host}" is GitHub or GitLab`
+        ? parsed?.protocol === "ssh" && !host.includes(".")
+          ? `unsupported_forge: could not resolve ssh alias "${host}" to GitHub or GitLab; PR and CI verbs need one (workit git push still pushes with git)`
+          : parsed?.protocol === "ssh"
+            ? `unsupported_forge: ssh host "${host}" is not a GitHub/GitLab host or an alias workit can resolve; PR and CI verbs need one (workit git push still pushes with git)`
+            : `unsupported_forge: cannot tell whether push host "${host}" is GitHub or GitLab; PR and CI verbs need one (workit git push still pushes with git)`
         : `push URL ${redactRemote(url)} of remote "${remote}" is not a GitHub/GitLab URL`,
       unblock: host
-        ? `map the alias in ~/.ssh/config (Host ${host} / HostName github.com|gitlab.com) or set github.host / gitlab.host in ~/.config/workit/vcs.json`
+        ? `if ${host} is an ssh alias of GitHub/GitLab, add "Host ${host}" with "HostName github.com" (or gitlab.com) to ~/.ssh/config; if it is a self-hosted GitHub/GitLab, set github.host or gitlab.host in ~/.config/workit/vcs.json; other forges (Bitbucket, Gitea…) have no PR/CI verbs`
         : `git remote set-url --push ${remote} <ssh-or-https-url>`,
     };
   }
@@ -906,7 +911,7 @@ export function forgeConflict(
   if (!configured || configured === derived.kind) return null;
   return {
     code: "blocked",
-    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}`,
-    unblock: `set vcs.provider to "${derived.kind}" for this repo in ~/.config/workit/workspaces.json (workit-github-override), or push to a ${configured} remote`,
+    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}, so its account and grants do not apply; PR and CI verbs stop here (workit git push still pushes with git)`,
+    unblock: `add a workspace whose glob matches only this repo, with "vcs": {"provider": "${derived.kind}"} (and its account), to ~/.config/workit/workspaces.json; the most specific glob wins`,
   };
 }

package/src/hooks/handle.ts

@@ -2,6 +2,14 @@
 import { sessionContextText, turnContextText } from "./context";
 import type { HostDescriptor, Support } from "./descriptor";
 import { shellPolicy } from "./policy";
+import {
+  callKey,
+  NEXT_COMMAND,
+  noteRawCommit,
+  rawGitPost,
+  rawGitPre,
+  settlePendingCommit,
+} from "./raw-git";
 import { shellWrites, writeGate } from "./write-gate";
 import type { HookDecision, HookEventKind, HookInput, HostAdapter, RenderedHook } from "./protocol";
 
@@ -74,13 +82,32 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
       return text ? { kind: "context", text } : NONE;
     }
     case "shell.pre": {
-      const policy = usable(descriptor.shellPolicy.deny)
-        ? shellPolicy(input.cwd, event.command)
-        : NONE;
-      if (policy.kind !== "none" || !usable(descriptor.events["write.pre"].support)) return policy;
-      const writes = shellWrites(event.command);
-      return writes.writes ? writeGate(input.cwd, writes.targets) : NONE;
+      const canDeny = usable(descriptor.shellPolicy.deny);
+      const policy = canDeny ? shellPolicy(input.cwd, event.command) : NONE;
+      if (policy.kind !== "none") return policy;
+      // Without a post-tool event, the previous raw commit is recorded now.
+      const postTool = usable(descriptor.events["shell.post"].support);
+      if (!postTool) settlePendingCommit(input);
+      const raw = canDeny ? rawGitPre(input, event.command) : NONE;
+      if (raw.kind === "deny") return raw;
+      const writes = usable(descriptor.events["write.pre"].support)
+        ? shellWrites(event.command)
+        : { writes: false, targets: null };
+      const gate = writes.writes ? writeGate(input.cwd, writes.targets) : NONE;
+      if (gate.kind === "deny") return gate;
+      // The command will run: note HEAD so the post-tool hook (or the next
+      // command, without one) can tell whether a raw commit moved it.
+      noteRawCommit(
+        input,
+        event.command,
+        postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND,
+      );
+      return raw;
     }
+    case "shell.post":
+      if (usable(descriptor.events["shell.post"].support))
+        rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
+      return NONE;
     case "write.pre":
       return usable(descriptor.events["write.pre"].support)
         ? writeGate(input.cwd, event.paths)
@@ -99,7 +126,6 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
     // Host permission policy owns other tools; attestation, prompt and stop
     // control arrive with the CLI-observed evidence model.
     case "tool.pre":
-    case "shell.post":
     case "subagent.stop":
     case "prompt.submit":
     case "stop":