@brainervirus/workit-core 8.1.1 → 8.3.0

package/src/hooks/hosts/codex.ts

@@ -4,7 +4,12 @@ import type { HookDecision, HookEvent, HookEventKind, HostAdapter } from "../pro
 import { commandText, existingDirectory, isRecord, nonEmpty, optionalText } from "./fields";
 
 export type CodexHost = "codex_cli" | "codex_desktop";
-export type CodexHookEvent = "SessionStart" | "PreToolUse" | "SubagentStart" | "SubagentStop";
+export type CodexHookEvent =
+  | "SessionStart"
+  | "PreToolUse"
+  | "PostToolUse"
+  | "SubagentStart"
+  | "SubagentStop";
 type SessionSource = "startup" | "resume" | "clear" | "compact";
 
 export type CodexHookInput = {
@@ -21,6 +26,8 @@ export type CodexHookInput = {
   /** The shell command as one string; argv arrays are joined. */
   command?: string;
   tool_use_id?: string;
+  /** PostToolUse: the model-facing tool output. */
+  tool_response?: string;
   agent_id?: string;
   agent_type?: string;
   agent_transcript_path?: string | null;
@@ -53,7 +60,7 @@ export const CODEX_DESCRIPTOR: HostDescriptor = {
     // Codex PreToolUse intercepts shell calls, not apply_patch edits: the
     // before-write gate stays advisory rather than half-enforced.
     "write.pre": { support: "undocumented", native: null },
-    "shell.post": undocumented,
+    "shell.post": { support: "native", native: "PostToolUse" },
     "subagent.start": { support: "native", native: "SubagentStart" },
     "subagent.stop": { support: "native", native: "SubagentStop" },
     "prompt.submit": undocumented,
@@ -74,7 +81,7 @@ export const CODEX_DESCRIPTOR: HostDescriptor = {
     worktreeIsolation: "undocumented",
     maxConcurrency: "undocumented",
   },
-  provenance: { sessionId: "native", agentIdOnTool: "partial", postToolObserve: "undocumented" },
+  provenance: { sessionId: "native", agentIdOnTool: "partial", postToolObserve: "native" },
   interaction: { questions: "none", writeBoundary: "partial" },
   stopControl: "undocumented",
   shellAvailable: "native",
@@ -146,6 +153,7 @@ export const codexDescriptor = (host: CodexHost): HostDescriptor => ({ ...CODEX_
 const EVENTS: Record<CodexHookEvent, HookEventKind> = {
   SessionStart: "session.start",
   PreToolUse: "shell.pre",
+  PostToolUse: "shell.post",
   SubagentStart: "subagent.start",
   SubagentStop: "subagent.stop",
 };
@@ -166,10 +174,10 @@ export const parseCodexHookInput = (value: unknown): CodexParseResult => {
   const event = value.hook_event_name as CodexHookEvent;
   const cwd = existingDirectory(value.cwd);
   if (!cwd) return { ok: false, error: "cwd must be an existing absolute directory" };
-  if (event === "PreToolUse" && !nonEmpty(value.tool_name))
-    return { ok: false, error: "tool_name is required" };
+  const toolEvent = event === "PreToolUse" || event === "PostToolUse";
+  if (toolEvent && !nonEmpty(value.tool_name)) return { ok: false, error: "tool_name is required" };
   const command = isRecord(value.tool_input) ? commandText(value.tool_input.command) : null;
-  if (event === "PreToolUse" && isShellTool(value.tool_name) && !command)
+  if (toolEvent && isShellTool(value.tool_name) && !command)
     return { ok: false, error: "tool_input.command is required for shell tools" };
   if (event === "SubagentStart" && !nonEmpty(value.agent_id))
     return { ok: false, error: "agent_id is required" };
@@ -188,7 +196,10 @@ export const parseCodexHookInput = (value: unknown): CodexParseResult => {
         : {}),
       ...(nonEmpty(value.turn_id) ? { turn_id: value.turn_id } : {}),
       ...(nonEmpty(value.tool_name) ? { tool_name: value.tool_name } : {}),
-      ...(event === "PreToolUse" ? { tool_input: value.tool_input } : {}),
+      ...(toolEvent ? { tool_input: value.tool_input } : {}),
+      ...(event === "PostToolUse" && typeof value.tool_response === "string"
+        ? { tool_response: value.tool_response }
+        : {}),
       ...(command ? { command } : {}),
       ...(nonEmpty(value.tool_use_id) ? { tool_use_id: value.tool_use_id } : {}),
       ...(nonEmpty(value.agent_id) ? { agent_id: value.agent_id } : {}),
@@ -218,6 +229,20 @@ const protocolEvent = (input: CodexHookInput): HookEvent => {
           }
         : { kind: "tool.pre", tool: input.tool_name!, toolUseId };
     }
+    case "PostToolUse": {
+      const toolUseId = input.tool_use_id ?? null;
+      return isShellTool(input.tool_name)
+        ? {
+            kind: "shell.post",
+            command: input.command ?? "",
+            stdout: input.tool_response ?? "",
+            // Codex reports the model-facing output, not an exit code.
+            exitCode: null,
+            toolUseId,
+          }
+        : // A non-shell tool result carries nothing workit observes.
+          { kind: "tool.pre", tool: input.tool_name!, toolUseId };
+    }
     case "SubagentStart":
       return {
         kind: "subagent.start",
@@ -288,5 +313,5 @@ export const codexAdapter: HostAdapter = {
   },
   render,
   addendum: (input) =>
-    `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json${input.session.id ? ` --actor ${input.session.id}` : ""}. A verifier or reviewer records workit ledger verdict under a session the lead assigns (WORKIT_SESSION_ID=<lead>-v<n>), never the author's. Merge and release need a workspace grant (workit grant show); a question answer is not host permission.</workit-codex-mutations>`,
+    `<workit-codex-mutations>Codex MCP is read-only: unattested callers cannot mutate. Run workit verbs with the workit CLI on the shell (node_modules/.bin/workit, or npx -y @brainervirus/workit-cli): check, git branch|commit|push, pr, ci, stack, ledger, handoff; task-family mutations take --json${input.session.id ? ` --actor ${input.session.id}` : ""}. workit acts as this thread (CODEX_THREAD_ID${input.session.id ? `=${input.session.id}` : ""}) unless WORKIT_SESSION_ID is set. A verifier or reviewer records workit ledger verdict under a session the lead assigns (WORKIT_HOST=codex_cli WORKIT_SESSION_ID=<lead>-v<n>), never the author's. Merge and release need a workspace grant (workit grant show); a question answer is not host permission.</workit-codex-mutations>`,
 };

package/src/hooks/hosts/cursor.ts

@@ -278,6 +278,10 @@ const render = (decision: HookDecision, native: string | null) => {
       json: cursorDeny(decision.reason),
       exitCode: native !== null && BLOCKING.has(native) ? 2 : 0,
     };
+  // beforeShellExecution has no context channel: a raw-git nudge rides on
+  // agent_message next to Cursor's required permission answer.
+  if (decision.kind === "context" && native === "beforeShellExecution")
+    return { json: { permission: "allow", agent_message: decision.text }, exitCode: 0 };
   if (decision.kind === "context")
     return { json: { additional_context: decision.text }, exitCode: 0 };
   if (decision.kind === "notice")
@@ -319,4 +323,10 @@ export const cursorAdapter: HostAdapter = {
     };
   },
   render,
+  // Cursor's shell carries no conversation id (sessionStart env reaches hooks
+  // only), so the agent is told the id its `workit` calls should act as.
+  addendum: (input) =>
+    input.session.id
+      ? `<workit-session>Cursor puts no session id in the shell: prefix workit commands that record authorship with WORKIT_SESSION_ID=${input.session.id} (e.g. \`WORKIT_SESSION_ID=${input.session.id} workit git commit -m …\`). A verifier uses its own id, never this one.</workit-session>`
+      : null,
 };

package/src/hooks/index.ts

@@ -18,6 +18,7 @@ export {
 } from "./context";
 export { shellPolicy } from "./policy";
 export { shellWrites, writeGate } from "./write-gate";
+export { callKey, noteRawCommit, rawGitPost, rawGitPre } from "./raw-git";
 export { isWriteTool, writePaths } from "./hosts/fields";
 export { dispatchHook, failureDecision, handleHook, type HookDeps } from "./handle";
 export { HOOK_ADAPTERS, runHookProcess } from "./run";

package/src/hooks/protocol.ts

@@ -17,7 +17,13 @@ export type HookEvent =
   | { kind: "session.start"; source: SessionSource }
   /** Per-turn injection (OpenCode session context, Pi before_agent_start, Claude UserPromptSubmit). */
   | { kind: "context.turn" }
-  | { kind: "shell.pre"; command: string; toolUseId: string | null }
+  | {
+      kind: "shell.pre";
+      command: string;
+      toolUseId: string | null;
+      /** The shell that runs `command`; posix when absent. */
+      dialect?: "posix" | "powershell";
+    }
   /** A pre-tool gate for a non-shell tool. Host permission policy owns these. */
   | { kind: "tool.pre"; tool: string; toolUseId: string | null }
   /** A file-writing tool (Edit, Write, apply_patch…): the before-write gate (S17). */
@@ -28,6 +34,7 @@ export type HookEvent =
       stdout: string;
       exitCode: number | null;
       toolUseId: string | null;
+      dialect?: "posix" | "powershell";
     }
   | { kind: "subagent.start"; agentId: string; agentType: string; task: string | null }
   | {