@brainervirus/workit-core 8.11.0 → 8.12.0

package/src/git/session-hook.ts

@@ -28,6 +28,12 @@
 //   it would commit a trailer-only message instead of aborting); for a
 //   template (git aborts an unedited one); for a comment-only message; and in a
 //   rebase or cherry-pick replaying commits that keep their own trailers.
+// - A workspace with `trailers: false`: the helper adds nothing when
+//   WORKIT_TRAILERS=off (set by `workit git commit`) or `workit git trailers`
+//   prints `off` (asked with a timeout when workit is on PATH). Without
+//   workit it fails open and adds the trailer, so doctor warns about any
+//   Workit hook or helper left there and `--fix` removes them
+//   (removeSessionHook); another tool's hook and its manual line stay.
 // - `--if-exists addIfDifferent`: the same session's trailer is never repeated;
 //   another session that amends adds its own, as `workit git commit --amend` does.
 import { spawnSync } from "node:child_process";
@@ -80,6 +86,19 @@ fi
 [ -n "$session" ] || exit 0
 [ \${#session} -le 128 ] || exit 0
 case "$session" in *[!A-Za-z0-9_.:@/+-]*) exit 0 ;; esac
+# A workspace with \`trailers: false\` keeps authorship in the ledger only.
+# \`workit git commit\` decides it already (WORKIT_TRAILERS); otherwise ask
+# workit, bounded, and add the trailer when it cannot answer.
+case "\${WORKIT_TRAILERS-}" in
+  off) exit 0 ;;
+  on) ;;
+  *)
+    if command -v workit >/dev/null 2>&1; then
+      t=; ! command -v timeout >/dev/null 2>&1 || t="timeout 5"
+      [ "$($t workit git trailers 2>/dev/null)" != off ] || exit 0
+    fi
+    ;;
+esac
 add_trailer() {
   [ -f "$1" ] && [ -r "$1" ] || return 0
   body=$(sed '/^# -\\{24\\} >8 -\\{24\\}$/,$d' "$1" | git stripspace --strip-comments)
@@ -519,3 +538,52 @@ export function installSessionHook(
     detail: `${verb} the Workit ${SESSION_HOOK_NAME} hook at ${status.hookPath}${helper}`,
   };
 }
+
+export type SessionHookRemoval = {
+  /** Whether Workit's own hook or helper was deleted. */
+  action: "removed" | "unchanged" | "skipped";
+  /** The files deleted: Workit's hook (only one carrying its marker) and the helper. */
+  removed: string[];
+  status: SessionHookStatus;
+  detail: string;
+};
+
+/** Whether `status` finds Workit's own hook (any version) in the slot. */
+export const workitHookIn = (status: SessionHookStatus): boolean =>
+  status.hookPath !== null && (readText(status.hookPath)?.includes(SESSION_HOOK_MARKER) ?? false);
+
+/** Whether the helper exists for `status`, current or not. */
+export const helperIn = (status: SessionHookStatus): boolean =>
+  status.helperPath !== null && exists(status.helperPath);
+
+/**
+ * For a workspace with `trailers: false`: delete Workit's own hook (only a
+ * slot holding its marker) and the helper. Another tool's hook, a husky
+ * script or a lefthook job that runs the helper is never edited; without the
+ * helper its manual line runs nothing.
+ */
+export function removeSessionHook(
+  cwd: string,
+  env: NodeJS.ProcessEnv = process.env,
+): SessionHookRemoval {
+  const status = inspectSessionHook(cwd, env);
+  if (status.state === "not_git")
+    return { action: "skipped", removed: [], status, detail: "not inside a git work tree" };
+  const removed: string[] = [];
+  if (workitHookIn(status)) {
+    rmSync(status.hookPath!, { force: true });
+    removed.push(status.hookPath!);
+  }
+  if (helperIn(status)) {
+    rmSync(status.helperPath!, { force: true });
+    removed.push(status.helperPath!);
+  }
+  return {
+    action: removed.length ? "removed" : "unchanged",
+    removed,
+    status: inspectSessionHook(cwd, env),
+    detail: removed.length
+      ? `removed ${removed.join(" and ")}`
+      : "no Workit session hook or helper to remove",
+  };
+}

package/src/hooks/handle.ts

@@ -7,6 +7,7 @@ import {
 } from "./context";
 import type { HostDescriptor, Support } from "./descriptor";
 import { branchGuidance } from "../core/branch";
+import { workspaceTrailers } from "../core/workspaces";
 import { recordIssuedSession } from "../host-session";
 import { shellPolicy } from "./policy";
 import {
@@ -78,8 +79,12 @@ const CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
  * (`workit git …` included) and cannot be turned off, so an isolated agent
  * runs git itself and workit for everything else.
  */
-const ISOLATED_GIT =
-  'Run git as plain, separate commands inside your worktree (`git switch -c <branch> <base>`, `git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a commit-msg hook that adds the trailer), never `workit git …`: Claude Code\'s worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (`workit check`, `workit ledger`, `workit pr`).';
+const isolatedGit = (cwd: string): string =>
+  `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${
+    workspaceTrailers(cwd).enabled
+      ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer'
+      : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"
+  }; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 
 const subagentStartText = (
   input: HookInput,
@@ -94,9 +99,9 @@ const subagentStartText = (
     (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
-    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
-    return `${ISOLATED_GIT}\n${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
+    return `${isolatedGit(input.cwd)}\n${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
     // No host isolation: the lead makes the worktree, and workit git works there.
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;