@brainervirus/workit-core 8.11.0 → 8.12.1

package/src/git/session-hook.ts

@@ -28,6 +28,12 @@
 //   it would commit a trailer-only message instead of aborting); for a
 //   template (git aborts an unedited one); for a comment-only message; and in a
 //   rebase or cherry-pick replaying commits that keep their own trailers.
+// - A workspace with `trailers: false`: the helper adds nothing when
+//   WORKIT_TRAILERS=off (set by `workit git commit`) or `workit git trailers`
+//   prints `off` (asked with a timeout when workit is on PATH). Without
+//   workit it fails open and adds the trailer, so doctor warns about any
+//   Workit hook or helper left there and `--fix` removes them
+//   (removeSessionHook); another tool's hook and its manual line stay.
 // - `--if-exists addIfDifferent`: the same session's trailer is never repeated;
 //   another session that amends adds its own, as `workit git commit --amend` does.
 import { spawnSync } from "node:child_process";
@@ -80,6 +86,19 @@ fi
 [ -n "$session" ] || exit 0
 [ \${#session} -le 128 ] || exit 0
 case "$session" in *[!A-Za-z0-9_.:@/+-]*) exit 0 ;; esac
+# A workspace with \`trailers: false\` keeps authorship in the ledger only.
+# \`workit git commit\` decides it already (WORKIT_TRAILERS); otherwise ask
+# workit, bounded, and add the trailer when it cannot answer.
+case "\${WORKIT_TRAILERS-}" in
+  off) exit 0 ;;
+  on) ;;
+  *)
+    if command -v workit >/dev/null 2>&1; then
+      t=; ! command -v timeout >/dev/null 2>&1 || t="timeout 5"
+      [ "$($t workit git trailers 2>/dev/null)" != off ] || exit 0
+    fi
+    ;;
+esac
 add_trailer() {
   [ -f "$1" ] && [ -r "$1" ] || return 0
   body=$(sed '/^# -\\{24\\} >8 -\\{24\\}$/,$d' "$1" | git stripspace --strip-comments)
@@ -519,3 +538,52 @@ export function installSessionHook(
     detail: `${verb} the Workit ${SESSION_HOOK_NAME} hook at ${status.hookPath}${helper}`,
   };
 }
+
+export type SessionHookRemoval = {
+  /** Whether Workit's own hook or helper was deleted. */
+  action: "removed" | "unchanged" | "skipped";
+  /** The files deleted: Workit's hook (only one carrying its marker) and the helper. */
+  removed: string[];
+  status: SessionHookStatus;
+  detail: string;
+};
+
+/** Whether `status` finds Workit's own hook (any version) in the slot. */
+export const workitHookIn = (status: SessionHookStatus): boolean =>
+  status.hookPath !== null && (readText(status.hookPath)?.includes(SESSION_HOOK_MARKER) ?? false);
+
+/** Whether the helper exists for `status`, current or not. */
+export const helperIn = (status: SessionHookStatus): boolean =>
+  status.helperPath !== null && exists(status.helperPath);
+
+/**
+ * For a workspace with `trailers: false`: delete Workit's own hook (only a
+ * slot holding its marker) and the helper. Another tool's hook, a husky
+ * script or a lefthook job that runs the helper is never edited; without the
+ * helper its manual line runs nothing.
+ */
+export function removeSessionHook(
+  cwd: string,
+  env: NodeJS.ProcessEnv = process.env,
+): SessionHookRemoval {
+  const status = inspectSessionHook(cwd, env);
+  if (status.state === "not_git")
+    return { action: "skipped", removed: [], status, detail: "not inside a git work tree" };
+  const removed: string[] = [];
+  if (workitHookIn(status)) {
+    rmSync(status.hookPath!, { force: true });
+    removed.push(status.hookPath!);
+  }
+  if (helperIn(status)) {
+    rmSync(status.helperPath!, { force: true });
+    removed.push(status.helperPath!);
+  }
+  return {
+    action: removed.length ? "removed" : "unchanged",
+    removed,
+    status: inspectSessionHook(cwd, env),
+    detail: removed.length
+      ? `removed ${removed.join(" and ")}`
+      : "no Workit session hook or helper to remove",
+  };
+}

package/src/hooks/handle.ts

@@ -7,6 +7,7 @@ import {
 } from "./context";
 import type { HostDescriptor, Support } from "./descriptor";
 import { branchGuidance } from "../core/branch";
+import { workspaceTrailers } from "../core/workspaces";
 import { recordIssuedSession } from "../host-session";
 import { shellPolicy } from "./policy";
 import {
@@ -78,8 +79,12 @@ const CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
  * (`workit git …` included) and cannot be turned off, so an isolated agent
  * runs git itself and workit for everything else.
  */
-const ISOLATED_GIT =
-  'Run git as plain, separate commands inside your worktree (`git switch -c <branch> <base>`, `git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a commit-msg hook that adds the trailer), never `workit git …`: Claude Code\'s worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (`workit check`, `workit ledger`, `workit pr`).';
+const isolatedGit = (cwd: string): string =>
+  `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${
+    workspaceTrailers(cwd).enabled
+      ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer'
+      : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"
+  }; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 
 const subagentStartText = (
   input: HookInput,
@@ -94,9 +99,9 @@ const subagentStartText = (
     (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
-    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${ISOLATED_GIT} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
-    return `${ISOLATED_GIT}\n${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
+    return `${isolatedGit(input.cwd)}\n${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
     // No host isolation: the lead makes the worktree, and workit git works there.
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;

package/src/host-session.ts

@@ -10,6 +10,7 @@
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { resolveStateDir } from "./core/logger";
 import { resolveStore } from "./store/paths";
 
 export type HostSession = { host: string | null; session: string | null };
@@ -80,36 +81,84 @@ export function realHostSession(env: NodeJS.ProcessEnv): RealSession {
 }
 
 // Ids a SubagentStart hook gave a lead's subagents (`<lead>:<agent id>`): one
-// empty file per id under `<store>/hooks/issued/<lead hash>/`, so concurrent
+// empty file per id under `<state>/issued/<lead hash>/`, so concurrent
 // hooks never lose each other's write, bounded per lead.
 const ISSUED_PER_LEAD = 64;
 
 /**
  * Written into each issued-id file. A hook bundle that contains this string
- * records issued ids; `workit doctor` looks for it in the installed Claude
+ * records issued ids per lead in the user's state dir (`/2`; `/1` hooks of
+ * 8.10-8.12 wrote them per repository, which breaks cross-repo verdicts); `workit doctor` looks for it in the installed Claude
  * Code and Codex hooks to catch a plugin older than the CLI.
  */
-export const ISSUED_SESSIONS_MARKER = "workit-issued-sessions/1";
+export const ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2";
 
 const hash = (value: string): string =>
   createHash("sha256").update(value).digest("hex").slice(0, 32);
 
-const issuedRoot = (cwd: string): string | null => {
-  const location = resolveStore(cwd);
-  return location instanceof Error ? null : path.join(location.dir, "hooks", "issued");
+// Issued ids live in the per-user state dir, keyed by lead session: a lead
+// started in one repository delegates review of others, and the verifier
+// records its verdict from whichever repository it reviews (#294).
+const userIssuedRoot = (): string => path.join(resolveStateDir(), "issued");
+
+/**
+ * Hooks of 8.10-8.12 wrote issued ids into `<store>/hooks/issued` of the
+ * lead's repository. Move them into the per-user registry file by file
+ * (copy, then unlink: an id an old hook writes meanwhile stays for the next
+ * read) and drop the emptied directories. Each lead migrates on its own, so
+ * one bad entry never strands the rest. Fails open.
+ */
+function migrateRepoIssued(cwd: string | undefined): void {
+  if (cwd === undefined) return;
+  let old: string;
+  try {
+    const location = resolveStore(cwd);
+    if (location instanceof Error) return;
+    old = path.join(location.dir, "hooks", "issued");
+    if (!fs.existsSync(old)) return;
+  } catch {
+    return;
+  }
+  for (const lead of safeList(old)) {
+    try {
+      const from = path.join(old, lead);
+      if (!fs.statSync(from).isDirectory()) continue;
+      const to = path.join(userIssuedRoot(), lead);
+      fs.mkdirSync(to, { recursive: true, mode: 0o700 });
+      for (const id of fs.readdirSync(from)) {
+        fs.copyFileSync(path.join(from, id), path.join(to, id));
+        fs.rmSync(path.join(from, id), { force: true });
+      }
+      removeIfEmpty(from);
+    } catch {
+      // Fail open: this lead's ids stay for the next read.
+    }
+  }
+  removeIfEmpty(old);
+}
+
+const safeList = (dir: string): string[] => {
+  try {
+    return fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
 };
 
-const issuedDir = (cwd: string, lead: string): string | null => {
-  const root = issuedRoot(cwd);
-  return root === null ? null : path.join(root, hash(lead));
+const removeIfEmpty = (dir: string): void => {
+  try {
+    fs.rmdirSync(dir);
+  } catch {
+    // Not empty (a concurrent old hook wrote) or already gone.
+  }
 };
 
-/** No hook in this workspace has ever recorded an issued id (an older plugin hook, most likely). */
-const noIssuedRecord = (cwd: string | undefined): boolean => {
+/** This lead's hooks never recorded an issued id (an older plugin hook, most likely). */
+const noIssuedRecord = (cwd: string | undefined, lead: string): boolean => {
   if (cwd === undefined) return false;
   try {
-    const root = issuedRoot(cwd);
-    return root !== null && !fs.existsSync(root);
+    migrateRepoIssued(cwd);
+    return !fs.existsSync(path.join(userIssuedRoot(), hash(lead)));
   } catch {
     return false;
   }
@@ -124,9 +173,9 @@ const PLUGIN_UPDATE: Readonly<Record<string, string>> = {
 /** Remember that a SubagentStart hook issued `issued` to a subagent of `lead`. Fails open. */
 export function recordIssuedSession(cwd: string, lead: string, issued: string): void {
   try {
-    const dir = issuedDir(cwd, lead);
-    if (!dir) return;
-    fs.mkdirSync(dir, { recursive: true });
+    migrateRepoIssued(cwd);
+    const dir = path.join(userIssuedRoot(), hash(lead));
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const own = hash(issued);
     fs.writeFileSync(path.join(dir, own), ISSUED_SESSIONS_MARKER);
     const entries = fs.readdirSync(dir);
@@ -144,10 +193,9 @@ export function recordIssuedSession(cwd: string, lead: string, issued: string):
 }
 
 const wasIssued = (cwd: string | undefined, lead: string, claimed: string): boolean => {
-  if (cwd === undefined) return false;
+  migrateRepoIssued(cwd);
   try {
-    const dir = issuedDir(cwd, lead);
-    return dir !== null && fs.existsSync(path.join(dir, hash(claimed)));
+    return fs.existsSync(path.join(userIssuedRoot(), hash(lead), hash(claimed)));
   } catch {
     return false;
   }
@@ -220,9 +268,9 @@ export function sessionClaimRefusal(
   const error = `forged_session: ${claimed} is neither this shell's session (${real.session}) nor an id its host issued to a child of it`;
   // A well-formed subagent id, but no hook here ever recorded one: the hook
   // most likely predates this CLI (CLI and plugin update separately).
-  if (issuedClaim && noIssuedRecord(cwd) && host !== null && PLUGIN_UPDATE[host])
+  if (issuedClaim && noIssuedRecord(cwd, leadOf(claimed)) && host !== null && PLUGIN_UPDATE[host])
     return {
-      error: `${error}; no SubagentStart hook in this workspace has recorded an issued id`,
+      error: `${error}; no SubagentStart hook has recorded an issued id for this lead`,
       unblock: `the workit plugin hook is probably older than this CLI and does not record the ids it issues: update the plugin (${PLUGIN_UPDATE[host]}), then relaunch the verifier so its SubagentStart runs the new hook (workit doctor checks this as hook_issued_sessions)`,
     };
   const ownChildShell = host !== null && OWN_CHILD_SHELL.has(host);