@brainervirus/workit-core 8.12.2 → 8.13.0

package/src/hooks/hosts/cursor.ts

@@ -63,7 +63,9 @@ export const CURSOR_DESCRIPTOR: HostDescriptor = {
     // `loop_limit: 1`, so the continuation's own stop never runs the hook.
     stop: { support: "native", native: "stop" },
   },
-  shellPolicy: { deny: "native", channel: "exit2+json", failClosed: true },
+  // Fails open like every host: a payload Workit cannot parse (a renamed
+  // field in a Cursor release) must not block every shell command.
+  shellPolicy: { deny: "native", channel: "exit2+json", failClosed: false },
   context: {
     sessionStart: "native",
     perTurn: "none",

package/src/hooks/policy.ts

@@ -1,19 +1,28 @@
 import { shellBranchPolicyViolation } from "../core/route-intent";
 import type { HookDecision } from "./protocol";
-import type { ShellDialect } from "./shell-words";
+import { analysisDenial } from "./raw-git";
+import { ShellAnalysisError, type ShellDialect } from "./shell-words";
 
 /**
  * Branch policy for one shell command: a raw branch creation (`git switch -c`,
  * `checkout -b`, `branch`, `worktree add -b`, in any chain, directory or
  * wrapper) onto a noncompliant name is denied. Every other command keeps the
  * host's own permission decision. The reason carries the policy's correction.
+ * A command the hook cannot analyze is denied with how to split it; any other
+ * failure propagates to the host's fail policy.
  */
 export const shellPolicy = (
   cwd: string,
   command: string,
   dialect: ShellDialect = "posix",
 ): HookDecision => {
-  const policy = shellBranchPolicyViolation(cwd, command, dialect);
+  let policy: ReturnType<typeof shellBranchPolicyViolation>;
+  try {
+    policy = shellBranchPolicyViolation(cwd, command, dialect);
+  } catch (error) {
+    if (error instanceof ShellAnalysisError) return analysisDenial(error);
+    throw error;
+  }
   return policy && !policy.ok
     ? { kind: "deny", reason: `branch_policy_denied: ${policy.error}`, unblock: null }
     : { kind: "none" };