@brainervirus/workit-core 8.13.0 → 8.14.0

package/src/fanout-brief.ts

@@ -17,6 +17,7 @@
 // the integration tip before reporting, and nothing else. It only reads, apart
 // from hiding `.workit-scratch/` in the repository's info/exclude.
 import { createHash } from "node:crypto";
+import { workspaceTierModel } from "./core/workspaces";
 import { activeStanding, readLedger, type LedgerActor } from "./ledger";
 import { branchRef, fanoutFail, planLeads, type FanoutFile, type FanoutResult } from "./fanout";
 import {
@@ -38,6 +39,8 @@ export type BriefOutcome = {
   branch: string;
   base: string;
   tier: string;
+  /** The model `fanout.tierModels` names for the tier on the lead's host, else null. */
+  model: string | null;
   /** Absolute when the slice's worktree exists, else relative to the worker's worktree root. */
   scratch: string;
   /** The id a worker exports, or null when its host issues or derives it. */
@@ -171,6 +174,7 @@ export function renderBrief(
     what: String(row.what),
   }));
   const identity = identityOf(input.actor.host);
+  const model = workspaceTierModel(cwd, slice.tier, input.actor.host);
   const minted = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
   const session = identity === "declared" ? minted : null;
   const fanIn =
@@ -200,6 +204,9 @@ export function renderBrief(
     ...slice.acceptance.map((line) => `  - ${line}`),
     `VERIFY: ${slice.verify.join("; ")}`,
     `TIER: ${slice.tier}`,
+    ...(model
+      ? [`  model: ${model.model}  (fanout.tierModels in workspace ${model.workspace})`]
+      : []),
     `TIMEBOX: ${slice.timebox ?? DEFAULT_TIMEBOX}; past it without a new commit you will be replaced`,
     scratchLine,
     `FORBIDDEN: ${slice.forbidden.join("; ")}`,
@@ -222,6 +229,7 @@ export function renderBrief(
       branch,
       base: slice.base,
       tier: slice.tier,
+      model: model?.model ?? null,
       scratch,
       session,
       standing,

package/src/fanout-status.ts

@@ -18,7 +18,8 @@
 import { parseDuration } from "./duration";
 import { checksState, gatingChecks, missingRequired, type ChecksState } from "./forge/report";
 import type { ResolvedForge } from "./forge/resolve";
-import { checkVerdicts, readLedger, type ReadRow, type VerdictBasis } from "./ledger";
+import { workspaceTierModel } from "./core/workspaces";
+import { actorFromEnv, checkVerdicts, readLedger, type ReadRow, type VerdictBasis } from "./ledger";
 import { sliceLandings } from "./fanout-check";
 import { forgeBreaker, inSliceRun } from "./fanout-landed";
 import {
@@ -74,6 +75,8 @@ export type StatusOutcome = {
   landingOrder: string[];
   /** Not started; every dependency landed (or, stacked, its parent has an accepted verdict). */
   spawnable: string[];
+  /** The model `fanout.tierModels` names for each spawnable slice's TIER on this host. */
+  spawnModels: Record<string, string>;
   stuck: string[];
   next: string;
   notes: string[];
@@ -85,6 +88,8 @@ export type StatusOptions = {
   forgeError?: string | null;
   stuckAfterMs?: number | null;
   now?: Date;
+  /** The lead's host, for `fanout.tierModels`; default: the environment's (WORKIT_HOST…). */
+  host?: string | null;
 };
 
 /** A TIMEBOX such as `45 minutes`, `2h` or `1h30m`, in ms; null without a unit or otherwise. */
@@ -279,6 +284,16 @@ export function fanoutStatus(
     if (row.waitsFor.length && !suggested.includes(id))
       row.reasons.push(`waits for ${row.waitsFor.join(", ")}`);
   }
+  const host = options.host === undefined ? actorFromEnv(process.env).host : options.host;
+  const spawnModels: Record<string, string> = {};
+  for (const id of spawnable) {
+    const tier = plan.slices.find((slice) => slice.id === id)?.tier;
+    const model = tier ? workspaceTierModel(cwd, tier, host) : null;
+    if (model) spawnModels[id] = model.model;
+  }
+  const spawnList = spawnable
+    .map((id) => (spawnModels[id] ? `${id} (model ${spawnModels[id]})` : id))
+    .join(", ");
   const stuck = order.filter((id) => out.get(id)?.stuck);
   const down = breaker.down();
   if (down)
@@ -300,7 +315,7 @@ export function fanoutStatus(
       : noPr.length
         ? `open PRs for ${noPr.join(", ")}: workit git push && workit pr create --fill on each branch`
         : spawnable.length
-          ? `spawn ${spawnable.join(", ")} (workit fanout worktree create <slice> on hosts without native worktrees)`
+          ? `spawn ${spawnList} (workit fanout worktree create <slice> on hosts without native worktrees)`
           : order.every((id) => out.get(id)?.landed)
             ? "every slice has landed"
             : "wait for workers, then workit fanout status again";
@@ -317,6 +332,7 @@ export function fanoutStatus(
       slices: order.map((id) => out.get(id) as SliceStatusRow),
       landingOrder: suggested,
       spawnable,
+      spawnModels,
       stuck,
       next,
       notes,

package/src/forge/pr-ops.ts

@@ -35,6 +35,7 @@ import { currentBranch, fetchRefs, GIT_TIMEOUTS, remoteRefTip, resolveRef } from
 import {
   appendObserved,
   checkVerdicts,
+  tamperedUnblock,
   readLedger,
   type LedgerActor,
   type VerdictCheck,
@@ -366,6 +367,8 @@ export type MergeOutcome = {
   grant: { source: AutonomySource };
   deletedBranch: boolean | { error: string };
   recorded: { id: string } | { error: string };
+  /** The `pr.merge.verified` row confirming `recorded`, or why it was not written. */
+  confirmed: { id: string } | { error: string };
   /**
    * Release tracks: when the PR landed on a track's production branch, the
    * branches it must flow back into (mergeBackBranches); empty otherwise.
@@ -420,7 +423,9 @@ export type MergeRefusal = {
     | "already_merged"
     | "closed"
     | "protected_branch"
-    | "base_mismatch";
+    | "base_mismatch"
+    | "ledger_tampered"
+    | "intent_unrecorded";
   next?: string;
   blockers?: string[];
   verdict?: Pick<VerdictCheck, "head" | "accepted" | "authors">;
@@ -434,6 +439,8 @@ export type MergeResult =
       error: string;
       unblock?: string;
       refusal?: MergeRefusal;
+      /** merge_unverified: the `pr.merged` row (verified:false) written when the forge accepted it. */
+      recorded?: { id: string } | { error: string };
     };
 
 const refuse = (error: string, unblock: string, refusal: MergeRefusal): MergeResult => ({
@@ -635,7 +642,7 @@ export async function mergePullRequest(
         { reason: "protected_branch" },
       );
   }
-  const ledger = readLedger(cwd);
+  const ledger = readLedger(cwd, { integrity: true });
   if (!ledger.ok) return ledger;
   const check = checkVerdicts(cwd, branch, ledger.value.rows);
   const summary = { head: check.head, accepted: check.accepted, authors: check.authors };
@@ -680,6 +687,12 @@ export async function mergePullRequest(
       `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`,
       { reason: "head_mismatch", verdict: summary },
     );
+  else if (!covered && check.accepted.reasons.includes("ledger_tampered"))
+    return refuse(
+      `ledger_tampered: a ledger row was edited, removed or moved, so no verdict for ${label} is accepted until it is repaired`,
+      tamperedUnblock(cwd),
+      { reason: "ledger_tampered", verdict: summary },
+    );
   else if (!covered)
     return refuse(
       `NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`,
@@ -689,12 +702,57 @@ export async function mergePullRequest(
 
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok) return squashMessage;
+  // The intent goes in before the forge write: a merge call that errors after
+  // the forge did merge still leaves a record `pr status` reads. A merge that
+  // cannot be recorded never starts.
+  const intent = appendObserved(cwd, {
+    type: "pr.merge.intent",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...(unverified ? { unverified: unverified.recorded } : {}),
+    grant: grant.source,
+  });
+  if (!intent.ok)
+    return refuse(
+      `intent_unrecorded: the merge intent for ${label} could not be recorded (${intent.error}); nothing was merged`,
+      "fix the ledger (workit ledger check), then merge again",
+      { reason: "intent_unrecorded" },
+    );
+  const intentId = String(intent.value.id);
   const merged = resolved.forge.merge(doc.number, {
     sha: head,
     method: input.method,
     ...(squashMessage ? { squashMessage: squashMessage.data } : {}),
   });
-  if (!merged.ok) return merged;
+  if (!merged.ok)
+    return {
+      ...merged,
+      error: `${merged.error} (merge intent ${intentId} is recorded: if the forge merged anyway, workit pr status reads it)`,
+    };
+  // Recorded as soon as the forge accepts it (N3): a failed read below must
+  // not leave a merge that `pr status`, the stop hook and `verify-delivery
+  // merged` cannot see. The post-verify then confirms it in its own row.
+  const row = appendObserved(cwd, {
+    type: "pr.merged",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    mergeSha: merged.data.mergeSha,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...(unverified ? { unverified: unverified.recorded } : {}),
+    grant: grant.source,
+    intent: intentId,
+    verified: false,
+  });
+  const recorded = row.ok ? { id: String(row.value.id) } : { error: row.error };
   // Post-verify: the forge must report the PR merged.
   let state = "open";
   for (const delay of [0, ...VERIFY_DELAYS_MS]) {
@@ -707,9 +765,29 @@ export async function mergePullRequest(
     return {
       ok: false,
       code: "failed",
-      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}`,
+      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
       unblock: `workit verify-delivery merged --pr ${doc.number}`,
+      recorded,
     };
+  const confirmation =
+    "id" in recorded
+      ? appendObserved(cwd, {
+          type: "pr.merge.verified",
+          actor: input.actor,
+          branch,
+          head,
+          pr: doc.number,
+          base: doc.base,
+          merged: recorded.id,
+          mergeSha: merged.data.mergeSha,
+        })
+      : null;
+  const confirmed: MergeOutcome["confirmed"] =
+    confirmation === null
+      ? { error: "no pr.merged row to confirm" }
+      : confirmation.ok
+        ? { id: String(confirmation.value.id) }
+        : { error: confirmation.error };
 
   let deletedBranch: MergeOutcome["deletedBranch"] = false;
   if (input.deleteBranch) {
@@ -720,19 +798,6 @@ export async function mergePullRequest(
       deleted.ok || (gone && gone.ok && gone.sha === null) ? true : { error: deleted.error };
   }
   const mergeBack = mergeBackFor(cwd, doc.base, branch);
-  const row = appendObserved(cwd, {
-    type: "pr.merged",
-    actor: input.actor,
-    branch,
-    head,
-    pr: doc.number,
-    base: doc.base,
-    mergeSha: merged.data.mergeSha,
-    method: input.method,
-    verdictId: verdict.verdictId,
-    ...(unverified ? { unverified: unverified.recorded } : {}),
-    grant: grant.source,
-  });
   return {
     ok: true,
     data: {
@@ -747,7 +812,8 @@ export async function mergePullRequest(
       unverified,
       grant: { source: grant.source },
       deletedBranch,
-      recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+      recorded,
+      confirmed,
       mergeBack: mergeBack.branches,
       mergeBackTrack: mergeBack.track,
     },

package/src/forge/redact.ts

@@ -8,8 +8,12 @@ const R = "[REDACTED]";
 const TOKEN_PATTERNS: readonly RegExp[] = [
   // GitHub tokens (classic, fine-grained, app, OAuth, refresh).
   /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
-  // GitLab tokens: glpat-, glrt-, gldt-, glcbt-, glptt-, glft-, gloas-, …
-  /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+  // GitLab tokens, by every prefix GitLab documents
+  // (https://docs.gitlab.com/security/tokens/#token-prefixes) and only those:
+  // a bare `gl…-` also matches words such as `global-setup-teardown-hook`.
+  /\b(?:glpat|gloas|gldt|glrtr|glrt|glcbt|glptt|glft|glimt|glagent|glwt|glsoat|glffct)-[A-Za-z0-9_-]{20,}/gu,
+  // GitLab's session cookie.
+  /\b_gitlab_session=[A-Za-z0-9%_-]{16,}/gu,
   /\bnpm_[A-Za-z0-9]{30,}/gu,
   /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
   /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,

package/src/forge/resolve.ts

@@ -181,6 +181,21 @@ function resolveCredential(
         `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`,
         `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`,
       );
+    // Like youtrack.token: a token other users can read is refused (N14).
+    if (process.platform !== "win32") {
+      let mode = 0;
+      try {
+        mode = fs.statSync(tokenFile.trim()).mode;
+      } catch {
+        // unreadable: reported below
+      }
+      if ((mode & 0o077) !== 0)
+        return failure(
+          "blocked",
+          `workspace ${workspace?.name ?? "?"} vcs.tokenFile is readable by group or other (mode ${(mode & 0o777).toString(8).padStart(4, "0")})`,
+          `chmod 600 ${tokenFile.trim()}`,
+        );
+    }
     let token = "";
     try {
       token = fs.readFileSync(tokenFile.trim(), "utf8").trim();

package/src/git/ops.ts

@@ -49,6 +49,7 @@ import {
 } from "../core/workspaces";
 import { redactText } from "../forge/redact";
 import { failure, success, type ForgeResult } from "../forge/types";
+import { issuedBinding, sessionClaimRefusal } from "../host-session";
 import { appendObserved, readLedger, type LedgerActor } from "../ledger";
 import {
   GIT_TIMEOUTS,
@@ -649,6 +650,25 @@ export function gitCommit(
       "invalid_input",
       "WORKIT_SESSION_ID must be 1-128 characters of [A-Za-z0-9_.:@/+-]",
     );
+  // A commit names its author session (commit.recorded, the trailer): the
+  // same claim check as a verdict, and an id issued to a verifier or
+  // reviewer never authors code (audit mv83zyg6 P2b).
+  if (session) {
+    const env = input.env ?? process.env;
+    if (issuedBinding(cwd, session) !== null)
+      return failure(
+        "blocked",
+        `judge_session: ${session} was issued to a verifier or reviewer subagent; it records verdicts and never authors commits`,
+        "commit from the implementer's or the lead's own session (unset WORKIT_SESSION_ID back to the shell's)",
+      );
+    const refusal = sessionClaimRefusal(env, session, cwd);
+    if (refusal)
+      return failure(
+        "blocked",
+        refusal.error,
+        "commit from the session this shell really is: never set WORKIT_SESSION_ID by hand for a commit (unset it, or use the id the host put in this shell)",
+      );
+  }
   // A commit that only rewords (amend) or is empty on purpose needs no change.
   const changeRequired = !input.amend && !input.allowEmpty;
 

package/src/hooks/handle.ts

@@ -26,7 +26,8 @@ import {
   withContextLine,
 } from "./skill-nudge";
 import { stopDecision } from "./stop";
-import { shellWrites, writeGate } from "./write-gate";
+import { liveOwner } from "../core/live-session";
+import { shellGate, writeGate } from "./write-gate";
 import type { HookDecision, HookEventKind, HookInput, HostAdapter, RenderedHook } from "./protocol";
 
 export type HookDeps = { descriptor: HostDescriptor; addendum: string | null };
@@ -108,10 +109,13 @@ const subagentStartText = (
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId) return readOnly;
   const own = subagentSession(session, event.agentId);
-  // `ledger verdict` accepts `<lead>:<agent id>` only when this hook issued it.
+  // `ledger verdict` accepts `<lead>:<agent id>` only when this hook issued it,
+  // and only with the token it hands to this subagent alone.
   // (An isolated judge's text is rebuilt with cwd "": the hook's own cwd then.)
-  if (session) recordIssuedSession(input.cwd || process.cwd(), session, own);
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
+  // Issued once: a replayed SubagentStart for the same id gets no token.
+  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
+  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 
 export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
@@ -153,10 +157,10 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
       if (!postTool) settlePendingCommit(input);
       const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE;
       if (raw.kind === "deny") return raw;
-      const writes = usable(descriptor.events["write.pre"].support)
-        ? shellWrites(event.command)
-        : { writes: false, targets: null };
-      const gate = writes.writes ? writeGate(input.cwd, writes.targets) : NONE;
+      // The before-write gate and the live-session guard (#274).
+      const gate = usable(descriptor.events["write.pre"].support)
+        ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect)
+        : NONE;
       if (gate.kind === "deny") return gate;
       // The command will run: note HEAD so the post-tool hook (or the next
       // command, without one) can tell whether a raw commit moved it.
@@ -179,7 +183,7 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
       return NONE;
     case "write.pre":
       return usable(descriptor.events["write.pre"].support)
-        ? writeGate(input.cwd, event.paths)
+        ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport))
         : NONE;
     case "subagent.start":
       return {

package/src/hooks/index.ts

@@ -19,7 +19,8 @@ export {
   type SessionHandle,
 } from "./context";
 export { shellPolicy } from "./policy";
-export { shellWrites, writeGate } from "./write-gate";
+export { shellGate, shellWrites, writeGate } from "./write-gate";
+export { liveOwner } from "../core/live-session";
 export { asksUser, stopDecision, stopObligation, type StopObligation } from "./stop";
 export { callKey, noteRawCommit, rawGitPost, rawGitPre } from "./raw-git";
 export { promptNudge, recordSkillLoad, shellNudge, skillFileIn } from "./skill-nudge";

package/src/hooks/stop.ts

@@ -253,9 +253,11 @@ export function stopObligation(
     if (!session || input.session.agentId || !inWorkitWorkspace(input.cwd)) return null;
     const branch = currentBranch(input.cwd);
     if (!branch || guardedBranch(input.cwd, branch)) return null;
-    const ledger = readLedger(input.cwd);
+    // Read with the hash chain: a hand-appended row neither creates nor
+    // clears an obligation, and verdicts are judged with integrity (N1).
+    const ledger = readLedger(input.cwd, { integrity: true });
     if (!ledger.ok) return null;
-    const all = ledger.value.rows;
+    const all = ledger.value.rows.filter((row) => row.integrity !== "unverified");
     const rows = all.filter((row) => row.branch === branch);
     const mine = rows.filter((row) => sessionOf(row) === session);
     const commits = new Set(