@brainervirus/workit-core 8.14.0 → 8.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.14.0",
+  "version": "8.14.1",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/src/core/task-contract.ts

@@ -33,6 +33,9 @@ const text = z.string().check((ctx) => {
     ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
 });
 const id = text.regex(uuidPattern, "expected lowercase UUID");
+/** A full id or an unambiguous lowercase prefix of one (the 8-char short id other surfaces print). */
+export const idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+const idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
 const digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
 const revision = text.regex(uuidPattern, "expected UUID revision");
 const validUtc = (value: string): boolean => {
@@ -598,7 +601,7 @@ export const workerReportSchema = z
     outcome: z.enum(["completed", "failed", "cancelled"]),
     summary: text,
     evidenceIds: z.array(id),
-    findingIds: z.array(id),
+    findingIds: z.array(idRef),
   })
   .strict();
 export type WorkerReport = z.infer<typeof workerReportSchema>;
@@ -938,7 +941,7 @@ const findingOperations = {
     action: z.literal("resolve"),
     ...taskId,
     expectedRevision: revision.optional(),
-    findingId: id,
+    findingId: idRef,
     disposition: z.enum(["open", "fixed", "dismissed", "deferred"]),
     reason: text,
     evidenceIds: z.array(id),
@@ -980,7 +983,7 @@ const workerOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     report: workerReportSchema,
   }),
   cancel: operation({
@@ -988,7 +991,7 @@ const workerOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     reason: text,
   }),
 };
@@ -1118,6 +1121,21 @@ export const failure = (
   details: ErrorDetails = {},
 ): Result<never> => ({ ok: false, schemaVersion: 1, code, error, details });
 
+/**
+ * Resolve a full id or an unambiguous prefix against the ids a task holds.
+ * An exact match always wins; several prefix matches fail listing the candidates.
+ */
+export function resolveIdRef(kind: string, ref: string, ids: readonly string[]): Result<string> {
+  if (ids.includes(ref)) return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1) return success(null, null, matches[0]);
+  if (matches.length === 0) return failure("not_found", `${kind} not found`);
+  return failure(
+    "invalid_input",
+    `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`,
+  );
+}
+
 export function parseOperation(family: OperationFamily, input: unknown): Result<OperationRequest> {
   if (
     typeof input === "object" &&

package/src/core/task-engine.ts

@@ -15,6 +15,7 @@ import {
   legacyAssessmentSchema,
   newId,
   parseOperation,
+  resolveIdRef,
   rewriteRecordRefs,
   success,
   type Candidate,
@@ -391,6 +392,8 @@ const TASK_SCOPED_ACTIONS: ReadonlySet<string> = new Set([
   "state.export",
 ]);
 /** Worker actions that name their worker: they resolve to that worker's task. */
+const ONLY_OWN_REPORT = "workers can submit only their own report";
+const NO_HELPER_CONTROL = "helpers cannot cancel or control workers";
 const WORKER_ADDRESSED_ACTIONS: ReadonlySet<string> = new Set(["worker.cancel", "worker.report"]);
 /**
  * The exact CLI command that runs worker `request` (cancel or report, with a
@@ -1524,6 +1527,13 @@ export class WorkitCore {
       return success(changed.data.revision, null, changed.data.findings.at(-1)!);
     }
     if (helper?.ok) return failure("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef(
+      "finding",
+      input.findingId,
+      task.data.findings.map((entry) => entry.id),
+    );
+    if (!findingRef.ok) return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding) return failure("not_found", "finding not found");
     if (!input.reason.trim())
@@ -1738,13 +1748,39 @@ export class WorkitCore {
       );
     }
 
+    // A helper may only address itself: resolving against its own id alone keeps
+    // another worker's id out of any ambiguity error.
+    const workerRef = resolveIdRef(
+      "worker",
+      input.workerId,
+      helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId],
+    );
+    if (!workerRef.ok)
+      return helperId === null
+        ? workerRef
+        : failure(
+            "permission_denied",
+            input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL,
+          );
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry) return failure("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure("permission_denied", "workers can submit only their own report");
+        return failure("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok) return helper;
+      const ownFindings = task.data.findings
+        .filter((candidate) => candidate.provenance.workerId === helperId)
+        .map((candidate) => candidate.id);
+      const reported: string[] = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok) reported.push(found.data);
+        else if (found.code === "not_found") reported.push(findingRef);
+        else return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) =>
         input.report.evidenceIds.includes(candidate.id),
       );
@@ -1800,8 +1836,7 @@ export class WorkitCore {
         : failure("recovery_required", "worker disappeared during report");
     }
 
-    if (helperId !== null)
-      return failure("permission_denied", "helpers cannot cancel or control workers");
+    if (helperId !== null) return failure("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {

package/src/core/task-store.ts

@@ -47,6 +47,8 @@ import {
   success,
   taskRecordSchema,
   workspaceRecordSchema,
+  idRefPattern,
+  resolveIdRef,
   type Id,
   type Intent,
   type Provenance,
@@ -728,20 +730,23 @@ export class TaskStore {
    * the branch checked out now (#264). Null when no open task has it.
    */
   taskForWorker(workerId: unknown): Result<Id | null> {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure(
         "invalid_input",
         "needs a worker id: `workit worker cancel|report <workerId>`",
       );
     const listed = this.listTaskIndex();
     if (!listed.ok) return listed;
+    const owners = new Map<string, Id>();
     for (const entry of listed.data) {
       if (entry.status === "closed") continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok) return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? []) owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok) return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found") return resolved;
     return success(null, null, null);
   }