@brainervirus/workit-core 8.16.0 → 8.17.1

package/src/hooks/hosts/claude-code.ts

@@ -54,7 +54,12 @@ export const CLAUDE_CODE_DESCRIPTOR: HostDescriptor = {
     // `stop_hook_active` and `last_assistant_message` (claude 2.1.295).
     stop: { support: "native", native: "Stop" },
   },
-  shellPolicy: { deny: "native", channel: "permissionDecision", failClosed: false },
+  shellPolicy: {
+    deny: "native",
+    channel: "permissionDecision",
+    failClosed: false,
+    rewrite: "native",
+  },
   context: {
     sessionStart: "native",
     perTurn: "native",
@@ -185,7 +190,16 @@ const eventOf = (name: ClaudeHookEvent, value: Record<string, unknown>): Parsed
         return { ok: true, event: { kind: "tool.pre", tool: value.tool_name, toolUseId } };
       const command = toolCommand(value);
       return command
-        ? { ok: true, event: { kind: "shell.pre", command, toolUseId, dialect: dialectOf(value) } }
+        ? {
+            ok: true,
+            event: {
+              kind: "shell.pre",
+              command,
+              toolUseId,
+              dialect: dialectOf(value),
+              toolInput: value.tool_input as Record<string, unknown>,
+            },
+          }
         : { ok: false, error: `tool_input.command is required for ${value.tool_name}` };
     }
     case "PostToolUse": {
@@ -254,8 +268,25 @@ const CONTEXT_EVENTS = new Set([
   "PostToolUse",
 ]);
 
-/** Never emits `allow`: that would bypass the user's own permission prompt. */
+/**
+ * Never emits `allow`: that would bypass the user's own permission prompt. A
+ * rewrite is `updatedInput` with no permissionDecision: Claude Code applies it
+ * and runs its normal permission flow on the rewritten command (claude
+ * 2.1.306: a hook result with updatedInput and no permissionBehavior is
+ * yielded as the input to run).
+ */
 const render = (decision: HookDecision, native: string | null) => {
+  if (decision.kind === "rewrite" && native === "PreToolUse" && decision.input)
+    return {
+      json: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          updatedInput: decision.input,
+          ...(decision.text ? { additionalContext: decision.text } : {}),
+        },
+      },
+      exitCode: 0,
+    };
   if (decision.kind === "deny" && native === "PreToolUse")
     return {
       json: {

package/src/hooks/hosts/codex.ts

@@ -88,7 +88,12 @@ export const CODEX_DESCRIPTOR: HostDescriptor = {
     // last_assistant_message, turn_id; output `{"decision":"block","reason"}`.
     stop: { support: "native", native: "Stop" },
   },
-  shellPolicy: { deny: "native", channel: "permissionDecision", failClosed: false },
+  shellPolicy: {
+    deny: "native",
+    channel: "permissionDecision",
+    failClosed: false,
+    rewrite: "none",
+  },
   context: {
     sessionStart: "native",
     perTurn: "native",

package/src/hooks/hosts/cursor.ts

@@ -65,7 +65,7 @@ export const CURSOR_DESCRIPTOR: HostDescriptor = {
   },
   // Fails open like every host: a payload Workit cannot parse (a renamed
   // field in a Cursor release) must not block every shell command.
-  shellPolicy: { deny: "native", channel: "exit2+json", failClosed: false },
+  shellPolicy: { deny: "native", channel: "exit2+json", failClosed: false, rewrite: "none" },
   context: {
     sessionStart: "native",
     perTurn: "none",

package/src/hooks/hosts/opencode.ts

@@ -25,7 +25,7 @@ export const OPENCODE_DESCRIPTOR: HostDescriptor = {
     // session went idle, and resume semantics are inferred from the schema.
     stop: { support: "partial", native: 'event("session.idle")' },
   },
-  shellPolicy: { deny: "native", channel: "effect", failClosed: false },
+  shellPolicy: { deny: "native", channel: "effect", failClosed: false, rewrite: "native" },
   context: {
     sessionStart: "none",
     perTurn: "native",

package/src/hooks/hosts/pi.ts

@@ -24,7 +24,7 @@ export const PI_DESCRIPTOR: HostDescriptor = {
     // no loop guard: the extension continues at most once per run.
     stop: { support: "native", native: "agent_end" },
   },
-  shellPolicy: { deny: "native", channel: "block", failClosed: false },
+  shellPolicy: { deny: "native", channel: "block", failClosed: false, rewrite: "native" },
   context: {
     sessionStart: "native",
     // before_agent_start runs every turn; its message stays in the session,

package/src/hooks/index.ts

@@ -19,6 +19,7 @@ export {
   type SessionHandle,
 } from "./context";
 export { shellPolicy } from "./policy";
+export { heavyDenial, heavyGate, splitDenial } from "./heavy-gate";
 export { shellGate, shellWrites, writeGate } from "./write-gate";
 export { liveOwner } from "../core/live-session";
 export { asksUser, stopDecision, stopObligation, type StopObligation } from "./stop";

package/src/hooks/protocol.ts

@@ -27,6 +27,8 @@ export type HookEvent =
       toolUseId: string | null;
       /** The shell that runs `command`; posix when absent. */
       dialect?: "posix" | "powershell";
+      /** The host's whole tool input, where a rewrite must hand it back (Claude Code). */
+      toolInput?: Record<string, unknown>;
     }
   /** A pre-tool gate for a non-shell tool. Host permission policy owns these. */
   | {
@@ -95,6 +97,12 @@ export type HookDecision =
   | { kind: "context"; text: string }
   /** The reason text always carries its own correction (principle 3). */
   | { kind: "deny"; reason: string; unblock: string | null }
+  /**
+   * shell.pre: run `command` instead (the heavy-command lease rewrite).
+   * `input` is the host's tool input with the command replaced, where the
+   * host takes the whole input back; `text` is model-visible context.
+   */
+  | { kind: "rewrite"; command: string; input: Record<string, unknown> | null; text: string | null }
   /** Stop/SubagentStop: keep working. */
   | { kind: "continue"; reason: string }
   | { kind: "notice"; userMessage: string };

package/src/hooks/raw-git.ts

@@ -544,7 +544,29 @@ export function rawInvocations(
 /** The invocations of the last few commands parsed (pure: same text, same answer). */
 const RECENT = new Map<string, readonly RawInvocation[]>();
 
-function walk(command: string, dialect: ShellDialect, depth: number): RawInvocation[] {
+/**
+ * Every command line a shell command runs, past the same wrappers, nesting
+ * and chains rawInvocations reads (`bash -c '…'`, `flock f -c '…'`, `xargs`,
+ * `timeout 30`, env prefixes): the words after the prefixes, outermost first.
+ */
+export function commandLines(command: string, dialect: ShellDialect = "posix"): string[][] {
+  const lines: string[][] = [];
+  try {
+    walk(command, dialect, 0, lines);
+  } catch (error) {
+    throw error instanceof ShellAnalysisError
+      ? error
+      : new ShellAnalysisError(error instanceof Error ? error.message : String(error));
+  }
+  return lines;
+}
+
+function walk(
+  command: string,
+  dialect: ShellDialect,
+  depth: number,
+  seen?: string[][],
+): RawInvocation[] {
   const found: RawInvocation[] = [];
   let dir: Dir = null;
   const groups: Array<{ dir: Dir; stack: Dir[] }> = [];
@@ -556,7 +578,10 @@ function walk(command: string, dialect: ShellDialect, depth: number): RawInvocat
   const sessionConfig: string[] = [];
   const nested = (script: string | null | undefined, inner: ShellDialect) => {
     if (!script || depth >= MAX_DEPTH) return;
-    for (const invocation of rawInvocations(script, inner, depth + 1))
+    const inside = seen
+      ? walk(script, inner, depth + 1, seen)
+      : rawInvocations(script, inner, depth + 1);
+    for (const invocation of inside)
       found.push({ ...invocation, dir: rebase(dir, invocation.dir) });
   };
   const visit = (input: string[], stdin: string | undefined, hops: number) => {
@@ -567,9 +592,18 @@ function walk(command: string, dialect: ShellDialect, depth: number): RawInvocat
     const { words, env } = stripPrefixes(line);
     const name = commandName(words[0]);
     if (!name) return;
+    seen?.push(words);
+    // `flock <file> -c '…'`: the wrapper's script.
+    if (name === "-c" || name === "--command") return nested(words[1], "posix");
     const runs = (lines: string[][]) => {
       if (hops < MAX_DEPTH) for (const next of lines) visit(next, undefined, hops + 1);
     };
+    // The gates judge what `workit check … -- <cmd>` runs as if it ran raw.
+    // (The heavy-command reader, `seen`, stops at workit: a wrapped command
+    // already runs under the lease.)
+    const wrapped = seen ? null : workitCheckTail(words);
+    if (wrapped)
+      return "script" in wrapped ? nested(wrapped.script, "posix") : runs([wrapped.argv]);
     if (CD.has(name)) {
       const target = cdTarget(words);
       dir = target === null ? os.homedir() : joinDir(dir, target);
@@ -659,6 +693,74 @@ const LAUNCHERS = new Set([
   "command",
 ]);
 const WORKIT_BIN = /(?:^|[\\/])workit(?:\.exe)?$|^@brainervirus\/workit-cli$/;
+const WORKIT_PACKAGE = /^@brainervirus\/workit-cli(?:@\S*)?$/;
+const PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+
+/**
+ * What a `workit check [flags] -- <cmd…>` (or `workit lock run -- <cmd…>`,
+ * also through `npx @brainervirus/workit-cli`) runs: the script of `--shell`,
+ * else the argv. Null for any other command.
+ */
+export function workitCheckTail(
+  words: readonly string[],
+): { script: string } | { argv: string[] } | null {
+  let at = 0;
+  if (PACKAGE_RUNNERS.has(commandName(words[0]))) {
+    at = words.findIndex((word, index) => index > 0 && !word.startsWith("-"));
+    if (at < 0 || !WORKIT_PACKAGE.test(words[at])) return null;
+  } else if (!/^workit(?:\.exe|\.cmd)?$/.test(commandName(words[0]))) return null;
+  const args = words.slice(at + 1);
+  if (args[0] !== "check" && !(args[0] === "lock" && args[1] === "run")) return null;
+  const split = args.indexOf("--");
+  const tail = split < 0 ? [] : args.slice(split + 1);
+  if (!tail.length) return null;
+  return args.slice(0, split).includes("--shell") ? { script: tail.join(" ") } : { argv: tail };
+}
+
+/**
+ * The one command `command` runs after its wrappers (env prefixes, `timeout`,
+ * `nice`, `flock`, `bash -c '<one command>'`), or null when it is a chain,
+ * pipe, redirect, substitution, group or heredoc anywhere.
+ */
+export function simpleCommand(
+  command: string,
+  dialect: ShellDialect = "posix",
+  depth = 0,
+): string[] | null {
+  let segments: Segment[];
+  try {
+    segments = segmentsOf(command, dialect);
+  } catch {
+    return null;
+  }
+  if (segments.length !== 1) return null;
+  const [segment] = segments;
+  if (
+    segment.group ||
+    segment.pipe ||
+    segment.unanalyzable ||
+    segment.redirects.length ||
+    segment.subs?.length ||
+    segment.stdin?.length
+  )
+    return null;
+  const { words } = stripPrefixes(segment.words);
+  const name = commandName(words[0]);
+  if (!name || depth >= MAX_DEPTH) return null;
+  if (SHELLS.has(name)) {
+    const script = shellScript(words, undefined);
+    return script ? simpleCommand(script, "posix", depth + 1) : null;
+  }
+  if (name === "-c" || name === "--command")
+    return words[1] ? simpleCommand(words[1], "posix", depth + 1) : null;
+  if (
+    EVALS.has(name) ||
+    POWERSHELLS.has(name) ||
+    ["xargs", "find", "parallel", "script", "cmd", "source", "."].includes(name)
+  )
+    return null;
+  return words;
+}
 
 /**
  * The arguments of every workit CLI invocation in a shell command: past env

package/src/hooks/run.ts

@@ -1,5 +1,13 @@
-// Hook-process entry: stdin JSON → parse → handle → render → stdout.
-import { dispatchHook } from "./handle";
+// Hook-process entry: stdin JSON → parse → handle → render → stdout, under
+// the hook's own deadline (deadline.ts).
+import {
+  dispatchWithin,
+  hookBudget,
+  PROCESS_START,
+  readWithin,
+  skippedHook,
+  type HookDeadline,
+} from "./deadline";
 import { claudeCodeAdapter } from "./hosts/claude-code";
 import { codexAdapter } from "./hosts/codex";
 import { cursorAdapter } from "./hosts/cursor";
@@ -17,25 +25,31 @@ export const HOOK_ADAPTERS: Record<ProcessHost, HostAdapter> = {
 type Sink = { write(chunk: string): unknown };
 
 /** Runs one hook invocation and returns the process exit code. A broken
- * payload never throws: the host's fail policy decides what is written. */
+ * payload never throws: the host's fail policy decides what is written. Past
+ * the deadline the host gets a minimal result naming the skip. */
 export async function runHookProcess(
   host: ProcessHost | HostAdapter,
   stdin: AsyncIterable<unknown> | Iterable<unknown>,
   stdout: Sink,
   stderr: Sink = process.stderr,
   env: NodeJS.ProcessEnv = process.env,
+  deadline: HookDeadline = {},
 ): Promise<number> {
   const adapter = typeof host === "string" ? HOOK_ADAPTERS[host] : host;
-  let text = "";
-  for await (const chunk of stdin) text += String(chunk);
+  const budget = hookBudget(env, deadline, adapter.descriptor.host);
+  const text = await readWithin(stdin, budget);
   let raw: unknown;
   try {
-    raw = JSON.parse(text || "{}");
+    raw = text === null ? undefined : JSON.parse(text || "{}");
   } catch {
     raw = undefined;
   }
-  const result = dispatchHook(adapter, raw, env);
-  if (raw === undefined || result.error)
+  const result =
+    text === null
+      ? skippedHook(adapter, undefined, env, budget, "input")
+      : await dispatchWithin(adapter, raw, env, budget, deadline.dispatch);
+  if (result.skipped) stderr.write(`[workit] ${result.error}\n`);
+  else if (raw === undefined || result.error)
     stderr.write(
       `[workit] hook input rejected: ${raw === undefined ? "invalid JSON hook input" : result.error}\n`,
     );
@@ -48,5 +62,16 @@ if (import.meta.main) {
   if (!Object.hasOwn(HOOK_ADAPTERS, host)) {
     process.stderr.write(`usage: run.ts <${Object.keys(HOOK_ADAPTERS).join("|")}>\n`);
     process.exitCode = 64;
-  } else process.exitCode = await runHookProcess(host, process.stdin, process.stdout);
+  } else {
+    process.exitCode = await runHookProcess(
+      host,
+      process.stdin,
+      process.stdout,
+      process.stderr,
+      process.env,
+      { startedAt: PROCESS_START },
+    );
+    // A payload that never ended must not keep the process alive past its answer.
+    process.stdin.destroy();
+  }
 }

package/src/hooks/write-gate.ts

@@ -23,6 +23,7 @@ import type { HookDecision } from "./protocol";
 import {
   inWorkitWorkspace,
   rawInvocations,
+  workitCheckTail,
   workitInvocations,
   type RawInvocation,
 } from "./raw-git";
@@ -70,6 +71,28 @@ const exempt = (cwd: string, root: string, file: string, plans: ReadonlySet<stri
 const PREFIXES = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
 const operands = (words: string[]) => words.filter((item) => !item.startsWith("-"));
 
+const SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+
+/**
+ * The script `workit check … -- <cmd>` runs, so the gates judge it as if it
+ * ran raw: the `--shell` string, a `bash -c` script, or the argv. Other
+ * workit verbs stay exempt (null).
+ */
+const wrappedScript = (input: string[]): string | null => {
+  let words = input;
+  while (words.length && (PREFIXES.has(words[0]) || /^\w+=/.test(words[0]))) words = words.slice(1);
+  const tail = workitCheckTail(words);
+  if (!tail) return null;
+  if ("script" in tail) return tail.script;
+  const [shell, flag, script] = tail.argv;
+  if (
+    SCRIPT_SHELLS.has((shell.split(/[\\/]/).at(-1) ?? "").toLowerCase()) &&
+    /^-[a-z]*c$/.test(flag ?? "")
+  )
+    return script ?? null;
+  return tail.argv.map(quoteWord).join(" ");
+};
+
 /** The files one simple command edits: [] none, null unknown. */
 const editsOf = (input: string[]): string[] | null => {
   let words = input;
@@ -149,10 +172,19 @@ const editsOf = (input: string[]): string[] | null => {
  * known, else null. Interpreters and formatters are not detected; Workit's
  * own commands never count.
  */
-export const shellWrites = (command: string): { writes: boolean; targets: string[] | null } => {
+export const shellWrites = (
+  command: string,
+  depth = 0,
+): { writes: boolean; targets: string[] | null } => {
   const targets: string[] = [];
   let unknown = false;
   for (const segment of segmentsOf(command)) {
+    const inner = depth < 4 ? wrappedScript(segment.words) : null;
+    if (inner !== null) {
+      const nested = shellWrites(inner, depth + 1);
+      if (nested.writes && nested.targets === null) unknown = true;
+      else if (nested.targets) targets.push(...nested.targets);
+    }
     targets.push(
       ...segment.redirects.filter((item) => !/^\/dev\/(?:null|stdout|stderr|tty)$/.test(item)),
     );
@@ -309,7 +341,12 @@ const quoteWord = (word: string): string =>
  * directory that segment runs in (`cd`, `pushd`/`popd`, `( … )` groups). A
  * relative target in an unknown directory is skipped.
  */
-const segmentTargets = (cwd: string, command: string, dialect: ShellDialect): string[] => {
+const segmentTargets = (
+  cwd: string,
+  command: string,
+  dialect: ShellDialect,
+  depth = 0,
+): string[] => {
   const targets: string[] = [];
   let dir: string | undefined = cwd;
   let stack: Array<string | undefined> = [];
@@ -342,6 +379,9 @@ const segmentTargets = (cwd: string, command: string, dialect: ShellDialect): st
       dir = stack.length ? stack.pop() : undefined;
       continue;
     }
+    const inner = depth < 4 ? wrappedScript(words) : null;
+    if (inner !== null && dir !== undefined)
+      targets.push(...segmentTargets(dir, inner, "posix", depth + 1));
     for (const file of segment.redirects)
       if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
         const resolved = at(file);