@brainervirus/workit-core 8.22.3 → 8.24.0

package/src/forge/report.ts

@@ -428,7 +428,7 @@ export function buildStatusDoc(
 
 /**
  * Record what the forge said about a PR as a CLI-observed `pr.status` row
- * (pr, branch, head, state: open|merged|closed, checks), only when it
+ * (pr, branch, head, base, state: open|merged|closed, checks), only when it
  * differs from the newest row for that PR, so polling never floods the
  * ledger. Hooks read it without calling the forge: an open PR's checks
  * (passing|failing|pending; one without gating checks is not recorded), and
@@ -455,7 +455,8 @@ export function recordPrStatus(cwd: string, doc: PrStatusDoc, actor: LedgerActor
       last &&
       last.head === doc.head.sha &&
       last.checks === checks &&
-      (last.state ?? "open") === state
+      (last.state ?? "open") === state &&
+      (last.base ?? null) === (doc.base ?? null)
     )
       return;
     appendObserved(cwd, {
@@ -468,6 +469,7 @@ export function recordPrStatus(cwd: string, doc: PrStatusDoc, actor: LedgerActor
       forge: doc.forge,
       state,
       checks,
+      base: doc.base,
     });
   } catch {
     // The row is an observation for hooks; the verb's answer stands without it.

package/src/git/rev.ts

@@ -515,6 +515,139 @@ export function resolveRef(cwd: string, ref: string): string | null {
   return line(git(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
 }
 
+/** Pinned diff options for the review-lane reads: user config never changes them. */
+const LANE_DIFF = [
+  "-c",
+  "core.quotePath=false",
+  "diff",
+  "--no-color",
+  "--no-ext-diff",
+  "--no-textconv",
+  "--no-renames",
+];
+
+/** `fork..head`, or with `head` null the working tree's tracked changes since `fork`. */
+const laneRange = (fork: string, head: string | null): string[] | null => {
+  if (!safeArg(fork) || (head !== null && !safeArg(head))) return null;
+  return head === null ? [fork] : [fork, head];
+};
+
+export type NumstatEntry = { path: string; added: number; deleted: number; binary: boolean };
+
+/** Added and deleted lines per file of `fork..head` (no renames); null when git fails. */
+export function diffNumstat(cwd: string, fork: string, head: string | null): NumstatEntry[] | null {
+  const range = laneRange(fork, head);
+  if (!range) return null;
+  const run = git(cwd, [...LANE_DIFF, "--numstat", "-z", ...range, "--"]);
+  if (!run.ok) return null;
+  const out: NumstatEntry[] = [];
+  for (const record of run.stdout.split("\0")) {
+    const match = /^(-|\d+)\t(-|\d+)\t(.+)$/su.exec(record.replace(/^\n/u, ""));
+    if (!match) continue;
+    const binary = match[1] === "-";
+    out.push({
+      path: match[3],
+      added: binary ? 0 : Number(match[1]),
+      deleted: binary ? 0 : Number(match[2]),
+      binary,
+    });
+  }
+  return out;
+}
+
+/** One file of `git diff --raw`: modes and blob ids on each side (zeros: absent or the working tree). */
+export type RawEntry = {
+  path: string;
+  oldMode: string;
+  newMode: string;
+  oldBlob: string;
+  newBlob: string;
+};
+
+/**
+ * The changed files of `fork..head` (or the working tree) with their modes
+ * and blob ids, read NUL-separated so no path is ever quoted or split.
+ * Null when git fails.
+ */
+export function diffRaw(cwd: string, fork: string, head: string | null): RawEntry[] | null {
+  const range = laneRange(fork, head);
+  if (!range) return null;
+  const run = git(cwd, [...LANE_DIFF, "--raw", "-z", "--no-abbrev", ...range, "--"]);
+  if (!run.ok) return null;
+  const fields = run.stdout.split("\0");
+  const out: RawEntry[] = [];
+  for (let index = 0; index + 1 < fields.length; index += 2) {
+    const meta = /^:(\d{6}) (\d{6}) ([0-9a-f]+) ([0-9a-f]+) [A-Z]\d*$/u.exec(
+      fields[index].replace(/^\n/u, ""),
+    );
+    if (!meta) return null;
+    out.push({
+      path: fields[index + 1],
+      oldMode: meta[1],
+      newMode: meta[2],
+      oldBlob: meta[3],
+      newBlob: meta[4],
+    });
+  }
+  return out;
+}
+
+/** The contents of `ids` (blob ids), by id; null when git fails. Missing objects are left out. */
+export function readBlobs(cwd: string, ids: readonly string[]): Map<string, Buffer> | null {
+  const out = new Map<string, Buffer>();
+  const wanted = [...new Set(ids)].filter((id) => /^[0-9a-f]{40,64}$/u.test(id));
+  if (!wanted.length) return out;
+  const run = spawnSync("git", ["cat-file", "--batch"], {
+    cwd,
+    input: `${wanted.join("\n")}\n`,
+    maxBuffer: MAX_BUFFER,
+    timeout: GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+  });
+  if (run.status !== 0 || !run.stdout) return null;
+  const bytes = run.stdout;
+  let at = 0;
+  for (const id of wanted) {
+    const end = bytes.indexOf(0x0a, at);
+    if (end < 0) return null;
+    const header = bytes.subarray(at, end).toString("utf8").split(" ");
+    at = end + 1;
+    if (header[1] === "missing") continue;
+    const size = Number(header[2]);
+    if (header[0] !== id || !Number.isSafeInteger(size)) return null;
+    out.set(id, bytes.subarray(at, at + size));
+    at += size + 1;
+  }
+  return out;
+}
+
+/** Blob ids of the files named `name` anywhere in the tree of `rev`, by path; null when git fails. */
+export function treeFilesNamed(cwd: string, rev: string, name: string): Map<string, string> | null {
+  if (!safeArg(rev)) return null;
+  const run = git(cwd, ["ls-tree", "-r", "-z", "--full-tree", rev]);
+  if (!run.ok) return null;
+  const out = new Map<string, string>();
+  for (const record of run.stdout.split("\0")) {
+    const match = /^\d{6} blob ([0-9a-f]+)\t(.+)$/su.exec(record);
+    if (match && (match[2] === name || match[2].endsWith(`/${name}`))) out.set(match[2], match[1]);
+  }
+  return out;
+}
+
+/** The text of `file` (a fixed repo path) at `rev`; null when it is absent or git fails. */
+export function fileAt(cwd: string, rev: string, file: string): string | null {
+  if (!safeArg(rev)) return null;
+  const run = git(cwd, ["cat-file", "blob", `${rev}:${file}`]);
+  return run.ok ? run.stdout : null;
+}
+
+/** Untracked, not ignored files of the working tree (repo-relative). */
+export function untrackedFiles(cwd: string): string[] {
+  const run = git(cwd, ["ls-files", "-z", "--others", "--exclude-standard"]);
+  return run.ok ? run.stdout.split("\0").filter(Boolean) : [];
+}
+
 /**
  * Commits `head` lacks from `base` (behind) and has on top of it (ahead), and
  * whether `base` is already an ancestor of `head`. Null when either side

package/src/hooks/handle.ts

@@ -31,7 +31,8 @@ import { seedStanding, standingDelta } from "./standing";
 import { trackJudge } from "./session-marker";
 import { stopDecision } from "./stop";
 import { liveOwner } from "../core/live-session";
-import { shellGate, writeGate } from "./write-gate";
+import { liveTargets, shellGate, writeGate } from "./write-gate";
+import { confineImplementer, confineImplementerShell, hostIsolated } from "./worktree-confine";
 import type { HookDecision, HookEventKind, HookInput, HostAdapter, RenderedHook } from "./protocol";
 
 export type HookDeps = { descriptor: HostDescriptor; addendum: string | null };
@@ -68,6 +69,12 @@ const workitRole = (
   return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
 };
 
+/** A tool call made by a Workit implementer subagent (the host names its agent type). */
+const implementerAgent = (input: HookInput, descriptor: HostDescriptor): boolean =>
+  Boolean(input.session.agentId) &&
+  input.session.agentType !== null &&
+  workitRole(descriptor, input.session.agentType) === "implementer";
+
 /** `<lead session>:<agent id>`, safe for the ledger's session grammar. */
 const subagentSession = (session: string | null, agentId: string): string =>
   [session, agentId]
@@ -99,17 +106,22 @@ const subagentStartText = (
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
+  // An implementer is host-isolated only when the host put it in its own
+  // worktree (`.claude/worktrees/agent-<id>`); by default the lead makes one.
   const isolated =
     descriptor.subagents.worktreeIsolation === "native" &&
-    (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
+    (role === "implementer"
+      ? hostIsolated(input.cwd, event.agentId)
+      : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
     return `${isolatedGit(input.cwd)}\n${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
-    // No host isolation: the lead makes the worktree, and workit git works there.
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    // No host isolation: the lead makes the worktree, Workit's hooks confine
+    // the implementer to it (worktree-confine.ts), and workit git works there.
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit --cwd <worktree> git commit -m "<message>" -- <paths>\`, \`workit --cwd <worktree> check <name>\`. The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit --cwd <worktree> git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId) return readOnly;
   const own = subagentSession(session, event.agentId);
@@ -189,6 +201,11 @@ function decide(input: HookInput, deps: HookDeps): HookDecision {
       if (!postTool) settlePendingCommit(input);
       const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE;
       if (raw.kind === "deny") return raw;
+      // An implementer subagent stays in its Workit worktree (#310).
+      if (canDeny && implementerAgent(input, descriptor)) {
+        const confined = confineImplementerShell(input, event.command, event.dialect);
+        if (confined.kind === "deny") return confined;
+      }
       // The before-write gate and the live-session guard (#274).
       const gate = usable(descriptor.events["write.pre"].support)
         ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect)
@@ -250,10 +267,14 @@ function decide(input: HookInput, deps: HookDeps): HookDecision {
       if (usable(descriptor.events["shell.post"].support))
         rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
       return NONE;
-    case "write.pre":
-      return usable(descriptor.events["write.pre"].support)
-        ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport))
-        : NONE;
+    case "write.pre": {
+      if (!usable(descriptor.events["write.pre"].support)) return NONE;
+      if (implementerAgent(input, descriptor)) {
+        const confined = confineImplementer(input, liveTargets(input.cwd, event.paths));
+        if (confined.kind === "deny") return confined;
+      }
+      return writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport));
+    }
     case "subagent.start":
       if (workitRole(descriptor, event.agentType) === "judge")
         trackJudge(input, event.agentId, true);

package/src/hooks/raw-git.ts

@@ -788,6 +788,25 @@ export function workitInvocations(
   return found;
 }
 
+/** Workit's global options before the verb: `--json`, and these (`--name value` or `--name=value`). */
+const WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
+
+/** An invocation's arguments without the global options before the verb, and the last `--cwd` among them. */
+export function skipWorkitGlobals(args: readonly string[]): { rest: string[]; cwd: string | null } {
+  let cwd: string | null = null;
+  let at = 0;
+  for (; at < args.length; at++) {
+    const match = WORKIT_GLOBAL.exec(args[at]);
+    if (match?.[1] === "=") {
+      if (args[at].startsWith("--cwd=")) cwd = args[at].slice(6);
+    } else if (match && args[at + 1] !== undefined) {
+      if (args[at] === "--cwd") cwd = args[at + 1];
+      at++;
+    } else if (args[at] !== "--json") break;
+  }
+  return { rest: args.slice(at), cwd };
+}
+
 /** What one raw invocation means for workit. */
 export type RawAction =
   | { kind: "commit"; amend: boolean }

package/src/hooks/stop.ts

@@ -11,11 +11,15 @@
 //       or merged;
 //   (c) verdict: the session opened the PR (or verified delivery) but the
 //       head lacks the verdict the policy asks for, while the endpoint is
-//       green or merged (a PR opens without one): the author's own `--self`
-//       verdict at normal risk under `verification: self`, an accepted
-//       non-author verdict at high risk or under `verification: independent`.
-//       Not raised when the task's latest judgment records no behavior
-//       change at normal risk (policy/derive.ts asks for none either), nor while a verifier or reviewer this lead started still runs.
+//       green or merged (a PR opens without one). Under `verification:
+//       proportional` (the default) the review lane of the head decides
+//       (core/policy/lane.ts): none owes nothing, self the author's own
+//       `--self` verdict, focused and full an accepted non-author verdict.
+//       Under `self`: the author's own at normal risk; at high risk or under
+//       `independent`: a non-author one, and not raised when the task's
+//       latest judgment records no behavior change at normal risk
+//       (policy/derive.ts asks for none either). Never raised while a
+//       verifier or reviewer this lead started still runs.
 // Each obligation blocks once per head and session (a marker keyed by kind
 // and head), not once per turn.
 // A branch that landed owes nothing: a recorded merge (`workit pr merge`, or
@@ -29,10 +33,9 @@
 // the ledger and local git only (no forge call), and every failure allows
 // the stop.
 import { spawnSync } from "node:child_process";
-import { resolveAutonomy } from "../autonomy";
-import { latestJudgment } from "../core/policy/derive";
-import type { Judgment } from "../core/task-contract";
-import { TaskStore } from "../core/task-store";
+import { resolveAutonomy, type VerificationMode } from "../autonomy";
+import { currentJudgment } from "../core/policy/current-judgment";
+import { branchLane, laneNeed } from "../core/policy/lane";
 import { currentBranch, pushRemoteName } from "../git/rev";
 import { checkVerdicts, readLedger, type ReadRow } from "../ledger";
 import type { HostDescriptor } from "./descriptor";
@@ -237,43 +240,57 @@ const redChecks = (
   };
 };
 
-/** The open task's latest judgment (the one policy/derive.ts reads), or null when none is recorded. */
-const taskJudgment = (cwd: string): Judgment | null => {
-  try {
-    const store = new TaskStore(cwd);
-    const listed = store.listTaskIndex();
-    const key = store.currentKey();
-    if (!listed.ok || !key.ok) return null;
-    const entry = listed.data
-      .filter((item) => item.key === key.data.key && item.status !== "closed")
-      .toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
-    const task = entry ? store.readTask(entry.id) : null;
-    return task?.ok === true ? latestJudgment(task.data) : null;
-  } catch {
-    return null;
-  }
+/**
+ * The base the branch's PR targets: the newest the forge reported (a
+ * `pr.status` row, so a PR retargeted on the forge is read against its
+ * current base), else the one it was opened with (`pr.created`), else null
+ * (the default base). Read from the ledger: the hook never calls the forge.
+ */
+const prBase = (rows: readonly ReadRow[]): string | null => {
+  const seen = rows.findLast(
+    (row) =>
+      (row.type === "pr.status" || row.type === "pr.created") &&
+      row.observer === "workit_cli" &&
+      typeof row.base === "string",
+  );
+  return typeof seen?.base === "string" ? seen.base : null;
 };
 
 /**
  * (c) Delivered by this session, yet the head lacks the verdict the policy
- * asks for: the author's own at normal risk when the workspace's
- * verification is `self`, else an accepted non-author one.
+ * asks for. Under `verification: proportional` the review lane of the head
+ * decides (core/policy/lane.ts): none owes nothing, self the author's own,
+ * focused and full a non-author one. Under `self`, the author's own at
+ * normal risk; under `independent` or at high risk, a non-author one.
  */
 const unverified = (
   cwd: string,
   branch: string,
   all: readonly ReadRow[],
   descriptor: HostDescriptor,
-  verification: "self" | "independent",
+  verification: VerificationMode,
+  head: string | null,
 ): StopObligation | null => {
   const check = checkVerdicts(cwd, branch, all);
   if (check.accepted.accepted || check.accepted.reasons.includes("failing_verdict")) return null;
-  const judgment = taskJudgment(cwd);
+  const judgment = currentJudgment(cwd);
   const high = judgment?.riskTier === "high";
-  // Like policy/derive.ts: a verdict is asked for a behavior change or high
-  // risk. A recorded judgment with neither (docs only) owes none.
-  if (judgment && !judgment.behaviorChange && !high) return null;
-  const independent = verification === "independent" || high;
+  let independent: boolean;
+  if (verification === "proportional") {
+    const lane = branchLane(cwd, {
+      base: prBase(all.filter((row) => row.branch === branch)),
+      head,
+      judgment,
+    });
+    const need = laneNeed(lane.lane);
+    if (need === "none") return null;
+    independent = need === "non-author";
+  } else {
+    // Like policy/derive.ts: a verdict is asked for a behavior change or high
+    // risk. A recorded judgment with neither (docs only) owes none.
+    if (judgment && !judgment.behaviorChange && !high) return null;
+    independent = verification === "independent" || high;
+  }
   if (!independent && check.review === "self-reviewed") return null;
   const has = check.review === "self-reviewed" ? "only a self verdict" : "no current verdict";
   const verifier = `${descriptor.subagents.agentPrefix}verifier`;
@@ -332,7 +349,7 @@ export function stopObligation(
     }
     // A PR opens without a verdict: only green and merged need one.
     if (!delivered || (endpoint !== "green" && endpoint !== "merged")) return null;
-    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification);
+    const left = unverified(input.cwd, branch, all, descriptor, autonomy.verification, head);
     return left ? { ...left, head } : null;
   } catch {
     return null;