@brainervirus/workit-core 8.24.0 → 8.26.0

package/src/hooks/delivery-verbs.ts

@@ -0,0 +1,129 @@
+// The Workit verbs a host may run without asking (issue #297, decision
+// mvk5q3io): delivery and state verbs whose own gates (grants, non-author
+// verdicts, branch policy) decide. One list for every host's permission
+// block: Claude Code `Bash(workit <verb> *)`, Codex `prefix_rule`, Cursor
+// `Shell(workit <verb>)`, and the OpenCode plugin's ask-to-allow.
+//
+// Never listed: verbs that run an arbitrary command (`check -- <cmd>`,
+// `lock run -- <cmd>`, `test-audit`, `fanout check`), change authority
+// (`grant`), install or remove host config (`init`, `upgrade`, `setup`,
+// `uninstall`, `launch`), delete data (`gc`), import state (`state`) or write
+// outside the forge flow (`youtrack`, `changelog`, `knowledge`, `handoff`).
+// Pure string work: the OpenCode plugin bundles it.
+import { segmentsOf, type ShellDialect } from "./shell-words";
+
+export const WORKIT_ALLOWED_VERBS = [
+  "git",
+  "pr",
+  "ci",
+  "stack",
+  "release",
+  "task",
+  "ledger",
+  "evidence",
+  "finding",
+  "decision",
+  "worker",
+  "verify-delivery",
+  "policy",
+  "doctor",
+  "help",
+] as const;
+
+/**
+ * Flags that override a Workit gate: a host never allows them unasked.
+ * Workit has no `--admin` flag and refuses a bare `--force` push itself.
+ */
+export const WORKIT_BYPASS_FLAGS = ["--unverified", "--overwrite-unintegrated"] as const;
+
+const ALLOWED = new Set<string>(WORKIT_ALLOWED_VERBS);
+
+const isBypass = (word: string): boolean =>
+  WORKIT_BYPASS_FLAGS.some((flag) => word === flag || word.startsWith(`${flag}=`));
+
+/** `workit`, `workit-cli`, or either by path. */
+const isWorkitWord = (word: string): boolean => /^(?:.*[\\/])?workit(?:-cli)?$/u.test(word);
+
+/**
+ * Is `words` one Workit call of an allowed verb? Global `--json` and
+ * `--cwd <dir>` may come first (they mean the same anywhere before `--`);
+ * `--session` may not (it changes the acting identity). A bypass flag before
+ * `--` disqualifies it, and so does a word the shell expands there (`expands`,
+ * indexes into `words`): `${F:---unverified}` could become one.
+ */
+export const isAllowedWorkitCall = (
+  words: readonly string[],
+  expands: readonly number[] = [],
+): boolean => {
+  if (words[0] !== "workit") return false;
+  let at = 1;
+  for (;;) {
+    const word = words[at];
+    if (word === "--json") at += 1;
+    else if (word === "--cwd") at += 2;
+    else if (word?.startsWith("--cwd=")) at += 1;
+    else break;
+  }
+  const verb = words[at];
+  if (verb === undefined) return false;
+  if (verb === "--version") return at === words.length - 1;
+  if (!ALLOWED.has(verb)) return false;
+  const end = words.indexOf("--");
+  const limit = end < 0 ? words.length : end;
+  return !words.slice(0, limit).some(isBypass) && !expands.some((index) => index < limit);
+};
+
+const bypassReason = (flag: string) =>
+  `Workit: \`${flag}\` overrides a Workit gate, so the user decides this call (no allow rule covers it).`;
+const EXPANSION_REASON =
+  "Workit: an expansion before `--` could become a bypass flag, so the user decides this call (no allow rule covers it).";
+
+/**
+ * The ask reason for a Workit call in `command` that carries a bypass flag
+ * before its `--` or a word the shell expands there, or null. Words are read after shell quoting, so `"--unverified"`,
+ * `--unverif''ied` or a tab-separated flag are found where a host's string
+ * rule could miss them. A command the tokenizer cannot analyze is judged on
+ * its text with quotes and backslashes removed.
+ */
+export const workitBypassFlag = (
+  command: string,
+  dialect: ShellDialect = "posix",
+): string | null => {
+  for (const segment of segmentsOf(command, dialect)) {
+    if (segment.unanalyzable) {
+      const text = command.replaceAll(/['"\\`]/gu, "");
+      if (!/\bworkit\b/u.test(text)) return null;
+      const found = WORKIT_BYPASS_FLAGS.find((flag) => text.includes(flag));
+      return found ? bypassReason(found) : null;
+    }
+    const start = segment.words.findIndex(isWorkitWord);
+    if (start < 0) continue;
+    const words = segment.words.slice(start + 1);
+    const end = words.indexOf("--");
+    const flag = (end < 0 ? words : words.slice(0, end)).find(isBypass);
+    if (flag) return bypassReason(flag.split("=")[0] ?? flag);
+    const limit = start + 1 + (end < 0 ? words.length : end);
+    if (segment.expands?.some((index) => index > start && index < limit)) return EXPANSION_REASON;
+  }
+  return null;
+};
+
+/**
+ * Is the whole shell `command` allowed Workit calls only? Every segment must
+ * be one, with no substitution, redirect, group or heredoc anywhere.
+ */
+export const isAllowedWorkitCommand = (command: string): boolean => {
+  const segments = segmentsOf(command);
+  return (
+    segments.length > 0 &&
+    segments.every(
+      (s) =>
+        !s.unanalyzable &&
+        !s.group &&
+        !s.subs?.length &&
+        !s.stdin?.length &&
+        !s.redirects.length &&
+        isAllowedWorkitCall(s.words, s.expands),
+    )
+  );
+};

package/src/hooks/handle.ts

@@ -9,7 +9,8 @@ import type { HostDescriptor, Support } from "./descriptor";
 import { branchGuidance } from "../core/branch";
 import { workspaceTrailers } from "../core/workspaces";
 import { judgeBranch, recordIssuedSession, verdictCommand } from "../host-session";
-import { cwdRewrite } from "./cwd-normalize";
+import { cwdRewrite, verbFirst } from "./cwd-normalize";
+import { workitBypassFlag } from "./delivery-verbs";
 import { heavyDenial, heavyGate, rewriteNote, splitDenial } from "./heavy-gate";
 import { shellPolicy } from "./policy";
 import {
@@ -121,7 +122,7 @@ const subagentStartText = (
   if (role === "implementer")
     // No host isolation: the lead makes the worktree, Workit's hooks confine
     // the implementer to it (worktree-confine.ts), and workit git works there.
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit --cwd <worktree> git commit -m "<message>" -- <paths>\`, \`workit --cwd <worktree> check <name>\`. The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit --cwd <worktree> git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit git --cwd <worktree> commit -m "<message>" -- <paths>\`, \`workit check --cwd <worktree> <name>\` (verb first, so host allow rules match). The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit git --cwd <worktree> branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId) return readOnly;
   const own = subagentSession(session, event.agentId);
@@ -152,7 +153,8 @@ export function handleHook(input: HookInput, deps: HookDeps): HookDecision {
   if (
     deps.descriptor.transport !== "hook-process" ||
     !PRE_TOOL.has(input.event.kind) ||
-    decision.kind === "deny"
+    decision.kind === "deny" ||
+    decision.kind === "ask"
   )
     return decision;
   const delta = standingDelta(input);
@@ -223,10 +225,14 @@ function decide(input: HookInput, deps: HookDeps): HookDecision {
       const rewrites = usable(descriptor.shellPolicy.rewrite);
       if (plan.kind === "rewrite" && !rewrites && canDeny) return heavyDenial(event.command, plan);
       const lease = plan.kind === "rewrite" && rewrites ? plan : null;
-      // `cd <dir> && workit …` becomes `workit --cwd <dir> …` (issue #388). A
-      // workit command is never heavy itself, so the lease plan wins when set.
+      // `cd <dir> && workit …` becomes `workit <verb> --cwd <dir> …` (issue
+      // #388), and `workit --cwd <dir> <verb>` puts the verb first (#297), so
+      // Workit's enumerated allow rules match. A workit command is never heavy
+      // itself, so the lease plan wins when set.
       const cwdCommand =
-        !lease && rewrites && input.host === "claude_code" ? cwdRewrite(event.command) : null;
+        !lease && rewrites && input.host === "claude_code"
+          ? (cwdRewrite(event.command) ?? verbFirst(event.command))
+          : null;
       const aside = plan.kind === "passthrough" ? plan.note : null;
       // The command will run: note HEAD so the post-tool hook (or the next
       // command, without one) can tell whether a raw commit moved it.
@@ -235,6 +241,15 @@ function decide(input: HookInput, deps: HookDeps): HookDecision {
         event.command,
         postTool ? callKey(event.toolUseId, event.command) : NEXT_COMMAND,
       );
+      // Claude Code: a Workit bypass flag always reaches the user, whatever
+      // the allow rules match (issue #297). Words, not text, so quoting
+      // cannot hide it; a deny above still wins. A leased command runs under
+      // `workit lock run`, which no Workit rule allows.
+      const bypass =
+        !lease && input.host === "claude_code"
+          ? workitBypassFlag(event.command, event.dialect)
+          : null;
+      if (bypass) return { kind: "ask", reason: bypass };
       const rewrittenTo = lease?.command ?? cwdCommand;
       const rewritten = (text: string | null): HookDecision =>
         rewrittenTo

package/src/hooks/hosts/claude-code.ts

@@ -298,6 +298,17 @@ const render = (decision: HookDecision, native: string | null) => {
       },
       exitCode: 0,
     };
+  if (decision.kind === "ask" && native === "PreToolUse")
+    return {
+      json: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "ask",
+          permissionDecisionReason: decision.reason,
+        },
+      },
+      exitCode: 0,
+    };
   if (decision.kind === "context" && native !== null && CONTEXT_EVENTS.has(native))
     return {
       json: { hookSpecificOutput: { hookEventName: native, additionalContext: decision.text } },

package/src/hooks/index.ts

@@ -19,6 +19,12 @@ export {
   type SessionHandle,
 } from "./context";
 export { shellPolicy } from "./policy";
+export {
+  isAllowedWorkitCall,
+  isAllowedWorkitCommand,
+  WORKIT_ALLOWED_VERBS,
+  WORKIT_BYPASS_FLAGS,
+} from "./delivery-verbs";
 export { heavyDenial, heavyGate, splitDenial } from "./heavy-gate";
 export { shellGate, shellWrites, writeGate } from "./write-gate";
 export { liveOwner } from "../core/live-session";

package/src/hooks/protocol.ts

@@ -97,6 +97,8 @@ export type HookDecision =
   | { kind: "context"; text: string }
   /** The reason text always carries its own correction (principle 3). */
   | { kind: "deny"; reason: string; unblock: string | null }
+  /** shell.pre: let the user decide, whatever the host's rules allow. Never an allow. */
+  | { kind: "ask"; reason: string }
   /**
    * shell.pre: run `command` instead (the heavy-command lease rewrite).
    * `input` is the host's tool input with the command replaced, where the

package/src/hooks/raw-git.ts

@@ -602,8 +602,15 @@ function walk(
     // (The heavy-command reader, `seen`, stops at workit: a wrapped command
     // already runs under the lease.)
     const wrapped = seen ? null : workitCheckTail(words);
-    if (wrapped)
-      return "script" in wrapped ? nested(wrapped.script, "posix") : runs([wrapped.argv]);
+    if (wrapped) {
+      // `--cwd <dir>` is where the wrapped command runs, not the shell's directory.
+      const outer = dir;
+      if (wrapped.cwd !== null) dir = joinDir(dir, wrapped.cwd);
+      if ("script" in wrapped) nested(wrapped.script, "posix");
+      else runs([wrapped.argv]);
+      dir = outer;
+      return;
+    }
     if (CD.has(name)) {
       const target = cdTarget(words);
       dir = target === null ? os.homedir() : joinDir(dir, target);
@@ -699,22 +706,25 @@ const PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
 /**
  * What a `workit check [flags] -- <cmd…>` (or `workit lock run -- <cmd…>`,
  * also through `npx @brainervirus/workit-cli`) runs: the script of `--shell`,
- * else the argv. Null for any other command.
+ * else the argv, and the `--cwd` it runs in (null: the shell's). Null for any
+ * other command.
  */
 export function workitCheckTail(
   words: readonly string[],
-): { script: string } | { argv: string[] } | null {
+): (({ script: string } | { argv: string[] }) & { cwd: string | null }) | null {
   let at = 0;
   if (PACKAGE_RUNNERS.has(commandName(words[0]))) {
     at = words.findIndex((word, index) => index > 0 && !word.startsWith("-"));
     if (at < 0 || !WORKIT_PACKAGE.test(words[at])) return null;
   } else if (!/^workit(?:\.exe|\.cmd)?$/.test(commandName(words[0]))) return null;
-  const args = words.slice(at + 1);
+  const { rest: args, cwd } = skipWorkitGlobals(words.slice(at + 1));
   if (args[0] !== "check" && !(args[0] === "lock" && args[1] === "run")) return null;
   const split = args.indexOf("--");
   const tail = split < 0 ? [] : args.slice(split + 1);
   if (!tail.length) return null;
-  return args.slice(0, split).includes("--shell") ? { script: tail.join(" ") } : { argv: tail };
+  return args.slice(0, split).includes("--shell")
+    ? { script: tail.join(" "), cwd }
+    : { argv: tail, cwd };
 }
 
 /**
@@ -791,7 +801,12 @@ export function workitInvocations(
 /** Workit's global options before the verb: `--json`, and these (`--name value` or `--name=value`). */
 const WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
 
-/** An invocation's arguments without the global options before the verb, and the last `--cwd` among them. */
+/**
+ * An invocation's arguments without the global options before the verb and
+ * without any `--cwd` before `--`, and the last `--cwd`. Like the CLI's
+ * parseGlobals, `--cwd` counts anywhere before `--`, so `workit <verb> --cwd
+ * <dir> …` (the form host allow rules match) runs in `<dir>` here too.
+ */
 export function skipWorkitGlobals(args: readonly string[]): { rest: string[]; cwd: string | null } {
   let cwd: string | null = null;
   let at = 0;
@@ -804,7 +819,18 @@ export function skipWorkitGlobals(args: readonly string[]): { rest: string[]; cw
       at++;
     } else if (args[at] !== "--json") break;
   }
-  return { rest: args.slice(at), cwd };
+  const rest: string[] = [];
+  for (; at < args.length; at++) {
+    const arg = args[at];
+    if (arg === "--") {
+      rest.push(...args.slice(at));
+      break;
+    }
+    if (arg.startsWith("--cwd=")) cwd = arg.slice("--cwd=".length);
+    else if (arg === "--cwd" && args[at + 1] !== undefined) cwd = args[++at];
+    else rest.push(arg);
+  }
+  return { rest, cwd };
 }
 
 /** What one raw invocation means for workit. */

package/src/hooks/shell-words.ts

@@ -18,6 +18,12 @@ export type Segment = {
   pipe?: true;
   /** Text it reads on standard input: heredoc bodies and here-strings. */
   stdin?: string[];
+  /**
+   * Indexes into `words` of the words the shell expands before the command
+   * runs: an unquoted `$`, `*`, `?`, `[` or backtick, or a `$(…)`, `<(…)` or
+   * double-quoted `$`/backtick. The text of such a word is not what runs.
+   */
+  expands?: number[];
   /** Command substitutions in its words (`$(…)`, `` `…` ``, `<(…)`), run with it. */
   subs?: string[];
   /** The command could not be analyzed (too deeply nested): why. The only segment then. */
@@ -291,6 +297,20 @@ const substitutions = (body: string): string[] => {
 const PLAIN_POSIX = /[^\s'"\\`$(){},<>|;&#]+/uy;
 const PLAIN_POWERSHELL = /[^\s'"`(){}<>|;&#]+/uy;
 
+/** Does a double-quoted body hold an expansion (`$x`, `$(…)`, a backtick)? */
+const expandsInQuotes = (body: string, dialect: ShellDialect): boolean => {
+  const escape = dialect === "posix" ? "\\" : "`";
+  for (let index = 0; index < body.length; index++) {
+    const char = body[index];
+    if (char === escape) index++;
+    else if (char === "$" || (dialect === "posix" && char === "`")) return true;
+  }
+  return false;
+};
+
+/** An unquoted glob or variable character in a plain run. */
+const EXPANDING_RUN = /[*?[]/u;
+
 /** The `)` of a `(( … ))` arithmetic command starting at `start`, or 0 for a subshell (`((a) )`). */
 const arithmeticEnd = (command: string, start: number): number => {
   const end = substitutionEnd(command, start);
@@ -316,6 +336,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
   let current: Segment = { words: [], redirects: [] };
   let word = "";
   let inWord = false;
+  let expanding = false;
   let pending: "redirect" | "input" | "heredoc" | "herestring" | null = null;
   const heredocs: Array<{ delimiter: string; owner: Segment }> = [];
   const escape = posix ? "\\" : "`";
@@ -327,11 +348,16 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
     } else if (pending === "heredoc")
       heredocs.push({ delimiter: text.replace(/^-/, ""), owner: current });
     else if (pending === "herestring") (current.stdin ??= []).push(text);
-    else if (pending !== "input")
+    else if (pending !== "input") {
+      const at = current.words.length;
       current.words.push(...(MARKERS.test(word) ? expandBraces(word) : [word]));
+      if (expanding || (!posix && word.startsWith("@")))
+        (current.expands ??= []).push(...current.words.slice(at).map((_, i) => at + i));
+    }
     pending = null;
     word = "";
     inWord = false;
+    expanding = false;
   };
   const flushSegment = () => {
     flushWord();
@@ -347,6 +373,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
   /** A substitution read apart: its command runs, its text stays in the word. */
   const substitution = (inner: string, text: string) => {
     (current.subs ??= []).push(inner);
+    expanding = true;
     word += text;
     inWord = true;
   };
@@ -358,6 +385,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
     if (run) {
       word += run[0];
       inWord = true;
+      if (EXPANDING_RUN.test(run[0])) expanding = true;
       index += run[0].length - 1;
       continue;
     }
@@ -383,6 +411,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
       const body = command.slice(index + 1, end < 0 ? undefined : end);
       if (posix && char === '"' && /\$\(|`/.test(body))
         (current.subs ??= []).push(...substitutions(body));
+      if (char === '"' && expandsInQuotes(body, dialect)) expanding = true;
       word += unquote(body, char, dialect);
       inWord = true;
       index = end < 0 ? command.length : end;
@@ -428,6 +457,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
       if (char === "(" && inWord && word.endsWith("$")) {
         word = word.slice(0, -1);
         inWord = word !== "";
+        if (!inWord) expanding = false;
       }
       group(char === "(" ? "open" : "close");
     } else if (!posix && (char === "{" || char === "}")) {
@@ -474,6 +504,7 @@ const tokenize = (command: string, dialect: ShellDialect): Segment[] => {
     } else if (posix && char === "," && word.includes(OPEN)) word += COMMA;
     else if (posix && char === "}" && word.includes(OPEN)) word += CLOSE;
     else {
+      if (char === "$") expanding = true;
       word += char;
       inWord = true;
     }

package/src/hooks/worktree-confine.ts

@@ -182,7 +182,7 @@ const shown = (target: string): string =>
 
 const unboundDeny = (input: HookInput, target: string): HookDecision => {
   const unblock =
-    "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit --cwd <worktree> git commit -m … -- <paths>`, `workit --cwd <worktree> check <name>`). If your brief names no worktree, stop and report that to the lead.";
+    "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit git --cwd <worktree> commit -m … -- <paths>`, `workit check --cwd <worktree> <name>`). If your brief names no worktree, stop and report that to the lead.";
   return {
     kind: "deny",
     reason: `workit worktree confinement: implementer ${input.session.agentId} is not working in a Workit worktree yet, and ${shown(target)} is outside every worktree \`workit fanout worktree create\` made, so it would change the lead's checkout. ${unblock}`,
@@ -191,7 +191,7 @@ const unboundDeny = (input: HookInput, target: string): HookDecision => {
 };
 
 const outsideDeny = (input: HookInput, worktree: string, target: string): HookDecision => {
-  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit --cwd ${worktree} git commit -m … -- <paths>\`, \`workit --cwd ${worktree} check <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
+  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit git --cwd ${worktree} commit -m … -- <paths>\`, \`workit check --cwd ${worktree} <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
   return {
     kind: "deny",
     reason: `workit worktree confinement: implementer ${input.session.agentId} is bound to the worktree ${worktree}, and ${shown(target)} is outside it. ${unblock}`,
@@ -201,7 +201,7 @@ const outsideDeny = (input: HookInput, worktree: string, target: string): HookDe
 
 const unknownDirDeny = (input: HookInput, worktree: string | null): HookDecision => {
   const wt = worktree ?? "<worktree>";
-  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit --cwd ${wt}\`.`;
+  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit <verb> --cwd ${wt}\`.`;
   return {
     kind: "deny",
     reason: `workit worktree confinement: implementer ${input.session.agentId} writes after an unknown directory change. ${unblock}`,

package/src/hooks/write-gate.ts

@@ -509,7 +509,7 @@ const segmentTargets = (
     }
     const inner = depth < 4 ? (wrappedScript(words) ?? (strict ? shellScript(words) : null)) : null;
     if (inner !== null && dir !== undefined)
-      targets.push(...segmentTargets(dir, inner, "posix", depth + 1, strict));
+      targets.push(...segmentTargets(workitRunDir(dir, words), inner, "posix", depth + 1, strict));
     if (strict && dir !== undefined) {
       const runIn = dir;
       for (const sub of depth < 4 ? (segment.subs ?? []) : [])
@@ -550,6 +550,15 @@ const segmentTargets = (
   return targets;
 };
 
+/** Where `workit check|lock run [--cwd <dir>] -- <cmd>` runs its command: `--cwd` resolved against `dir`. */
+const workitRunDir = (dir: string, words: string[]): string => {
+  for (const invocation of workitInvocations(words.map(quoteWord).join(" "), "posix")) {
+    const { at, args } = workitCwd(dir, invocation);
+    if (args[0] === "check" || (args[0] === "lock" && args[1] === "run")) return at;
+  }
+  return dir;
+};
+
 /** A workit invocation's global `--cwd <dir>` (or `--cwd=<dir>`), resolved against `dir`. */
 const workitCwd = (dir: string, args: string[]): { at: string; args: string[] } => {
   const { rest, cwd } = skipWorkitGlobals(args);