@brainervirus/workit-core 8.28.1 → 8.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.28.1",
+  "version": "8.29.1",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/src/check-config.ts

@@ -10,6 +10,10 @@
 //    self-ignoring `.workit/`, never at the repo root. A legacy root
 //    `workit.checks.json` is still read when `.workit/checks.json` is absent,
 //    with a note that it moved.
+//    In a linked worktree (a fanout slice's, an agent's) that has neither
+//    file, the main checkout's is read: `.workit/` is git-ignored, so a new
+//    worktree never has one, and it shares the main checkout's checks
+//    (#426). Configured commands still run from the worktree's own top.
 // 2. Built-in ecosystem defaults detected from the repo: package.json scripts
 //    `test`, `lint`, `typecheck`, `check` (`<pm> run <script>`, pm from the
 //    lockfile); go.mod → `go test ./...`; Cargo.toml → `cargo test`;
@@ -216,10 +220,25 @@ function detectedChecks(root: string): NamedCheck[] {
 
 const GATES = ["testing", "verification"] as const;
 
+/**
+ * The checks config file for `root`: its own, else (in a linked worktree
+ * without one) the main checkout's, else the path a new config belongs at.
+ */
+function configFileFor(root: string): string {
+  const own = checksConfigFile(root);
+  if (fs.existsSync(own)) return own;
+  const common = git(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (!common || path.basename(common) !== ".git") return own;
+  const main = path.dirname(common);
+  if (path.resolve(main) === path.resolve(root)) return own;
+  const shared = checksConfigFile(main);
+  return fs.existsSync(shared) ? shared : own;
+}
+
 /** The named checks for the repository containing `cwd` (see the header). */
 export function loadCheckConfig(cwd: string): CheckConfig {
   const root = checkRoot(cwd);
-  const file = checksConfigFile(root);
+  const file = configFileFor(root);
   const legacy = path.basename(file) === LEGACY_CHECKS_FILE;
   const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
   const note = legacy

package/src/core/heavy.ts

@@ -446,8 +446,8 @@ export type HeavyPlan =
   | { kind: "rewrite"; command: string; reason: string }
   /** A chain with heavy parts: run each part alone (`unblock` is the first heavy one). */
   | { kind: "split"; reason: string; unblock: string | null }
-  /** A host rule names it, or wrapping would raise it: it runs as typed. */
-  | { kind: "passthrough"; note: string };
+  /** A host rule names it, or wrapping would raise it: it runs as typed, saying nothing. */
+  | { kind: "passthrough"; note: "" };
 
 export type PlanOptions = HeavyOptions & {
   /** The host's permission rules; null where the host has none to read (Pi). */
@@ -476,7 +476,7 @@ export function heavyPlan(command: string, options: PlanOptions): HeavyPlan {
   if (!lines) return { kind: "none" };
   const heavy = heavyLines(lines, options);
   if (!heavy.length) return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName(simple[0])) && heavyLines([simple], options)[0];
   const judged = single
     ? [{ words: lines.flat(), text: command }]
@@ -490,7 +490,7 @@ export function heavyPlan(command: string, options: PlanOptions): HeavyPlan {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`,
+          note: "",
         };
     }
   if (single) {
@@ -502,7 +502,7 @@ export function heavyPlan(command: string, options: PlanOptions): HeavyPlan {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null,
   };
 }

package/src/fanout-worktree.ts

@@ -255,9 +255,56 @@ export type CreateOutcome = {
   created: boolean;
   /** node_modules linked from the main checkout (worktree-deps.ts); null when none were. */
   dependencies: LinkedDependencies | null;
+  /** The install command to run in the worktree when its lockfile differs from the main checkout's. */
+  install: string | null;
   notes: string[];
 };
 
+/** Lockfiles in the order a package manager is picked, with its frozen install for a directory. */
+const LOCKFILES: ReadonlyArray<[string, (dir: string) => string]> = [
+  ["bun.lock", (dir) => `bun install --frozen-lockfile --cwd ${dir}`],
+  ["bun.lockb", (dir) => `bun install --frozen-lockfile --cwd ${dir}`],
+  ["pnpm-lock.yaml", (dir) => `pnpm install --frozen-lockfile --dir ${dir}`],
+  ["yarn.lock", (dir) => `yarn install --frozen-lockfile --cwd ${dir}`],
+  ["package-lock.json", (dir) => `npm ci --prefix ${dir}`],
+];
+
+const readBytes = (file: string): Buffer | null => {
+  try {
+    return fs.readFileSync(file);
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * Link the main checkout's node_modules into `worktree` only when every
+ * lockfile is byte-identical in both: a stale main checkout would otherwise
+ * hand the worktree the wrong dependency versions (#426). When one differs,
+ * nothing is linked and `install` is the command the worker runs instead.
+ */
+function worktreeDependencies(
+  main: string,
+  worktree: string,
+): { linked: LinkedDependencies | null; install: string | null; notes: string[] } {
+  for (const [name, install] of LOCKFILES) {
+    const ours = readBytes(path.join(main, name));
+    const theirs = readBytes(path.join(worktree, name));
+    if (ours === null && theirs === null) continue;
+    if (ours !== null && theirs !== null && ours.equals(theirs)) continue;
+    if (fs.existsSync(path.join(worktree, "node_modules"))) break;
+    const command = install(worktree);
+    return {
+      linked: null,
+      install: command,
+      notes: [
+        `${name} differs from the main checkout's (${main}), so its node_modules was not linked; install dependencies first: ${command}`,
+      ],
+    };
+  }
+  return { ...linkWorktreeDependencies(main, worktree), install: null };
+}
+
 function ensureScratch(worktree: string): string {
   const scratch = path.join(worktree, SCRATCH_DIR);
   fs.mkdirSync(scratch, { recursive: true });
@@ -303,7 +350,7 @@ export function createSliceWorktree(
         `remove it yourself (git worktree remove ${target}) once you know what it holds`,
       );
     excludeScratch(cwd);
-    const deps = linkWorktreeDependencies(mainCheckout(cwd), target);
+    const deps = worktreeDependencies(mainCheckout(cwd), target);
     return {
       ok: true,
       data: {
@@ -313,6 +360,7 @@ export function createSliceWorktree(
         mode: resolveRef(cwd, localRef) ? "resume" : "new",
         created: false,
         dependencies: deps.linked,
+        install: deps.install,
         notes: [
           deps.linked
             ? "the worktree already exists; only its missing dependencies were linked"
@@ -392,7 +440,7 @@ export function createSliceWorktree(
   }
   excludeScratch(cwd);
   const scratch = ensureScratch(target);
-  const deps = linkWorktreeDependencies(mainCheckout(cwd), target);
+  const deps = worktreeDependencies(mainCheckout(cwd), target);
   notes.push(...deps.notes);
   const head = gitRun(target, ["rev-parse", "HEAD"]).stdout.trim();
   const baseSha = mode === "new" ? head : null;
@@ -415,7 +463,16 @@ export function createSliceWorktree(
   });
   return {
     ok: true,
-    data: { ...base, scratch, head, mode, created: true, dependencies: deps.linked, notes },
+    data: {
+      ...base,
+      scratch,
+      head,
+      mode,
+      created: true,
+      dependencies: deps.linked,
+      install: deps.install,
+      notes,
+    },
   };
 }
 

package/src/hooks/handle.ts

@@ -127,18 +127,26 @@ const subagentStartText = (
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId) return readOnly;
   const own = subagentSession(session, event.agentId);
+  const cwd = input.cwd || process.cwd();
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const branch = judgeBranch(cwd);
+  // Codex runs a subagent's shell with its own CODEX_THREAD_ID: the CLI already
+  // acts as that session, so the line names no --session and no --token (a
+  // token on a command line lands in the rollout, #427) and nothing is issued.
+  if (descriptor.host === "codex_cli" || descriptor.host === "codex_desktop")
+    return `${readOnly} Its shell already acts as its own Workit session, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${verdictCommand({ branch, judge })}\`. Add no session or token option to it, and never set WORKIT_SESSION_ID by hand.`;
   // `ledger verdict` accepts `<lead>:<agent id>` only when this hook issued it,
-  // and only with the token it hands to this subagent alone.
+  // and only with the token it hands to this subagent alone. Claude Code
+  // subagents share the lead's environment, so no per-agent env var or file
+  // can carry it: the token stays on the line (docs/agents/hosts.md, #427).
   // (An isolated judge's text is rebuilt with cwd "": the hook's own cwd then.)
   // Issued once: a replayed SubagentStart for the same id gets no token.
-  const cwd = input.cwd || process.cwd();
   const token = session ? recordIssuedSession(cwd, session, own) : null;
   // Already issued: without its token the id is refused (unbound_session).
   if (session && !token)
     return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
-  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
-  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
-  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const line = verdictCommand({ branch, judge, session: own, token });
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 

package/src/hooks/raw-git.ts

@@ -727,15 +727,19 @@ export function workitCheckTail(
     : { argv: tail, cwd };
 }
 
+const OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
+
 /**
  * The one command `command` runs after its wrappers (env prefixes, `timeout`,
  * `nice`, `flock`, `bash -c '<one command>'`), or null when it is a chain,
- * pipe, redirect, substitution, group or heredoc anywhere.
+ * pipe, redirect, substitution, group or heredoc anywhere (`shaped` allows
+ * redirects and one trailing `| tail|head|grep` filter).
  */
 export function simpleCommand(
   command: string,
   dialect: ShellDialect = "posix",
   depth = 0,
+  shaped = false,
 ): string[] | null {
   let segments: Segment[];
   try {
@@ -743,13 +747,27 @@ export function simpleCommand(
   } catch {
     return null;
   }
-  if (segments.length !== 1) return null;
+  // `shaped`: output shaping around the one command is not a chain: any
+  // redirects, and at most one trailing `| tail|head|grep …` filter.
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (
+      !segments[0].pipe ||
+      !OUTPUT_FILTERS.has(commandName(filter.words[0])) ||
+      filter.group ||
+      filter.pipe ||
+      filter.unanalyzable ||
+      filter.subs?.length ||
+      filter.stdin?.length
+    )
+      return null;
+  } else if (segments.length !== 1) return null;
   const [segment] = segments;
   if (
     segment.group ||
-    segment.pipe ||
+    (segment.pipe && !filter) ||
     segment.unanalyzable ||
-    segment.redirects.length ||
+    (segment.redirects.length && !shaped) ||
     segment.subs?.length ||
     segment.stdin?.length
   )

package/src/host-session.ts

@@ -381,6 +381,20 @@ export type SessionClaimRefusal = { error: string; unblock: string };
  * Anything else is a forged id: a verdict recorded under it would make author
  * is not verifier a naming convention.
  */
+const isOwnShellClaim = (real: RealSession, claimed: string): boolean =>
+  (claimed === real.session && !(real.kind === "declared" && claimed.includes(":"))) ||
+  (real.kind === "derived" && claimed.endsWith(`:${real.session}`));
+
+/**
+ * `claimed` is the shell's own derived session (OPENCODE_SESSION_ID,
+ * PI_SESSION_ID, CODEX_THREAD_ID), alone or as `<lead>:<it>`: a `--session`
+ * naming it adds nothing, so the CLI acts as the shell's session instead.
+ */
+export const namesOwnDerivedSession = (env: NodeJS.ProcessEnv, claimed: string): boolean => {
+  const real = realHostSession(env);
+  return real.kind === "derived" && isOwnShellClaim(real, claimed);
+};
+
 export function sessionClaimRefusal(
   env: NodeJS.ProcessEnv,
   claimed: string,
@@ -397,16 +411,17 @@ export function sessionClaimRefusal(
       unblock: `record the verdict from the ${real.host} session's own shell, where ${HOST_SET_VARIABLE[host]} is set`,
     };
   if (real.kind === "none" || !real.session) return null;
-  const ownShell =
-    (claimed === real.session && !(real.kind === "declared" && claimed.includes(":"))) ||
-    (real.kind === "derived" && claimed.endsWith(`:${real.session}`));
-  if (ownShell)
-    return options.flag
-      ? {
-          error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
-          unblock: "drop --session: the shell's own session is already the acting one",
-        }
-      : null;
+  const ownShell = isOwnShellClaim(real, claimed);
+  if (ownShell) {
+    // A derived session (the host's own shell variable) cannot be replaced by
+    // a flag, so naming it is a no-op, not an error: a printed line that
+    // carries it still records. Declared sessions keep refusing the flag.
+    if (!options.flag || real.kind === "derived") return null;
+    return {
+      error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
+      unblock: "drop --session: the shell's own session is already the acting one",
+    };
+  }
   const issuedClaim = claimed === real.session || claimed.startsWith(`${real.session}:`);
   if (issuedClaim) {
     const binding = issuedBinding(cwd, claimed);