@brainervirus/workit-core 8.29.0 → 8.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "8.29.0",
+  "version": "8.29.1",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/src/core/heavy.ts

@@ -446,8 +446,8 @@ export type HeavyPlan =
   | { kind: "rewrite"; command: string; reason: string }
   /** A chain with heavy parts: run each part alone (`unblock` is the first heavy one). */
   | { kind: "split"; reason: string; unblock: string | null }
-  /** A host rule names it, or wrapping would raise it: it runs as typed. */
-  | { kind: "passthrough"; note: string };
+  /** A host rule names it, or wrapping would raise it: it runs as typed, saying nothing. */
+  | { kind: "passthrough"; note: "" };
 
 export type PlanOptions = HeavyOptions & {
   /** The host's permission rules; null where the host has none to read (Pi). */
@@ -476,7 +476,7 @@ export function heavyPlan(command: string, options: PlanOptions): HeavyPlan {
   if (!lines) return { kind: "none" };
   const heavy = heavyLines(lines, options);
   if (!heavy.length) return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName(simple[0])) && heavyLines([simple], options)[0];
   const judged = single
     ? [{ words: lines.flat(), text: command }]
@@ -490,7 +490,7 @@ export function heavyPlan(command: string, options: PlanOptions): HeavyPlan {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`,
+          note: "",
         };
     }
   if (single) {
@@ -502,7 +502,7 @@ export function heavyPlan(command: string, options: PlanOptions): HeavyPlan {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null,
   };
 }

package/src/hooks/handle.ts

@@ -127,18 +127,26 @@ const subagentStartText = (
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId) return readOnly;
   const own = subagentSession(session, event.agentId);
+  const cwd = input.cwd || process.cwd();
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const branch = judgeBranch(cwd);
+  // Codex runs a subagent's shell with its own CODEX_THREAD_ID: the CLI already
+  // acts as that session, so the line names no --session and no --token (a
+  // token on a command line lands in the rollout, #427) and nothing is issued.
+  if (descriptor.host === "codex_cli" || descriptor.host === "codex_desktop")
+    return `${readOnly} Its shell already acts as its own Workit session, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${verdictCommand({ branch, judge })}\`. Add no session or token option to it, and never set WORKIT_SESSION_ID by hand.`;
   // `ledger verdict` accepts `<lead>:<agent id>` only when this hook issued it,
-  // and only with the token it hands to this subagent alone.
+  // and only with the token it hands to this subagent alone. Claude Code
+  // subagents share the lead's environment, so no per-agent env var or file
+  // can carry it: the token stays on the line (docs/agents/hosts.md, #427).
   // (An isolated judge's text is rebuilt with cwd "": the hook's own cwd then.)
   // Issued once: a replayed SubagentStart for the same id gets no token.
-  const cwd = input.cwd || process.cwd();
   const token = session ? recordIssuedSession(cwd, session, own) : null;
   // Already issued: without its token the id is refused (unbound_session).
   if (session && !token)
     return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
-  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
-  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
-  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const line = verdictCommand({ branch, judge, session: own, token });
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 

package/src/hooks/raw-git.ts

@@ -727,15 +727,19 @@ export function workitCheckTail(
     : { argv: tail, cwd };
 }
 
+const OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
+
 /**
  * The one command `command` runs after its wrappers (env prefixes, `timeout`,
  * `nice`, `flock`, `bash -c '<one command>'`), or null when it is a chain,
- * pipe, redirect, substitution, group or heredoc anywhere.
+ * pipe, redirect, substitution, group or heredoc anywhere (`shaped` allows
+ * redirects and one trailing `| tail|head|grep` filter).
  */
 export function simpleCommand(
   command: string,
   dialect: ShellDialect = "posix",
   depth = 0,
+  shaped = false,
 ): string[] | null {
   let segments: Segment[];
   try {
@@ -743,13 +747,27 @@ export function simpleCommand(
   } catch {
     return null;
   }
-  if (segments.length !== 1) return null;
+  // `shaped`: output shaping around the one command is not a chain: any
+  // redirects, and at most one trailing `| tail|head|grep …` filter.
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (
+      !segments[0].pipe ||
+      !OUTPUT_FILTERS.has(commandName(filter.words[0])) ||
+      filter.group ||
+      filter.pipe ||
+      filter.unanalyzable ||
+      filter.subs?.length ||
+      filter.stdin?.length
+    )
+      return null;
+  } else if (segments.length !== 1) return null;
   const [segment] = segments;
   if (
     segment.group ||
-    segment.pipe ||
+    (segment.pipe && !filter) ||
     segment.unanalyzable ||
-    segment.redirects.length ||
+    (segment.redirects.length && !shaped) ||
     segment.subs?.length ||
     segment.stdin?.length
   )

package/src/host-session.ts

@@ -381,6 +381,20 @@ export type SessionClaimRefusal = { error: string; unblock: string };
  * Anything else is a forged id: a verdict recorded under it would make author
  * is not verifier a naming convention.
  */
+const isOwnShellClaim = (real: RealSession, claimed: string): boolean =>
+  (claimed === real.session && !(real.kind === "declared" && claimed.includes(":"))) ||
+  (real.kind === "derived" && claimed.endsWith(`:${real.session}`));
+
+/**
+ * `claimed` is the shell's own derived session (OPENCODE_SESSION_ID,
+ * PI_SESSION_ID, CODEX_THREAD_ID), alone or as `<lead>:<it>`: a `--session`
+ * naming it adds nothing, so the CLI acts as the shell's session instead.
+ */
+export const namesOwnDerivedSession = (env: NodeJS.ProcessEnv, claimed: string): boolean => {
+  const real = realHostSession(env);
+  return real.kind === "derived" && isOwnShellClaim(real, claimed);
+};
+
 export function sessionClaimRefusal(
   env: NodeJS.ProcessEnv,
   claimed: string,
@@ -397,16 +411,17 @@ export function sessionClaimRefusal(
       unblock: `record the verdict from the ${real.host} session's own shell, where ${HOST_SET_VARIABLE[host]} is set`,
     };
   if (real.kind === "none" || !real.session) return null;
-  const ownShell =
-    (claimed === real.session && !(real.kind === "declared" && claimed.includes(":"))) ||
-    (real.kind === "derived" && claimed.endsWith(`:${real.session}`));
-  if (ownShell)
-    return options.flag
-      ? {
-          error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
-          unblock: "drop --session: the shell's own session is already the acting one",
-        }
-      : null;
+  const ownShell = isOwnShellClaim(real, claimed);
+  if (ownShell) {
+    // A derived session (the host's own shell variable) cannot be replaced by
+    // a flag, so naming it is a no-op, not an error: a printed line that
+    // carries it still records. Declared sessions keep refusing the flag.
+    if (!options.flag || real.kind === "derived") return null;
+    return {
+      error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
+      unblock: "drop --session: the shell's own session is already the acting one",
+    };
+  }
   const issuedClaim = claimed === real.session || claimed.startsWith(`${real.session}:`);
   if (issuedClaim) {
     const binding = issuedBinding(cwd, claimed);