@brainervirus/workit-cursor 8.17.0 → 8.18.0

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "8.17.0",
+  "version": "8.18.0",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/dist/cursor-session-start.js

@@ -11526,7 +11526,7 @@ var RULES, derived2 = (spec) => ({
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -15033,6 +15033,11 @@ var init_workers = __esm(() => {
 import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
 import path16 from "node:path";
+function checksConfigFile(root) {
+  const current = path16.join(root, CHECKS_FILE);
+  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
+  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+}
 function repoHeavyCommands(root) {
   try {
     const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
@@ -15124,19 +15129,25 @@ function detectedChecks(root) {
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -15146,33 +15157,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord3(parsed) || !isRecord3(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord3(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 function matchesNamedCheck(config, name, argv, cwd) {
   if (config.error || name === null || cwd !== ".")
@@ -15207,7 +15218,7 @@ function workitAvailable(env = process.env) {
 function checkCommand(args, version, onPath = workitAvailable()) {
   return onPath ? `workit check ${args}` : `npx -y @brainervirus/workit-cli@${version} check ${args}`;
 }
-var SCRIPT_CHECKS, CHECKS_FILE = "workit.checks.json", checksConfigFile = (root) => path16.join(root, CHECKS_FILE), isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git4 = (cwd, args) => {
+var SCRIPT_CHECKS, CHECKS_FILE = ".workit/checks.json", LEGACY_CHECKS_FILE = "workit.checks.json", isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SHELL_META, git4 = (cwd, args) => {
   const run = spawnSync9("git", args, {
     cwd,
     encoding: "utf8",
@@ -15423,7 +15434,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)
@@ -22274,6 +22285,102 @@ var init_handle = __esm(() => {
   CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
 });
 
+// packages/workit-core/src/hooks/deadline.ts
+import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
+import path28 from "node:path";
+var HOOK_SKIP_TEXT = "workit context skipped: host under load", HOOK_DEADLINE_MS = 8000, HOST_DEADLINES, HOOK_SKIPS_FILE = "hook-skips.jsonl", override = (env) => {
+  const value = Number(env.WORKIT_HOOK_DEADLINE_MS);
+  return Number.isFinite(value) && value > 0 ? value : null;
+}, hookDeadlineMs = (env, host = "", native) => {
+  const row = HOST_DEADLINES[host];
+  return override(env) ?? (row ? native === undefined ? Math.min(...Object.values(row)) : row[native] ?? row[""] : HOOK_DEADLINE_MS);
+}, skipsFile = (stateDir) => path28.join(stateDir, HOOK_SKIPS_FILE), recordHookSkip = (skip, stateDir = resolveStateDir()) => {
+  try {
+    mkdirSync3(stateDir, { recursive: true });
+    appendFileSync(skipsFile(stateDir), `${JSON.stringify(skip)}
+`);
+  } catch {}
+}, QUIET, skipDecision = (event) => QUIET.has(event) ? { kind: "none" } : { kind: "context", text: HOOK_SKIP_TEXT }, TIMED_OUT, within = async (work, ms) => {
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), Math.max(0, ms));
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([work, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}, isTimedOut = (value) => value === TIMED_OUT, PROCESS_START, hookBudget = (env, options = {}, host = "") => {
+  const now = options.now ?? Date.now;
+  return {
+    now,
+    record: options.record ?? ((skip) => recordHookSkip(skip)),
+    startedAt: options.startedAt ?? now(),
+    deadlineMs: options.deadlineMs ?? hookDeadlineMs(env, host),
+    host: options.deadlineMs === undefined ? host : null
+  };
+}, readWithin = async (stdin, budget) => {
+  const read = (async () => {
+    let text = "";
+    for await (const chunk of stdin)
+      text += String(chunk);
+    return text;
+  })();
+  const text = await within(read, budget.startedAt + budget.deadlineMs - budget.now());
+  return isTimedOut(text) ? null : text;
+}, note = (adapter, raw, env, budget, outcome, stage) => {
+  const parsed = raw === undefined ? null : adapter.parse(raw, env);
+  const event = parsed ? parsed.ok ? parsed.input.event.kind : parsed.event : null;
+  budget.record({
+    at: new Date(budget.now()).toISOString(),
+    host: adapter.descriptor.host,
+    event,
+    outcome,
+    stage,
+    elapsedMs: Math.round(budget.now() - budget.startedAt)
+  });
+  return { native: parsed?.native ?? null, event };
+}, skippedHook = (adapter, raw, env, budget, stage) => {
+  const { native, event } = note(adapter, raw, env, budget, "skip", stage);
+  return {
+    ...adapter.render(skipDecision(event), native),
+    error: `${HOOK_SKIP_TEXT} (past the ${budget.deadlineMs} ms hook deadline)`,
+    skipped: true
+  };
+}, dispatchWithin = async (adapter, raw, env, budget, dispatch = dispatchHook) => {
+  const native = raw?.hook_event_name;
+  if (budget.host !== null && typeof native === "string")
+    budget.deadlineMs = hookDeadlineMs(env, budget.host, native);
+  const remaining = () => budget.startedAt + budget.deadlineMs - budget.now();
+  const result = remaining() > 0 ? await within(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
+  if (isTimedOut(result))
+    return skippedHook(adapter, raw, env, budget, "dispatch");
+  if (remaining() < 0)
+    note(adapter, raw, env, budget, "late", "done");
+  return { ...result, skipped: false };
+};
+var init_deadline = __esm(() => {
+  init_logger();
+  init_handle();
+  HOST_DEADLINES = {
+    claude_code: { "": 8000, SessionStart: 16000, Stop: 16000 },
+    codex_cli: { "": 45000, Stop: 16000 },
+    codex_desktop: { "": 45000, Stop: 16000 },
+    cursor: { "": 45000 }
+  };
+  QUIET = new Set([
+    "stop",
+    "subagent.stop",
+    "shell.post",
+    "compact.pre",
+    "prompt.submit",
+    null
+  ]);
+  TIMED_OUT = Symbol("timed out");
+  PROCESS_START = performance.timeOrigin;
+});
+
 // packages/workit-core/src/hooks/hosts/claude-code.ts
 var CLAUDE_CODE_DESCRIPTOR, EVENTS, SOURCES, SHELL_TOOLS, dialectOf2 = (value) => value.tool_name === "PowerShell" ? "powershell" : "posix", toolCommand = (value) => isRecord6(value.tool_input) ? commandText(value.tool_input.command) : null, eventOf = (name, value) => {
   const toolUseId = optionalText(value.tool_use_id);
@@ -22832,7 +22939,7 @@ var init_codex = __esm(() => {
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
 import fs21 from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (value) => {
   if (!isRecord6(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
@@ -22913,7 +23020,7 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
       };
   }
 }, TRANSCRIPT_TAIL_BYTES, lastAssistantText = (file) => {
-  if (!file || !path28.isAbsolute(file))
+  if (!file || !path29.isAbsolute(file))
     return null;
   try {
     const size = fs21.statSync(file).size;
@@ -22949,14 +23056,14 @@ var undocumented, none, CURSOR_DESCRIPTOR, EVENTS3, parseCursorHookInput = (valu
   } catch {
     return null;
   }
-}, within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path28.sep) ? root : `${root}${path28.sep}`), hookCwd = (input) => {
+}, within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path29.sep) ? root : `${root}${path29.sep}`), hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
     return cwd;
   return cursorWorkspaceRoot(input);
 }, cursorWorkspaceRoot = (input) => {
   const cwd = existingDirectory(input.cwd);
-  return cwd && input.workspace_roots.find((root) => within(root, cwd)) || input.workspace_roots[0];
+  return cwd && input.workspace_roots.find((root) => within2(root, cwd)) || input.workspace_roots[0];
 }, cursorDeny = (reason) => ({
   permission: "deny",
   user_message: "Workit blocked this action",
@@ -23130,19 +23237,21 @@ var init_cursor = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/run.ts
-async function runHookProcess(host, stdin, stdout, stderr = process.stderr, env = process.env) {
+async function runHookProcess(host, stdin, stdout, stderr = process.stderr, env = process.env, deadline = {}) {
   const adapter = typeof host === "string" ? HOOK_ADAPTERS[host] : host;
-  let text = "";
-  for await (const chunk of stdin)
-    text += String(chunk);
+  const budget = hookBudget(env, deadline, adapter.descriptor.host);
+  const text = await readWithin(stdin, budget);
   let raw;
   try {
-    raw = JSON.parse(text || "{}");
+    raw = text === null ? undefined : JSON.parse(text || "{}");
   } catch {
     raw = undefined;
   }
-  const result = dispatchHook(adapter, raw, env);
-  if (raw === undefined || result.error)
+  const result = text === null ? skippedHook(adapter, undefined, env, budget, "input") : await dispatchWithin(adapter, raw, env, budget, deadline.dispatch);
+  if (result.skipped)
+    stderr.write(`[workit] ${result.error}
+`);
+  else if (raw === undefined || result.error)
     stderr.write(`[workit] hook input rejected: ${raw === undefined ? "invalid JSON hook input" : result.error}
 `);
   stdout.write(`${JSON.stringify(result.json)}
@@ -23151,7 +23260,7 @@ async function runHookProcess(host, stdin, stdout, stderr = process.stderr, env
 }
 var HOOK_ADAPTERS;
 var init_run = __esm(async () => {
-  init_handle();
+  init_deadline();
   init_claude_code();
   init_codex();
   init_cursor();
@@ -23309,6 +23418,14 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
     return { json: {} };
   const note = `[workit: ${gap}; Workit checks are skipped for this action]`;
   return { json: { permission: "allow", user_message: note, agent_message: note } };
+}, subagentStartStep = (_adapter, raw) => {
+  let json;
+  try {
+    json = handleSubagentStartHook(raw);
+  } catch (error) {
+    json = cursorDeny(`hook failure: ${String(error)}`);
+  }
+  return { json, exitCode: json.permission === "deny" ? 2 : 0, error: null };
 }, runCursorHook = async () => {
   let text = "";
   for await (const chunk of process.stdin)
@@ -23326,24 +23443,16 @@ var hostRef = (handle) => ({ kind: "host", host: "cursor", handle }), cursorCapa
     process.exitCode = 0;
     return;
   }
-  if (isSubagentStart(raw)) {
-    let output;
-    try {
-      output = handleSubagentStartHook(raw);
-    } catch (error) {
-      output = cursorDeny(`hook failure: ${String(error)}`);
-    }
-    process.stdout.write(`${JSON.stringify(output)}
-`);
-    process.exitCode = output.permission === "deny" ? 2 : 0;
-    return;
-  }
-  process.exitCode = await runHookProcess(cursorAdapter, [text], process.stdout);
+  process.exitCode = await runHookProcess(cursorAdapter, [text], process.stdout, process.stderr, process.env, {
+    startedAt: PROCESS_START,
+    ...isSubagentStart(raw) ? { dispatch: subagentStartStep } : {}
+  });
 };
 var init_workit_hook = __esm(async () => {
   init_task_contract();
   init_task_engine();
   init_task_store();
+  init_deadline();
   await __promiseAll([
     init_hooks(),
     init_hooks()

package/dist/mcp-server.js

@@ -21250,8 +21250,13 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import fs9 from "node:fs";
 import path9 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
-var CHECKS_FILE = "workit.checks.json";
-var checksConfigFile = (root) => path9.join(root, CHECKS_FILE);
+var CHECKS_FILE = ".workit/checks.json";
+var LEGACY_CHECKS_FILE = "workit.checks.json";
+function checksConfigFile(root) {
+  const current = path9.join(root, CHECKS_FILE);
+  const legacy = path9.join(root, LEGACY_CHECKS_FILE);
+  return !fs9.existsSync(current) && fs9.existsSync(legacy) ? legacy : current;
+}
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var SHELL_META = /[|&;<>()$`\\*?[\]{}~!#]/u;
 function splitCommand(command) {
@@ -21365,19 +21370,25 @@ var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path9.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs9.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -21387,33 +21398,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord(parsed) || !isRecord(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -24072,7 +24083,7 @@ var productDecision = (task, ledger) => {
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -24556,7 +24567,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)
@@ -28828,6 +28839,18 @@ var WRITE_TOOLS = new Set([
 ]);
 // packages/workit-core/src/hooks/handle.ts
 var offered = new Set;
+// packages/workit-core/src/hooks/deadline.ts
+var QUIET = new Set([
+  "stop",
+  "subagent.stop",
+  "shell.post",
+  "compact.pre",
+  "prompt.submit",
+  null
+]);
+var TIMED_OUT = Symbol("timed out");
+var PROCESS_START = performance.timeOrigin;
+
 // packages/workit-core/src/hooks/hosts/claude-code.ts
 var SOURCES = new Set(["startup", "resume", "clear", "compact", "fork"]);
 var SHELL_TOOLS = new Set(["Bash", "PowerShell"]);

package/dist/workit-hook.js

@@ -11528,7 +11528,7 @@ var productDecision = (task, ledger) => {
     };
   const since = Date.parse(task.createdAt);
   const branch = ledger.branch();
-  const row = ledger.rows().findLast((item) => item.type === "decision" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
+  const row = ledger.rows().findLast((item) => item.type === "decision" && item.by !== "decider" && !item.superseded && (item.branch ?? null) === branch && Date.parse(item.at) >= since);
   return row ? { met: true, reason: `ledger decision ${row.id} records the choice`, decisionIds: [] } : {
     met: false,
     reason: 'open product choice: ask the user, then `workit ledger decision "<choice>" --why "<reason>"` (or, if it is not open, `workit policy assess --judge product-choice=no --why "<reason>"`)',
@@ -15071,8 +15071,13 @@ import { spawnSync as spawnSync9 } from "node:child_process";
 import fs12 from "node:fs";
 import path16 from "node:path";
 var SCRIPT_CHECKS = ["test", "lint", "typecheck", "check"];
-var CHECKS_FILE = "workit.checks.json";
-var checksConfigFile = (root) => path16.join(root, CHECKS_FILE);
+var CHECKS_FILE = ".workit/checks.json";
+var LEGACY_CHECKS_FILE = "workit.checks.json";
+function checksConfigFile(root) {
+  const current = path16.join(root, CHECKS_FILE);
+  const legacy = path16.join(root, LEGACY_CHECKS_FILE);
+  return !fs12.existsSync(current) && fs12.existsSync(legacy) ? legacy : current;
+}
 function repoHeavyCommands(root) {
   try {
     const value = JSON.parse(fs12.readFileSync(checksConfigFile(root), "utf8"));
@@ -15196,19 +15201,25 @@ var GATES = ["testing", "verification"];
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
   const file = checksConfigFile(root);
+  const legacy = path16.basename(file) === LEGACY_CHECKS_FILE;
+  const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
+  const note = legacy ? {
+    note: `${LEGACY_CHECKS_FILE} is deprecated; move it to ${CHECKS_FILE} (workit doctor --fix)`
+  } : {};
   const none = (error = null) => ({
-    source: error ? CHECKS_FILE : "none",
+    source: error ? label : "none",
     root,
     checks: [],
     gates: {},
-    error
+    error,
+    ...note
   });
   let text = null;
   try {
     text = fs12.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT")
-      return none(`cannot read ${CHECKS_FILE}: ${error.message}`);
+      return none(`cannot read ${label}: ${error.message}`);
   }
   if (text === null) {
     const checks = detectedChecks(root);
@@ -15218,33 +15229,33 @@ function loadCheckConfig(cwd) {
   try {
     parsed = JSON.parse(text);
   } catch {
-    return none(`${CHECKS_FILE} is not valid JSON`);
+    return none(`${label} is not valid JSON`);
   }
   if (!isRecord3(parsed) || !isRecord3(parsed.checks))
-    return none(`${CHECKS_FILE} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
+    return none(`${label} must be {"checks":{"<name>":"<command>"|["argv",…]}}`);
   const checks = [];
   for (const [name, value] of Object.entries(parsed.checks)) {
     if (!CHECK_NAME.test(name))
-      return none(`${CHECKS_FILE}: check name "${name}" must match ${CHECK_NAME.source}`);
+      return none(`${label}: check name "${name}" must match ${CHECK_NAME.source}`);
     const argv = typeof value === "string" ? splitCommand(value) : Array.isArray(value) && value.length > 0 && value.every((item) => typeof item === "string" && item.length > 0) ? value : new Error("expected a command string or a non-empty argv array");
     if (argv instanceof Error)
-      return none(`${CHECKS_FILE}: check "${name}": ${argv.message}`);
+      return none(`${label}: check "${name}": ${argv.message}`);
     checks.push({ name, argv, accepts: [argv] });
   }
   const gates = {};
   if (parsed.gates !== undefined) {
     if (!isRecord3(parsed.gates))
-      return none(`${CHECKS_FILE}: gates must be {"testing":"<name>"|["<name>",…]}`);
+      return none(`${label}: gates must be {"testing":"<name>"|["<name>",…]}`);
     for (const [gate, value] of Object.entries(parsed.gates)) {
       if (!GATES.includes(gate))
-        return none(`${CHECKS_FILE}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
+        return none(`${label}: unknown gate "${gate}" (use ${GATES.join(" or ")})`);
       const names = typeof value === "string" ? [value] : value;
       if (!Array.isArray(names) || names.length === 0 || !names.every((name) => typeof name === "string" && checks.some((c) => c.name === name)))
-        return none(`${CHECKS_FILE}: gates.${gate} must name configured checks`);
+        return none(`${label}: gates.${gate} must name configured checks`);
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
+  return { source: label, root, checks, gates, error: null, ...note, resources: parsed.resources };
 }
 var sameArgv = (left, right) => left.length === right.length && left.every((item, index) => item === right[index]);
 function matchesNamedCheck(config, name, argv, cwd) {
@@ -15711,7 +15722,7 @@ function evaluateObservedGate(task, requirement, statuses, config) {
     return {
       satisfied: [],
       considered,
-      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE} (committed, so it shows in the diff), e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
+      reason: requirement.dimension === "testing" && config.checks.length ? `no \`test\` check is configured; add one (or gates.testing) to ${CHECKS_FILE}, then run ${checkCommand("test", runtimeVersion())}` : `no checks are configured or detected; add ${CHECKS_FILE}, e.g. {"checks":{"test":"<your test command>"}}, then run ${checkCommand("test", runtimeVersion())}`
     };
   const satisfied = fresh.filter(named);
   if (satisfied.length)
@@ -22498,6 +22509,112 @@ var dispatchHook = (adapter, raw, env = process.env) => {
     };
   }
 };
+// packages/workit-core/src/hooks/deadline.ts
+import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
+import path28 from "node:path";
+var HOOK_SKIP_TEXT = "workit context skipped: host under load";
+var HOOK_DEADLINE_MS = 8000;
+var HOST_DEADLINES = {
+  claude_code: { "": 8000, SessionStart: 16000, Stop: 16000 },
+  codex_cli: { "": 45000, Stop: 16000 },
+  codex_desktop: { "": 45000, Stop: 16000 },
+  cursor: { "": 45000 }
+};
+var HOOK_SKIPS_FILE = "hook-skips.jsonl";
+var override = (env) => {
+  const value = Number(env.WORKIT_HOOK_DEADLINE_MS);
+  return Number.isFinite(value) && value > 0 ? value : null;
+};
+var hookDeadlineMs = (env, host = "", native) => {
+  const row = HOST_DEADLINES[host];
+  return override(env) ?? (row ? native === undefined ? Math.min(...Object.values(row)) : row[native] ?? row[""] : HOOK_DEADLINE_MS);
+};
+var skipsFile = (stateDir) => path28.join(stateDir, HOOK_SKIPS_FILE);
+var recordHookSkip = (skip, stateDir = resolveStateDir()) => {
+  try {
+    mkdirSync3(stateDir, { recursive: true });
+    appendFileSync(skipsFile(stateDir), `${JSON.stringify(skip)}
+`);
+  } catch {}
+};
+var QUIET = new Set([
+  "stop",
+  "subagent.stop",
+  "shell.post",
+  "compact.pre",
+  "prompt.submit",
+  null
+]);
+var skipDecision = (event) => QUIET.has(event) ? { kind: "none" } : { kind: "context", text: HOOK_SKIP_TEXT };
+var TIMED_OUT = Symbol("timed out");
+var within = async (work, ms) => {
+  let timer;
+  const expired = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(TIMED_OUT), Math.max(0, ms));
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([work, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+};
+var isTimedOut = (value) => value === TIMED_OUT;
+var PROCESS_START = performance.timeOrigin;
+var hookBudget = (env, options = {}, host = "") => {
+  const now = options.now ?? Date.now;
+  return {
+    now,
+    record: options.record ?? ((skip) => recordHookSkip(skip)),
+    startedAt: options.startedAt ?? now(),
+    deadlineMs: options.deadlineMs ?? hookDeadlineMs(env, host),
+    host: options.deadlineMs === undefined ? host : null
+  };
+};
+var readWithin = async (stdin, budget) => {
+  const read = (async () => {
+    let text = "";
+    for await (const chunk of stdin)
+      text += String(chunk);
+    return text;
+  })();
+  const text = await within(read, budget.startedAt + budget.deadlineMs - budget.now());
+  return isTimedOut(text) ? null : text;
+};
+var note = (adapter, raw, env, budget, outcome, stage) => {
+  const parsed = raw === undefined ? null : adapter.parse(raw, env);
+  const event = parsed ? parsed.ok ? parsed.input.event.kind : parsed.event : null;
+  budget.record({
+    at: new Date(budget.now()).toISOString(),
+    host: adapter.descriptor.host,
+    event,
+    outcome,
+    stage,
+    elapsedMs: Math.round(budget.now() - budget.startedAt)
+  });
+  return { native: parsed?.native ?? null, event };
+};
+var skippedHook = (adapter, raw, env, budget, stage) => {
+  const { native, event } = note(adapter, raw, env, budget, "skip", stage);
+  return {
+    ...adapter.render(skipDecision(event), native),
+    error: `${HOOK_SKIP_TEXT} (past the ${budget.deadlineMs} ms hook deadline)`,
+    skipped: true
+  };
+};
+var dispatchWithin = async (adapter, raw, env, budget, dispatch = dispatchHook) => {
+  const native = raw?.hook_event_name;
+  if (budget.host !== null && typeof native === "string")
+    budget.deadlineMs = hookDeadlineMs(env, budget.host, native);
+  const remaining = () => budget.startedAt + budget.deadlineMs - budget.now();
+  const result = remaining() > 0 ? await within(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
+  if (isTimedOut(result))
+    return skippedHook(adapter, raw, env, budget, "dispatch");
+  if (remaining() < 0)
+    note(adapter, raw, env, budget, "late", "done");
+  return { ...result, skipped: false };
+};
+
 // packages/workit-core/src/hooks/hosts/claude-code.ts
 var CLAUDE_CODE_DESCRIPTOR = {
   host: "claude_code",
@@ -23057,7 +23174,7 @@ var codexAdapter = {
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
 import fs21 from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -23254,7 +23371,7 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path28.isAbsolute(file))
+  if (!file || !path29.isAbsolute(file))
     return null;
   try {
     const size = fs21.statSync(file).size;
@@ -23291,7 +23408,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within = (root, dir) => dir === root || dir.startsWith(root.endsWith(path28.sep) ? root : `${root}${path28.sep}`);
+var within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path29.sep) ? root : `${root}${path29.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
@@ -23300,7 +23417,7 @@ var hookCwd = (input) => {
 };
 var cursorWorkspaceRoot = (input) => {
   const cwd = existingDirectory(input.cwd);
-  return cwd && input.workspace_roots.find((root) => within(root, cwd)) || input.workspace_roots[0];
+  return cwd && input.workspace_roots.find((root) => within2(root, cwd)) || input.workspace_roots[0];
 };
 var cursorDeny = (reason) => ({
   permission: "deny",
@@ -23365,19 +23482,21 @@ var HOOK_ADAPTERS = {
   codex_desktop: codexAdapter,
   cursor: cursorAdapter
 };
-async function runHookProcess(host, stdin, stdout, stderr = process.stderr, env = process.env) {
+async function runHookProcess(host, stdin, stdout, stderr = process.stderr, env = process.env, deadline = {}) {
   const adapter = typeof host === "string" ? HOOK_ADAPTERS[host] : host;
-  let text = "";
-  for await (const chunk of stdin)
-    text += String(chunk);
+  const budget = hookBudget(env, deadline, adapter.descriptor.host);
+  const text = await readWithin(stdin, budget);
   let raw;
   try {
-    raw = JSON.parse(text || "{}");
+    raw = text === null ? undefined : JSON.parse(text || "{}");
   } catch {
     raw = undefined;
   }
-  const result = dispatchHook(adapter, raw, env);
-  if (raw === undefined || result.error)
+  const result = text === null ? skippedHook(adapter, undefined, env, budget, "input") : await dispatchWithin(adapter, raw, env, budget, deadline.dispatch);
+  if (result.skipped)
+    stderr.write(`[workit] ${result.error}
+`);
+  else if (raw === undefined || result.error)
     stderr.write(`[workit] hook input rejected: ${raw === undefined ? "invalid JSON hook input" : result.error}
 `);
   stdout.write(`${JSON.stringify(result.json)}
@@ -23530,6 +23649,15 @@ var degradedCursorHook = (raw) => {
   return { json: { permission: "allow", user_message: note, agent_message: note } };
 };
 var handleCursorHook = (raw) => degradedCursorHook(raw)?.json ?? (isSubagentStart(raw) ? handleSubagentStartHook(raw) : dispatchHook(cursorAdapter, raw).json);
+var subagentStartStep = (_adapter, raw) => {
+  let json;
+  try {
+    json = handleSubagentStartHook(raw);
+  } catch (error) {
+    json = cursorDeny(`hook failure: ${String(error)}`);
+  }
+  return { json, exitCode: json.permission === "deny" ? 2 : 0, error: null };
+};
 var runCursorHook = async () => {
   let text = "";
   for await (const chunk of process.stdin)
@@ -23547,19 +23675,10 @@ var runCursorHook = async () => {
     process.exitCode = 0;
     return;
   }
-  if (isSubagentStart(raw)) {
-    let output;
-    try {
-      output = handleSubagentStartHook(raw);
-    } catch (error) {
-      output = cursorDeny(`hook failure: ${String(error)}`);
-    }
-    process.stdout.write(`${JSON.stringify(output)}
-`);
-    process.exitCode = output.permission === "deny" ? 2 : 0;
-    return;
-  }
-  process.exitCode = await runHookProcess(cursorAdapter, [text], process.stdout);
+  process.exitCode = await runHookProcess(cursorAdapter, [text], process.stdout, process.stderr, process.env, {
+    startedAt: PROCESS_START,
+    ...isSubagentStart(raw) ? { dispatch: subagentStartStep } : {}
+  });
 };
 if (__require.main == __require.module)
   await runCursorHook();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "8.17.0",
+  "version": "8.18.0",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and sixteen method skills",
   "keywords": [
@@ -46,8 +46,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.17.0",
-    "@brainervirus/workit-mcp": "^8.17.0"
+    "@brainervirus/workit-core": "^8.18.0",
+    "@brainervirus/workit-mcp": "^8.18.0"
   },
   "engines": {
     "node": ">=24"

package/skills/workit-bdd/SKILL.md

@@ -22,7 +22,7 @@ description: Turn requirements into Given/When/Then scenarios, agree the test se
    then take the next scenario. Any edit makes the observation stale; re-run
    before you claim it. A recorded "tests pass" is a note, and an ad-hoc
    `workit check -- <cmd>` never satisfies the gate: only the configured
-   `test` check does. No `test` detected? Create `workit.checks.json`, copying
+   `test` check does. No `test` detected? Create `.workit/checks.json`, copying
    in every check the repo already runs: once it exists it replaces the
    detected defaults.
 5. **Mock only at system boundaries:** network, clock, randomness, other

package/skills/workit-fanout/SKILL.md

@@ -37,8 +37,8 @@ units of ~100+ lines each. Coupled work stays with one owner. Workit never spawn
 6. **Retry once, then escalate.** A stuck or failed slice gets one retry with
    a fresh brief (`workit fanout brief <slice> --mode resume`, same branch);
    if that fails too, re-slice it, take it over, or report the gap. Never
-   chain resumes. A hard slice may race instead: N attempts, keep the best
-   verdict (`references/orchestration.md`).
+   chain resumes. A fix round and recheck that both fail: a decider, not a
+   third round; product choices go to the user (`references/orchestration.md`).
 7. **Verify by the workspace `verification` setting** (`workit grant show`).
    A report is a pointer, never evidence. `self`: a verifier that wrote none
    of the slices, or you if you wrote none. `independent` or high risk: a

package/skills/workit-fanout/references/orchestration.md

@@ -43,6 +43,27 @@ rulings). If the retry fails too, escalate instead of a third worker:
 re-slice it smaller (`workit fanout plan` again), take it over yourself, or
 report the gap to the user.
 
+## Stuck calls: the decider
+
+A failed review gets one fix round and one recheck (the changed hunks only).
+If the recheck fails, or a worker and a reviewer disagree, spawn a decider
+instead of a third round. A decider is a fresh read-only agent, not the author
+or the reviewer. It returns three things: the options, a pick by
+reversibility (the option cheapest to undo wins a tie), and the exact change
+list. The fixer applies that list once, then one focused recheck follows.
+
+- Hard call (shared contract, security, migration): two deciders on different
+  models (Claude Code: a different `model` on the Agent call; OpenCode: a
+  child session on another configured agent; Codex, Cursor and Pi: one
+  decider, since the host picks no model). If they disagree, you take the
+  more reversible option.
+- Record it: `workit ledger decision "<pick>" --by decider --why "<why it is
+  the more reversible>" --view "<decider A: view>" --view "<decider B: view>"`.
+  The row is listed as a decider call; it is never the user's answer to a
+  product choice and never a verdict.
+- A product choice, or authority nobody here has, is not a decider's call:
+  ask the user with your recommendation.
+
 ## Race a hard slice
 
 When a hard slice has an uncertain approach and a cheap VERIFY, run 2-3

package/skills/workit-retro/SKILL.md

@@ -32,7 +32,7 @@ proposes and stops. Nothing changes until the user approves.
    more cited occurrences**; a one-off is not a learning.
 4. **Name the strongest enforcer that works**, strongest first: architecture
    or types (the mistake cannot be written) > lint rule > configured check
-   (`workit.checks.json`, `workit check <name>`) or CI job > test >
+   (`.workit/checks.json`, `workit check <name>`) or CI job > test >
    `CODING_STANDARDS.md` (judgment the reviewer reads) > AGENTS.md pointer
    (navigation only). A mechanical rule gets a check, not prose: a check can
    fail, a sentence cannot. From types to test, the proof is that the new
@@ -60,7 +60,7 @@ Bad: "Agents seem lost in the build. Added 'read the build docs carefully' to
 AGENTS.md." One vague occurrence, no citation, a no-op line, auto-applied.
 
 Good: "Navigation, 3 occurrences (rulings 12, 19; PR #88 thread): agents sought
-check names in package.json, missing `workit.checks.json`. Enforcer: AGENTS.md
+check names in package.json, missing `.workit/checks.json`. Enforcer: AGENTS.md
 pointer, +74 bytes, minus the stale Commands paragraph (-210). Unstable check,
 2 occurrences (ledger rows 31, 44: `e2e` red then green on one SHA): a debug
 slice to fix the check. Approve?"

package/skills/workit-review/SKILL.md

@@ -36,7 +36,10 @@ independent; `type-check-only` never proves a behavior change.
 7. Record the verdict:
    `workit ledger verdict verified|failed|blocked --kind review --branch <b> --how "<what you ran and read>"`
    under your own session (the one the lead or the hook gave you).
-8. **Harness note** (optional): friction caused by the repo or harness, not
+8. **Bound the loop.** A failed verdict gets one fix round and one recheck of
+   the changed hunks. Still failing, or stuck: no third round; the lead spawns
+   a decider (read the `workit-fanout` skill's SKILL.md and follow it). A product choice goes to the user.
+9. **Harness note** (optional): friction caused by the repo or harness, not
    the change (a flaky fixture, a missing check, a misleading doc or skill
    line), goes on its own `Harness note:` line in the report and any PR
    comment, never as a finding or in the verdict, so a later retro finds it.

package/skills/workit-ship/SKILL.md

@@ -30,7 +30,7 @@ once the verdict is accepted. `merged`: step 7. `null` (closed, not merged):
 stop and report. Stop early only for a new consequential choice, a host
 denial, a review comment that needs a product decision, a required update
 that repeats because the base keeps moving, or after 3 failed fix attempts on
-the same check.
+the same check. Fix round and recheck both failed: a decider (read the `workit-fanout` skill's SKILL.md and follow it).
 
 1. **Open.** `workit git push`, then `workit pr create --title "<title>"
    --body-file <f|->` plus `--issue <#n|ID>` per issue (`--refs`: no close; idempotent;

package/skills/workit-verify-app/SKILL.md

@@ -35,7 +35,7 @@ way a user would.
    never run is a guess; do not hand it off.
 4. **Make the driver a named check** when it is cheap and deterministic. A
    named check is one command without shell syntax (put pipes and setup in a
-   script). Add `"verify": "<driver>"` to `checks` in `workit.checks.json`; if
+   script). Add `"verify": "<driver>"` to `checks` in `.workit/checks.json`; if
    the file does not exist yet, first copy in every check the repo already runs
    (test, lint, typecheck), because the file replaces the detected defaults.
    `workit check verify` then records it, and it joins the verification gate