@brainervirus/workit-cursor 8.22.3 → 8.23.0

package/dist/workit-hook.js

@@ -17953,6 +17953,24 @@ function workitInvocations(command, dialect = "posix", depth = 0) {
   }
   return found;
 }
+var WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
+function skipWorkitGlobals(args) {
+  let cwd = null;
+  let at = 0;
+  for (;at < args.length; at++) {
+    const match = WORKIT_GLOBAL.exec(args[at]);
+    if (match?.[1] === "=") {
+      if (args[at].startsWith("--cwd="))
+        cwd = args[at].slice(6);
+    } else if (match && args[at + 1] !== undefined) {
+      if (args[at] === "--cwd")
+        cwd = args[at + 1];
+      at++;
+    } else if (args[at] !== "--json")
+      break;
+  }
+  return { rest: args.slice(at), cwd };
+}
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var CURRENT_BRANCH = /^\$\(\s*git\s+(?:branch\s+--show-current|rev-parse\s+--abbrev-ref\s+HEAD|symbolic-ref\s+--short\s+HEAD)\s*\)$/;
 var pushDestination = (destination) => {
@@ -19774,7 +19792,7 @@ var splitDenial = (plan) => ({
   unblock: plan.unblock
 });
 // packages/workit-core/src/hooks/write-gate.ts
-import { realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
 import os10 from "node:os";
 import path27 from "node:path";
 
@@ -20003,7 +20021,7 @@ var exempt = (cwd, root, file, plans) => {
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
-var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs"]);
+var PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs", "busybox"]);
 var operands = (words) => words.filter((item) => !item.startsWith("-"));
 var SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
 var wrappedScript = (input) => {
@@ -20015,9 +20033,9 @@ var wrappedScript = (input) => {
     return null;
   if ("script" in tail)
     return tail.script;
-  const [shell, flag, script] = tail.argv;
-  if (SCRIPT_SHELLS.has((shell.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && /^-[a-z]*c$/.test(flag ?? ""))
-    return script ?? null;
+  const script = shellScript2(tail.argv);
+  if (SCRIPT_SHELLS.has((tail.argv[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()) && script)
+    return script;
   return tail.argv.map(quoteWord2).join(" ");
 };
 var editsOf = (input) => {
@@ -20096,6 +20114,94 @@ var editsOf = (input) => {
       return [];
   }
 };
+var shellScript2 = (words) => {
+  if (!SCRIPT_SHELLS.has((words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase()))
+    return null;
+  for (let index = 1;index < words.length; index++) {
+    const word = words[index];
+    if (/^-[a-z]*c$/.test(word))
+      return words[index + 1] ?? null;
+    if (/^[-+][oO]$/.test(word))
+      index++;
+    else if (!/^[-+]/.test(word))
+      return null;
+  }
+  return null;
+};
+var XARGS_VALUE = /^-[IinLPdsEa]$/;
+var runsWriter = (words) => {
+  const filled = [...words.filter((word) => word !== "{}" && word !== ";" && word !== "+"), "x"];
+  const edits = editsOf(filled);
+  return edits === null || edits.length > 0 || opaqueWrites(filled) !== null;
+};
+var opaqueWrites = (input) => {
+  let words = input;
+  while (words.length && (PREFIXES2.has(words[0]) || /^\w+=/.test(words[0]))) {
+    if (words[0] === "xargs") {
+      let at = 1;
+      while (words[at]?.startsWith("-"))
+        at += XARGS_VALUE.test(words[at]) ? 2 : 1;
+      return runsWriter(words.slice(at)) ? ["."] : null;
+    }
+    words = words.slice(1);
+  }
+  const [verb, ...args] = words;
+  const name = (verb?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+  const files = operands(args);
+  const has = (pattern) => args.some((arg) => pattern.test(arg));
+  const listed = (named) => named.length ? named : ["."];
+  if (name === "unlink" || name === "shred")
+    return listed(files);
+  if (/^(?:chmod|chown|chgrp|chattr)$/.test(name))
+    return listed(has(/^--reference/) ? files : files.slice(1));
+  if (name === "rsync") {
+    const dest = files.at(-1);
+    const remote = /^[\w.@-]*:/.test(dest ?? "") && !/^[A-Za-z]:[\\/]/.test(dest ?? "");
+    return dest === undefined ? ["."] : remote ? [] : [dest];
+  }
+  if (name === "find") {
+    const exec = args.findIndex((arg) => /^-(?:exec|execdir|ok|okdir)$/.test(arg));
+    const writes = has(/^-(?:delete|fprint\w*|fls)$/) || exec >= 0 && runsWriter(args.slice(exec + 1));
+    const end = args.findIndex((arg) => /^[-(!]/.test(arg));
+    return writes ? listed(end < 0 ? args : args.slice(0, end)) : null;
+  }
+  if (/^g?awk$/.test(name)) {
+    if (!has(/^-i|^--include/))
+      return null;
+    const named = [];
+    let program = !has(/^-f$|^--file/);
+    for (let index = 0;index < args.length; index++)
+      if (/^(?:-[ifvF]|--(?:include|file|assign|field-separator))$/.test(args[index]))
+        index++;
+      else if (args[index].startsWith("-"))
+        continue;
+      else if (program)
+        program = false;
+      else
+        named.push(args[index]);
+    return listed(named);
+  }
+  if (name === "perl")
+    return has(/^-[a-zA-Z]*[eE]/) ? ["."] : null;
+  if (/^(?:python[\d.]*|node|bun|deno|ruby|php)$/.test(name))
+    return has(/^-[a-zA-Z]*[ce]$|^--eval$|^-p$/) ? ["."] : null;
+  return shellScript2(words) === null ? null : ["."];
+};
+var linkSources = (args, at) => {
+  const names = operands([...args]);
+  const into = args.indexOf("-t");
+  const dest = into >= 0 ? args[into + 1] : names.length > 1 ? names.at(-1) : ".";
+  const sources = names.filter((name, index) => into >= 0 ? name !== dest : index < names.length - 1 || names.length === 1);
+  const target = dest === undefined ? null : at(dest);
+  const symbolic = args.some((arg) => /^-[a-zA-Z]*s|^--symbolic$/.test(arg));
+  const base = target === null ? null : into >= 0 || sources.length > 1 || existsSync7(target) || /[\\/]$/.test(dest ?? "") ? target : path27.dirname(target);
+  return sources.flatMap((source) => {
+    if (symbolic && base !== null && !path27.isAbsolute(homeExpanded(source)))
+      return [path27.resolve(base, source)];
+    const resolved = at(source);
+    return resolved ? [resolved] : [];
+  });
+};
 var shellWrites = (command, depth = 0) => {
   const targets = [];
   let unknown = false;
@@ -20205,11 +20311,15 @@ var gitMutationDirs = (cwd, command, dialect) => {
 var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
 var PUSHD2 = new Set(["pushd", "push-location"]);
 var POPD2 = new Set(["popd", "pop-location"]);
-var cdInto = (dir, words) => {
+var UNKNOWN_DIR = path27.resolve(path27.parse(process.cwd()).root, ".workit-unknown-dir");
+var cdInto = (dir, words, strict = false) => {
+  const lost = strict ? UNKNOWN_DIR : undefined;
   const named = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
   const target = named === undefined ? undefined : homeExpanded(named);
-  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
-    return;
+  if (target === "-" || target && /^~|[$`*?]/.test(target))
+    return lost;
+  if (dir === undefined)
+    return lost;
   return target === undefined ? os10.homedir() : path27.resolve(dir, target);
 };
 var quoteWord2 = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
@@ -20217,7 +20327,7 @@ var homeExpanded = (file) => {
   const match = /^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/.exec(file);
   return match ? (process.env.HOME || os10.homedir()) + file.slice(match[0].length) : file;
 };
-var segmentTargets = (cwd, command, dialect, depth = 0) => {
+var segmentTargets = (cwd, command, dialect, depth = 0, strict = false) => {
   const targets = [];
   let dir = cwd;
   let stack = [];
@@ -20241,21 +20351,35 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
     const words = lead < 0 ? [] : segment.words.slice(lead);
     const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
     if (CD2.has(name)) {
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (PUSHD2.has(name)) {
       stack.push(dir);
-      dir = cdInto(dir, words);
+      dir = cdInto(dir, words, strict);
       continue;
     }
     if (POPD2.has(name)) {
-      dir = stack.length ? stack.pop() : undefined;
+      dir = stack.length ? stack.pop() : strict ? UNKNOWN_DIR : undefined;
       continue;
     }
-    const inner = depth < 4 ? wrappedScript(words) : null;
+    const inner = depth < 4 ? wrappedScript(words) ?? (strict ? shellScript2(words) : null) : null;
     if (inner !== null && dir !== undefined)
-      targets.push(...segmentTargets(dir, inner, "posix", depth + 1));
+      targets.push(...segmentTargets(dir, inner, "posix", depth + 1, strict));
+    if (strict && dir !== undefined) {
+      const runIn = dir;
+      for (const sub of depth < 4 ? segment.subs ?? [] : [])
+        targets.push(...segmentTargets(runIn, sub, dialect, depth + 1, true));
+      const opaque = segment.unanalyzable ? ["."] : inner === null ? opaqueWrites(words) : null;
+      for (const file of opaque ?? []) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(file === "." ? path27.join(resolved, DIR_TARGET) : resolved);
+      }
+      const ln = words.findIndex((word) => /^ln$/i.test(word.split(/[\\/]/).at(-1) ?? ""));
+      if (ln >= 0 && words.slice(0, ln).every((word) => PREFIXES2.has(word)))
+        targets.push(...linkSources(words.slice(ln + 1), at));
+    }
     for (const file of segment.redirects)
       if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
         const resolved = at(file);
@@ -20272,11 +20396,29 @@ var segmentTargets = (cwd, command, dialect, depth = 0) => {
         if (resolved)
           targets.push(resolved);
       }
-    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord2).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
-      targets.push(path27.join(dir, DIR_TARGET));
+    if (dir !== undefined)
+      for (const invocation of workitInvocations(segment.words.map(quoteWord2).join(" "), "posix")) {
+        const { at: runsIn, args } = workitCwd(dir, invocation);
+        if (args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), ""))
+          targets.push(path27.join(runsIn, DIR_TARGET));
+      }
   }
   return targets;
 };
+var workitCwd = (dir, args) => {
+  const { rest, cwd } = skipWorkitGlobals(args);
+  return { at: cwd === null ? dir : path27.resolve(dir, homeExpanded(cwd)), args: rest };
+};
+var shellMutationTargets = (cwd, command, dialect = "posix", strict = false) => {
+  try {
+    return [
+      ...segmentTargets(cwd, command, dialect, 0, strict),
+      ...gitMutationDirs(cwd, command, dialect).map((dir) => path27.join(dir, DIR_TARGET))
+    ];
+  } catch {
+    return [];
+  }
+};
 var overridden = (command, dialect) => {
   const segments = segmentsOf(command, dialect);
   if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
@@ -20382,16 +20524,8 @@ function shellGate(cwd, command, owner, dialect = "posix", deps) {
   } catch {}
   const writes = shellWrites(command);
   let targets = [];
-  if (owner) {
-    try {
-      targets = [
-        ...segmentTargets(cwd, command, dialect),
-        ...gitMutationDirs(cwd, command, dialect).map((dir) => path27.join(dir, DIR_TARGET))
-      ];
-    } catch {
-      targets = [];
-    }
-  }
+  if (owner)
+    targets = shellMutationTargets(cwd, command, dialect);
   if (owner && targets.length) {
     const live = liveGate(owner, targets, deps);
     if (live.kind !== "none") {
@@ -20858,13 +20992,13 @@ ${line}` };
   return decision;
 };
 // packages/workit-core/src/hooks/hosts/fields.ts
-import { existsSync as existsSync7, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
 import path28 from "node:path";
 var isRecord6 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
-  if (!nonEmpty2(value) || !path28.isAbsolute(value) || !existsSync7(value))
+  if (!nonEmpty2(value) || !path28.isAbsolute(value) || !existsSync8(value))
     return null;
   try {
     return statSync2(value).isDirectory() ? realpathSync6(value) : null;
@@ -21067,9 +21201,266 @@ var cwdRewrite = (command) => {
   return `workit --cwd ${dir} ${rest.slice("workit".length).trimStart()}`.trimEnd();
 };
 
+// packages/workit-core/src/hooks/worktree-confine.ts
+import { createHash as createHash17 } from "node:crypto";
+import fs23 from "node:fs";
+import path30 from "node:path";
+var FANOUT_TOKEN_FILE = "workit-fanout-token";
+var NONE5 = { kind: "none" };
+var CASE_INSENSITIVE2 = process.platform === "darwin" || process.platform === "win32";
+var canonical3 = (file) => {
+  let rest = "";
+  for (let dir = path30.resolve(file);; dir = path30.dirname(dir)) {
+    try {
+      return path30.join(fs23.realpathSync.native(dir), rest);
+    } catch {
+      if (path30.dirname(dir) === dir)
+        return path30.resolve(file);
+      rest = rest ? path30.join(path30.basename(dir), rest) : path30.basename(dir);
+    }
+  }
+};
+var within = (child, parent) => {
+  const fold = (value) => CASE_INSENSITIVE2 ? value.toLowerCase() : value;
+  const relative = path30.relative(fold(parent), fold(child));
+  return relative === "" || !relative.startsWith("..") && !path30.isAbsolute(relative);
+};
+var checkoutOf2 = (file) => {
+  for (let dir = canonical3(file);; dir = path30.dirname(dir)) {
+    const dotGit = path30.join(dir, ".git");
+    if (fs23.existsSync(dotGit)) {
+      if (!fs23.statSync(dotGit).isFile())
+        return { root: dir, workit: false };
+      const admin = /^gitdir:\s*(.+)$/mu.exec(fs23.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+      return {
+        root: dir,
+        workit: Boolean(admin) && fs23.existsSync(path30.join(path30.resolve(dir, admin), FANOUT_TOKEN_FILE))
+      };
+    }
+    if (path30.dirname(dir) === dir)
+      return null;
+  }
+};
+var workitWorktreeOf = (file) => {
+  try {
+    const checkout = checkoutOf2(file);
+    return checkout?.workit ? checkout.root : null;
+  } catch {
+    return null;
+  }
+};
+var bindingDir = () => path30.join(resolveStateDir(), "worktree-bind");
+var bindingFile = (session, agentId) => path30.join(bindingDir(), `${createHash17("sha256").update(`${session}\x00${agentId}`).digest("hex").slice(0, 32)}.json`);
+var readBinding = (file) => {
+  try {
+    const value = JSON.parse(fs23.readFileSync(file, "utf8"));
+    return typeof value.worktree === "string" ? value : null;
+  } catch {
+    return null;
+  }
+};
+var boundWorktree = (input) => {
+  const agentId = input.session.agentId;
+  if (!agentId)
+    return null;
+  const binding = readBinding(bindingFile(input.session.id, agentId));
+  return binding && workitWorktreeOf(binding.worktree) === binding.worktree ? binding.worktree : null;
+};
+var bind = (input, worktree) => {
+  const agentId = input.session.agentId;
+  const file = bindingFile(input.session.id, agentId);
+  const binding = {
+    worktree,
+    session: input.session.id,
+    agentId,
+    at: new Date().toISOString()
+  };
+  fs23.mkdirSync(path30.dirname(file), { recursive: true });
+  fs23.writeFileSync(file, JSON.stringify(binding));
+  try {
+    if (inWorkitWorkspace(input.cwd))
+      appendHookObserved(input.cwd, {
+        type: "worktree.bound",
+        actor: { host: input.host, session: input.session.id, agentId },
+        agentType: input.session.agentType,
+        worktree
+      });
+  } catch {}
+};
+var hostIsolated = (cwd, agentId) => {
+  try {
+    if (agentId === null)
+      return false;
+    const checkout = checkoutOf2(cwd);
+    if (!checkout)
+      return false;
+    const dotGit = path30.join(checkout.root, ".git");
+    if (!fs23.statSync(dotGit).isFile())
+      return false;
+    const admin = /^gitdir:\s*(.+)$/mu.exec(fs23.readFileSync(dotGit, "utf8"))?.[1]?.trim();
+    if (!admin)
+      return false;
+    const adminDir = path30.resolve(checkout.root, admin);
+    const back = fs23.readFileSync(path30.join(adminDir, "gitdir"), "utf8").trim();
+    if (path30.relative(canonical3(path30.resolve(adminDir, back)), canonical3(dotGit)) !== "")
+      return false;
+    const common = path30.join(adminDir, "commondir");
+    const gitDir = fs23.existsSync(common) ? path30.resolve(adminDir, fs23.readFileSync(common, "utf8").trim()) : adminDir;
+    const expected = path30.join(path30.dirname(canonical3(gitDir)), ".claude", "worktrees", `agent-${agentId}`);
+    return path30.relative(canonical3(expected), checkout.root) === "";
+  } catch {
+    return false;
+  }
+};
+var shown = (target) => path30.basename(target) === ".workit-live-target" ? path30.dirname(target) : target;
+var unboundDeny = (input, target) => {
+  const unblock = "Work only in the worktree your brief names, which the lead made with `workit fanout worktree create <slice>`: edit files under it and run one verb per call against it (`workit --cwd <worktree> git commit -m … -- <paths>`, `workit --cwd <worktree> check <name>`). If your brief names no worktree, stop and report that to the lead.";
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} is not working in a Workit worktree yet, and ${shown(target)} is outside every worktree \`workit fanout worktree create\` made, so it would change the lead's checkout. ${unblock}`,
+    unblock
+  };
+};
+var outsideDeny = (input, worktree, target) => {
+  const unblock = `Edit only under ${worktree} and run git there, one verb per call: \`workit --cwd ${worktree} git commit -m … -- <paths>\`, \`workit --cwd ${worktree} check <name>\` (or \`git -C ${worktree} …\`); a command whose writes Workit cannot see is judged by the directory it runs in. Anything outside it is a follow-up for your report.`;
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} is bound to the worktree ${worktree}, and ${shown(target)} is outside it. ${unblock}`,
+    unblock
+  };
+};
+var unknownDirDeny = (input, worktree) => {
+  const wt = worktree ?? "<worktree>";
+  const unblock = `Workit cannot resolve \`cd -\`, \`cd "$X"\` or \`popd\`: write by absolute path, \`git -C ${wt}\` or \`workit --cwd ${wt}\`.`;
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} writes after an unknown directory change. ${unblock}`,
+    unblock
+  };
+};
+function confineImplementer(input, targets) {
+  try {
+    if (!input.session.agentId || hostIsolated(input.cwd, input.session.agentId))
+      return NONE5;
+    if (targets.some((target) => within(path30.resolve(target), UNKNOWN_DIR)))
+      return unknownDirDeny(input, boundWorktree(input));
+    const bindings = canonical3(bindingDir());
+    const judged = targets.map((named) => ({ named, real: canonical3(named) })).filter(({ real }) => within(real, bindings) || checkoutOf2(real) !== null);
+    if (judged.length === 0)
+      return NONE5;
+    let worktree = boundWorktree(input);
+    if (!worktree) {
+      for (const { real } of judged) {
+        worktree = within(real, bindings) ? null : workitWorktreeOf(real);
+        if (worktree)
+          break;
+      }
+      if (!worktree)
+        return unboundDeny(input, judged[0].named);
+      bind(input, worktree);
+    }
+    const root = canonical3(worktree);
+    const outside = judged.find(({ real }) => !within(real, root) || within(real, bindings));
+    return outside ? outsideDeny(input, worktree, outside.named) : NONE5;
+  } catch {
+    return NONE5;
+  }
+}
+var MUTATING_REMOTE = new Set([
+  "add",
+  "remove",
+  "rm",
+  "rename",
+  "set-url",
+  "set-head",
+  "set-branches",
+  "prune"
+]);
+var CONFIG_READ = /^(?:--get(?:-all|-regexp|-urlmatch)?|--list|-l|get|list)$/;
+var CONFIG_WRITE = /^(?:--(?:unset(?:-all)?|add|replace-all|rename-section|remove-section|edit)|-e|set|unset|rename-section|remove-section|edit)$/;
+var CONFIG_VALUE = /^(?:--file|-f|--blob|--type|--default|--comment)$/;
+var leadOwnedGit = (args) => {
+  const [sub = "", ...rest] = args;
+  if (rest.some((arg) => arg === "--help" || arg === "-h"))
+    return false;
+  const names = rest.filter((arg) => !arg.startsWith("-"));
+  const flag = (pattern) => rest.some((arg) => pattern.test(arg));
+  switch (sub) {
+    case "worktree":
+      return names[0] !== undefined && names[0] !== "list";
+    case "update-ref":
+      return true;
+    case "symbolic-ref":
+      return names.length > 1 || flag(/^(?:-d|--delete)$/);
+    case "branch":
+      return flag(/^-[a-zA-Z]*[dDfmMcC]|^--(?:delete|force|move|copy)$/);
+    case "tag":
+      return flag(/^-[a-zA-Z]*[df]|^--(?:delete|force)$/);
+    case "push": {
+      if (flag(/^(?:-d|--delete|--mirror|--prune)$/))
+        return true;
+      const refspecs = names.slice(1);
+      return refspecs.some((name) => name.includes(":") || name.startsWith("+")) || refspecs.length > 0 && flag(/^-[a-zA-Z]*f|^--force/);
+    }
+    case "replace":
+    case "filter-branch":
+    case "gc":
+    case "prune":
+    case "repack":
+    case "sparse-checkout":
+      return true;
+    case "notes":
+    case "reflog":
+    case "submodule":
+      return !/^(?:list|show|status|exists)$/.test(names[0] ?? "list");
+    case "stash":
+      return names[0] === "drop" || names[0] === "clear";
+    case "remote":
+      return MUTATING_REMOTE.has(names[0] ?? "");
+    case "config": {
+      if (rest.some((arg) => CONFIG_READ.test(arg)))
+        return false;
+      if (rest.some((arg) => CONFIG_WRITE.test(arg)))
+        return true;
+      let operands = 0;
+      for (let index = 0;index < rest.length; index++)
+        if (CONFIG_VALUE.test(rest[index]))
+          index++;
+        else if (!rest[index].startsWith("-"))
+          operands++;
+      return operands > 1;
+    }
+    default:
+      return false;
+  }
+};
+var leadOwnedWorkit = (args) => !args.includes("--help") && args.some((_, start) => {
+  if (start > 0 && !/(?:^|[\\/])workit(?:\.exe|\.cmd)?$/.test(args[start - 1]))
+    return false;
+  const [verb, sub] = skipWorkitGlobals(args.slice(start)).rest;
+  return verb === "fanout" && /^(?:plan|worktree)$/.test(sub ?? "");
+});
+var leadOwnedDeny = (input, command) => {
+  const unblock = "Worktrees, branches other than your own, refs, tags, remotes, git config, the shared stash and the fan-out plan belong to the lead: report what you need changed as a follow-up instead.";
+  return {
+    kind: "deny",
+    reason: `workit worktree confinement: implementer ${input.session.agentId} may not run \`${command.slice(0, 160)}\`. ${unblock}`,
+    unblock
+  };
+};
+function confineImplementerShell(input, command, dialect = "posix") {
+  try {
+    if (!input.session.agentId || hostIsolated(input.cwd, input.session.agentId))
+      return NONE5;
+    if (rawInvocations(command, dialect).some((invocation) => invocation.tool === "git" && leadOwnedGit(invocation.args)) || workitInvocations(command, dialect).some(leadOwnedWorkit))
+      return leadOwnedDeny(input, command);
+  } catch {}
+  return confineImplementer(input, shellMutationTargets(input.cwd, command, dialect, true));
+}
+
 // packages/workit-core/src/hooks/handle.ts
 var usable2 = (value) => value === "native" || value === "partial";
-var NONE5 = { kind: "none" };
+var NONE6 = { kind: "none" };
 var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
 var offered = new Set;
 var ROLES = {
@@ -21082,6 +21473,7 @@ var workitRole = (descriptor, agentType) => {
   const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
   return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
 };
+var implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer";
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
 var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
 var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
@@ -21089,7 +21481,7 @@ var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
   const role = workitRole(descriptor, event.agentType);
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
-  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" || CLAUDE_WORKTREE.test(input.cwd));
+  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(input.cwd, event.agentId) : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
   if (role === "implementer" && isolated)
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
@@ -21097,7 +21489,7 @@ var subagentStartText = (input, descriptor, event) => {
     return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role === "implementer")
-    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree (the lead makes one with \`workit fanout worktree create <slice>\`), never in the lead's checkout, within its brief's scope. Before the first commit, switch to a policy-compliant branch with \`workit git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
+    return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit --cwd <worktree> git commit -m "<message>" -- <paths>\`, \`workit --cwd <worktree> check <name>\`. The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit --cwd <worktree> git branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
@@ -21128,7 +21520,7 @@ function decide(input, deps) {
   switch (event.kind) {
     case "session.start": {
       if (!usable2(descriptor.context.sessionStart))
-        return NONE5;
+        return NONE6;
       const key = input.session.id ? `${input.host}\x00${input.session.id}` : null;
       const offer = event.source === "startup" && (key === null || !offered.has(key));
       if (offer && key !== null)
@@ -21143,26 +21535,31 @@ function decide(input, deps) {
     }
     case "context.turn": {
       if (!usable2(descriptor.context.perTurn))
-        return NONE5;
+        return NONE6;
       const current = turnContextText(input, descriptor);
       const text = resendsOnChange(descriptor) ? changedTurnContext(input, current) : current;
-      return withContextLine(text ? { kind: "context", text } : NONE5, promptNudge(input, event.prompt));
+      return withContextLine(text ? { kind: "context", text } : NONE6, promptNudge(input, event.prompt));
     }
     case "shell.pre": {
       const skillRead = skillReadIn(event.command, event.dialect);
       if (skillRead)
         recordSkillLoad(input, skillRead, "read");
       const canDeny = usable2(descriptor.shellPolicy.deny);
-      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE5;
+      const policy = canDeny ? shellPolicy(input.cwd, event.command, event.dialect) : NONE6;
       if (policy.kind !== "none")
         return policy;
       const postTool = usable2(descriptor.events["shell.post"].support);
       if (!postTool)
         settlePendingCommit(input);
-      const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE5;
+      const raw = canDeny ? rawGitPre(input, event.command, { nudge: false }) : NONE6;
       if (raw.kind === "deny")
         return raw;
-      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE5;
+      if (canDeny && implementerAgent(input, descriptor)) {
+        const confined = confineImplementerShell(input, event.command, event.dialect);
+        if (confined.kind === "deny")
+          return confined;
+      }
+      const gate = usable2(descriptor.events["write.pre"].support) ? shellGate(input.cwd, event.command, liveOwner(input, descriptor.transport), event.dialect) : NONE6;
       if (gate.kind === "deny")
         return gate;
       const plan = heavyGate(input.cwd, event.command, {
@@ -21185,10 +21582,10 @@ function decide(input, deps) {
         command: rewrittenTo,
         input: event.toolInput ? { ...event.toolInput, command: rewrittenTo } : null,
         text
-      } : NONE5;
+      } : NONE6;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
-      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE5, aside), shipNudge(input, event.command));
+      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE6, aside), shipNudge(input, event.command));
       if (!lease)
         return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
@@ -21197,9 +21594,17 @@ function decide(input, deps) {
     case "shell.post":
       if (usable2(descriptor.events["shell.post"].support))
         rawGitPost(input, event.command, callKey(event.toolUseId, event.command));
-      return NONE5;
-    case "write.pre":
-      return usable2(descriptor.events["write.pre"].support) ? writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport)) : NONE5;
+      return NONE6;
+    case "write.pre": {
+      if (!usable2(descriptor.events["write.pre"].support))
+        return NONE6;
+      if (implementerAgent(input, descriptor)) {
+        const confined = confineImplementer(input, liveTargets(input.cwd, event.paths));
+        if (confined.kind === "deny")
+          return confined;
+      }
+      return writeGate(input.cwd, event.paths, liveOwner(input, descriptor.transport));
+    }
     case "subagent.start":
       if (workitRole(descriptor, event.agentType) === "judge")
         trackJudge(input, event.agentId, true);
@@ -21216,22 +21621,22 @@ function decide(input, deps) {
     case "tool.pre":
       if (event.skill)
         recordSkillLoad(input, event.skill, "tool");
-      return NONE5;
+      return NONE6;
     case "stop":
-      return usable2(descriptor.events.stop.support) ? stopDecision(input, descriptor) : NONE5;
+      return usable2(descriptor.events.stop.support) ? stopDecision(input, descriptor) : NONE6;
     case "subagent.stop":
       trackJudge(input, event.agentId, false);
-      return NONE5;
+      return NONE6;
     case "prompt.submit":
-      return NONE5;
+      return NONE6;
   }
 }
 var failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
-    return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE5;
+    return descriptor.shellPolicy.failClosed ? { kind: "deny", reason: error, unblock: null } : NONE6;
   if (event === "session.start" || event === "subagent.start")
     return { kind: "context", text: `[workit diagnostic: ${error}]` };
-  return NONE5;
+  return NONE6;
 };
 var dispatchHook = (adapter, raw, env = process.env) => {
   const parsed = adapter.parse(raw, env);
@@ -21257,7 +21662,7 @@ var dispatchHook = (adapter, raw, env = process.env) => {
 };
 // packages/workit-core/src/hooks/deadline.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import path30 from "node:path";
+import path31 from "node:path";
 var HOOK_SKIP_TEXT = "workit context skipped: host under load";
 var HOOK_DEADLINE_MS = 8000;
 var HOST_DEADLINES = {
@@ -21275,7 +21680,7 @@ var hookDeadlineMs = (env, host = "", native) => {
   const row = HOST_DEADLINES[host];
   return override(env) ?? (row ? native === undefined ? Math.min(...Object.values(row)) : row[native] ?? row[""] : HOOK_DEADLINE_MS);
 };
-var skipsFile = (stateDir) => path30.join(stateDir, HOOK_SKIPS_FILE);
+var skipsFile = (stateDir) => path31.join(stateDir, HOOK_SKIPS_FILE);
 var recordHookSkip = (skip, stateDir = resolveStateDir()) => {
   try {
     mkdirSync3(stateDir, { recursive: true });
@@ -21293,7 +21698,7 @@ var QUIET = new Set([
 ]);
 var skipDecision = (event) => QUIET.has(event) ? { kind: "none" } : { kind: "context", text: HOOK_SKIP_TEXT };
 var TIMED_OUT = Symbol("timed out");
-var within = async (work, ms) => {
+var within2 = async (work, ms) => {
   let timer;
   const expired = new Promise((resolve) => {
     timer = setTimeout(() => resolve(TIMED_OUT), Math.max(0, ms));
@@ -21324,7 +21729,7 @@ var readWithin = async (stdin, budget) => {
       text += String(chunk);
     return text;
   })();
-  const text = await within(read, budget.startedAt + budget.deadlineMs - budget.now());
+  const text = await within2(read, budget.startedAt + budget.deadlineMs - budget.now());
   return isTimedOut(text) ? null : text;
 };
 var note = (adapter, raw, env, budget, outcome, stage) => {
@@ -21353,7 +21758,7 @@ var dispatchWithin = async (adapter, raw, env, budget, dispatch = dispatchHook)
   if (budget.host !== null && typeof native === "string")
     budget.deadlineMs = hookDeadlineMs(env, budget.host, native);
   const remaining = () => budget.startedAt + budget.deadlineMs - budget.now();
-  const result = remaining() > 0 ? await within(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
+  const result = remaining() > 0 ? await within2(Promise.resolve().then(() => dispatch(adapter, raw, env)), remaining()) : TIMED_OUT;
   if (isTimedOut(result))
     return skippedHook(adapter, raw, env, budget, "dispatch");
   if (remaining() < 0)
@@ -21919,8 +22324,8 @@ var codexAdapter = {
 };
 
 // packages/workit-core/src/hooks/hosts/cursor.ts
-import fs23 from "node:fs";
-import path31 from "node:path";
+import fs24 from "node:fs";
+import path32 from "node:path";
 var undocumented = { support: "undocumented", native: null };
 var none = { support: "none", native: null };
 var CURSOR_DESCRIPTOR = {
@@ -22117,17 +22522,17 @@ var protocolEvent2 = (input) => {
 };
 var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var lastAssistantText = (file) => {
-  if (!file || !path31.isAbsolute(file))
+  if (!file || !path32.isAbsolute(file))
     return null;
   try {
-    const size = fs23.statSync(file).size;
+    const size = fs24.statSync(file).size;
     const start = Math.max(0, size - TRANSCRIPT_TAIL_BYTES);
     const buffer = Buffer.alloc(size - start);
-    const fd = fs23.openSync(file, "r");
+    const fd = fs24.openSync(file, "r");
     try {
-      fs23.readSync(fd, buffer, 0, buffer.length, start);
+      fs24.readSync(fd, buffer, 0, buffer.length, start);
     } finally {
-      fs23.closeSync(fd);
+      fs24.closeSync(fd);
     }
     const lines = buffer.toString("utf8").split(`
 `);
@@ -22154,7 +22559,7 @@ var lastAssistantText = (file) => {
     return null;
   }
 };
-var within2 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path31.sep) ? root : `${root}${path31.sep}`);
+var within3 = (root, dir) => dir === root || dir.startsWith(root.endsWith(path32.sep) ? root : `${root}${path32.sep}`);
 var hookCwd = (input) => {
   const cwd = existingDirectory(input.cwd);
   if (cwd && input.hook_event_name === "beforeShellExecution")
@@ -22163,7 +22568,7 @@ var hookCwd = (input) => {
 };
 var cursorWorkspaceRoot = (input) => {
   const cwd = existingDirectory(input.cwd);
-  return cwd && input.workspace_roots.find((root) => within2(root, cwd)) || input.workspace_roots[0];
+  return cwd && input.workspace_roots.find((root) => within3(root, cwd)) || input.workspace_roots[0];
 };
 var cursorDeny = (reason) => ({
   permission: "deny",