@brainervirus/workit-cursor 8.29.0 → 8.29.2

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "8.29.0",
+  "version": "8.29.2",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/dist/cursor-session-start.js

@@ -15689,13 +15689,13 @@ Autonomy contract:
   or an unresolved blocker; report open gaps and uncertain workers.
 - No endpoint named: stop at a local commit on a policy-compliant branch and
   state the next command. If the request implies delivery (fix, implement,
-  ship), go to the effective endpoint in \`workit grant show\`: \`pr\` opens
-  the PR; \`green\` babysits it without asking (workit-ship) to merge-ready,
-  never merging; \`merged\` also lands it with \`workit pr merge\`.
-  Merge and release need a workspace grant only the user raises from their
-  own terminal (a blocked verb names how); never edit workspaces.json or route
-  around grant_required. Release: \`workit release start <v>\`, commits,
-  \`finish\`; \`publish\` if asked.
+  ship), go to the effective endpoint in \`workit grant show\`: \`pr\` stops
+  at the PR even with merge granted; \`green\` babysits it (workit-ship) to
+  merge-ready, never merging; \`merged\` lands it with \`workit pr merge\`.
+  Only the user raises a grant or the endpoint, in a terminal outside the agent
+  host (\`workit grant set <ws> defaultEndpoint=merged\`); never edit
+  workspaces.json or route around grant_required. Release: \`workit release
+  start <v>\`, commits, \`finish\`; \`publish\` if asked.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -15709,9 +15709,8 @@ Autonomy contract:
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
-CLI first: if a step has one right answer, use the \`workit\` verb instead of
-hand-running git, gh or glab (\`workit git|pr|ci|check|help\`;
-else \`npx -y @brainervirus/workit-cli\`).
+Read-only git and gh run raw; mutations go through workit verbs
+(\`workit git|pr|ci|check|help\`; else \`npx -y @brainervirus/workit-cli\`).
 Other checkout: \`workit <verb> --cwd <dir> …\` (verb first: host rules match it); one workit
 verb per shell call, never \`cd <dir> && workit\`. zsh-safe: no \`echo =====\`
 (\`printf '%s\\n' ---\`), quote globs and URLs, no variable named \`status\` or \`path\`.
@@ -17699,12 +17698,36 @@ ${invariantBootstrap()}${compact}${offer ? `
 ${offer}` : ""}${options.addendum ? `
 ${options.addendum}` : ""}
 </workit-contract>`;
+}, checkoutAt = (cwd) => {
+  for (let dir = path20.resolve(cwd);; dir = path20.dirname(dir)) {
+    const dotGit = path20.join(dir, ".git");
+    if (fs15.existsSync(dotGit)) {
+      const admin = fs15.statSync(dotGit).isFile() ? path20.resolve(dir, /^gitdir:\s*(.+)$/mu.exec(fs15.readFileSync(dotGit, "utf8"))?.[1]?.trim() ?? "") : dotGit;
+      const head = fs15.readFileSync(path20.join(admin, "HEAD"), "utf8").trim();
+      return { root: dir, branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null };
+    }
+    if (path20.dirname(dir) === dir)
+      return null;
+  }
+}, whereLine = (cwd) => {
+  try {
+    const checkout = checkoutAt(cwd);
+    if (!checkout)
+      return null;
+    const allowed = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowed.some((pattern) => pattern.source === "^.*$") ? "any" : allowedKinds(allowed).join(", ") || "see `workit help git`";
+    const place = checkout.root === path20.resolve(cwd) ? "" : ` in ${checkout.root}`;
+    return `cwd ${cwd}${place} on ${checkout.branch ?? "detached HEAD"}; branch kinds: ${kinds}`;
+  } catch {
+    return null;
+  }
 }, turnContextText = (input, descriptor) => {
   try {
     const text = sessionCompactContext(new TaskStore(input.cwd), { host: input.host, handle: input.session.id }, hookOperationContext(input, descriptor), descriptor.context.task);
     if (text === MIGRATION_PENDING_NOTE)
       return text;
-    return text ? `<workit-task-context>${text}</workit-task-context>` : null;
+    return text ? `<workit-task-context>${[whereLine(input.cwd), text].filter(Boolean).join(`
+`)}</workit-task-context>` : null;
   } catch {
     return null;
   }
@@ -17770,6 +17793,7 @@ ${options.addendum}` : ""}
     clearTurnDigest(file);
 };
 var init_context = __esm(() => {
+  init_branch();
   init_methods();
   init_paths();
   init_task_contract();
@@ -18477,17 +18501,21 @@ function workitCheckTail(words) {
     return null;
   return args.slice(0, split).includes("--shell") ? { script: tail.join(" "), cwd } : { argv: tail, cwd };
 }
-function simpleCommand(command, dialect = "posix", depth = 0) {
+function simpleCommand(command, dialect = "posix", depth = 0, shaped = false) {
   let segments;
   try {
     segments = segmentsOf(command, dialect);
   } catch {
     return null;
   }
-  if (segments.length !== 1)
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (!segments[0].pipe || !OUTPUT_FILTERS.has(commandName(filter.words[0])) || filter.group || filter.pipe || filter.unanalyzable || filter.subs?.length || filter.stdin?.length)
+      return null;
+  } else if (segments.length !== 1)
     return null;
   const [segment] = segments;
-  if (segment.group || segment.pipe || segment.unanalyzable || segment.redirects.length || segment.subs?.length || segment.stdin?.length)
+  if (segment.group || segment.pipe && !filter || segment.unanalyzable || segment.redirects.length && !shaped || segment.subs?.length || segment.stdin?.length)
     return null;
   const { words } = stripPrefixes(segment.words);
   const name = commandName(words[0]);
@@ -18950,7 +18978,7 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
     ...Object.keys(env).length ? { env } : {},
     ...stdin === undefined ? {} : { stdin }
   };
-}, RECENT, LAUNCHERS, WORKIT_BIN, WORKIT_PACKAGE, PACKAGE_RUNNERS, WORKIT_GLOBAL, PUSH_VALUE_OPTIONS, CURRENT_BRANCH, pushDestination = (destination) => {
+}, RECENT, LAUNCHERS, WORKIT_BIN, WORKIT_PACKAGE, PACKAGE_RUNNERS, OUTPUT_FILTERS, WORKIT_GLOBAL, PUSH_VALUE_OPTIONS, CURRENT_BRANCH, pushDestination = (destination) => {
   if (destination === "HEAD" || destination === "@" || CURRENT_BRANCH.test(destination))
     return { name: null };
   if (destination.startsWith("refs/heads/"))
@@ -19436,7 +19464,6 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
     case "pr-create":
       return `workit: prefer ${quote("workit pr create --fill")} (or --title/--body): it records the PR the merge gate checks.`;
     case "pr-read":
-      return `workit: ${quote("workit pr status")} shows the PR, its checks and the verdict state; ${quote("workit ci wait")} waits for checks.`;
     case "merge":
       return null;
   }
@@ -19644,6 +19671,7 @@ var init_raw_git = __esm(() => {
   WORKIT_BIN = /(?:^|[\\/])workit(?:\.exe)?$|^@brainervirus\/workit-cli$/;
   WORKIT_PACKAGE = /^@brainervirus\/workit-cli(?:@\S*)?$/;
   PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+  OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
   WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
   PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
   CURRENT_BRANCH = /^\$\(\s*git\s+(?:branch\s+--show-current|rev-parse\s+--abbrev-ref\s+HEAD|symbolic-ref\s+--short\s+HEAD)\s*\)$/;
@@ -20427,7 +20455,7 @@ function heavyPlan(command, options) {
   const heavy = heavyLines(lines, options);
   if (!heavy.length)
     return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName2(simple[0])) && heavyLines([simple], options)[0];
   const judged = single ? [{ words: lines.flat(), text: command }] : heavy.map((match) => ({
     words: match.line,
@@ -20439,7 +20467,7 @@ function heavyPlan(command, options) {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`
+          note: ""
         };
     }
   if (single) {
@@ -20449,7 +20477,7 @@ function heavyPlan(command, options) {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null
   };
 }
@@ -22506,6 +22534,31 @@ var init_worktree_confine = __esm(() => {
   CONFIG_VALUE = /^(?:--file|-f|--blob|--type|--default|--comment)$/;
 });
 
+// packages/workit-core/src/hooks/steering.ts
+var ROLES, workitRole = (descriptor, agentType) => {
+  const prefix = descriptor.subagents.agentPrefix;
+  const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
+  return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
+}, CLAUDE_WORKTREE, roleSteering = (role, isolated) => ({
+  role,
+  isolated,
+  git: role === "implementer" ? isolated ? "plain" : "workit" : null,
+  nudges: role === null
+}), agentSteering = (descriptor, cwd, agent) => {
+  const role = agent.type ? workitRole(descriptor, agent.type) : null;
+  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(cwd, agent.id) : CLAUDE_WORKTREE.test(cwd));
+  return roleSteering(role, isolated);
+};
+var init_steering = __esm(() => {
+  init_worktree_confine();
+  ROLES = {
+    implementer: "implementer",
+    verifier: "judge",
+    reviewer: "judge"
+  };
+  CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
+});
+
 // packages/workit-core/src/hooks/handle.ts
 function handleHook(input, deps) {
   const decision = decide(input, deps);
@@ -22591,7 +22644,12 @@ function decide(input, deps) {
       } : NONE6;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
-      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE6, aside), shipNudge(input, event.command));
+      const { nudges } = agentSteering(descriptor, input.cwd, {
+        type: input.session.agentType,
+        id: input.session.agentId
+      });
+      const nudge = canDeny ? rawGitPre(input, event.command, { nudge: nudges }) : NONE6;
+      const nudged = withContextLine(withContextLine(nudge, aside), shipNudge(input, event.command));
       if (!lease)
         return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
@@ -22639,34 +22697,35 @@ function decide(input, deps) {
       return NONE6;
   }
 }
-var usable2 = (value) => value === "native" || value === "partial", NONE6, resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn), offered, ROLES, workitRole = (descriptor, agentType) => {
-  const prefix = descriptor.subagents.agentPrefix;
-  const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
-  return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
-}, implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer", subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128), CLAUDE_WORKTREE, isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`, subagentStartText = (input, descriptor, event) => {
+var usable2 = (value) => value === "native" || value === "partial", NONE6, resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn), offered, implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer", subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128), isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`, subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
-  const role = workitRole(descriptor, event.agentType);
+  const { role, isolated, git } = agentSteering(descriptor, input.cwd, {
+    type: event.agentType,
+    id: event.agentId
+  });
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
-  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(input.cwd, event.agentId) : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
-  if (role === "implementer" && isolated)
+  if (git === "plain")
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
     return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
-  if (role === "implementer")
+  if (git === "workit")
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit git --cwd <worktree> commit -m "<message>" -- <paths>\`, \`workit check --cwd <worktree> <name>\` (verb first, so host allow rules match). The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit git --cwd <worktree> branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
   const cwd = input.cwd || process.cwd();
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const branch = judgeBranch(cwd);
+  if (descriptor.host === "codex_cli" || descriptor.host === "codex_desktop")
+    return `${readOnly} Its shell already acts as its own Workit session, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${verdictCommand({ branch, judge })}\`. Add no session or token option to it, and never set WORKIT_SESSION_ID by hand.`;
   const token = session ? recordIssuedSession(cwd, session, own) : null;
   if (session && !token)
     return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
-  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
-  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
-  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const line = verdictCommand({ branch, judge, session: own, token });
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 }, PRE_TOOL, failureDecision = (descriptor, event, error) => {
   if (event === "shell.pre" || event === "tool.pre" || event === "write.pre")
@@ -22714,14 +22773,9 @@ var init_handle = __esm(() => {
   init_live_session();
   init_write_gate();
   init_worktree_confine();
+  init_steering();
   NONE6 = { kind: "none" };
   offered = new Set;
-  ROLES = {
-    implementer: "implementer",
-    verifier: "judge",
-    reviewer: "judge"
-  };
-  CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
   PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
 });
 

package/dist/mcp-server.js

@@ -24574,6 +24574,7 @@ var LAUNCHERS = new Set([
   "command"
 ]);
 var PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+var OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var VALUE_OPTIONS = {
   git: new Set([

package/dist/workit-hook.js

@@ -15735,13 +15735,13 @@ Autonomy contract:
   or an unresolved blocker; report open gaps and uncertain workers.
 - No endpoint named: stop at a local commit on a policy-compliant branch and
   state the next command. If the request implies delivery (fix, implement,
-  ship), go to the effective endpoint in \`workit grant show\`: \`pr\` opens
-  the PR; \`green\` babysits it without asking (workit-ship) to merge-ready,
-  never merging; \`merged\` also lands it with \`workit pr merge\`.
-  Merge and release need a workspace grant only the user raises from their
-  own terminal (a blocked verb names how); never edit workspaces.json or route
-  around grant_required. Release: \`workit release start <v>\`, commits,
-  \`finish\`; \`publish\` if asked.
+  ship), go to the effective endpoint in \`workit grant show\`: \`pr\` stops
+  at the PR even with merge granted; \`green\` babysits it (workit-ship) to
+  merge-ready, never merging; \`merged\` lands it with \`workit pr merge\`.
+  Only the user raises a grant or the endpoint, in a terminal outside the agent
+  host (\`workit grant set <ws> defaultEndpoint=merged\`); never edit
+  workspaces.json or route around grant_required. Release: \`workit release
+  start <v>\`, commits, \`finish\`; \`publish\` if asked.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -15755,9 +15755,8 @@ Autonomy contract:
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
-CLI first: if a step has one right answer, use the \`workit\` verb instead of
-hand-running git, gh or glab (\`workit git|pr|ci|check|help\`;
-else \`npx -y @brainervirus/workit-cli\`).
+Read-only git and gh run raw; mutations go through workit verbs
+(\`workit git|pr|ci|check|help\`; else \`npx -y @brainervirus/workit-cli\`).
 Other checkout: \`workit <verb> --cwd <dir> …\` (verb first: host rules match it); one workit
 verb per shell call, never \`cd <dir> && workit\`. zsh-safe: no \`echo =====\`
 (\`printf '%s\\n' ---\`), quote globs and URLs, no variable named \`status\` or \`path\`.
@@ -17759,12 +17758,38 @@ ${offer}` : ""}${options.addendum ? `
 ${options.addendum}` : ""}
 </workit-contract>`;
 };
+var checkoutAt = (cwd) => {
+  for (let dir = path20.resolve(cwd);; dir = path20.dirname(dir)) {
+    const dotGit = path20.join(dir, ".git");
+    if (fs15.existsSync(dotGit)) {
+      const admin = fs15.statSync(dotGit).isFile() ? path20.resolve(dir, /^gitdir:\s*(.+)$/mu.exec(fs15.readFileSync(dotGit, "utf8"))?.[1]?.trim() ?? "") : dotGit;
+      const head = fs15.readFileSync(path20.join(admin, "HEAD"), "utf8").trim();
+      return { root: dir, branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null };
+    }
+    if (path20.dirname(dir) === dir)
+      return null;
+  }
+};
+var whereLine = (cwd) => {
+  try {
+    const checkout = checkoutAt(cwd);
+    if (!checkout)
+      return null;
+    const allowed = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowed.some((pattern) => pattern.source === "^.*$") ? "any" : allowedKinds(allowed).join(", ") || "see `workit help git`";
+    const place = checkout.root === path20.resolve(cwd) ? "" : ` in ${checkout.root}`;
+    return `cwd ${cwd}${place} on ${checkout.branch ?? "detached HEAD"}; branch kinds: ${kinds}`;
+  } catch {
+    return null;
+  }
+};
 var turnContextText = (input, descriptor) => {
   try {
     const text = sessionCompactContext(new TaskStore(input.cwd), { host: input.host, handle: input.session.id }, hookOperationContext(input, descriptor), descriptor.context.task);
     if (text === MIGRATION_PENDING_NOTE)
       return text;
-    return text ? `<workit-task-context>${text}</workit-task-context>` : null;
+    return text ? `<workit-task-context>${[whereLine(input.cwd), text].filter(Boolean).join(`
+`)}</workit-task-context>` : null;
   } catch {
     return null;
   }
@@ -18954,17 +18979,22 @@ function workitCheckTail(words) {
     return null;
   return args.slice(0, split).includes("--shell") ? { script: tail.join(" "), cwd } : { argv: tail, cwd };
 }
-function simpleCommand(command, dialect = "posix", depth = 0) {
+var OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
+function simpleCommand(command, dialect = "posix", depth = 0, shaped = false) {
   let segments;
   try {
     segments = segmentsOf(command, dialect);
   } catch {
     return null;
   }
-  if (segments.length !== 1)
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (!segments[0].pipe || !OUTPUT_FILTERS.has(commandName(filter.words[0])) || filter.group || filter.pipe || filter.unanalyzable || filter.subs?.length || filter.stdin?.length)
+      return null;
+  } else if (segments.length !== 1)
     return null;
   const [segment] = segments;
-  if (segment.group || segment.pipe || segment.unanalyzable || segment.redirects.length || segment.subs?.length || segment.stdin?.length)
+  if (segment.group || segment.pipe && !filter || segment.unanalyzable || segment.redirects.length && !shaped || segment.subs?.length || segment.stdin?.length)
     return null;
   const { words } = stripPrefixes(segment.words);
   const name = commandName(words[0]);
@@ -19649,7 +19679,6 @@ var nudgeFor = (action, host, session) => {
     case "pr-create":
       return `workit: prefer ${quote("workit pr create --fill")} (or --title/--body): it records the PR the merge gate checks.`;
     case "pr-read":
-      return `workit: ${quote("workit pr status")} shows the PR, its checks and the verdict state; ${quote("workit ci wait")} waits for checks.`;
     case "merge":
       return null;
   }
@@ -20739,7 +20768,7 @@ function heavyPlan(command, options) {
   const heavy = heavyLines(lines, options);
   if (!heavy.length)
     return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName2(simple[0])) && heavyLines([simple], options)[0];
   const judged = single ? [{ words: lines.flat(), text: command }] : heavy.map((match) => ({
     words: match.line,
@@ -20751,7 +20780,7 @@ function heavyPlan(command, options) {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`
+          note: ""
         };
     }
   if (single) {
@@ -20761,7 +20790,7 @@ function heavyPlan(command, options) {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null
   };
 }
@@ -22734,11 +22763,7 @@ function confineImplementerShell(input, command, dialect = "posix") {
   return confineImplementer(input, shellMutationTargets(input.cwd, command, dialect, true));
 }
 
-// packages/workit-core/src/hooks/handle.ts
-var usable2 = (value) => value === "native" || value === "partial";
-var NONE6 = { kind: "none" };
-var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
-var offered = new Set;
+// packages/workit-core/src/hooks/steering.ts
 var ROLES = {
   implementer: "implementer",
   verifier: "judge",
@@ -22749,34 +22774,56 @@ var workitRole = (descriptor, agentType) => {
   const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
   return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
 };
+var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
+var roleSteering = (role, isolated) => ({
+  role,
+  isolated,
+  git: role === "implementer" ? isolated ? "plain" : "workit" : null,
+  nudges: role === null
+});
+var agentSteering = (descriptor, cwd, agent) => {
+  const role = agent.type ? workitRole(descriptor, agent.type) : null;
+  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(cwd, agent.id) : CLAUDE_WORKTREE.test(cwd));
+  return roleSteering(role, isolated);
+};
+
+// packages/workit-core/src/hooks/handle.ts
+var usable2 = (value) => value === "native" || value === "partial";
+var NONE6 = { kind: "none" };
+var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
+var offered = new Set;
 var implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer";
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
-var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
 var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
-  const role = workitRole(descriptor, event.agentType);
+  const { role, isolated, git } = agentSteering(descriptor, input.cwd, {
+    type: event.agentType,
+    id: event.agentId
+  });
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
-  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(input.cwd, event.agentId) : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
-  if (role === "implementer" && isolated)
+  if (git === "plain")
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
     return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
-  if (role === "implementer")
+  if (git === "workit")
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit git --cwd <worktree> commit -m "<message>" -- <paths>\`, \`workit check --cwd <worktree> <name>\` (verb first, so host allow rules match). The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit git --cwd <worktree> branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
   const cwd = input.cwd || process.cwd();
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const branch = judgeBranch(cwd);
+  if (descriptor.host === "codex_cli" || descriptor.host === "codex_desktop")
+    return `${readOnly} Its shell already acts as its own Workit session, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${verdictCommand({ branch, judge })}\`. Add no session or token option to it, and never set WORKIT_SESSION_ID by hand.`;
   const token = session ? recordIssuedSession(cwd, session, own) : null;
   if (session && !token)
     return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
-  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
-  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
-  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const line = verdictCommand({ branch, judge, session: own, token });
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
@@ -22864,7 +22911,12 @@ function decide(input, deps) {
       } : NONE6;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
-      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE6, aside), shipNudge(input, event.command));
+      const { nudges } = agentSteering(descriptor, input.cwd, {
+        type: input.session.agentType,
+        id: input.session.agentId
+      });
+      const nudge = canDeny ? rawGitPre(input, event.command, { nudge: nudges }) : NONE6;
+      const nudged = withContextLine(withContextLine(nudge, aside), shipNudge(input, event.command));
       if (!lease)
         return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "8.29.0",
+  "version": "8.29.2",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and sixteen method skills",
   "keywords": [
@@ -46,8 +46,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.29.0",
-    "@brainervirus/workit-mcp": "^8.29.0"
+    "@brainervirus/workit-core": "^8.29.2",
+    "@brainervirus/workit-mcp": "^8.29.2"
   },
   "engines": {
     "node": ">=24"