@brainervirus/workit-opencode 1.3.0 → 1.3.1

package/dist/plugin.js

@@ -8318,7 +8318,47 @@ function operationJsonSchema(family) {
   return toJSONSchema(operationSchemas[family], { target: "draft-2020-12" });
 }
 var OPERATION_SCHEMA_DEPTH = 1;
-var canonicalFieldsDescription = (fields) => `Canonical object fields: ${fields.join(", ")}. Workit validates the complete nested value.`;
+var schemaShapeDescription = (value, depth = 0) => {
+  if (!value || typeof value !== "object")
+    return "value";
+  const schema = value;
+  if (Array.isArray(schema.oneOf) || Array.isArray(schema.anyOf)) {
+    const options = Array.isArray(schema.oneOf) ? schema.oneOf : schema.anyOf;
+    return `(${options.map((option) => schemaShapeDescription(option, depth)).join("|")})`;
+  }
+  if (schema.const !== undefined)
+    return `=${JSON.stringify(schema.const)}`;
+  if (Array.isArray(schema.enum))
+    return `[${schema.enum.map(String).join("|")}]`;
+  const type = Array.isArray(schema.type) ? schema.type.join("/") : schema.type;
+  if (type === "array")
+    return `arr<${schemaShapeDescription(schema.items, depth)}>`;
+  if (type === "object" && schema.properties && typeof schema.properties === "object") {
+    if (depth >= 2)
+      return "obj";
+    const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+    const properties = schema.properties;
+    const fields = Object.entries(properties).map(([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child, depth + 1)}`);
+    return `obj{${fields.join(",")}}`;
+  }
+  if (typeof type !== "string")
+    return "?";
+  return type.split("/").map((part) => ({ string: "str", boolean: "bool", number: "num", null: "null" })[part] ?? part).join("|");
+};
+var canonicalFieldsDescription = (value) => {
+  if (Array.isArray(value))
+    return `Canonical object fields: ${value.join(", ")}. Workit validates the complete nested value.`;
+  const isZodType = (schema) => ("_zod" in schema) && typeof schema._zod === "object";
+  const schema = isZodType(value) ? toJSONSchema(value, { target: "draft-2020-12" }) : value;
+  if (!schema.properties || typeof schema.properties !== "object") {
+    const variants = Array.isArray(schema.oneOf) ? schema.oneOf : Array.isArray(schema.anyOf) ? schema.anyOf : null;
+    return variants ? `Canonical shapes: ${variants.map((variant) => schemaShapeDescription(variant)).join(" | ")}. Full nested value is validated.` : "Canonical nested value; Workit validates the complete value.";
+  }
+  const properties = schema.properties;
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  const fields = Object.entries(properties).map(([name, child]) => `${name}${required.has(name) ? "!" : ""}:${schemaShapeDescription(child)}`);
+  return `Fields (! required): ${fields.join(", ")}. Full nested value is validated.`;
+};
 function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, stringifiedObjects = false) {
   const tolerate = (projected) => {
     if (!stringifiedObjects)
@@ -8342,9 +8382,10 @@ function boundedOperationJsonSchema(family, maxDepth = OPERATION_SCHEMA_DEPTH, s
       return node;
     const record = node;
     if (record.properties && typeof record.properties === "object") {
-      const fields = Object.keys(record.properties);
+      const properties = record.properties;
+      const fields = Object.keys(properties);
       if (currentDepth >= maxDepth || fields.length === 0) {
-        const description = stringifiedObjects ? `${canonicalFieldsDescription(fields)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(fields);
+        const description = stringifiedObjects ? `${canonicalFieldsDescription(record)} A JSON-encoded string is also accepted.` : canonicalFieldsDescription(record);
         return tolerate({ type: "object", description });
       }
       return tolerate({
@@ -10650,6 +10691,28 @@ var canonicalGlob = (glob) => {
   const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
   return real + (prefix.endsWith("/") ? "/" : "") + rest;
 };
+var globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length;
+var selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+  if (workspaceName !== undefined) {
+    const named = matches.filter((entry) => entry.name === workspaceName);
+    if (named.length === 1)
+      return named[0];
+    if (named.length > 1)
+      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+    if (matches.length > 0) {
+      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+    }
+    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+  }
+  if (matches.length < 2)
+    return matches[0];
+  const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
+  const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
+  if (mostSpecific.length > 1) {
+    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+  }
+  return mostSpecific[0];
+};
 var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
   const result = readWorkspacesResult(dir);
   if (result.status === "malformed" || result.status === "invalid")
@@ -10669,20 +10732,7 @@ var resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
     if (matched)
       matches.push(ws);
   }
-  if (workspaceName !== undefined) {
-    const selected = matches.find((ws) => ws.name === workspaceName);
-    if (!selected && matches.length > 0) {
-      const matchingNames = matches.map((ws) => ws.name);
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matchingNames.join(", ")}`);
-    }
-    if (selected)
-      return selected;
-    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  }
-  if (matches.length > 1) {
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((ws) => ws.name).join(", ")}`);
-  }
-  return matches[0] ?? null;
+  return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
 };
 var runtimeWorkspacePolicySchema = (kind) => {
   const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
@@ -10739,21 +10789,7 @@ var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
     return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
-  let selected;
-  if (workspaceName) {
-    const named = matches.filter((entry) => entry.name === workspaceName);
-    if (named.length === 1)
-      selected = named[0];
-    else if (named.length > 1)
-      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
-    else if (matches.length)
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
-    else
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
-  } else if (matches.length > 1)
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${matches.map((entry) => entry.name).join(", ")}`);
-  else
-    selected = matches[0];
+  const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
   if (!selected)
     return null;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
@@ -12941,6 +12977,15 @@ need zero Workit task, assessment, or writer calls. Use one compact tracked
 record only when handoff, dependent steps, concurrent actors, or meaningful
 decisions make continuity useful; similar titles alone never merge tasks.
 
+For a routine user-authorized branch or commit, prefer native host Git/shell
+tools from the outset when managed coordination or outcome reconciliation is
+not needed. Inspect the actual target checkout and its configured conventions;
+use Workit's read-only context/policy tools when needed. Do not start a task,
+acquire a writer, or mint a decision receipt solely for a native Git action.
+Native permissions still apply. Never switch execution paths to evade a denial
+or repeat an uncertain managed effect. A local-commit endpoint does not imply
+PR readiness, a fresh review, or post-commit assessment/closure paperwork.
+
 For tracked work, inspect its current state and use the shared operations for
 task, policy, evidence, finding, decision, worker, writer, and state changes.
 Start a record once for an explicit tracked objective; assess or reassess only
@@ -13222,6 +13267,10 @@ var externalActionSchema = discriminatedUnion("operation", [
     }).strict()
   }).strict()
 ]);
+var externalActionJsonSchema = () => ({
+  type: "object",
+  ...toJSONSchema(externalActionSchema, { target: "draft-2020-12" })
+});
 var externalActionRequest = (value) => {
   const parsed = externalActionSchema.safeParse(value);
   return parsed.success ? success(null, null, parsed.data) : failure("invalid_input", "external action payload is invalid", {
@@ -13977,6 +14026,7 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }));
+  const independentBehaviorReview = input.preferences?.thorough === true || input.assessment.consequences.some((consequence) => ["security", "data", "public_contract", "operations"].includes(consequence.area));
   if (signals.behaviorChange.value === true)
     requirements.push(requirement({
       ruleId: "behavioral-verification",
@@ -13988,14 +14038,14 @@ function resolveRequirements(input) {
       dependentAction: null,
       acceptanceAllowed: false
     }), requirement({
-      ruleId: "fresh-context-review",
+      ruleId: independentBehaviorReview ? "fresh-context-review" : "self-review",
       dimension: "review",
       scope,
-      reason: "A non-mechanical behavior change requires fresh-context review.",
-      satisfaction: "A separate review context examines the current candidate and records its result.",
+      reason: independentBehaviorReview ? "Consequential behavior or the thorough preference requires fresh-context review." : "Bounded behavior changes use self-review unless consequential risks or trusted rules require more.",
+      satisfaction: independentBehaviorReview ? "A separate review context examines the current candidate and records its result." : "The lead reviews the resulting diff and records the relevant scope and checks.",
       before: "close",
       dependentAction: null,
-      acceptanceAllowed: false
+      acceptanceAllowed: !independentBehaviorReview
     }));
   else if (signals.mechanicalLowRisk.value === true)
     requirements.push(requirement({
@@ -34040,14 +34090,33 @@ class NativeReceiptStore {
   #observations = new WeakSet;
   #reservations = new WeakMap;
   #pending = new Map;
+  #callSequences = new Map;
+  #seenCalls = new Set;
   #now;
+  #sequence = 0;
   constructor(options = {}) {
     this.#now = options.now ?? Date.now;
   }
+  get sequence() {
+    return this.#sequence;
+  }
+  callKey(sessionID, callID) {
+    return `${sessionID.length}:${sessionID}${callID}`;
+  }
+  rememberSequence(key, sequence) {
+    if (!this.#callSequences.has(key))
+      this.#callSequences.set(key, sequence);
+  }
   recordRequest(requestID, sessionID, callID, questions) {
     if (typeof requestID !== "string" || !requestID)
       return;
-    this.#pending.set(requestID, { sessionID, callID, questions });
+    const key = this.callKey(sessionID, callID);
+    let sequence = this.#callSequences.get(key);
+    if (sequence === undefined) {
+      sequence = ++this.#sequence;
+      this.rememberSequence(key, sequence);
+    }
+    this.#pending.set(requestID, { sessionID, callID, questions, sequence });
     if (this.#pending.size > 16) {
       const oldest = this.#pending.keys().next();
       if (!oldest.done)
@@ -34064,9 +34133,9 @@ class NativeReceiptStore {
       return false;
     if (!Array.isArray(answers) || answers.length !== 1)
       return false;
-    return this.mint(pending.sessionID, pending.callID, pending.questions, answers);
+    return this.mint(pending.sessionID, pending.callID, pending.questions, answers, pending.sequence);
   }
-  mint(sessionID, callID, questions, answers) {
+  mint(sessionID, callID, questions, answers, sequence) {
     const answer = Array.isArray(answers) && answers.length === 1 && Array.isArray(answers[0]) && answers[0].length === 1 && typeof answers[0][0] === "string" ? answers[0][0] : undefined;
     if (typeof answer !== "string" || !answer.trim())
       return false;
@@ -34087,6 +34156,12 @@ class NativeReceiptStore {
     const decisionPurpose = typeof question.header === "string" ? question.header.match(/^Workit decision: (design|action|limitation|preference)$/)?.[1] : undefined;
     if (!decisionPurpose)
       return false;
+    const key = this.callKey(sessionID, callID);
+    if (this.#seenCalls.has(key))
+      return true;
+    const receiptSequence = sequence ?? this.#callSequences.get(key) ?? ++this.#sequence;
+    this.rememberSequence(key, receiptSequence);
+    this.#seenCalls.add(key);
     const content = decisionContent(decisionPurpose, typeof question.question === "string" ? question.question : "", options[0].description);
     const receipt = {
       sessionID,
@@ -34097,7 +34172,8 @@ class NativeReceiptStore {
       question: content.question,
       purpose,
       contentDigest: sha256(canonicalJson(content)),
-      recordedAt: this.#now()
+      recordedAt: this.#now(),
+      sequence: receiptSequence
     };
     const queue = this.#receipts.get(sessionID) ?? [];
     queue.push(receipt);
@@ -34201,7 +34277,7 @@ var boundedSchema = (schema, depth, field) => {
       key,
       depth >= MAX_OPERATION_OBJECT_DEPTH ? shallowSchema(child, `${field}.${key}`) : boundedSchema(child, depth + 1, `${field}.${key}`)
     ]));
-    const description = depth >= MAX_OPERATION_OBJECT_DEPTH ? canonicalFieldsDescription(Object.keys(canonicalShape)) : undefined;
+    const description = depth >= MAX_OPERATION_OBJECT_DEPTH ? canonicalFieldsDescription(schema) : undefined;
     const object = tool.schema.object(shape).strict();
     return description ? object.describe(description) : object;
   }
@@ -34493,27 +34569,39 @@ var createWorkitTools = ({
         if (decision.purpose === "action" && decision.response === "approved") {
           const queue = actionProposals.get(context.sessionID) ?? [];
           const textMatches = queue.filter((pending) => pending.presented === decision.binding.presented && pending.approvedText === decision.binding.approvedContent);
-          if (textMatches.length > 1 && new Set(textMatches.map((pending) => pending.descriptor)).size > 1)
-            return output2(failure("invalid_input", "multiple action proposals match this approval; resolve the action again"));
           let bound = false;
-          const pending = textMatches[0];
-          if (pending) {
+          const valid = [];
+          const stale = new Set;
+          let unresolved = false;
+          for (const pending of textMatches) {
             const fresh = resolveExternalActionRequest(context.directory, pending.request);
             const freshDescriptor = fresh.ok ? externalActionDescriptor(pending.request.operation, fresh.data.descriptorPayload) : null;
             if (freshDescriptor === pending.descriptor) {
-              proposalToCommit = pending;
-              recordInput = {
-                ...recordInput,
-                binding: {
-                  ...recordInput.binding,
-                  approvedContent: pending.descriptor,
-                  displayed: pending.approvedText
-                }
-              };
-              bound = true;
+              valid.push(pending);
+              if (observed.receipt.sequence <= pending.receiptSequence)
+                unresolved = true;
             } else if (fresh.ok) {
-              actionProposals.set(context.sessionID, queue.filter((candidate) => candidate !== pending));
-            }
+              stale.add(pending);
+            } else
+              unresolved = true;
+          }
+          if (stale.size)
+            actionProposals.set(context.sessionID, queue.filter((candidate) => !stale.has(candidate)));
+          const validDescriptors = new Set(valid.map((pending) => pending.descriptor));
+          if (unresolved || validDescriptors.size > 1)
+            return output2(failure("invalid_input", "matching action proposals are ambiguous or this receipt predates a matching proposal; resolve and ask again"));
+          if (validDescriptors.size === 1) {
+            const pending = valid[0];
+            proposalToCommit = pending;
+            recordInput = {
+              ...recordInput,
+              binding: {
+                ...recordInput.binding,
+                approvedContent: pending.descriptor,
+                displayed: pending.approvedText
+              }
+            };
+            bound = true;
           }
           if (!bound && !isSelfAuthorizingActionContent(decision.binding.approvedContent)) {
             return output2(failure("invalid_input", textMatches.length > 0 ? "repository state changed since the proposal; resolve the action again for a fresh proposal" : "no matching action proposal; resolve the action through the action tool first"));
@@ -34540,20 +34628,8 @@ var createWorkitTools = ({
     workit_external_action: tool({
       description: `Run one fixed optional action. ${externalActionHelp}`,
       args: {
-        operation: tool.schema.enum([
-          "git.branch_setup",
-          "git.commit",
-          "git.push",
-          "hosting.pull_request",
-          "hosting.merge",
-          "hosting.delete_branch",
-          "youtrack.update",
-          "youtrack.time",
-          "youtrack.meeting",
-          "changelog.apply",
-          "context.read"
-        ]),
-        payload: tool.schema.record(tool.schema.string(), tool.schema.any())
+        operation: tool.schema.enum(externalActionSchema.options.map((variant) => variant.shape.operation.value)),
+        payload: tool.schema.union(externalActionSchema.options.map((variant) => variant.shape.payload)).describe("Use the payload variant for the selected operation; Workit validates their exact pairing.")
       },
       execute: async (args, context) => {
         const parsed = externalActionRequest(args);
@@ -34687,7 +34763,8 @@ var createWorkitTools = ({
               descriptor,
               presented: proposal.presented,
               approvedText: proposal.approvedText,
-              request: resolved.data.request
+              request: resolved.data.request,
+              receiptSequence: receipts.sequence
             };
             if (!existing) {
               pending.push(open);
@@ -35259,19 +35336,6 @@ var objectSchema = (properties, required) => ({
   required,
   additionalProperties: false
 });
-var WORKIT_EXTERNAL_ACTION_OPERATIONS = [
-  "git.branch_setup",
-  "git.commit",
-  "git.push",
-  "hosting.pull_request",
-  "hosting.merge",
-  "hosting.delete_branch",
-  "youtrack.update",
-  "youtrack.time",
-  "youtrack.meeting",
-  "changelog.apply",
-  "context.read"
-];
 var familyTools = OPERATION_FAMILIES.map((family) => ({
   name: `workit_${family}`,
   description: `Workit ${family} operations backed by the shared task contract.`,
@@ -35281,19 +35345,8 @@ var WORKIT_TOOL_CATALOG = [
   ...familyTools,
   {
     name: "workit_external_action",
-    description: `Run one fixed optional action. ${externalActionHelp}`,
-    input: objectSchema({
-      operation: {
-        type: "string",
-        enum: [...WORKIT_EXTERNAL_ACTION_OPERATIONS],
-        description: "Fixed optional action to run."
-      },
-      payload: {
-        type: "object",
-        description: "Operation-specific payload; Workit validates it.",
-        additionalProperties: true
-      }
-    }, ["operation", "payload"])
+    description: "Run a Workit-managed external action. context.read is read-only. Mutations require an active coordinator task, checkout writer ownership, and host-native authorization. Routine Git work already permitted by the host can use native tools without a Workit task; never use another route to bypass a host denial or uncertain result.",
+    input: externalActionJsonSchema()
   },
   {
     name: "workit_init_apply",
@@ -36028,6 +36081,12 @@ var setup = async (ctx) => {
     }
   });
   await ctx.tool.hook("execute.before", async (event) => {
+    if (event.tool === "question") {
+      const sessionID = String(event.sessionID);
+      const callID = String(event.id);
+      receipts.recordRequest(callID, sessionID, callID, event.input?.questions);
+      return;
+    }
     if (event.tool !== "subagent")
       return;
     await lifecycle.executeBefore({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": false,
   "description": "Workit OpenCode plugin — native tools, adaptive policy, and fourteen method skills",
   "keywords": [
@@ -39,7 +39,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^1.3.0"
+    "@brainervirus/workit-core": "^1.3.1"
   },
   "devDependencies": {
     "@opencode-ai/plugin": "1.18.30",