@brainervirus/workit-opencode 8.13.1 → 8.14.0

package/assets/skills/workit-fanout/SKILL.md

@@ -25,9 +25,9 @@ ceremony; do it yourself. Workit never spawns agents; you do.
    it; change the plan or the standing orders and render again.
 4. **Spawn in a rolling window**, in the background, each in its own worktree:
    keep 4-6 in flight and refill from `spawnable` in `workit fanout status` as
-   each one finishes. Pick the model from TIER (`references/orchestration.md`).
-   Claude Code: the `implementer` agent; elsewhere first `workit fanout
-   worktree create <slice>`.
+   each one finishes. Model: the brief's `model:` line, else TIER
+   (`references/orchestration.md`). Claude Code: the `implementer` agent;
+   elsewhere first `workit fanout worktree create <slice>`.
 5. **Judge liveness by side effects only:** `workit fanout status` (head age,
    PR, CI, verdict, landed; STUCK past the TIMEBOX). Stop a stuck worker and
    observe that it exited (a timeout is not proof). Removing a worktree drops
@@ -53,7 +53,7 @@ ceremony; do it yourself. Workit never spawns agents; you do.
    status` order, release the worktrees you made, and `workit ledger standing
    clear`. Only you touch topology: workers never rebase, retarget or merge,
    except the integration-tip merge in integration mode. Then ship
-   (call the skill tool with `workit-ship`).
+   (call the skill tool with `workit-ship`) up to `defaultEndpoint` from `workit grant show`.
 
 ## Example
 

package/assets/skills/workit-fanout/references/orchestration.md

@@ -5,8 +5,10 @@ and fans in. Workit records and checks; the host's own subagents run the work.
 
 ## TIER to model
 
-TIER is a field of each slice and of its brief. Map it where the host lets you
-pick a model per spawn; nothing in the workspace config routes it.
+TIER is a field of each slice and of its brief. When the workspace sets
+`fanout.tierModels`, the brief has a `model:` line under TIER and `workit
+fanout status` names the model next to each spawnable slice: use that model.
+Without one, map TIER where the host lets you pick a model per spawn:
 
 | TIER | Claude Code (`model` on the Agent call) | Hosts without a per-spawn model |
 | --- | --- | --- |

package/dist/plugin.js

@@ -13161,6 +13161,8 @@ var workspaceConfigSchema = object({
   defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
   trailers: boolean2().optional(),
+  liveSessionGuard: boolean2().optional(),
+  fanout: object({ tierModels: unknown().optional() }).passthrough().optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -13478,6 +13480,31 @@ var resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
 };
+var inheritedSetting = (cwd, dir, has) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return null;
+  }
+  if (!matched)
+    return null;
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+};
+var workspaceLiveSessionGuard = (cwd, dir) => inheritedSetting(cwd, dir, (entry) => typeof entry.liveSessionGuard === "boolean")?.source?.liveSessionGuard !== false;
+var TIER_KEYS = new Set(["mundane", "standard", "hard"]);
+var TIER_HOSTS = new Set([
+  "claude_code",
+  "opencode",
+  "codex",
+  "codex_cli",
+  "codex_desktop",
+  "cursor",
+  "pi",
+  "default"
+]);
 var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -21684,27 +21711,231 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
 };
 // packages/workit-core/src/hooks/write-gate.ts
 import { realpathSync as realpathSync6 } from "node:fs";
+import os7 from "node:os";
+import path27 from "node:path";
+
+// packages/workit-core/src/core/live-session.ts
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { createHash as createHash14 } from "node:crypto";
+import fs18 from "node:fs";
+import os6 from "node:os";
 import path26 from "node:path";
+var LIVE_SESSION_TTL_MS = 15 * 60000;
+var HEARTBEAT_EVERY_MS = 30000;
+var liveProbe = {
+  platform: process.platform,
+  run: (args) => spawnSync17("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
+  start: (pid) => processStartOf(pid)
+};
+var leadOf = (session) => session.split(":")[0].replace(/-w-.*$/su, "") || session;
+var familyOf = (host) => host.replace(/_(?:cli|desktop)$/u, "");
+var processAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var processInfo = (pid) => {
+  try {
+    if (liveProbe.platform === "linux") {
+      const stat = fs18.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+      const command = fs18.readFileSync(`/proc/${pid}/cmdline`, "utf8").replaceAll("\x00", " ");
+      return Number.isInteger(ppid) ? { ppid, command: command.trim() } : null;
+    }
+    if (liveProbe.platform === "win32")
+      return null;
+    const match = /^\s*(\d+)\s+(.*)$/su.exec(liveProbe.run(["-o", "ppid=,command=", "-p", String(pid)]));
+    return match ? { ppid: Number(match[1]), command: match[2].trim() } : null;
+  } catch {
+    return null;
+  }
+};
+var WRAPPER = /^(?:\S*\/)?(?:sh|bash|dash|zsh|ash|ksh|fish|env|timeout|npx|npm|bunx|cmd\.exe|pwsh|powershell)(?:\s|$)|launch\.mjs|npx-cli\.js/u;
+var PIDS = new Map;
+var hostPid = (transport) => {
+  if (transport !== "hook-process")
+    return process.pid;
+  const key = `${liveProbe.platform}\x00${process.ppid}`;
+  if (PIDS.has(key))
+    return PIDS.get(key) ?? null;
+  if (liveProbe.platform === "win32") {
+    PIDS.set(key, null);
+    return null;
+  }
+  let pid = process.ppid;
+  for (let hop = 0;hop < 4; hop++) {
+    const info = processInfo(pid);
+    if (!info || !WRAPPER.test(info.command) || info.ppid <= 1)
+      break;
+    pid = info.ppid;
+  }
+  PIDS.set(key, pid);
+  return pid;
+};
+var sessionSafe = (value) => value.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-");
+var liveOwner = (input, transport, env = process.env) => {
+  const session = input.session.id?.trim();
+  if (!session)
+    return null;
+  const leads = new Set([leadOf(sessionSafe(session))]);
+  if (input.session.parentId)
+    leads.add(leadOf(sessionSafe(input.session.parentId)));
+  if (env.WORKIT_PI_WORKER_SESSION && env.WORKIT_SESSION_ID)
+    leads.add(leadOf(sessionSafe(env.WORKIT_SESSION_ID)));
+  return {
+    host: input.host,
+    session: sessionSafe(session),
+    leads: [...leads],
+    pid: () => hostPid(transport)
+  };
+};
+var checkoutOf = (target) => {
+  let dir = path26.resolve(target);
+  while (!fs18.existsSync(dir) && path26.dirname(dir) !== dir)
+    dir = path26.dirname(dir);
+  if (fs18.existsSync(dir) && !fs18.statSync(dir).isDirectory())
+    dir = path26.dirname(dir);
+  const parts = dir.split(path26.sep);
+  const dotGit = parts.lastIndexOf(".git");
+  if (dotGit > 0)
+    dir = parts.slice(0, dotGit).join(path26.sep) || path26.sep;
+  const location = resolveStore(dir);
+  if (location instanceof Error || !location.shared || !location.top)
+    return null;
+  let top = location.top;
+  try {
+    top = fs18.realpathSync.native(top);
+  } catch {}
+  return top;
+};
+var markerFile2 = (top) => path26.join(resolveStateDir(), "live-sessions", `${createHash14("sha256").update(checkoutKey(top)).digest("hex").slice(0, 32)}.json`);
+var checkoutKey = (top, platform = process.platform) => {
+  let key = path26.resolve(top);
+  try {
+    key = fs18.realpathSync.native(key);
+  } catch {}
+  return platform === "win32" ? key.replaceAll("/", "\\").toLowerCase() : key;
+};
+var readMarker = (file) => {
+  try {
+    const value = JSON.parse(fs18.readFileSync(file, "utf8"));
+    if (value?.version !== 1 || typeof value.session !== "string" || typeof value.host !== "string" || typeof value.heartbeatAt !== "string" || Number.isNaN(Date.parse(value.heartbeatAt)))
+      return null;
+    return {
+      version: 1,
+      session: value.session,
+      leads: Array.isArray(value.leads) ? value.leads.filter((item) => typeof item === "string") : [],
+      host: value.host,
+      pid: typeof value.pid === "number" ? value.pid : null,
+      pidStart: typeof value.pidStart === "string" ? value.pidStart : null,
+      machine: typeof value.machine === "string" ? value.machine : "",
+      checkout: typeof value.checkout === "string" ? value.checkout : "",
+      heartbeatAt: value.heartbeatAt
+    };
+  } catch {
+    return null;
+  }
+};
+var ageOf2 = (marker, now) => now.getTime() - Date.parse(marker.heartbeatAt);
+var isLive = (marker, deps) => {
+  const age = ageOf2(marker, deps.now ?? new Date);
+  if (age > (deps.ttlMs ?? LIVE_SESSION_TTL_MS))
+    return false;
+  if (marker.machine !== (deps.machine ?? os6.hostname()) || marker.pid === null)
+    return true;
+  if (!(deps.alive ?? processAlive)(marker.pid))
+    return false;
+  if (marker.pidStart === null)
+    return true;
+  const start = liveProbe.start(marker.pid);
+  return start === null || start === marker.pidStart;
+};
+var sameLead = (marker, owner) => marker.session === owner.session || owner.leads.some((lead) => lead === marker.session || marker.leads.includes(lead));
+var sameOwner = (marker, owner, machine) => {
+  if (sameLead(marker, owner))
+    return true;
+  if (marker.machine !== machine)
+    return false;
+  const pid = owner.pid();
+  if (pid === null || marker.pid === null || marker.pidStart === null)
+    return familyOf(marker.host) === familyOf(owner.host);
+  return marker.pid === pid;
+};
+var liveConflict = (target, owner, deps = {}) => {
+  try {
+    const checkout = checkoutOf(target);
+    if (!checkout)
+      return null;
+    const file = markerFile2(checkout);
+    const marker = readMarker(file);
+    if (!marker || sameLead(marker, owner) || !isLive(marker, deps))
+      return null;
+    if (sameOwner(marker, owner, deps.machine ?? os6.hostname()))
+      return null;
+    return { marker, file, ageMs: ageOf2(marker, deps.now ?? new Date), checkout };
+  } catch {
+    return null;
+  }
+};
+var claimLiveSession = (target, owner, deps = {}) => {
+  try {
+    const checkout = checkoutOf(target);
+    if (!checkout)
+      return;
+    const file = markerFile2(checkout);
+    const now = deps.now ?? new Date;
+    const machine = deps.machine ?? os6.hostname();
+    const current = readMarker(file);
+    if (current) {
+      const age = ageOf2(current, now);
+      if (sameLead(current, owner) && age >= 0 && age < HEARTBEAT_EVERY_MS)
+        return;
+      if (!sameLead(current, owner) && isLive(current, deps) && !sameOwner(current, owner, machine))
+        return;
+    }
+    const pid = owner.pid();
+    const marker = {
+      version: 1,
+      session: owner.session,
+      leads: owner.leads,
+      host: owner.host,
+      pid,
+      pidStart: pid === null ? null : liveProbe.start(pid),
+      machine,
+      checkout,
+      heartbeatAt: now.toISOString()
+    };
+    fs18.mkdirSync(path26.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    fs18.writeFileSync(temp, JSON.stringify(marker));
+    fs18.renameSync(temp, file);
+  } catch {}
+};
+
+// packages/workit-core/src/hooks/write-gate.ts
 var NONE3 = { kind: "none" };
 var CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
 var canonical2 = (file) => {
   let rest = "";
-  for (let dir = path26.resolve(file);; dir = path26.dirname(dir)) {
+  for (let dir = path27.resolve(file);; dir = path27.dirname(dir)) {
     try {
-      return path26.join(realpathSync6(dir), rest);
+      return path27.join(realpathSync6(dir), rest);
     } catch {
-      if (path26.dirname(dir) === dir)
-        return path26.resolve(file);
-      rest = rest ? path26.join(path26.basename(dir), rest) : path26.basename(dir);
+      if (path27.dirname(dir) === dir)
+        return path27.resolve(file);
+      rest = rest ? path27.join(path27.basename(dir), rest) : path27.basename(dir);
     }
   }
 };
 var exempt = (cwd, root, file, plans) => {
   const fold = (value) => CASE_INSENSITIVE ? value.toLowerCase() : value;
-  const relative = path26.relative(fold(canonical2(root)), fold(canonical2(path26.resolve(cwd, file))));
-  if (relative.startsWith("..") || path26.isAbsolute(relative))
+  const relative = path27.relative(fold(canonical2(root)), fold(canonical2(path27.resolve(cwd, file))));
+  if (relative.startsWith("..") || path27.isAbsolute(relative))
     return true;
-  const posix = relative.split(path26.sep).join("/");
+  const posix = relative.split(path27.sep).join("/");
   const segments = posix.split("/");
   return /\.mdx?$/i.test(posix) || segments[0] === "docs" || segments.includes("plans") || [...plans].some((plan) => fold(plan) === posix);
 };
@@ -21802,7 +22033,7 @@ var shellWrites = (command) => {
   return { writes: true, targets: unknown ? null : targets };
 };
 var cache2 = new Map;
-var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path26.resolve(root, file)) ?? "-").join("\x00");
+var planKeyOf = (root, plans) => [...plans].map((file) => fileSignature(path27.resolve(root, file)) ?? "-").join("\x00");
 var gateFor = (cwd) => {
   const store = new TaskStore(cwd);
   const listed = store.listTaskIndex();
@@ -21840,7 +22071,218 @@ var gateFor = (cwd) => {
     cache2.delete(cache2.keys().next().value);
   return gate;
 };
-function writeGate(cwd, paths) {
+var MUTATING_GIT = new Set([
+  "add",
+  "am",
+  "apply",
+  "checkout",
+  "cherry-pick",
+  "clean",
+  "commit",
+  "merge",
+  "mv",
+  "pull",
+  "rebase",
+  "reset",
+  "restore",
+  "revert",
+  "rm",
+  "stash",
+  "switch"
+]);
+var DRY_N = new Set(["add", "clean", "rm", "mv"]);
+var MUTATING_WORKIT_GIT = new Set(["commit", "branch"]);
+var DIR_TARGET = ".workit-live-target";
+var OVERRIDE = "WORKIT_LIVE_SESSION=override";
+var inert = (args, sub) => args.some((arg) => arg === "--help" || arg === "-h" || arg === "--dry-run" || DRY_N.has(sub) && /^-[a-zA-Z]*n[a-zA-Z]*$/.test(arg) && !arg.startsWith("--"));
+var gitMutationDirs = (cwd, command, dialect) => {
+  let invocations;
+  try {
+    invocations = rawInvocations(command, dialect);
+  } catch {
+    return [];
+  }
+  return invocations.flatMap((invocation) => {
+    if (invocation.tool !== "git" || invocation.dir === undefined)
+      return [];
+    const at = invocation.args.findIndex((arg) => !arg.startsWith("-"));
+    const sub = invocation.args[at] ?? "";
+    const rest = invocation.args.slice(at + 1);
+    if (!MUTATING_GIT.has(sub) || inert(rest, sub))
+      return [];
+    if (sub === "stash" && ["list", "show"].includes(rest[0] ?? ""))
+      return [];
+    return [path27.resolve(cwd, invocation.dir ?? ".")];
+  });
+};
+var CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
+var PUSHD2 = new Set(["pushd", "push-location"]);
+var POPD2 = new Set(["popd", "pop-location"]);
+var cdInto = (dir, words) => {
+  const target = words.slice(1).find((word) => !word.startsWith("-") || word === "-");
+  if (dir === undefined || target === "-" || target && /^~|[$`*?]/.test(target))
+    return;
+  return target === undefined ? os7.homedir() : path27.resolve(dir, target);
+};
+var quoteWord = (word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
+var segmentTargets = (cwd, command, dialect) => {
+  const targets = [];
+  let dir = cwd;
+  let stack = [];
+  const groups = [];
+  const at = (file) => path27.isAbsolute(file) ? file : dir === undefined ? null : path27.resolve(dir, file);
+  for (const segment of segmentsOf(command, dialect)) {
+    if (segment.group === "open") {
+      groups.push({ dir, stack: [...stack] });
+      continue;
+    }
+    if (segment.group === "close") {
+      const saved = groups.pop();
+      if (saved)
+        ({ dir, stack } = saved);
+      continue;
+    }
+    const lead = segment.words.findIndex((word) => !/^\w+=/.test(word));
+    const words = lead < 0 ? [] : segment.words.slice(lead);
+    const name = (words[0]?.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+    if (CD2.has(name)) {
+      dir = cdInto(dir, words);
+      continue;
+    }
+    if (PUSHD2.has(name)) {
+      stack.push(dir);
+      dir = cdInto(dir, words);
+      continue;
+    }
+    if (POPD2.has(name)) {
+      dir = stack.length ? stack.pop() : undefined;
+      continue;
+    }
+    for (const file of segment.redirects)
+      if (!/^\/dev\/(?:null|stdout|stderr|tty)$/.test(file)) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(resolved);
+      }
+    const edits = editsOf(segment.words);
+    if (edits === null) {
+      if (dir !== undefined)
+        targets.push(path27.join(dir, DIR_TARGET));
+    } else
+      for (const file of edits) {
+        const resolved = at(file);
+        if (resolved)
+          targets.push(resolved);
+      }
+    if (dir !== undefined && workitInvocations(segment.words.map(quoteWord).join(" "), "posix").some((args) => args[0] === "git" && MUTATING_WORKIT_GIT.has(args[1] ?? "") && !inert(args.slice(2), "")))
+      targets.push(path27.join(dir, DIR_TARGET));
+  }
+  return targets;
+};
+var overridden = (command, dialect) => {
+  const segments = segmentsOf(command, dialect);
+  if (segments.length !== 1 || segments[0].group || segments[0].subs?.length)
+    return false;
+  const words = segments[0].words;
+  const lead = words.findIndex((word) => !/^\w+=/.test(word));
+  return lead > 0 && words.slice(0, lead).includes(OVERRIDE);
+};
+var HOST_LABELS = {
+  claude_code: "Claude Code",
+  opencode: "OpenCode",
+  codex_cli: "Codex CLI",
+  codex_desktop: "Codex Desktop",
+  cursor: "Cursor",
+  pi: "Pi"
+};
+var ageText = (ms) => {
+  const seconds = Math.max(0, Math.round(ms / 1000));
+  return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)} min`;
+};
+var liveDeny = ({ marker, checkout, ageMs, file }) => {
+  const unblock = `Work in your own worktree (\`git worktree add <path> -b <branch>\`, or \`workit fanout worktree create <slice>\`). Only if the user confirms that session is finished: release it with \`rm '${file}'\`, or prefix one command with ${OVERRIDE}.`;
+  return {
+    kind: "deny",
+    reason: `workit live-session guard: ${checkout} belongs to another live agent session, ${HOST_LABELS[marker.host] ?? marker.host} session ${marker.session}${marker.pid === null ? "" : ` (pid ${marker.pid})`}, last active ${ageText(ageMs)} ago. Do not edit a checkout another session is working in; read-only commands stay allowed. ${unblock}`,
+    unblock
+  };
+};
+var guarded = (targets) => {
+  const seen = new Set;
+  return targets.filter((target) => {
+    const dir = path27.dirname(target);
+    if (seen.has(dir))
+      return false;
+    seen.add(dir);
+    return true;
+  });
+};
+var liveGate = (owner, targets, deps) => {
+  try {
+    for (const target of guarded(targets)) {
+      const conflict = liveConflict(target, owner, deps);
+      if (conflict && workspaceLiveSessionGuard(conflict.checkout))
+        return liveDeny(conflict);
+    }
+  } catch {}
+  return NONE3;
+};
+var claimAll = (owner, targets, deps) => {
+  for (const target of guarded(targets))
+    claimLiveSession(target, owner, deps);
+};
+var liveTargets = (cwd, paths) => paths?.length ? paths.map((file) => path27.resolve(cwd, file)) : [path27.join(cwd, DIR_TARGET)];
+function writeGate(cwd, paths, owner, deps) {
+  if (!owner)
+    return beforeWriteGate(cwd, paths);
+  const targets = liveTargets(cwd, paths);
+  const live = liveGate(owner, targets, deps);
+  if (live.kind !== "none")
+    return live;
+  const decision = beforeWriteGate(cwd, paths);
+  if (decision.kind === "none")
+    claimAll(owner, targets, deps);
+  return decision;
+}
+function shellGate(cwd, command, owner, dialect = "posix", deps) {
+  const writes = shellWrites(command);
+  let targets = [];
+  if (owner) {
+    try {
+      targets = [
+        ...segmentTargets(cwd, command, dialect),
+        ...gitMutationDirs(cwd, command, dialect).map((dir) => path27.join(dir, DIR_TARGET))
+      ];
+    } catch {
+      targets = [];
+    }
+  }
+  if (owner && targets.length) {
+    const live = liveGate(owner, targets, deps);
+    if (live.kind !== "none") {
+      if (!overridden(command, dialect))
+        return live;
+      noteOverride(cwd, owner, command);
+    }
+  }
+  const decision = writes.writes ? beforeWriteGate(cwd, writes.targets) : NONE3;
+  if (owner && targets.length && decision.kind === "none")
+    claimAll(owner, targets, deps);
+  return decision;
+}
+var noteOverride = (cwd, owner, command) => {
+  try {
+    if (!inWorkitWorkspace(cwd))
+      return;
+    appendHookObserved(cwd, {
+      type: "live_session.override",
+      actor: { host: owner.host, session: owner.session, agentId: null },
+      session: owner.session,
+      command: command.slice(0, 200)
+    });
+  } catch {}
+};
+function beforeWriteGate(cwd, paths) {
   try {
     const gate = gateFor(cwd);
     if (!gate || gate.blockers.length === 0)
@@ -21858,7 +22300,7 @@ function writeGate(cwd, paths) {
   }
 }
 // packages/workit-core/src/hooks/stop.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 var NONE4 = { kind: "none" };
 var QUESTION = /[?？؟](?=[\s*_`"')\]>]*(?:\s|$))|¿/;
 var OFFER = /\b(?:let me know|want me to|should I|shall I|would you like|do you want|if you(?:'d| would) like|may I|can I go ahead)\b/i;
@@ -21879,7 +22321,7 @@ var asksUser = (message) => {
 };
 var short = (sha) => (sha ?? "?").slice(0, 12);
 var gitList = (cwd, args) => {
-  const run = spawnSync17("git", args, {
+  const run = spawnSync18("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 3000,
@@ -22341,11 +22783,11 @@ var OPENCODE_DESCRIPTOR = {
   ]
 };
 // packages/workit-opencode/src/shared/init-apply.ts
-import path31 from "node:path";
+import path32 from "node:path";
 
 // packages/workit-core/src/core/gitignore.ts
 import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 var GITIGNORE_ENTRIES = [
   "# workit: SDD working state (never commit)",
   "docs/*/sdd/",
@@ -22365,7 +22807,7 @@ var GITIGNORE_ENTRIES = [
 var ensureProjectGitignore = (workspaceRoot, confirmed) => {
   if (!confirmed)
     return { ok: false, error: "confirmed: true required" };
-  const file = path27.join(workspaceRoot, ".gitignore");
+  const file = path28.join(workspaceRoot, ".gitignore");
   const existing = existsSync9(file) ? readFileSync6(file, "utf8") : "";
   const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
@@ -22393,25 +22835,25 @@ var ensureProjectGitignore = (workspaceRoot, confirmed) => {
 
 // packages/workit-core/src/core/hygiene.ts
 import { existsSync as existsSync10, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 var repoRoot3 = assetRoot();
-var templatesDir = () => path28.join(repoRoot3, "templates", "hygiene");
+var templatesDir = () => path29.join(repoRoot3, "templates", "hygiene");
 var packageJson = (root) => {
-  if (!existsSync10(path28.join(root, "package.json")))
+  if (!existsSync10(path29.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync7(path28.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync7(path29.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
 };
 var isOpenSource = (root) => {
-  if (existsSync10(path28.join(root, "LICENSE")))
+  if (existsSync10(path29.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
     return true;
-  return path28.basename(root) === "workflow-toolkit";
+  return path29.basename(root) === "workflow-toolkit";
 };
 var licenseHolder = (root) => {
   const pkg = packageJson(root);
@@ -22434,13 +22876,13 @@ var planHygieneFiles = (root, opts = {}) => {
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync10(path28.join(root, file)))
+    if (existsSync10(path29.join(root, file)))
       continue;
-    const tpl = path28.join(templatesDir(), file);
+    const tpl = path29.join(templatesDir(), file);
     if (!existsSync10(tpl))
       continue;
-    const content = readFileSync7(tpl, "utf8").replace(/<PROJECT>/g, path28.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path28.join(root, file), content });
+    const content = readFileSync7(tpl, "utf8").replace(/<PROJECT>/g, path29.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path29.join(root, file), content });
   }
   return planned;
 };
@@ -22450,19 +22892,19 @@ var ensureHygieneFiles = (root, opts) => {
   const created = [];
   for (const planned of planHygieneFiles(root, opts)) {
     writeFileSync5(planned.path, planned.content, "utf8");
-    created.push(path28.basename(planned.path));
+    created.push(path29.basename(planned.path));
   }
   return { ok: true, created };
 };
 
 // packages/workit-core/src/core/init.ts
-import fs18 from "node:fs";
-import path30 from "node:path";
-import { spawnSync as spawnSync18 } from "node:child_process";
+import fs19 from "node:fs";
+import path31 from "node:path";
+import { spawnSync as spawnSync19 } from "node:child_process";
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 import { isDeepStrictEqual } from "node:util";
 var readFileSafe = (p) => {
   try {
@@ -22473,7 +22915,7 @@ var readFileSafe = (p) => {
 };
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path29.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path30.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const {
     status,
     path: wsPath,
@@ -22485,7 +22927,7 @@ function applyWorkspaceBranchPolicy(opts) {
   if (status === "malformed" || status === "invalid")
     return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path29.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path30.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -22534,7 +22976,7 @@ function applyWorkspaceBranchPolicy(opts) {
       ok: false,
       error: `workspaces.json changed while applying the branch policy: ${wsPath}`
     };
-  mkdirSync4(path29.dirname(wsPath), { recursive: true });
+  mkdirSync4(path30.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
     writeFileSync6(tmp, JSON.stringify({ ...document, workspaces: next }, null, 2) + `
@@ -22569,7 +23011,7 @@ function applyWorkspaceBranchPolicy(opts) {
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE";
 var readJson = (p) => {
   try {
-    const parsed = JSON.parse(fs18.readFileSync(p, "utf8"));
+    const parsed = JSON.parse(fs19.readFileSync(p, "utf8"));
     return isConfigObject(parsed) ? parsed : null;
   } catch {
     return null;
@@ -22581,7 +23023,7 @@ var resolveInitProvider = (cwd) => {
     return env.toLowerCase();
   const root = cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
   try {
-    const out = spawnSync18("git", ["remote", "get-url", "origin"], {
+    const out = spawnSync19("git", ["remote", "get-url", "origin"], {
       cwd: root,
       encoding: "utf8"
     });
@@ -22599,7 +23041,7 @@ var youtrackJsonContent = (dir) => {
   const meetingIssue = process.env.WORKFLOW_YT_MEETING_ISSUE;
   return {
     baseUrl: process.env.WORKFLOW_YT_BASE_URL ?? "https://youtrack.example.com",
-    tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path30.join(dir, "youtrack.token"),
+    tokenFile: process.env.WORKFLOW_YT_TOKEN_FILE ?? path31.join(dir, "youtrack.token"),
     ...meetingIssue ? {
       meetingIssue,
       meetingIssues: { general: { issue: meetingIssue, label: "General meetings" } }
@@ -22629,19 +23071,19 @@ var vcsJsonContent = () => {
 };
 function initApplyData(action, env = process.env) {
   const dir = String(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
-  fs18.mkdirSync(dir, { recursive: true });
+  fs19.mkdirSync(dir, { recursive: true });
   switch (action) {
     case "youtrack_json": {
-      const out = path30.join(dir, "youtrack.json");
-      fs18.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
+      const out = path31.join(dir, "youtrack.json");
+      fs19.writeFileSync(out, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       return { action, ok: true, path: out };
     }
     case "youtrack_token_placeholder": {
-      const p = path30.join(dir, "youtrack.token");
+      const p = path31.join(dir, "youtrack.token");
       const preserved = writeFileExclusive(p, TOKEN_PLACEHOLDER2 + `
 `, 384) === "preserved";
-      const abs = path30.resolve(p);
+      const abs = path31.resolve(p);
       return {
         action,
         ok: true,
@@ -22653,14 +23095,14 @@ function initApplyData(action, env = process.env) {
       };
     }
     case "youtrack_scaffold": {
-      const jsonOut = path30.join(dir, "youtrack.json");
-      const tokenOut = path30.join(dir, "youtrack.token");
-      fs18.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
+      const jsonOut = path31.join(dir, "youtrack.json");
+      const tokenOut = path31.join(dir, "youtrack.token");
+      fs19.writeFileSync(jsonOut, JSON.stringify(youtrackJsonContent(dir), null, 2) + `
 `, "utf8");
       const preserved = writeFileExclusive(tokenOut, TOKEN_PLACEHOLDER2 + `
 `, 384) === "preserved";
-      const configPath = path30.resolve(jsonOut);
-      const tokenPath = path30.resolve(tokenOut);
+      const configPath = path31.resolve(jsonOut);
+      const tokenPath = path31.resolve(tokenOut);
       const prev = process.env.WORKFLOW_YOUTRACK_CONFIG;
       process.env.WORKFLOW_YOUTRACK_CONFIG = configPath;
       let tokenCreate = {};
@@ -22712,10 +23154,10 @@ function initApplyData(action, env = process.env) {
       }
     }
     case "vcs_scaffold": {
-      const jsonOut = path30.join(dir, "vcs.json");
-      fs18.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(), null, 2) + `
+      const jsonOut = path31.join(dir, "vcs.json");
+      fs19.writeFileSync(jsonOut, JSON.stringify(vcsJsonContent(), null, 2) + `
 `, "utf8");
-      const configPath = path30.resolve(jsonOut);
+      const configPath = path31.resolve(jsonOut);
       const prev = process.env.WORKFLOW_VCS_CONFIG;
       process.env.WORKFLOW_VCS_CONFIG = configPath;
       try {
@@ -22834,7 +23276,7 @@ var executeInitApply = (args, directory, runtime) => {
       protectedNames: args.branch_policy_protected
     }, current);
     writeConfig(next);
-    return output(ok({ action: "config", path: path31.join(configDir(), "config.json"), ...next }));
+    return output(ok({ action: "config", path: path32.join(configDir(), "config.json"), ...next }));
   }
   const env = Object.fromEntries(Object.entries({
     WORKFLOW_YT_BASE_URL: args.base_url,
@@ -22851,14 +23293,14 @@ var executeInitApply = (args, directory, runtime) => {
 
 // packages/workit-opencode/src/shared/session.ts
 import { realpathSync as realpathSync7 } from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 var sameWorkspace = (expected, observed) => {
   if (typeof observed !== "string" || !observed)
     return false;
   try {
     return realpathSync7(expected) === realpathSync7(observed);
   } catch {
-    return path32.resolve(expected) === path32.resolve(observed);
+    return path33.resolve(expected) === path33.resolve(observed);
   }
 };
 
@@ -22930,7 +23372,7 @@ var workitFamilyOf = (toolName) => {
 
 // packages/workit-opencode/src/tools/context.ts
 import { realpathSync as realpathSync8 } from "node:fs";
-import path33 from "node:path";
+import path34 from "node:path";
 var createContextTool = () => ({
   description: "Read Git, pull request, YouTrack, issue, changelog, release, or affected-file context.",
   execute: async (args, context) => {
@@ -22940,7 +23382,7 @@ var createContextTool = () => ({
     let root;
     try {
       const cwd = parsed.data.cwd;
-      root = realpathSync8(cwd ? path33.resolve(context.directory, cwd) : context.directory);
+      root = realpathSync8(cwd ? path34.resolve(context.directory, cwd) : context.directory);
     } catch {
       return JSON.stringify(failure2("invalid_input", "context target directory cannot be resolved"), null, 2);
     }
@@ -23484,8 +23926,9 @@ var evaluateShellPermission = (root, event, workdirs = new Map) => {
     event.message = reason;
   };
   const resources = event.resources.filter((resource) => typeof resource === "string");
+  const owner = liveOwner({ host: "opencode", session: { id: event.sessionID ?? "", parentId: null } }, "in-process-plugin");
   if (WRITE_ACTIONS.has(event.action)) {
-    const decision = writeGate(root, resources);
+    const decision = writeGate(root, resources, owner);
     if (decision.kind === "deny")
       deny(decision.reason);
     return;
@@ -23507,9 +23950,8 @@ var evaluateShellPermission = (root, event, workdirs = new Map) => {
     }, resource, { nudge: false });
     if (raw.kind === "deny")
       return deny(raw.reason);
-    const writes = shellWrites(resource);
-    const gated = writes.writes ? writeGate(root, writes.targets) : null;
-    if (gated?.kind === "deny")
+    const gated = shellGate(cwd, resource, owner);
+    if (gated.kind === "deny")
       return deny(gated.reason);
   }
 };
@@ -23533,7 +23975,7 @@ var childTaskMissing = (store, input) => {
 var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
 
 // packages/workit-opencode/src/v2/shell.ts
-import path34 from "node:path";
+import path35 from "node:path";
 var commandOf = (input) => {
   if (input === null || typeof input !== "object")
     return null;
@@ -23542,7 +23984,7 @@ var commandOf = (input) => {
 };
 var hookInput = (root, sessionID, id, shell) => ({
   host: "opencode",
-  cwd: shell.workdir ? path34.resolve(root, shell.workdir) : root,
+  cwd: shell.workdir ? path35.resolve(root, shell.workdir) : root,
   session: { id: sessionID, agentId: null, agentType: null, parentId: null },
   permissionMode: null,
   transcriptPath: null,
@@ -23727,37 +24169,37 @@ var createStopControl = (root, port) => {
 
 // packages/workit-opencode/src/v2/registry.ts
 import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import path36 from "node:path";
+import path37 from "node:path";
 
 // packages/workit-opencode/src/shared/assets.ts
 import { existsSync as existsSync11, realpathSync as realpathSync9 } from "node:fs";
-import path35 from "node:path";
+import path36 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir = () => {
   try {
-    return realpathSync9(path35.dirname(fileURLToPath2(import.meta.url)));
+    return realpathSync9(path36.dirname(fileURLToPath2(import.meta.url)));
   } catch {
-    return path35.dirname(fileURLToPath2(import.meta.url));
+    return path36.dirname(fileURLToPath2(import.meta.url));
   }
 };
 var packageRoot2 = () => {
   const dir = moduleDir();
   for (const candidate of [
-    path35.resolve(dir, ".."),
-    path35.resolve(dir, "..", ".."),
-    path35.resolve(dir, "..", "..", "..")
+    path36.resolve(dir, ".."),
+    path36.resolve(dir, "..", ".."),
+    path36.resolve(dir, "..", "..", "..")
   ]) {
-    if (existsSync11(path35.join(candidate, "package.json")))
+    if (existsSync11(path36.join(candidate, "package.json")))
       return candidate;
   }
-  return path35.resolve(dir, "..");
+  return path36.resolve(dir, "..");
 };
 var skillsRoot = () => {
   const root = packageRoot2();
-  const canonical = path35.resolve(root, "..", "workit-core", "skills");
-  if (existsSync11(path35.join(root, "src")) && existsSync11(canonical))
+  const canonical = path36.resolve(root, "..", "workit-core", "skills");
+  if (existsSync11(path36.join(root, "src")) && existsSync11(canonical))
     return canonical;
-  return path35.join(root, "assets", "skills");
+  return path36.join(root, "assets", "skills");
 };
 
 // packages/workit-opencode/src/v2/registry.ts
@@ -23784,11 +24226,11 @@ var registerSkills = async (ctx) => {
   if (!existsSync12(skillsDir))
     return new Set;
   const listed = await ctx.skill.list().catch(() => ({ data: [] }));
-  const own = (skill) => typeof skill.path === "string" && path36.resolve(skill.path).startsWith(skillsDir + path36.sep);
+  const own = (skill) => typeof skill.path === "string" && path37.resolve(skill.path).startsWith(skillsDir + path37.sep);
   const userSkills = new Set((listed?.data ?? []).filter((skill) => !own(skill)).map((skill) => skill.id));
   const packaged = new Map;
   for (const id of WORKIT_METHOD_SKILLS) {
-    const file = path36.join(skillsDir, id, "SKILL.md");
+    const file = path37.join(skillsDir, id, "SKILL.md");
     if (!userSkills.has(id) && existsSync12(file))
       packaged.set(id, file);
   }
@@ -23836,22 +24278,22 @@ var registerCommands = async (ctx, registeredSkills) => {
 
 // packages/workit-opencode/src/stale-sources.ts
 import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
-import path37 from "node:path";
+import path38 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var typescriptFiles = (directory) => {
   if (!existsSync13(directory))
     return [];
   return readdirSync6(directory, { withFileTypes: true }).flatMap((entry) => {
-    const file = path37.join(directory, entry.name);
+    const file = path38.join(directory, entry.name);
     return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
   });
 };
 var pluginSourceFiles = [
   ...new Set([
     fileURLToPath3(import.meta.url),
-    ...typescriptFiles(path37.join(packageRoot2(), "src")),
-    path37.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
-    ...typescriptFiles(path37.join(packageRoot2(), "..", "workit-core", "src", "core"))
+    ...typescriptFiles(path38.join(packageRoot2(), "src")),
+    path38.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path38.join(packageRoot2(), "..", "workit-core", "src", "core"))
   ])
 ].filter((file) => existsSync13(file)).toSorted();
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "8.13.1",
+  "version": "8.14.0",
   "private": false,
   "description": "Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills",
   "keywords": [
@@ -39,7 +39,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.13.1",
+    "@brainervirus/workit-core": "^8.14.0",
     "@opencode/plugin": "2.0.18"
   },
   "engines": {