@brainervirus/workit-opencode 8.15.0 → 8.16.0

package/dist/plugin.js

@@ -12384,6 +12384,7 @@ class TaskStore {
 var UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 var isUncertainWorker = (state) => UNCERTAIN_WORKER_STATES.includes(state);
 var workerBlocksTransition = (transition, state) => transition === "pause" ? false : isUncertainWorker(state);
+var holdsLiveState = (state, dirty) => state === "running" || dirty === true;
 
 // packages/workit-core/src/core/task-evaluation.ts
 import { createHash as createHash10 } from "node:crypto";
@@ -12630,6 +12631,36 @@ var line = (run) => {
   return value ? value : null;
 };
 var safeArg = (value) => value.length > 0 && !value.startsWith("-");
+var UNPARSEABLE = "<unparseable remote>";
+function redactRemote(raw) {
+  const value = raw.trim();
+  if (!value)
+    return UNPARSEABLE;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*::/u.test(value))
+    return UNPARSEABLE;
+  if (/^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("/") || value.startsWith("."))
+    return value;
+  if (!/[:@]/u.test(value))
+    return value;
+  if (!value.includes("://")) {
+    if (/^[^/@]*:[^/]*@/u.test(value))
+      return UNPARSEABLE;
+    const scp = /^(?:([^@\s/:]+)@)?([^:/\s]+):([^?#]+)/u.exec(value);
+    return scp ? `${scp[1] ? `${scp[1]}@` : ""}${scp[2]}:${scp[3]}` : UNPARSEABLE;
+  }
+  try {
+    const url = new URL(value);
+    const ssh = /^(?:ssh|git\+ssh|ssh\+git):$/u.test(url.protocol);
+    url.password = "";
+    if (!ssh)
+      url.username = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return UNPARSEABLE;
+  }
+}
 function headSha(cwd) {
   return line(git2(cwd, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]));
 }
@@ -12776,6 +12807,52 @@ function pushRemoteName(cwd, branch) {
     return "origin";
   return remotes.length === 1 ? remotes[0] : null;
 }
+function pushUrl(cwd, remote) {
+  if (!safeArg(remote))
+    return null;
+  const urls = git2(cwd, ["remote", "get-url", "--push", "--all", remote]).stdout.split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+}
+var cleanPath = (value) => value.replace(/^\/+/u, "").replace(/\/+$/u, "").replace(/\.git$/u, "");
+function parseRemoteUrl(raw) {
+  const value = raw.trim();
+  if (!value || /^[A-Za-z][A-Za-z0-9+.-]*::/u.test(value))
+    return null;
+  if (/^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("/") || value.startsWith(".")) {
+    return { protocol: "file", user: null, host: "", port: null, path: value };
+  }
+  if (!value.includes("://")) {
+    if (/^[^/@]*:[^/]*@/u.test(value))
+      return null;
+    const scp = /^(?:([^@\s/:]+)@)?([^:/\s]+):(.+)$/u.exec(value);
+    if (!scp)
+      return null;
+    return {
+      protocol: "ssh",
+      user: scp[1] ?? null,
+      host: scp[2],
+      port: null,
+      path: cleanPath(scp[3])
+    };
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  const scheme = url.protocol.replace(/:$/u, "");
+  const protocol = scheme === "ssh" || scheme === "git+ssh" || scheme === "ssh+git" ? "ssh" : scheme === "https" || scheme === "http" || scheme === "git" || scheme === "file" ? scheme : null;
+  if (!protocol)
+    return null;
+  return {
+    protocol,
+    user: protocol === "ssh" && url.username ? decodeURIComponent(url.username) : null,
+    host: url.hostname.replace(/\.$/u, ""),
+    port: url.port || null,
+    path: cleanPath(decodeURIComponent(url.pathname))
+  };
+}
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
@@ -16009,6 +16086,54 @@ function evaluateClosure(requestedOutcome, view) {
     requirementIds: evaluations.map((item) => item.requirementId)
   });
 }
+var BRIEF_TEXT = 250;
+var BRIEF_BLOCKERS = 3;
+var BRIEF_OPEN = 8;
+var clip = (value) => {
+  const fits = (text) => Buffer.byteLength(JSON.stringify(text)) <= BRIEF_TEXT;
+  if (fits(value))
+    return value;
+  let length = Math.min(value.length, BRIEF_TEXT);
+  while (length > 0 && !fits(`${value.slice(0, length)}…`))
+    length -= 1;
+  return `${value.slice(0, length)}…`;
+};
+function boundTaskSummary(summary) {
+  const rules = new Map((summary.policy?.requirements ?? []).map((item) => [item.id, item]));
+  const unmet = summary.requirements.filter((item) => item.status === "unsatisfied" || item.status === "unavailable");
+  const { progress, closure } = summary;
+  const next = progress.nextAction;
+  const open = unmet.slice(0, BRIEF_OPEN).map((item) => ({
+    dimension: rules.get(item.requirementId)?.dimension ?? "verification",
+    before: rules.get(item.requirementId)?.before ?? "close",
+    status: item.status
+  }));
+  const brief = {
+    id: summary.id,
+    revision: summary.revision,
+    workspaceRevision: summary.workspaceRevision,
+    updatedAt: summary.updatedAt,
+    objective: clip(summary.objective),
+    status: summary.status,
+    closure: closure && {
+      outcome: closure.outcome,
+      at: closure.at,
+      summary: clip(closure.summary)
+    },
+    progress: {
+      summary: clip(progress.summary),
+      nextAction: next && clip(next),
+      blockers: progress.blockers.slice(0, BRIEF_BLOCKERS).map((item) => ({
+        reason: clip(item.reason),
+        dependentAction: clip(item.dependentAction)
+      }))
+    },
+    requirements: { total: summary.requirements.length, unmet: unmet.length, open },
+    truncated: false
+  };
+  brief.truncated = JSON.stringify(brief).includes("…") || progress.blockers.length > BRIEF_BLOCKERS || unmet.length > BRIEF_OPEN;
+  return brief;
+}
 
 // packages/workit-core/src/core/methods.ts
 var METHODS = {
@@ -16502,6 +16627,15 @@ var releaseBranchesOf = (cwd) => {
   }
 };
 var releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase());
+var policy = (root) => resolveBranchPolicyFor(root);
+var isProtected = (root, name) => policy(root).protected.has(name.toLowerCase());
+var isProtectedTarget = (root, name) => {
+  try {
+    return isProtected(root, name);
+  } catch {
+    return true;
+  }
+};
 
 // packages/workit-core/src/hooks/session-marker.ts
 import { createHash as createHash12 } from "node:crypto";
@@ -17951,7 +18085,7 @@ var rewrittenUrl = (url, config) => {
   }
   return url;
 };
-var pushUrl = (config, remote, dir) => {
+var pushUrl2 = (config, remote, dir) => {
   const configured = configValue(config, `remote.${remote}.pushurl`) ?? configValue(config, `remote.${remote}.url`);
   return normalizedUrl(rewrittenUrl(configured ?? remote, config), dir);
 };
@@ -17979,7 +18113,7 @@ var toPushRemote = (repo, remote, config) => {
   const pushRemote = pushRemoteOf(config, repo.branch);
   if (pushRemote === null || pushRemote === remote)
     return true;
-  return pushUrl(config, remote, repo.dir) === pushUrl(config, pushRemote, repo.dir);
+  return pushUrl2(config, remote, repo.dir) === pushUrl2(config, pushRemote, repo.dir);
 };
 var quote = (text) => `\`${text}\``;
 var refusal = (action, branch, dir) => {
@@ -19428,6 +19562,15 @@ class WorkitCore {
     if (!parsed.ok)
       return parsed;
     const input = parsed.data;
+    if (this.context.readOnlyChild) {
+      if (input.action !== "inspect")
+        return failure2("permission_denied", "child sessions can only inspect the task summary");
+      const task = this.store.readTask(input.taskId);
+      if (!task.ok)
+        return task;
+      const summary = this.summary(task.data);
+      return summary.ok ? { ...summary, data: boundTaskSummary(summary.data) } : summary;
+    }
     if ((this.context.workerId ?? null) !== null) {
       if (input.action !== "inspect" && input.action !== "list")
         return failure2("permission_denied", "helpers cannot control task lifecycle or scope");
@@ -21011,6 +21154,7 @@ import { spawnSync as spawnSync15 } from "node:child_process";
 import fs16 from "node:fs";
 import path22 from "node:path";
 import { spawnSync as spawnSync14 } from "node:child_process";
+import { pathToFileURL } from "node:url";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
@@ -21044,6 +21188,39 @@ var pushRemote = (cwd) => {
   const urls = (result.stdout ?? "").split(/\r?\n/u).map((url) => url.trim()).filter(Boolean);
   return urls.length === 1 ? urls[0] : null;
 };
+var safePushUrl = (remote) => {
+  const raw = remote.trim();
+  if (path22.isAbsolute(raw))
+    return pathToFileURL(raw).href;
+  if (!raw.includes("://")) {
+    const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
+    if (scp)
+      return `${scp[1] || "git"}@${scp[2]}:${scp[3]}`;
+  }
+  try {
+    const url = new URL(raw);
+    if (!["file:", "git:", "http:", "https:", "ssh:"].includes(url.protocol))
+      return null;
+    url.password = "";
+    if (url.protocol !== "ssh:")
+      url.username = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+};
+var pushTargetIsStable = (cwd, remote) => {
+  const target = safePushUrl(remote);
+  if (!target)
+    return false;
+  const result = spawnSync14("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  if (result.status !== 0 && result.status !== 1)
+    return false;
+  const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
+  return !prefixes.some((prefix) => target.startsWith(prefix));
+};
 
 // packages/workit-core/src/core/tracker-issues.ts
 var repoPathFromRemote = (remote) => {
@@ -23496,10 +23673,494 @@ var workerCoordinatorFor = (task, worker) => {
   return coordinator?.kind === "host" && coordinator.host === "opencode" ? coordinator.handle : null;
 };
 
+// packages/workit-core/src/fanout.ts
+import { createHash as createHash16 } from "node:crypto";
+import fs21 from "node:fs";
+import path37 from "node:path";
+
+// packages/workit-core/src/stack.ts
+import { spawnSync as spawnSync21 } from "node:child_process";
+import { createHash as createHash15, randomBytes as randomBytes4 } from "node:crypto";
+import fs20 from "node:fs";
+import path36 from "node:path";
+
+// packages/workit-core/src/git/ops.ts
+import { spawnSync as spawnSync20 } from "node:child_process";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
+import path35 from "node:path";
+
+// packages/workit-core/src/forge/redact.ts
+var KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
+var ASSIGNMENT2 = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
+var QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
+var ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
+
+// packages/workit-core/src/forge/types.ts
+var success2 = (data) => ({ ok: true, data });
+var failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
+
+// packages/workit-core/src/git/ops.ts
+var COMMIT_TIMEOUT_MS = 10 * 60000;
+var git5 = (cwd, args, options = {}) => {
+  const result = spawnSync20("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
+  });
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? ""
+  };
+};
+function operationInProgress(cwd) {
+  const markers = [
+    ["rebase-merge", "rebase"],
+    ["rebase-apply", "rebase"],
+    ["MERGE_HEAD", "merge"],
+    ["CHERRY_PICK_HEAD", "cherry-pick"],
+    ["REVERT_HEAD", "revert"]
+  ];
+  const run = git5(cwd, ["rev-parse", ...markers.flatMap(([name]) => ["--git-path", name])]);
+  if (!run.ok)
+    return null;
+  const found = run.stdout.split(`
+`).map((line) => path35.resolve(cwd, line.trim()));
+  const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
+  for (const [index, [, operation]] of markers.entries()) {
+    const marker = found[index];
+    if (!marker || !existsSync11(marker))
+      continue;
+    if (index === 1 && existsSync11(path35.join(marker, "applying")))
+      return { operation: "am", commitAllowed: false, branch: null };
+    if (index === 0 && existsSync11(path35.join(marker, "amend")) && !conflicted()) {
+      let headName = "";
+      try {
+        headName = readFileSync9(path35.join(marker, "head-name"), "utf8").trim();
+      } catch {}
+      const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
+      return { operation, commitAllowed: branch !== null, branch };
+    }
+    if ((operation === "revert" || operation === "merge") && !conflicted())
+      return { operation, commitAllowed: true, branch: null };
+    return { operation, commitAllowed: false, branch: null };
+  }
+  return null;
+}
+function inProgressFailure(operation, verb) {
+  const command = operation === "am" ? "git am" : `git ${operation}`;
+  return failure3("blocked", `${operation.replace("-", "_")}_in_progress: a ${operation === "am" ? "git am" : operation} is in progress; finish or abort it before workit can ${verb}`, `resolve the conflicts, git add <files>, then ${command} --continue  # or ${command} --abort to return to where you started`);
+}
+function pushPreflight(cwd, options = {}) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
+  const branch = options.branch ?? currentBranch(cwd);
+  if (!branch)
+    return failure3("invalid_input", "HEAD is detached; push a branch");
+  if (isProtectedTarget(cwd, branch))
+    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit git push never pushes to it`, releaseBranch(cwd, branch) ? `workit git push --release ${branch}  # finishing a release or hotfix; needs the release grant` : "workit git branch <feature/name>  # push a feature branch and open a PR");
+  const sha = resolveRef(cwd, `refs/heads/${branch}`);
+  if (!sha)
+    return failure3("not_found", `branch ${branch} has no commit to push`);
+  const remote = pushRemoteName(cwd, branch);
+  if (!remote)
+    return failure3("not_found", "no push remote is configured for this branch", "git remote add origin <url>");
+  const raw = pushUrl(cwd, remote);
+  if (!raw)
+    return failure3("blocked", `remote "${remote}" has no single push URL`, `git remote get-url --push --all ${remote}  # keep exactly one push URL`);
+  const parsed = parseRemoteUrl(raw);
+  const local = parsed?.protocol === "file";
+  if (!local && !pushTargetIsStable(cwd, raw))
+    return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
+  return success2({
+    branch,
+    sha,
+    remote,
+    url: redactRemote(raw),
+    rawUrl: raw,
+    local
+  });
+}
+
+// packages/workit-core/src/forge/report.ts
+var GITLAB_MERGEABLE = new Set(["mergeable"]);
+var GITHUB_MERGEABLE = new Set(["clean", "unstable", "has_hooks"]);
+
+// packages/workit-core/src/stack.ts
+var stackFail = (code, error, unblock, data) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {},
+  ...data ? { data } : {}
+});
+var stackDeps = {
+  pushPlan: (cwd, branch) => pushPreflight(cwd, { branch }),
+  adapter: { name: "git", restack: (cwd, input) => gitRestack(cwd, input) },
+  rebaseTimeoutMs: Number(process.env.WORKIT_STACK_REBASE_TIMEOUT_MS) || 10 * 60000
+};
+var gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
+  const run = spawnSync21("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_EDITOR: "true",
+      GIT_SEQUENCE_EDITOR: "true",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  const failure = run.error;
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: run.error ? String(run.error.message) : run.stderr ?? "",
+    timedOut: failure?.code === "ETIMEDOUT"
+  };
+};
+var branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`);
+function worktreeOf(cwd, branch) {
+  const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
+  if (!list.ok)
+    return null;
+  let current = null;
+  for (const line of list.stdout.split(`
+`)) {
+    if (line.startsWith("worktree "))
+      current = line.slice("worktree ".length);
+    else if (line === `branch refs/heads/${branch}` && current)
+      return current;
+    else if (line === "detached" && current && rebasingBranch2(current) === `refs/heads/${branch}`)
+      return current;
+  }
+  return null;
+}
+function rebasingBranch2(dir) {
+  for (const name of ["rebase-merge/head-name", "rebase-apply/head-name"]) {
+    const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
+    if (!found.ok)
+      continue;
+    try {
+      return fs20.readFileSync(found.stdout.trim(), "utf8").trim();
+    } catch {}
+  }
+  return null;
+}
+function rebaseInProgress(dir) {
+  for (const name of ["rebase-merge", "rebase-apply"]) {
+    const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
+    if (found.ok && fs20.existsSync(found.stdout.trim()))
+      return true;
+  }
+  return false;
+}
+var scratchDir = (cwd) => {
+  const dir = stacksDir(cwd);
+  return dir.ok ? path36.join(dir.data, "worktrees") : null;
+};
+function gitRestack(cwd, input) {
+  const owner = worktreeOf(cwd, input.branch);
+  let dir = owner;
+  if (!dir) {
+    const scratch = scratchDir(cwd);
+    if (!scratch)
+      return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
+    fs20.mkdirSync(scratch, { recursive: true });
+    dir = path36.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
+    if (!added.ok)
+      return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
+  }
+  const run = gitRun3(dir, [
+    "-c",
+    "rebase.autoStash=false",
+    "-c",
+    "rebase.updateRefs=false",
+    "rebase",
+    "--no-autosquash",
+    "--onto",
+    input.onto,
+    input.from
+  ], stackDeps.rebaseTimeoutMs);
+  if (!run.ok) {
+    if (run.timedOut)
+      return {
+        ok: false,
+        conflict: false,
+        timedOut: true,
+        worktree: dir,
+        error: `git rebase did not finish within ${stackDeps.rebaseTimeoutMs} ms`
+      };
+    if (rebaseInProgress(dir))
+      return { ok: false, conflict: true, worktree: dir, error: firstLine(run) };
+    if (!owner)
+      gitRun3(cwd, ["worktree", "remove", "--force", dir]);
+    return { ok: false, conflict: false, worktree: dir, error: firstLine(run) };
+  }
+  if (!owner)
+    gitRun3(cwd, ["worktree", "remove", "--force", dir]);
+  const head = branchTip(cwd, input.branch);
+  return head ? { ok: true, head } : { ok: false, conflict: false, worktree: dir, error: `${input.branch} vanished` };
+}
+var firstLine = (run) => (`${run.stderr}
+${run.stdout}`.split(`
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300);
+var stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`;
+function stacksDir(cwd) {
+  const root = storeRoot(cwd);
+  if (!root.ok)
+    return stackFail(root.code, root.error, root.unblock);
+  return { ok: true, data: path36.join(root.value.root, "stacks") };
+}
+var HEARTBEAT_STALE_MS = 2 * 60000;
+
+// packages/workit-core/src/fanout.ts
+var FANOUT_VERSION = 1;
+var TIERS = ["mundane", "standard", "hard"];
+var fanoutFail = (code, error, unblock, data) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {},
+  ...data ? { data } : {}
+});
+var compiled = new Map;
+function normalizePattern(raw) {
+  let pattern = raw.trim();
+  if (pattern.includes("\\")) {
+    if (/\\[*?{}]/u.test(pattern))
+      return {
+        error: "has \\*, \\?, \\{ or \\}: only \\[ and \\] are escapes; use / as the separator (src/**/*.ts)"
+      };
+    const brackets = /\\[[\]]/u.test(pattern);
+    if (brackets && pattern.replace(/\\[[\]]/gu, "").includes("\\"))
+      return {
+        error: "mixes \\[ or \\] escapes with other backslashes, which is ambiguous: use / as the separator (app/\\[id\\]/page.tsx)"
+      };
+    if (!brackets)
+      pattern = pattern.replaceAll("\\", "/");
+  }
+  while (pattern.startsWith("./"))
+    pattern = pattern.slice(2);
+  if (pattern === "." || pattern === "")
+    pattern = raw.trim() ? "**" : "";
+  if (pattern.endsWith("/"))
+    pattern = `${pattern}**`;
+  if (!pattern)
+    return { error: "is empty" };
+  if (pattern.startsWith("/") || /^[A-Za-z]:/u.test(pattern))
+    return { error: "must be relative to the repository root" };
+  if (pattern.split("/").includes(".."))
+    return { error: "must not contain .." };
+  const bare = pattern.replace(/\\./gu, "");
+  if (/[[\]]/u.test(bare))
+    return {
+      error: 'has an unescaped [ or ]: write \\[ and \\] for literal brackets (app/\\[id\\]/page.tsx; in JSON "app/\\\\[id\\\\]/page.tsx")'
+    };
+  if (bare.startsWith("!"))
+    return { error: "uses ! (negation is not supported)" };
+  let depth = 0;
+  for (const char of bare) {
+    if (char === "{")
+      depth += 1;
+    if (char === "}")
+      depth -= 1;
+    if (depth < 0 || depth > 1)
+      return { error: "has unbalanced or nested braces" };
+  }
+  if (depth !== 0)
+    return { error: "has unbalanced or nested braces" };
+  return { pattern };
+}
+var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function findCycle(slices) {
+  const byId = new Map(slices.map((slice) => [slice.id, slice]));
+  const state = new Map;
+  const trail = [];
+  const visit = (id) => {
+    if (state.get(id) === "done")
+      return null;
+    if (state.get(id) === "open")
+      return [...trail.slice(trail.indexOf(id)), id];
+    state.set(id, "open");
+    trail.push(id);
+    for (const dep of byId.get(id)?.dependsOn ?? []) {
+      if (!byId.has(dep) || dep === id)
+        continue;
+      const found = visit(dep);
+      if (found)
+        return found;
+    }
+    trail.pop();
+    state.set(id, "done");
+    return null;
+  };
+  for (const slice of slices) {
+    const found = visit(slice.id);
+    if (found)
+      return found;
+  }
+  return null;
+}
+function sliceHash(slice) {
+  const {
+    worktree: _worktree,
+    hash: _hash,
+    hashSince: _since,
+    tier: _tier,
+    timebox: _timebox,
+    context: _context,
+    issues: _issues,
+    ...definition
+  } = slice;
+  return createHash16("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+}
+function fanoutsDir(cwd) {
+  const root = storeRoot(cwd);
+  if (!root.ok)
+    return fanoutFail(root.code, root.error, root.unblock);
+  return { ok: true, data: path37.join(root.value.root, "fanouts") };
+}
+function parseStored(raw) {
+  if (!isRecord5(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
+    return null;
+  if (!Array.isArray(raw.slices))
+    return null;
+  const list = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+  const text = (value) => typeof value === "string" ? value : "";
+  let globsValid = true;
+  const globs = (value) => list(value).map((entry) => {
+    const normalized = normalizePattern(entry);
+    if ("error" in normalized) {
+      globsValid = false;
+      return entry;
+    }
+    return normalized.pattern;
+  });
+  const slices = [];
+  for (const item of raw.slices) {
+    if (!isRecord5(item) || typeof item.id !== "string" || typeof item.branch !== "string")
+      return null;
+    slices.push({
+      id: item.id,
+      branch: item.branch,
+      base: text(item.base) || raw.trunk,
+      worktree: text(item.worktree),
+      tier: TIERS.includes(item.tier) ? item.tier : "standard",
+      dependsOn: list(item.dependsOn),
+      scope: globs(item.scope),
+      owns: globs(item.owns),
+      goal: text(item.goal),
+      acceptance: list(item.acceptance),
+      verify: list(item.verify),
+      forbidden: list(item.forbidden),
+      context: typeof item.context === "string" ? item.context : null,
+      timebox: typeof item.timebox === "string" ? item.timebox : null,
+      issues: list(item.issues),
+      hash: text(item.hash),
+      hashSince: text(item.hashSince) || text(raw.createdAt)
+    });
+  }
+  for (const slice of slices)
+    slice.hash ||= sliceHash(slice);
+  const shared = globs(raw.shared);
+  const ids = new Set(slices.map((slice) => slice.id));
+  if (!globsValid || ids.size !== slices.length || slices.some((slice) => slice.dependsOn.some((dep) => dep === slice.id || !ids.has(dep))) || findCycle(slices))
+    return null;
+  const fanIn = raw.fanIn === "integration" ? "integration" : "prs";
+  const createdAt = text(raw.createdAt);
+  return {
+    v: typeof raw.v === "number" ? raw.v : FANOUT_VERSION,
+    name: raw.name,
+    trunk: raw.trunk,
+    fanIn,
+    shared,
+    slices,
+    leadSession: typeof raw.leadSession === "string" && raw.leadSession ? raw.leadSession : null,
+    formerLeads: list(raw.formerLeads),
+    createdAt,
+    updatedAt: text(raw.updatedAt)
+  };
+}
+function readFanout(cwd, name) {
+  const dir = fanoutsDir(cwd);
+  if (!dir.ok)
+    return dir;
+  const file = path37.join(dir.data, stackFileName(name));
+  let parsed = null;
+  try {
+    parsed = parseStored(JSON.parse(fs21.readFileSync(file, "utf8")));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { ok: true, data: null };
+    parsed = null;
+  }
+  return parsed ? { ok: true, data: parsed } : fanoutFail("failed", `fanout file ${file} is not a valid plan`, `workit fanout plan <plan.json> --name ${name}  # rewrite it`);
+}
+function listFanouts(cwd) {
+  const dir = fanoutsDir(cwd);
+  if (!dir.ok)
+    return dir;
+  let names = [];
+  try {
+    names = fs21.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
+  } catch {
+    return { ok: true, data: [] };
+  }
+  const out = [];
+  for (const entry of names) {
+    let parsed = null;
+    try {
+      parsed = parseStored(JSON.parse(fs21.readFileSync(path37.join(dir.data, entry), "utf8")));
+    } catch {
+      parsed = null;
+    }
+    if (parsed && stackFileName(parsed.name) === entry)
+      out.push(parsed);
+  }
+  return { ok: true, data: out.toSorted((a, b) => a.name.localeCompare(b.name)) };
+}
+function selectFanout(cwd, name, current) {
+  if (name) {
+    const read = readFanout(cwd, name);
+    if (!read.ok)
+      return read;
+    return read.data ? { ok: true, data: read.data } : fanoutFail("not_found", `no fanout plan named ${name}`, "workit fanout plan <plan.json>");
+  }
+  const all = listFanouts(cwd);
+  if (!all.ok)
+    return all;
+  const holding = all.data.filter((plan) => plan.slices.some((slice) => slice.branch === current));
+  if (holding.length === 1)
+    return { ok: true, data: holding[0] };
+  if (all.data.length === 1)
+    return { ok: true, data: all.data[0] };
+  return all.data.length === 0 ? fanoutFail("not_found", "no fanout plan is recorded here", "workit fanout plan <plan.json>") : fanoutFail("invalid_input", `several fanout plans match; pick one (${all.data.map((plan) => plan.name).join(", ")})`, "pass --name <plan>");
+}
+
 // packages/workit-opencode/src/v2/lifecycle.ts
 var record2 = (value) => typeof value === "object" && value !== null ? value : {};
 var sessionIDOf = (value) => typeof value === "string" && value.length > 0 ? value : null;
 var parentOf = (session) => typeof session?.parentID === "string" && session.parentID ? session.parentID : undefined;
+var resumeBriefCommand = (root, directory) => {
+  const branch = directory ? currentBranch(directory) : null;
+  const plan = branch ? selectFanout(root, null, branch) : null;
+  const slice = branch && plan?.ok ? plan.data.slices.find((entry) => entry.branch === branch || branch.startsWith(`${entry.branch}-try`) && /^\d+$/u.test(branch.slice(entry.branch.length + 4))) : undefined;
+  return `workit fanout brief ${slice?.id ?? "<slice>"} --mode resume`;
+};
 var contentText = (content) => {
   if (typeof content === "string")
     return content;
@@ -23755,8 +24416,12 @@ var createV2Lifecycle = (deps) => {
         throw new Error("delegation_lineage_denied: a continuation sessionID must name an existing direct child of the coordinator");
       const listed = new TaskStore(root).listTasks();
       const bound = listed.ok ? listed.data.filter((task) => task.workers.some((worker) => worker.data.state === "running" && worker.data.session?.kind === "host" && worker.data.session.handle === childID && workerCoordinatorFor(task, worker) === coordinator)).length : 0;
-      if (bound !== 1 && ownsActiveTask(coordinator))
-        throw new Error("delegation_lineage_denied: a continuation sessionID must name a running Workit worker");
+      if (bound !== 1 && ownsActiveTask(coordinator)) {
+        const reported = listed.ok && listed.data.some((task) => task.workers.some((worker) => worker.data.state === "stopped" && worker.data.session?.kind === "host" && worker.data.session.handle === childID && workerCoordinatorFor(task, worker) === coordinator));
+        const dirty = reported && child.directory ? worktreeTree(child.directory)?.dirty ?? null : null;
+        if (!reported || !holdsLiveState("stopped", dirty))
+          throw new Error(reported ? `delegation_lineage_denied: this worker already reported and holds no live state (no running process, no uncommitted changes); continue the slice with a fresh worker: ${resumeBriefCommand(root, child.directory)}` : "delegation_lineage_denied: a continuation sessionID must name a running Workit worker");
+      }
       return;
     }
     if (!ownsActiveTask(coordinator)) {
@@ -24051,16 +24716,17 @@ var childMayRecord = (family, input) => {
   const action = fields(input).action;
   return family !== null && typeof action === "string" && CHILD_RECORDS[family]?.has(action) === true;
 };
+var childMayInspect = (family, input) => family === "task" && fields(input).action === "inspect";
 var childTaskMissing = (store, input) => {
   if (fields(input).taskId !== undefined)
     return false;
   const report = store.keyReport();
   return !report.ok || report.data.bound.length === 0;
 };
-var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
+var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only inspect the task summary (workit_task action "inspect") or record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
 
 // packages/workit-opencode/src/v2/shell.ts
-import path35 from "node:path";
+import path38 from "node:path";
 var commandOf = (input) => {
   if (input === null || typeof input !== "object")
     return null;
@@ -24069,7 +24735,7 @@ var commandOf = (input) => {
 };
 var hookInput = (root, sessionID, id, shell) => ({
   host: "opencode",
-  cwd: shell.workdir ? path35.resolve(root, shell.workdir) : root,
+  cwd: shell.workdir ? path38.resolve(root, shell.workdir) : root,
   session: { id: sessionID, agentId: null, agentType: null, parentId: null },
   permissionMode: null,
   transcriptPath: null,
@@ -24253,38 +24919,38 @@ var createStopControl = (root, port) => {
 };
 
 // packages/workit-opencode/src/v2/registry.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import path37 from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import path40 from "node:path";
 
 // packages/workit-opencode/src/shared/assets.ts
-import { existsSync as existsSync11, realpathSync as realpathSync9 } from "node:fs";
-import path36 from "node:path";
+import { existsSync as existsSync12, realpathSync as realpathSync9 } from "node:fs";
+import path39 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var moduleDir = () => {
   try {
-    return realpathSync9(path36.dirname(fileURLToPath2(import.meta.url)));
+    return realpathSync9(path39.dirname(fileURLToPath2(import.meta.url)));
   } catch {
-    return path36.dirname(fileURLToPath2(import.meta.url));
+    return path39.dirname(fileURLToPath2(import.meta.url));
   }
 };
 var packageRoot2 = () => {
   const dir = moduleDir();
   for (const candidate of [
-    path36.resolve(dir, ".."),
-    path36.resolve(dir, "..", ".."),
-    path36.resolve(dir, "..", "..", "..")
+    path39.resolve(dir, ".."),
+    path39.resolve(dir, "..", ".."),
+    path39.resolve(dir, "..", "..", "..")
   ]) {
-    if (existsSync11(path36.join(candidate, "package.json")))
+    if (existsSync12(path39.join(candidate, "package.json")))
       return candidate;
   }
-  return path36.resolve(dir, "..");
+  return path39.resolve(dir, "..");
 };
 var skillsRoot = () => {
   const root = packageRoot2();
-  const canonical = path36.resolve(root, "..", "workit-core", "skills");
-  if (existsSync11(path36.join(root, "src")) && existsSync11(canonical))
+  const canonical = path39.resolve(root, "..", "workit-core", "skills");
+  if (existsSync12(path39.join(root, "src")) && existsSync12(canonical))
     return canonical;
-  return path36.join(root, "assets", "skills");
+  return path39.join(root, "assets", "skills");
 };
 
 // packages/workit-opencode/src/v2/registry.ts
@@ -24308,15 +24974,15 @@ var parseFrontmatter = (markdown) => {
 };
 var registerSkills = async (ctx) => {
   const skillsDir = skillsRoot();
-  if (!existsSync12(skillsDir))
+  if (!existsSync13(skillsDir))
     return new Set;
   const listed = await ctx.skill.list().catch(() => ({ data: [] }));
-  const own = (skill) => typeof skill.path === "string" && path37.resolve(skill.path).startsWith(skillsDir + path37.sep);
+  const own = (skill) => typeof skill.path === "string" && path40.resolve(skill.path).startsWith(skillsDir + path40.sep);
   const userSkills = new Set((listed?.data ?? []).filter((skill) => !own(skill)).map((skill) => skill.id));
   const packaged = new Map;
   for (const id of WORKIT_METHOD_SKILLS) {
-    const file = path37.join(skillsDir, id, "SKILL.md");
-    if (!userSkills.has(id) && existsSync12(file))
+    const file = path40.join(skillsDir, id, "SKILL.md");
+    if (!userSkills.has(id) && existsSync13(file))
       packaged.set(id, file);
   }
   await ctx.skill.transform((editor) => {
@@ -24324,7 +24990,7 @@ var registerSkills = async (ctx) => {
     for (const [id, file] of packaged) {
       if (existing.has(id))
         continue;
-      const parsed = parseFrontmatter(readFileSync9(file, "utf8"));
+      const parsed = parseFrontmatter(readFileSync10(file, "utf8"));
       editor.add({
         id,
         name: parsed.name || id,
@@ -24362,25 +25028,25 @@ var registerCommands = async (ctx, registeredSkills) => {
 };
 
 // packages/workit-opencode/src/stale-sources.ts
-import { existsSync as existsSync13, readdirSync as readdirSync6 } from "node:fs";
-import path38 from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync6 } from "node:fs";
+import path41 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var typescriptFiles = (directory) => {
-  if (!existsSync13(directory))
+  if (!existsSync14(directory))
     return [];
   return readdirSync6(directory, { withFileTypes: true }).flatMap((entry) => {
-    const file = path38.join(directory, entry.name);
+    const file = path41.join(directory, entry.name);
     return entry.isDirectory() ? typescriptFiles(file) : entry.isFile() && file.endsWith(".ts") ? [file] : [];
   });
 };
 var pluginSourceFiles = [
   ...new Set([
     fileURLToPath3(import.meta.url),
-    ...typescriptFiles(path38.join(packageRoot2(), "src")),
-    path38.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
-    ...typescriptFiles(path38.join(packageRoot2(), "..", "workit-core", "src", "core"))
+    ...typescriptFiles(path41.join(packageRoot2(), "src")),
+    path41.join(packageRoot2(), "..", "workit-core", "src", "core.ts"),
+    ...typescriptFiles(path41.join(packageRoot2(), "..", "workit-core", "src", "core"))
   ])
-].filter((file) => existsSync13(file)).toSorted();
+].filter((file) => existsSync14(file)).toSorted();
 
 // packages/workit-opencode/src/v2/plugin.ts
 var sessionFacts = async (ctx, sessionID) => {
@@ -24433,7 +25099,7 @@ var setup = async (ctx) => {
     }
   });
   const contextTool = createContextTool();
-  const runFamily = (family, input, session, store, workerId) => {
+  const runFamily = (family, input, session, store, workerId, readOnlyChild = false) => {
     const parsed = parseAdvertisedOperation(family, input, "opencode");
     if (!parsed.ok)
       return parsed;
@@ -24444,6 +25110,7 @@ var setup = async (ctx) => {
       constraints: [],
       now: () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
       workerId,
+      ...readOnlyChild ? { readOnlyChild } : {},
       nativeWorker: nativeWorkerFor(lifecycle.directChildren, session.id)
     });
     const run = core[family];
@@ -24471,8 +25138,11 @@ var setup = async (ctx) => {
             const identity = childSessionId(session.parentID, session.id);
             const lead = await sessionFacts(ctx, session.parentID);
             const directChild = lead !== null && lead.parentID === undefined && sameWorkspace(root, lead.directory);
-            if (!directChild || family === null || !childMayRecord(family, input))
+            const inspecting = childMayInspect(family, input);
+            if (!directChild || family === null || !(inspecting || childMayRecord(family, input)))
               return resultContent(failure2("permission_denied", childDenial(identity)));
+            if (inspecting)
+              return resultContent(runFamily(family, input, { ...session, id: identity }, store, null, true));
             if (childTaskMissing(store, input))
               return resultContent(failure2("not_found", "no task for this branch yet: the lead starts one (workit_task start) before a child records on it, or pass taskId"));
             return resultContent(runFamily(family, input, { ...session, id: identity }, store, null));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "8.15.0",
+  "version": "8.16.0",
   "private": false,
   "description": "Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills",
   "keywords": [
@@ -39,7 +39,7 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.15.0",
+    "@brainervirus/workit-core": "^8.16.0",
     "@opencode/plugin": "2.0.18"
   },
   "engines": {