@brainervirus/workit-opencode 8.9.0 → 8.10.0

package/assets/skills/workit-fanout/references/brief.md

@@ -25,7 +25,7 @@ REPORT: branch, head SHA, files changed, each VERIFY command with its exit code,
   each ACCEPTANCE line met / not met, rulings you made (`workit ledger ruling`),
   anything out of scope as a follow-up, not a diff.
 STANDING: <the standing orders, verbatim: `workit ledger standing add` records each one>
-  export WORKIT_SESSION_ID=<lead>-w<n>   (set by the lead; a verifier brief gets <lead>-v<n>)
+  export WORKIT_SESSION_ID=<lead>-w<n>   (set by the lead for a worker's commits; a verifier brief sets none: the host derives it)
 ```
 
 ## Worked example

package/assets/skills/workit-fanout/references/orchestration.md

@@ -72,12 +72,22 @@ Which session id a verdict carries, per host:
 
 - Claude Code: subagents inherit your `WORKIT_SESSION_ID`, so the
   SubagentStart hook names each `verifier` and `reviewer` its own session
-  (`<lead>:<agent id>`), passed as `--session`; that one wins over any
-  `<lead>-v<n>` in a brief. An `implementer` uses the session its brief
-  exports for its workit commands.
-- Other hosts: the session the brief sets wins: `export
-  WORKIT_SESSION_ID=<lead>-w-<slice>` from `workit fanout brief` for a
-  worker, `<lead>-v<n>` (or `--as verifier`) for a verifier you start.
+  (`<lead>:<agent id>`), passed exactly as `--session`: the hook records the
+  ids it issues, and only those are accepted. An `implementer` uses the
+  session its brief exports for its workit commands.
+- Codex: the `workit-verifier` and `workit-reviewer` agents get the same
+  issued `--session` from SubagentStart; any other verifier passes
+  `--as verifier`.
+- OpenCode: a child session's shell already has
+  `WORKIT_SESSION_ID=<lead>:<child>`; Pi: a supervised worker's shell has
+  `<lead>:<worker session>`. Set nothing for a verifier there.
+- Cursor (no session id in the shell): the brief sets the verifier's
+  `WORKIT_SESSION_ID=<lead>:verifier-<random hex>`, a fresh suffix per
+  verifier. Cursor cannot check it: it is declared, not derived.
+- A worker's commits use `export WORKIT_SESSION_ID=<lead>-w-<slice>` from
+  `workit fanout brief`. A verdict under an id you made up (`<lead>-v1`,
+  `<lead>:v1`) is refused as `forged_session` on Claude Code, Codex,
+  OpenCode and Pi.
 
 A batch verifier takes several slices on one surface in one session: for
 each branch it checks out the head, runs that slice's VERIFY, and records its

package/assets/skills/workit-implement/SKILL.md

@@ -33,8 +33,9 @@ description: Build a requested change in small verified steps - follow local pat
    `workit ledger verdict tests-verified --self --how "<what you ran>"`; it
    reads self-reviewed, never verified. High risk, a workspace with
    `verification: independent` (`workit grant show`) or a verified merge needs
-   a fresh verifier with its own session (`WORKIT_SESSION_ID=<yours>-v1`;
-   Claude Code: the `verifier` agent). Before saying done, reconcile
+   a fresh verifier with its own host-derived session (Claude Code and Codex:
+   the `verifier` agent; OpenCode: a child session; Pi: a supervised worker),
+   never a hand-minted id. Before saying done, reconcile
    every named deliverable against the target checkout and observe it (for a push:
    `workit verify-delivery push`).
 

package/assets/skills/workit-review/SKILL.md

@@ -7,8 +7,10 @@ description: Independent review of a diff, branch or PR - intent fidelity and st
 
 Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
-review to a fresh agent with its own session (`WORKIT_SESSION_ID=<lead>-v<n>`;
-Claude Code: the `reviewer` or `verifier` agent).
+review to a fresh agent with its own host-derived session: Claude Code and
+Codex, the `reviewer` or `verifier` agent (`--session` from SubagentStart);
+OpenCode, a child session; Pi, a supervised worker. Never hand-mint one such
+as `<lead>-v1`: it is refused as `forged_session`.
 An author's `--self` verdict reads self-reviewed and never counts as
 independent; `type-check-only` never proves a behavior change.
 

package/dist/plugin.js

@@ -9597,64 +9597,11 @@ function acquireFileLockSync(targetPath, options) {
     }
   }
 }
-// packages/workit-core/src/host-session.ts
-var HOST_SESSION_VARS = [
-  ["OPENCODE_SESSION_ID", () => "opencode"],
-  ["PI_SESSION_ID", () => "pi"],
-  [
-    "CODEX_THREAD_ID",
-    (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
-  ]
-];
-var family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
-function hostSessionFromEnv(env) {
-  const value = (key) => env[key]?.trim() || null;
-  let inner = null;
-  for (const [key, host] of HOST_SESSION_VARS) {
-    const session = value(key);
-    if (session) {
-      inner = { host: host(env), session };
-      break;
-    }
-  }
-  const declared = value("WORKIT_HOST");
-  if (env.WORKIT_SESSION_ID !== undefined) {
-    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
-    if (!inherited)
-      return { host: declared, session: value("WORKIT_SESSION_ID") };
-  }
-  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
-}
-
-// packages/workit-core/src/core/package-root.ts
-import { existsSync } from "node:fs";
-import path3 from "node:path";
-import { fileURLToPath } from "node:url";
-var packageRoot = () => {
-  let dir = path3.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const parent = path3.dirname(dir);
-    if (existsSync(path3.join(dir, "package.json")) || parent === dir)
-      return dir;
-    dir = parent;
-  }
-};
-var assetRoot = () => {
-  const root = packageRoot();
-  const assets = path3.join(root, "assets");
-  return existsSync(assets) ? assets : root;
-};
-
-// packages/workit-core/src/core/store-lock.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import fs5 from "node:fs";
-import { hostname } from "node:os";
-
 // packages/workit-core/src/store/paths.ts
 import { spawnSync } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import fs4 from "node:fs";
-import path4 from "node:path";
+import path3 from "node:path";
 var NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
 var gitRun = (cwd, args) => {
   const run = spawnSync("git", args, {
@@ -9696,14 +9643,14 @@ var DISCOVERY_ENV = [
 ];
 var isGitDir = (dir) => {
   try {
-    return fs4.statSync(path4.join(dir, "HEAD")).isFile() && fs4.statSync(path4.join(dir, "objects")).isDirectory() && fs4.statSync(path4.join(dir, "refs")).isDirectory();
+    return fs4.statSync(path3.join(dir, "HEAD")).isFile() && fs4.statSync(path3.join(dir, "objects")).isDirectory() && fs4.statSync(path3.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 };
 var reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs4.readFileSync(path4.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs4.readFileSync(path3.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
@@ -9723,7 +9670,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path4.join(dir, ".git");
+    const dotGit = path3.join(dir, ".git");
     let entry = null;
     try {
       entry = fs4.statSync(dotGit);
@@ -9744,19 +9691,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path4.resolve(dir, match[1].trim());
+        gitDir = path3.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs4.existsSync(path4.join(gitDir, "HEAD")))
+      if (!fs4.existsSync(path3.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path4.resolve(gitDir, fs4.readFileSync(path4.join(gitDir, "commondir"), "utf8").trim());
+        common = path3.resolve(gitDir, fs4.readFileSync(path3.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs4.existsSync(path4.join(common, "objects")))
+      if (!fs4.existsSync(path3.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -9766,26 +9713,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path4.dirname(dir);
+    const parent = path3.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path4.resolve(root);
+  root = path3.resolve(root);
   let directory = false;
   try {
     directory = fs4.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path4.join(fast.common, "workit"),
+      dir: path3.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -9795,20 +9742,20 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path4.join(real(path4.resolve(root, common)), "workit"),
+      dir: path3.join(real(path3.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path3.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
 var rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs4.readFileSync(path4.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs4.readFileSync(path3.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -9823,7 +9770,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs4.readFileSync(path4.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs4.readFileSync(path3.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -9854,7 +9801,7 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path4.resolve(root);
+  const resolved = path3.resolve(root);
   let canonical = resolved;
   try {
     canonical = fs4.realpathSync(resolved);
@@ -9885,13 +9832,13 @@ function branchRenames(location) {
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path4.join(dir, entry.name));
+        walk(path3.join(dir, entry.name));
       else
-        files.push(path4.join(dir, entry.name));
+        files.push(path3.join(dir, entry.name));
   };
-  walk(path4.join(path4.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path3.join(path3.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path4.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path3.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
@@ -9926,11 +9873,69 @@ var checkoutSlug = (root) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path4.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path3.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
 
+// packages/workit-core/src/host-session.ts
+var HOST_SESSION_VARS = [
+  ["OPENCODE_SESSION_ID", () => "opencode"],
+  ["PI_SESSION_ID", () => "pi"],
+  [
+    "CODEX_THREAD_ID",
+    (env) => env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE === "Codex Desktop" || env.CODEX_ELECTRON_RESOURCES_PATH ? "codex_desktop" : "codex_cli"
+  ]
+];
+var family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null;
+function hostSessionFromEnv(env) {
+  const value = (key) => env[key]?.trim() || null;
+  let inner = null;
+  for (const [key, host] of HOST_SESSION_VARS) {
+    const session = value(key);
+    if (session) {
+      inner = { host: host(env), session };
+      break;
+    }
+  }
+  const declared = value("WORKIT_HOST");
+  if (env.WORKIT_SESSION_ID !== undefined) {
+    const inherited = inner !== null && declared !== null && family(declared) !== family(inner.host);
+    if (!inherited)
+      return { host: declared, session: value("WORKIT_SESSION_ID") };
+  }
+  return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
+}
+var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
+var SESSION_UNSAFE = /[^A-Za-z0-9_.:@/+-]/g;
+function childSessionId(lead, child) {
+  const leaf = child.replace(SESSION_UNSAFE, "-").slice(-120);
+  const prefix = lead.replace(SESSION_UNSAFE, "-").slice(0, 127 - leaf.length);
+  return prefix ? `${prefix}:${leaf}` : leaf;
+}
+
+// packages/workit-core/src/core/package-root.ts
+import { existsSync } from "node:fs";
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+var packageRoot = () => {
+  let dir = path4.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const parent = path4.dirname(dir);
+    if (existsSync(path4.join(dir, "package.json")) || parent === dir)
+      return dir;
+    dir = parent;
+  }
+};
+var assetRoot = () => {
+  const root = packageRoot();
+  const assets = path4.join(root, "assets");
+  return existsSync(assets) ? assets : root;
+};
+
 // packages/workit-core/src/core/store-lock.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import fs5 from "node:fs";
+import { hostname } from "node:os";
 var metadataLockSchema = object({
   pid: number2().int().nonnegative().safe(),
   processStart: string2().nullable(),
@@ -10564,6 +10569,38 @@ var isNewerVersion = (candidate, current) => {
   return false;
 };
 var validId = (value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(value);
+var readText = (file) => {
+  try {
+    return fs7.readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+};
+var REFLOG_LINE = /^[0-9a-f]+ ([0-9a-f]+) .* (\d+) [+-]\d{4}\t(.*)$/u;
+var branchStart = (location, branch, aliases) => {
+  const first = readText(path6.join(path6.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+`, 1)[0];
+  const created = REFLOG_LINE.exec(first);
+  const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
+  if (!created || !start)
+    return null;
+  if (start !== "HEAD")
+    return start;
+  if (!location.git)
+    return null;
+  for (const line of readText(path6.join(location.git.gitDir, "logs", "HEAD")).split(`
+`)) {
+    const entry = REFLOG_LINE.exec(line);
+    const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
+    const seconds = entry ? Number(entry[2]) - Number(created[2]) : -1;
+    if (moved && entry[1] === created[1] && seconds >= 0 && seconds <= 1 && aliases.includes(moved[2]))
+      return moved[1];
+  }
+  return null;
+};
+var refExists = (common, ref) => fs7.existsSync(path6.join(common, ref)) || readText(path6.join(common, "packed-refs")).includes(` ${ref}
+`);
+var origins = new Map;
 var sameDirectoryIdentity = (left, right) => {
   if (!path6.isAbsolute(left) || !path6.isAbsolute(right))
     return false;
@@ -10816,6 +10853,66 @@ class TaskStore {
       return bound;
     return success(null, null, { key: key.data, bound: bound.data });
   }
+  taskForWorker(workerId) {
+    if (typeof workerId !== "string" || !validId(workerId))
+      return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
+    const listed = this.listTaskIndex();
+    if (!listed.ok)
+      return listed;
+    for (const entry of listed.data) {
+      if (entry.status === "closed")
+        continue;
+      const loaded = this.load(entry.id);
+      if (!loaded.ok)
+        return loaded;
+      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
+        return success(null, null, entry.id);
+    }
+    return success(null, null, null);
+  }
+  originTaskEntry() {
+    const key = this.currentKey();
+    const location = this.location();
+    const branch = key.ok ? key.data.branch : null;
+    if (!branch || !location.ok)
+      return success(null, null, null);
+    const common = path6.dirname(location.data.dir);
+    const heads = path6.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path6.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const signatures = [
+      path6.join(heads, branch),
+      headLog,
+      heads,
+      path6.join(common, "packed-refs")
+    ].map((file) => fileSignature(file) ?? "-");
+    const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
+    let resolved = origins.get(slot);
+    if (resolved?.signature !== signatures.join("|")) {
+      const renames = branchRenames(location.data);
+      const aliases = [branch];
+      for (const rename of renames.toReversed())
+        if (rename.to === aliases.at(-1))
+          aliases.push(rename.from);
+      const start = branchStart(location.data, branch, aliases);
+      const slash = start?.indexOf("/") ?? -1;
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path6.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const name = start && (remote ? start.slice(slash + 1) : start);
+      resolved = {
+        signature: signatures.join("|"),
+        name: name && !aliases.includes(name) ? name : null,
+        renames
+      };
+      origins.set(slot, resolved);
+    }
+    const entry = resolved.name ? this.openTasksForKey(resolved.name, resolved.renames) : null;
+    if (entry && !entry.ok)
+      return entry;
+    return success(null, null, entry?.data[0] ? { origin: `branch ${resolved.name}`, entry: entry.data[0] } : null);
+  }
+  readStoreTask(taskId) {
+    const loaded = this.load(taskId);
+    return loaded.ok ? success(null, null, loaded.data?.record ?? null) : loaded;
+  }
   create(input, provenance, expectedWorkspaceRevision) {
     const value = "intent" in input ? input : {
       intent: input,
@@ -11485,12 +11582,12 @@ class TaskStore {
       return 0;
     }
   }
-  openTasksForKey(key) {
+  openTasksForKey(key, known) {
     const all = this.listStoreIndex();
     if (!all.ok)
       return all;
-    const location = this.location();
-    const renames = location.ok ? branchRenames(location.data) : [];
+    const location = known ? null : this.location();
+    const renames = known ?? (location?.ok ? branchRenames(location.data) : []);
     return success(null, null, all.data.filter((entry) => entry.key !== null && entry.status !== "closed").filter((entry) => (renames.length ? followRenames(entry.key, entry.boundAt ?? entry.createdAt, renames) : entry.key) === key).toSorted(oldestFirst));
   }
   openTaskForKey(key) {
@@ -14509,11 +14606,20 @@ function authorSessions(cwd, rows, branch, range = { base: null, head: null }, s
     sessions.add(session);
   return sessions;
 }
+var derivesFrom = (derived, bare) => !bare.includes(":") && derived.endsWith(`:${bare}`);
+var authoredBy = (authors, session) => {
+  if (authors.has(session))
+    return true;
+  for (const author of authors)
+    if (derivesFrom(author, session) || derivesFrom(session, author))
+      return true;
+  return false;
+};
 var independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
     reasons.push("no_session");
-  else if (authors.has(row.actor.session))
+  else if (authoredBy(authors, row.actor.session))
     reasons.push("author_session");
   if (row.self === true && !reasons.includes("no_session"))
     reasons.push("self");
@@ -15594,7 +15700,8 @@ Autonomy contract:
   satisfies a gate; an ad-hoc \`workit check -- <cmd>\` never does.
 - Author is not verifier: your own verdict is \`--self\`, shown as
   self-reviewed, never verified. High risk, \`verification: independent\` and
-  merge need a verifier with its own session (\`WORKIT_SESSION_ID=<lead>-v<n>\`).
+  merge need a verifier with its own host-derived session (a subagent's
+  \`<lead>:<child>\`, set by the host); never hand-mint one such as \`<lead>-v1\`.
 - A local-commit endpoint does not imply PR readiness, and a local commit alone
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
@@ -15687,38 +15794,45 @@ var compactReference = (ref) => {
     };
   return { kind: ref.kind };
 };
-function compactTaskContext(view) {
-  const decisions = view.task.decisions.slice().toSorted((left, right) => {
-    const leftAt = compactTimestamp(left.recordedAt);
-    const rightAt = compactTimestamp(right.recordedAt);
-    if (leftAt !== rightAt)
-      return leftAt > rightAt ? -1 : 1;
-    return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
-  }).slice(0, COMPACT_MAX_ITEMS).map((entry) => ({
-    id: entry.id,
-    purpose: entry.data.purpose,
-    status: entry.data.response,
-    digest: entry.data.digest,
-    choice: compactDecisionChoice(entry) || `task.inspect taskId=${view.task.id} view=full; decision=${entry.id}`,
-    references: entry.data.binding.contentRefs.slice(0, 1).map(compactReference)
-  }));
-  const methods = view.task.policy ? selectMethods(view.task.policy, view.capabilities).map((method) => ({
+var newestDecisionFirst = (left, right) => {
+  const leftAt = compactTimestamp(left.recordedAt);
+  const rightAt = compactTimestamp(right.recordedAt);
+  if (leftAt !== rightAt)
+    return leftAt > rightAt ? -1 : 1;
+  return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+};
+var compactDecisions = (sources) => sources.flatMap((source) => source ? source.decisions.toSorted(newestDecisionFirst).map((entry) => ({
+  id: entry.id,
+  purpose: entry.data.purpose,
+  status: entry.data.response,
+  digest: entry.data.digest,
+  choice: compactDecisionChoice(entry) || `task.inspect taskId=${source.taskId} view=full; decision=${entry.id}`,
+  references: entry.data.binding.contentRefs.slice(0, 1).map(compactReference),
+  origin: source.origin ?? undefined
+})) : []).slice(0, COMPACT_MAX_ITEMS);
+function compactTaskContext(view, inherited = null) {
+  const decisions = compactDecisions([
+    view && { origin: null, taskId: view.task.id, decisions: view.task.decisions },
+    inherited
+  ]);
+  const methods = view?.task.policy ? selectMethods(view.task.policy, view.capabilities).map((method) => ({
     id: method.id,
     assurance: method.assurance,
     reason: compactText(method.reason, COMPACT_TEXT_BYTES) ?? ""
   })) : [];
+  const stale = view?.evidence.filter((entry) => entry.status === "stale").length;
   const gaps = Array.from(new Set([
-    ...view.evidence.filter((entry) => entry.status === "stale").map((entry) => `stale evidence: ${entry.evidenceId}`),
-    ...view.requirements.filter((entry) => entry.status !== "satisfied").map((entry) => entry.reason),
-    ...view.task.progress.blockers.map((entry) => entry.reason)
+    ...stale ? [`stale evidence: ${stale}; workit task inspect --task ${view.task.id} --view full`] : [],
+    ...(view?.requirements ?? []).filter((entry) => entry.status !== "satisfied").map((entry) => entry.reason),
+    ...(view?.task.progress.blockers ?? []).map((entry) => entry.reason)
   ])).toSorted().slice(0, COMPACT_MAX_ITEMS).map((gap) => compactText(gap, COMPACT_TEXT_BYTES));
   const context = {
-    objective: compactText(view.task.intent.data.objective, COMPACT_TEXT_BYTES) ?? "",
-    status: view.task.status,
+    objective: view ? compactText(view.task.intent.data.objective, COMPACT_TEXT_BYTES) ?? "" : "no task on this branch yet",
+    status: view?.task.status ?? null,
     decisions,
     methods,
     gaps,
-    nextAction: compactText(view.task.progress.nextAction, COMPACT_TEXT_BYTES)
+    nextAction: compactText(view?.task.progress.nextAction ?? null, COMPACT_TEXT_BYTES)
   };
   let encoded = JSON.stringify(context);
   while (compactBytes(encoded) > COMPACT_MAX_BYTES && (context.decisions.length || context.methods.length || context.gaps.length)) {
@@ -16461,6 +16575,13 @@ var TASK_SCOPED_ACTIONS = new Set([
   "worker.cancel",
   "state.export"
 ]);
+var WORKER_ADDRESSED_ACTIONS = new Set(["worker.cancel", "worker.report"]);
+var workerCommand = (taskId, request) => {
+  const { action, workerId, reason, report } = request;
+  const rest = JSON.stringify({ reason, report });
+  const payload = rest === "{}" ? "" : ` --payload '${rest.replace(/'/gu, "'\\''")}'`;
+  return `workit worker ${String(action)} ${String(workerId)} --task ${taskId}${payload}`;
+};
 var CREATING_ACTIONS = new Set([
   "task.revise",
   "task.progress",
@@ -16711,6 +16832,17 @@ class WorkitCore {
     const root = this.contextRootError();
     if (!root.ok)
       return root;
+    const addressed = WORKER_ADDRESSED_ACTIONS.has(action);
+    const workerId = addressed ? value.workerId : this.context.workerId ?? null;
+    if (workerId !== null) {
+      const owner = this.store.taskForWorker(workerId);
+      if (!owner.ok)
+        return owner;
+      if (owner.data)
+        return success(null, null, { ...request, taskId: owner.data });
+      if (addressed)
+        return failure2("not_found", `worker ${workerId} is on no open task; find its task with \`workit task status --all\`, then run \`${workerCommand("<task-id>", request)}\``);
+    }
     const create = CREATING_ACTIONS.has(action) && (this.context.workerId ?? null) === null;
     const found = this.store.implicitTask({
       provenance: provenance(this.context),
@@ -17417,7 +17549,9 @@ class WorkitCore {
     if (!resolved.ok)
       return resolved;
     const value = resolved.data;
-    return this.retryOmittedRevisions(value, () => this.workerOnce(value));
+    const result = this.retryOmittedRevisions(value, () => this.workerOnce(value));
+    const { action, taskId } = value ?? {};
+    return result.ok || request?.taskId !== undefined || typeof taskId !== "string" || !WORKER_ADDRESSED_ACTIONS.has(`worker.${String(action)}`) ? result : { ...result, error: `${result.error}; run \`${workerCommand(taskId, value)}\`` };
   }
   workerOnce(request) {
     const root = this.contextRootError();
@@ -17622,10 +17756,18 @@ class WorkitCore {
       requirements
     });
   }
-  compactContext(taskId, freshness) {
+  compactContext(taskId, freshness, origin = null) {
     const root = this.contextRootError();
     if (!root.ok)
       return root;
+    const base = origin && this.store.readStoreTask(origin.taskId);
+    const inherited = base?.ok && base.data ? {
+      origin: origin.origin,
+      taskId: base.data.id,
+      decisions: base.data.decisions.filter((entry) => entry.data.revoked === null)
+    } : null;
+    if (taskId === null)
+      return success(null, null, inherited?.decisions.length ? compactTaskContext(null, inherited) : "");
     const task = this.store.readTask(taskId);
     if (!task.ok)
       return task;
@@ -17635,7 +17777,7 @@ class WorkitCore {
     const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
     if (!view.ok)
       return view;
-    return success(view.revision, view.workspaceRevision, compactTaskContext(view.data));
+    return success(view.revision, view.workspaceRevision, compactTaskContext(view.data, inherited));
   }
   view(task, capture = true, freshness = treeFreshness(this.store.root)) {
     const workspace = this.store.readWorkspace();
@@ -19074,8 +19216,9 @@ var currentTaskEntry = (entries, session, selection) => {
   const active = entries.filter((entry) => entry.status === "active");
   return active.length === 1 ? active[0] : null;
 };
+var otherConversation = (entry, session) => entry.sessions.some((item) => item.host !== "workit_cli" && !(item.host === session.host && item.handle === session.handle));
 var implicitTaskEntry = (store, entries, session) => {
-  const open = entries.filter((entry) => entry.key !== null && entry.status !== "closed" && !entry.sessions.some((item) => item.host !== "workit_cli" && !(item.host === session.host && item.handle === session.handle)));
+  const open = entries.filter((entry) => entry.key !== null && entry.status !== "closed" && !otherConversation(entry, session));
   if (open.length === 0)
     return null;
   const key = store.currentKey();
@@ -19116,18 +19259,23 @@ function sessionCompactContext(store, session, context, selection = "session-bou
   if (!listed.ok)
     return migrationPending(listed) ? MIGRATION_PENDING_NOTE : null;
   const entry = currentTaskEntry(listed.data, session, selection) ?? implicitTaskEntry(store, listed.data, session);
-  return entry ? entryCompactContext(store, entry, session, context) : null;
+  return entryCompactContext(store, entry, session, context);
 }
 function entryCompactContext(store, entry, session, context) {
+  const found = store.originTaskEntry();
+  const origin = found.ok && found.data && found.data.entry.id !== entry?.id && !otherConversation(found.data.entry, session) ? found.data : null;
+  if (!entry && !origin)
+    return null;
   const workspace = store.readWorkspace();
-  if (!workspace.ok || !workspace.data)
+  if (!workspace.ok || entry && !workspace.data)
     return null;
   const slot = `${store.root}\x00${session.host}\x00${session.handle}`;
   const key = canonicalJson({
-    task: entry.id,
-    revision: entry.revision,
-    file: entry.file,
-    workspace: workspace.data.revision,
+    task: entry?.id ?? null,
+    revision: entry?.revision ?? null,
+    file: entry?.file ?? null,
+    origin: origin && origin.entry.file,
+    workspace: workspace.data?.revision ?? null,
     caller: context.caller,
     workerId: context.workerId ?? null,
     capabilities: context.capabilities
@@ -19135,15 +19283,15 @@ function entryCompactContext(store, entry, session, context) {
   const hit = cache.get(slot);
   if (hit && hit.key === key && hit.filesKey !== null && hit.filesKey === filesKey(hit.files) && (hit.signal === null || hit.signal === recentSignal(store.root)))
     return hit.value;
-  const task = store.readTask(entry.id);
-  if (!task.ok)
+  const task = entry ? store.readTask(entry.id) : null;
+  if (task && !task.ok)
     return null;
   const freshness = { mode: "signal", current: () => recentSignal(store.root) };
-  const observed = task.data.evidence.some(isObservedCheck);
-  const files = task.data.decisions.flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path20.resolve(store.root, ref.path)] : []));
+  const observed = task?.data.evidence.some(isObservedCheck) ?? false;
+  const files = (task?.data.decisions ?? []).flatMap((decision) => decision.data.binding.contentRefs.flatMap((ref) => ref.kind === "file" ? [path20.resolve(store.root, ref.path)] : []));
   const observedFiles = filesKey(files);
-  const compact = new WorkitCore(store, context).compactContext(entry.id, freshness);
-  if (!compact.ok)
+  const compact = new WorkitCore(store, context).compactContext(entry?.id ?? null, freshness, origin && { origin: origin.origin, taskId: origin.entry.id });
+  if (!compact.ok || !compact.data)
     return null;
   cache.delete(slot);
   cache.set(slot, {
@@ -21176,9 +21324,12 @@ var createV2Lifecycle = (deps) => {
       expectedWorkspaceRevision: workspace.data.revision
     } : null;
   };
-  const oldestOfSingleTask = (items) => {
-    const tasks = new Set(items.map((item) => item.task.id));
-    if (tasks.size !== 1 || items.length === 0)
+  const currentTaskId = (store) => {
+    const report = store.keyReport();
+    return report.ok ? report.data.bound[0]?.id ?? null : null;
+  };
+  const oldest = (items) => {
+    if (items.length === 0)
       return null;
     return [...items].toSorted((a, b) => a.entry.recordedAt < b.entry.recordedAt ? -1 : a.entry.recordedAt > b.entry.recordedAt ? 1 : a.entry.id < b.entry.id ? -1 : 1)[0];
   };
@@ -21187,6 +21338,16 @@ var createV2Lifecycle = (deps) => {
     const cancel = workerId ? `workit_worker {"action":"cancel","workerId":"${workerId}","reason":"launch not observed"}` : 'workit_worker {"action":"cancel","workerId":"<id>","reason":"launch not observed"} for the stuck worker';
     return `recovery_required: a previous native subagent launch is unsettled; wait for it to settle, or ${cancel} before launching again`;
   };
+  const unboundLaunch = (coordinator) => {
+    const store = new TaskStore(root);
+    const current = currentTaskId(store);
+    const base = current === null ? 'recovery_required: this branch has no Workit task yet; start it (workit_task start, or `workit task start "<objective>"`), then assign a worker on it with workit_worker before launching a native task' : "recovery_required: no assigned Workit worker is attributable to this coordinator on the current branch's task; assign one with workit_worker before launching a native task";
+    const listed = store.listTasks();
+    if (!listed.ok)
+      return base;
+    const stale = listed.data.flatMap((task) => task.status === "active" && task.id !== current ? task.workers.filter((worker) => (worker.data.state === "assigned" || worker.data.state === "running") && worker.provenance.session?.kind === "host" && worker.provenance.session.handle === coordinator).map((worker) => `workit_worker {"action":"cancel","taskId":"${task.id}","workerId":"${worker.id}","reason":"stale worker from another branch"}`) : []);
+    return stale.length > 0 ? `${base}. Workers of this coordinator are still open on other tasks; cancel any that are stale: ${stale.join("; ")}` : base;
+  };
   const prepareDispatch = (coordinator, callID) => {
     if (dispatches.has(coordinator))
       return "unsettled";
@@ -21199,7 +21360,8 @@ var createV2Lifecycle = (deps) => {
     if (managed.length === 0)
       return "unmanaged";
     const eligible = managed.flatMap((task) => task.workers.filter((entry) => entry.data.state === "assigned" && entry.data.session === null && entry.provenance.session?.kind === "host" && entry.provenance.session.host === "opencode" && entry.provenance.session.handle === coordinator).map((entry) => ({ task, entry })));
-    const next = oldestOfSingleTask(eligible);
+    const current = currentTaskId(store);
+    const next = oldest(eligible.filter((item) => item.task.id === current));
     if (!next)
       return "unbound";
     dispatches.set(coordinator, {
@@ -21393,9 +21555,8 @@ var createV2Lifecycle = (deps) => {
       if (prepared === "unsettled") {
         throw new Error(unsettledLaunch(coordinator));
       }
-      if (prepared === "unbound") {
-        throw new Error("recovery_required: no assigned Workit worker is attributable to this coordinator; assign one with workit_worker before launching a native task");
-      }
+      if (prepared === "unbound")
+        throw new Error(unboundLaunch(coordinator));
     } catch (error) {
       if (inflight.get(coordinator) === event.id)
         inflight.delete(coordinator);
@@ -21649,6 +21810,24 @@ var evaluateShellPermission = (root, event, workdirs = new Map) => {
   }
 };
 
+// packages/workit-opencode/src/v2/child-identity.ts
+var CHILD_RECORDS = {
+  evidence: new Set(["record"]),
+  finding: new Set(["record"])
+};
+var fields = (input) => typeof input === "object" && input !== null ? input : {};
+var childMayRecord = (family, input) => {
+  const action = fields(input).action;
+  return family !== null && typeof action === "string" && CHILD_RECORDS[family]?.has(action) === true;
+};
+var childTaskMissing = (store, input) => {
+  if (fields(input).taskId !== undefined)
+    return false;
+  const report = store.keyReport();
+  return !report.ok || report.data.bound.length === 0;
+};
+var childDenial = (identity) => `OpenCode child session has no validated Workit worker: as ${identity} it may only record evidence or findings (workit_evidence/workit_finding action "record") on an existing task; for anything else the lead assigns it a worker with workit_worker before launching it`;
+
 // packages/workit-opencode/src/v2/shell.ts
 import path31 from "node:path";
 var commandOf = (input) => {
@@ -21705,6 +21884,54 @@ ${nudge.text}` };
   } catch {}
 };
 
+// packages/workit-opencode/src/v2/shell-session.ts
+var PENDING_LIMIT = 256;
+var commandText2 = (input) => {
+  if (input === null || typeof input !== "object")
+    return null;
+  const command = input.command;
+  return typeof command === "string" && command.trim() ? command : null;
+};
+var noteShellCall = (pending, event) => {
+  const command = commandText2(event.input);
+  if (!command)
+    return;
+  const sessionID = String(event.sessionID);
+  const queue = pending.get(command) ?? { sessions: [], mixed: false };
+  if (queue.sessions.some((other) => other !== sessionID))
+    queue.mixed = true;
+  queue.sessions.push(sessionID);
+  pending.set(command, queue);
+  if (pending.size > PENDING_LIMIT)
+    pending.delete(pending.keys().next().value);
+};
+var settleShellCall = (pending, event) => {
+  const command = commandText2(event.input);
+  const queue = command ? pending.get(command) : undefined;
+  if (!command || !queue)
+    return;
+  const index = queue.sessions.indexOf(String(event.sessionID));
+  if (index >= 0)
+    queue.sessions.splice(index, 1);
+  if (queue.sessions.length === 0)
+    pending.delete(command);
+};
+var applyShellSession = async (pending, event, parentOf) => {
+  event.env.WORKIT_HOST = "opencode";
+  delete event.env.WORKIT_SESSION_ID;
+  const queue = pending.get(event.command);
+  if (!queue || queue.sessions.length === 0)
+    return;
+  const sessionID = queue.sessions.shift();
+  if (queue.sessions.length === 0)
+    pending.delete(event.command);
+  if (queue.mixed)
+    return;
+  const parent = await parentOf(sessionID);
+  if (parent)
+    event.env.WORKIT_SESSION_ID = childSessionId(parent, sessionID);
+};
+
 // packages/workit-opencode/src/v2/skills.ts
 var hookInput2 = (root, sessionID, subagent) => ({
   host: "opencode",
@@ -22008,9 +22235,17 @@ var setup = async (ctx) => {
             };
           const store = new TaskStore(root);
           const workerId = workerIdFor(store, session.id, session.parentID, lifecycle.directChildren);
-          if (session.parentID !== undefined && workerId === null)
-            return resultContent(failure2("permission_denied", "OpenCode child session has no validated Workit worker"));
           const family = workitFamilyOf(spec.name);
+          if (session.parentID !== undefined && workerId === null) {
+            const identity = childSessionId(session.parentID, session.id);
+            const lead = await sessionFacts(ctx, session.parentID);
+            const directChild = lead !== null && lead.parentID === undefined && sameWorkspace(root, lead.directory);
+            if (!directChild || family === null || !childMayRecord(family, input))
+              return resultContent(failure2("permission_denied", childDenial(identity)));
+            if (childTaskMissing(store, input))
+              return resultContent(failure2("not_found", "no task for this branch yet: the lead starts one (workit_task start) before a child records on it, or pass taskId"));
+            return resultContent(runFamily(family, input, { ...session, id: identity }, store, null));
+          }
           if (family !== null)
             return resultContent(runFamily(family, input, session, store, workerId));
           if (spec.name === "workit_init_apply") {
@@ -22022,9 +22257,12 @@ var setup = async (ctx) => {
     }
   });
   const shellWorkdirs = new Map;
+  const pendingShells = new Map;
   await ctx.tool.hook("execute.before", async (event) => {
-    if (event.tool === "shell")
+    if (event.tool === "shell") {
+      noteShellCall(pendingShells, { sessionID: String(event.sessionID), input: event.input });
       return observeShellBefore(root, event, shellWorkdirs);
+    }
     if (event.tool === "skill")
       return observeSkillLoad(root, event);
     if (event.tool !== "subagent")
@@ -22036,9 +22274,17 @@ var setup = async (ctx) => {
       input: event.input
     });
   });
+  const shellDomain = ctx.shell;
+  if (shellDomain)
+    await shellDomain.hook("create.before", (event) => applyShellSession(pendingShells, event, async (sessionID) => {
+      const known = lifecycle.directChildren.get(sessionID);
+      return known ?? (await sessionFacts(ctx, sessionID))?.parentID;
+    }));
   await ctx.tool.hook("execute.after", async (event) => {
-    if (event.tool === "shell")
+    if (event.tool === "shell") {
+      settleShellCall(pendingShells, { sessionID: String(event.sessionID), input: event.input });
       return observeShellResult(root, event);
+    }
     if (event.tool !== "subagent")
       return;
     await lifecycle.executeAfter({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-opencode",
-  "version": "8.9.0",
+  "version": "8.10.0",
   "private": false,
   "description": "Workit OpenCode plugin — native tools, adaptive policy, and sixteen method skills",
   "keywords": [
@@ -39,7 +39,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^8.9.0"
+    "@brainervirus/workit-core": "^8.10.0"
   },
   "devDependencies": {
     "@opencode/plugin": "2.0.18"