@brainervirus/workit-pi 1.0.10 → 1.0.11

package/dist/worker.js

@@ -7554,10 +7554,11 @@ var decisionSchema = object({
     presented: text,
     approvedContent: text,
     displayed: text.optional(),
-    contentRefs: array(refSchema)
+    contentRefs: array(refSchema),
+    statedChoice: object({ ref: text, text }).strict().optional()
   }).strict(),
   digest,
-  response: _enum(["approved", "rejected"]),
+  response: _enum(["approved", "rejected", "stated"]),
   requirementIds: array(digest),
   revoked: object({ at: utc, reason: text }).strict().nullable(),
   consumption: object({

package/dist/workit.js

@@ -7797,10 +7797,11 @@ var decisionSchema = object({
     presented: text,
     approvedContent: text,
     displayed: text.optional(),
-    contentRefs: array(refSchema)
+    contentRefs: array(refSchema),
+    statedChoice: object({ ref: text, text }).strict().optional()
   }).strict(),
   digest,
-  response: _enum(["approved", "rejected"]),
+  response: _enum(["approved", "rejected", "stated"]),
   requirementIds: array(digest),
   revoked: object({ at: utc, reason: text }).strict().nullable(),
   consumption: object({
@@ -10673,7 +10674,7 @@ function evaluateEvidence(task, candidate) {
 }
 var scopeCovers2 = scopeCovers;
 var applicableDecision2 = (task, workspace, requirement, checkoutRoot) => task.decisions.filter((entry) => entry.provenance.kind !== "imported").map((entry) => entry.data).filter((decision) => decision.purpose === "limitation" && decision.response === "approved" && decision.revoked === null && decision.binding.taskId === task.id && decision.binding.workspaceId === workspace.id && decision.requirementIds.includes(requirement.id) && decision.binding.scope && scopeCovers2(decision.binding.scope, requirement.scope) && decision.digest === decisionDigest(decision) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, decision.binding).ok : decision.binding.contentRefs.every((reference) => reference.kind !== "file")));
-var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && data.response === "approved" && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
+var applicableRequirementDecision = (task, workspace, requirement, checkoutRoot) => task.decisions.filter(({ data, provenance }) => provenance.kind !== "imported" && data.purpose !== "limitation" && (data.response === "approved" || data.response === "stated") && data.revoked === null && data.binding.taskId === task.id && data.binding.workspaceId === workspace.id && data.requirementIds.includes(requirement.id) && scopeCovers2(data.binding.scope, requirement.scope) && data.digest === decisionDigest(data) && (checkoutRoot ? verifyDecisionContentAtRoot(checkoutRoot, data.binding).ok : data.binding.contentRefs.every((reference) => reference.kind !== "file"))).map(({ id }) => ({ id }));
 var evidenceMatchesRequirement = (kind, evidenceKind, dimension) => {
   if (kind !== "passed")
     return false;
@@ -10749,7 +10750,7 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
         status: "satisfied",
         evidenceIds: [],
         decisionIds: decisions.map((decision) => decision.id),
-        reason: "an applicable approved decision satisfies the requirement"
+        reason: "an applicable approved or stated decision satisfies the requirement"
       };
     const limitations = requirement.acceptanceAllowed ? applicableDecision2(task, workspace, requirement, checkoutRoot) : [];
     if (limitations.length)
@@ -11082,6 +11083,23 @@ function shellRouteIntent(command) {
   }
   return null;
 }
+function hasLiveWorkitTask(dir) {
+  try {
+    if (typeof dir !== "string" || dir === "")
+      return false;
+    const listed = new TaskStore(dir).listTasks();
+    if (!listed.ok)
+      return false;
+    return listed.data.some((task) => task.status === "active" || task.status === "paused");
+  } catch {
+    return false;
+  }
+}
+function shouldDenyShellRoute(dir, command) {
+  if (!hasLiveWorkitTask(dir))
+    return null;
+  return shellRouteIntent(command);
+}
 // packages/workit-core/src/core/external-action.ts
 import { execFileSync } from "node:child_process";
 var externalActionSchema = discriminatedUnion("operation", [
@@ -11328,12 +11346,62 @@ var planCommitBinding = (store, host, actor, operation) => {
 };
 var approvedExternalAction = (store, host, actor, operation) => {
   const selected = externalActionState(store, host, actor, operation);
-  if (!selected.ok)
+  if (selected.ok) {
+    if (selected.data.entry.data.consumption !== null)
+      return failure(selected.data.entry.data.consumption.state === "uncertain" ? "external_outcome_unknown" : "permission_denied", selected.data.entry.data.consumption.state === "uncertain" ? "previous external action outcome is unknown" : "external action was already settled");
     return selected;
-  if (selected.data.entry.data.consumption !== null)
-    return failure(selected.data.entry.data.consumption.state === "uncertain" ? "external_outcome_unknown" : "permission_denied", selected.data.entry.data.consumption.state === "uncertain" ? "previous external action outcome is unknown" : "external action was already settled");
+  }
+  const intent = approvedBranchSetupIntent(store, host, actor, operation);
+  if (intent.ok) {
+    if (intent.data.entry.data.consumption !== null)
+      return failure(intent.data.entry.data.consumption.state === "uncertain" ? "external_outcome_unknown" : "permission_denied", intent.data.entry.data.consumption.state === "uncertain" ? "previous external action outcome is unknown" : "external action was already settled");
+    return intent;
+  }
   return selected;
 };
+var branchSetupIntent = (descriptor) => {
+  try {
+    const value = JSON.parse(descriptor);
+    if (value.operation !== "git.branch_setup" || !value.payload)
+      return null;
+    const { target_branch, resolved } = value.payload;
+    if (typeof target_branch !== "string" || !target_branch || !resolved)
+      return null;
+    if (typeof resolved.base_branch !== "string" || typeof resolved.target_exists !== "boolean")
+      return null;
+    return {
+      target: target_branch,
+      base: resolved.base_branch,
+      remoteBase: typeof resolved.remote_base === "string" ? resolved.remote_base : null,
+      targetExists: resolved.target_exists
+    };
+  } catch {
+    return null;
+  }
+};
+var approvedBranchSetupIntent = (store, host, actor, operation) => {
+  const current = branchSetupIntent(operation);
+  if (!current)
+    return failure("permission_denied", "no approved action is bound to this session");
+  const listed = store.listTasks();
+  const workspace = store.readWorkspace();
+  if (!listed.ok || !workspace.ok)
+    return failure("storage_error", "external action state is unavailable");
+  if (!workspace.data)
+    return failure("not_found", "workspace not found");
+  const candidates = listed.data.flatMap((task) => {
+    if (task.status !== "active" || task.workspaceId !== workspace.data.id || task.intent.provenance.session?.kind !== "host" || task.intent.provenance.session.host !== host || task.intent.provenance.session.handle !== actor)
+      return [];
+    return task.decisions.filter((entry) => entry.data.purpose === "action" && entry.data.response === "approved" && entry.data.revoked === null).map((entry) => ({ task, entry }));
+  });
+  const matches = candidates.filter(({ entry }) => {
+    const intent = branchSetupIntent(entry.data.binding.approvedContent);
+    return intent !== null && intent.target === current.target && intent.base === current.base && intent.remoteBase === current.remoteBase && intent.targetExists === current.targetExists;
+  });
+  if (matches.length !== 1)
+    return failure("permission_denied", matches.length === 0 ? "no approved action is bound to this session" : "multiple approved actions match this session");
+  return success(workspace.data.revision, null, { ...matches[0], workspace: workspace.data });
+};
 var priorResolvedDrift = (store, host, actor, operation, payload, currentResolved) => {
   const prior = priorExternalAction(store, host, actor, operation, payload);
   if (!prior.ok)
@@ -11347,6 +11415,24 @@ var priorResolvedDrift = (store, host, actor, operation, payload, currentResolve
   }
   if (baseline === undefined || baseline === null)
     return success(null, null, null);
+  if (operation === "git.branch_setup") {
+    const before = branchSetupIntent(prior.data.entry.data.binding.approvedContent);
+    let after = null;
+    try {
+      after = branchSetupIntent(JSON.stringify({
+        operation,
+        payload: { ...payload, resolved: currentResolved }
+      }));
+    } catch {
+      after = null;
+    }
+    if (before && after) {
+      const moved = before.target !== after.target ? "target_branch" : before.base !== after.base ? "base_branch" : before.remoteBase !== after.remoteBase ? "remote_base" : before.targetExists !== after.targetExists ? "target_exists" : null;
+      if (moved === null)
+        return success(null, null, null);
+      return failure("invalid_input", `repository state changed since approval (${moved} moved); show the current state and approve the action again`, { outcome: "not_started", operation });
+    }
+  }
   if (canonicalJson(baseline) === canonicalJson(currentResolved))
     return success(null, null, null);
   return failure("invalid_input", "repository state changed since approval; show the current state and approve the action again", { outcome: "not_started", operation });
@@ -12621,7 +12707,12 @@ class WorkitCore {
     const input = parsed.data;
     if (nativeRequired && input.action !== "record")
       return failure("permission_denied", "native observation is only valid for recording decisions");
-    if (nativeRequired && nativeObservation === undefined)
+    const stated = input.action === "record" && input.response === "stated";
+    if (stated && input.purpose === "action")
+      return failure("permission_denied", "stated choices cannot authorize mutating actions");
+    if (stated && !input.binding?.statedChoice)
+      return failure("invalid_input", "stated choices require binding.statedChoice");
+    if (nativeRequired && nativeObservation === undefined && !stated)
       return failure("permission_denied", "native decision observation is required");
     const task = this.store.readTask(input.taskId);
     if (!task.ok)
@@ -12654,7 +12745,7 @@ class WorkitCore {
         consumption: null
       };
       const data = { ...base, digest: decisionDigest(base) };
-      const native = nativeRequired ? verifyNativeDecision(this.context.nativeAuthority, {
+      const native = nativeRequired && !stated ? verifyNativeDecision(this.context.nativeAuthority, {
         observation: nativeObservation,
         expected: {
           taskId: task.data.id,
@@ -16862,13 +16953,20 @@ var actionProposalQuestion = (request, descriptorPayload) => {
           approvedText: "Reapply the recorded stash."
         };
       const target = String(payload.target_branch ?? "");
+      const stashes = payload.stash === "yes" && resolved.dirty === true;
       if (resolved.target_exists === true)
-        return {
+        return stashes ? {
+          presented: `Workit decision: action — Stash the dirty working tree and switch to branch \`${target}\`?`,
+          approvedText: `Stash and switch to \`${target}\`.`
+        } : {
           presented: `Workit decision: action — Switch to branch \`${target}\`?`,
           approvedText: `Switch to \`${target}\`.`
         };
       const base = String(resolved.base_branch ?? "the base branch");
-      return {
+      return stashes ? {
+        presented: `Workit decision: action — Stash the dirty working tree and create branch \`${target}\` from \`${base}\` (currently ${shortSha(resolved.remote_base)})?`,
+        approvedText: `Stash and create \`${target}\` from \`${base}\` at ${shortSha(resolved.remote_base)}.`
+      } : {
         presented: `Workit decision: action — Create branch \`${target}\` from \`${base}\` (currently ${shortSha(resolved.remote_base)})?`,
         approvedText: `Create \`${target}\` from \`${base}\` at ${shortSha(resolved.remote_base)}.`
       };
@@ -17810,9 +17908,17 @@ var registerWorkitTools = (pi, options = {}) => {
       if (!parsed.ok)
         return output(parsed);
       const context = piContext(ctx);
-      const resolved = resolveExternalActionRequest(ctx.cwd, parsed.data);
+      let resolved = resolveExternalActionRequest(ctx.cwd, parsed.data);
       if (!resolved.ok)
         return output(resolved);
+      if (resolved.data.request.operation === "git.branch_setup" && resolved.data.descriptorPayload.resolved?.dirty === true && resolved.data.descriptorPayload.stash !== "yes") {
+        const upgraded = resolveExternalActionRequest(ctx.cwd, {
+          ...parsed.data,
+          payload: { ...parsed.data.payload, stash: "yes" }
+        });
+        if (upgraded.ok)
+          resolved = upgraded;
+      }
       if (resolved.data.request.operation === "context.read")
         return output(await executeResolvedExternalAction(resolved.data, ctx.cwd));
       if (!ctx.isProjectTrusted())
@@ -17946,7 +18052,7 @@ var registerWorkitTools = (pi, options = {}) => {
 var enforceNativeWriter = (event, ctx) => {
   if (event.toolName === "bash") {
     const command = event.input?.command;
-    const route = typeof command === "string" ? shellRouteIntent(command) : null;
+    const route = typeof command === "string" ? shouldDenyShellRoute(ctx.cwd, command) : null;
     if (route)
       return {
         block: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-pi",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "description": "Workit native extension for Pi — tools, method skills, and session continuity",
   "keywords": [
     "agentic-coding",