@brainervirus/workit-pi 6.0.1 → 7.1.0

package/README.md

@@ -15,7 +15,10 @@ pi install ./packages/workit-pi -l --approve   # local checkout
 ```
 
 Pi discovers the extension and skills from the package's `pi` manifest
-(`./dist/workit.js`, `./skills`). Pi project trust still gates mutations;
-shell writes are agent-guided, since an extension is not an OS sandbox.
+(`./dist/workit.js`, `./skills`). Pi project trust still gates mutations.
+The `tool_call` boundary applies branch policy and the
+[before-write gate](https://github.com/BrainerVirus/workit/blob/main/docs/guides/verification.md) to write, edit and recognizable bash
+writes (unrecognized shell writes stay agent-guided; an extension is not an OS
+sandbox). Tools take flat fields.
 Delivery limits come from Pi's permissions plus the workspace
 [grants](https://github.com/BrainerVirus/workit/blob/main/docs/guides/grants.md).

package/dist/worker.js

@@ -7206,6 +7206,14 @@ function object(shape, params) {
   };
   return new ZodObject(def);
 }
+function looseObject(shape, params) {
+  return new ZodObject({
+    type: "object",
+    shape,
+    catchall: unknown(),
+    ...normalizeParams(params)
+  });
+}
 var ZodUnion = /* @__PURE__ */ $constructor("ZodUnion", (inst, def) => {
   $ZodUnion.init(inst, def);
   ZodType.init(inst, def);
@@ -7607,76 +7615,16 @@ var provenanceSchema = object({
   workerId: nullableId
 }).strict();
 var entrySchema = (data) => object({ id, recordedAt: utc, provenance: provenanceSchema, data }).strict();
-var factSchema = object({
-  statement: text,
-  basis: _enum(["observed", "inferred", "unknown"]),
-  refs: array(refSchema)
-}).strict().check((ctx) => {
-  if (ctx.value.basis === "observed" && ctx.value.refs.length === 0)
-    ctx.issues.push({
-      code: "custom",
-      input: ctx.value,
-      message: "observed facts require supporting references",
-      path: ["refs"]
-    });
-});
-var signalSchema = object({
-  value: union([boolean2(), literal("unknown")]),
-  basis: _enum(["observed", "inferred", "unknown"]),
-  reason: text,
+var RISK_TIERS = ["trivial", "normal", "high"];
+var judgmentSchema = object({
+  riskTier: _enum(RISK_TIERS),
+  behaviorChange: boolean2(),
+  productChoiceOpen: boolean2(),
+  needsPlan: boolean2(),
+  note: text.nullable(),
   refs: array(refSchema)
-}).strict().check((ctx) => {
-  const signal = ctx.value;
-  const valid = signal.value === "unknown" ? signal.basis === "unknown" : signal.basis === "observed" || signal.basis === "inferred";
-  if (!valid)
-    ctx.issues.push({
-      code: "custom",
-      input: signal,
-      message: "signal value and basis disagree",
-      path: []
-    });
-  if (signal.basis === "observed" && signal.refs.length === 0)
-    ctx.issues.push({
-      code: "custom",
-      input: signal,
-      message: "observed signals require supporting references",
-      path: ["refs"]
-    });
-});
-var signalSet = object({
-  approachUnknown: signalSchema,
-  productChoiceOpen: signalSchema,
-  behaviorChange: signalSchema,
-  mechanicalLowRisk: signalSchema,
-  durableAgreementNeeded: signalSchema,
-  coordinationPlanNeeded: signalSchema,
-  helperUseful: signalSchema,
-  testFirstPractical: signalSchema
-}).strict();
-var consequenceSchema = object({
-  area: _enum([
-    "behavior",
-    "public_contract",
-    "data",
-    "security",
-    "operations",
-    "reversibility",
-    "consumers"
-  ]),
-  fact: factSchema
-}).strict();
-var verificationSchema = object({
-  claim: text,
-  scope: scopeSchema,
-  availableChecks: array(refSchema),
-  gaps: array(text)
-}).strict();
-var assessmentSchema = object({
-  facts: array(factSchema),
-  signals: signalSet,
-  consequences: array(consequenceSchema),
-  verification: array(verificationSchema)
 }).strict();
+var legacyAssessmentSchema = looseObject({});
 var constraintSchema = object({
   id: nonEmpty,
   kind: _enum(["host", "project", "user"]),
@@ -7912,7 +7860,8 @@ var taskRecordSchema = object({
   progress: progressSchema,
   pauseReason: text.nullable().optional(),
   runtime: runtimeSchema.optional(),
-  assessments: array(entrySchema(assessmentSchema)),
+  assessments: array(entrySchema(legacyAssessmentSchema)),
+  judgments: array(entrySchema(judgmentSchema)).optional(),
   policy: policySchema.nullable(),
   policyChanges: array(policyChangeSchema),
   candidates: array(candidateSchema),
@@ -8035,14 +7984,15 @@ var taskOperations = {
     decisionIds: array(id).optional()
   })
 };
+var rawJudgment = record(string2(), unknown());
 var policyOperations = {
   assess: operation({
     action: literal("assess"),
     ...taskId,
     expectedRevision: revision.optional(),
-    assessment: assessmentSchema
+    judgment: rawJudgment
   }),
-  preview: operation({ action: literal("preview"), ...taskId, assessment: assessmentSchema }),
+  preview: operation({ action: literal("preview"), ...taskId, judgment: rawJudgment }),
   explain: operation({ action: literal("explain"), ...taskId })
 };
 var evidenceOperations = {
@@ -8081,7 +8031,10 @@ var decisionOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     purpose: decisionSchema.shape.purpose,
-    binding: decisionSchema.shape.binding,
+    binding: decisionSchema.shape.binding.extend({
+      taskId: id.optional(),
+      workspaceId: id.optional()
+    }),
     response: decisionSchema.shape.response,
     requirementIds: array(digest)
   }),
@@ -8135,6 +8088,15 @@ var operationSchemas = {
   worker: discriminatedUnion("action", Object.values(workerOperations)),
   state: discriminatedUnion("action", Object.values(stateOperations))
 };
+var OPERATION_ACTIONS = {
+  task: Object.keys(taskOperations),
+  policy: Object.keys(policyOperations),
+  evidence: Object.keys(evidenceOperations),
+  finding: Object.keys(findingOperations),
+  decision: Object.keys(decisionOperations),
+  worker: Object.keys(workerOperations),
+  state: Object.keys(stateOperations)
+};
 var withImplicitTask = (options) => Object.values(options).map((option) => ("taskId" in option.shape) ? option.extend({ taskId: id.optional() }) : option);
 var advertised = (options) => discriminatedUnion("action", withImplicitTask(options));
 var advertisedOperationSchemas = {
@@ -8223,6 +8185,126 @@ function candidateDigest(input) {
     head: input.head
   });
 }
+// packages/workit-core/src/core/operation-input.ts
+var str = (d, values) => ({
+  type: "string",
+  ...values ? { enum: values } : {},
+  ...d ? { d } : {}
+});
+var list = (d) => ({ type: "array", ...d ? { d } : {} });
+var bool = (d) => ({ type: "boolean", ...d ? { d } : {} });
+var int2 = (d) => ({ type: "integer", ...d ? { d } : {} });
+var scopeFields = {
+  paths: list("Scope paths (default: whole checkout)."),
+  exclusions: list(),
+  scope: str("Scope description.")
+};
+var refs = list("Paths or URLs.");
+var FLAT = {
+  task: {
+    fields: {
+      objective: str(),
+      ...scopeFields,
+      refs,
+      reason: str(),
+      summary: str(),
+      nextAction: str(),
+      blockers: list(),
+      outcome: str(undefined, ["verified", "accepted_limitations", "stopped"]),
+      decisionIds: list(),
+      status: str(undefined, ["open", "closed", "all"]),
+      query: str(),
+      limit: int2(),
+      view: str(undefined, ["summary", "full"])
+    }
+  },
+  policy: {
+    fields: {
+      riskTier: str("low=trivial, medium=normal.", ["trivial", "normal", "high", "low", "medium"]),
+      behaviorChange: bool("Observable behavior changes."),
+      productChoiceOpen: bool("A product/preference choice is still open."),
+      needsPlan: bool("Needs a written plan or spec first."),
+      note: str(),
+      refs: list("Plan/spec paths or URLs.")
+    }
+  },
+  evidence: {
+    fields: {
+      kind: str(undefined, ["check", "review", "investigation", "artifact"]),
+      claim: str(),
+      result: str(undefined, ["passed", "failed", "missing", "skipped"]),
+      summary: str(),
+      exitCode: int2(),
+      refs,
+      requirementIds: list(),
+      candidateId: str(),
+      beforeCandidateId: str(),
+      reviewSession: str("Reviewer session handle (review evidence).")
+    }
+  },
+  finding: {
+    fields: {
+      claim: str(),
+      consequence: str(),
+      ...scopeFields,
+      candidateId: str(),
+      refs,
+      findingId: str(),
+      disposition: str(undefined, ["open", "fixed", "dismissed", "deferred"]),
+      reason: str(),
+      evidenceIds: list(),
+      decisionIds: list()
+    }
+  },
+  decision: {
+    fields: {
+      purpose: str(undefined, ["design", "action", "limitation", "preference"]),
+      response: str(undefined, ["approved", "rejected", "stated"]),
+      presented: str("What the user was asked."),
+      choice: str("The user's stated choice (response=stated)."),
+      ...scopeFields,
+      refs,
+      requirementIds: list(),
+      decisionId: str(),
+      reason: str()
+    }
+  },
+  worker: {
+    fields: {
+      role: str(undefined, ["investigator", "reviewer", "implementer"]),
+      objective: str(),
+      ...scopeFields,
+      decisionIds: list(),
+      requirementIds: list(),
+      candidateId: str(),
+      stoppingCondition: str(),
+      workerId: str(),
+      outcome: str(undefined, ["completed", "failed", "cancelled"]),
+      summary: str(),
+      evidenceIds: list(),
+      findingIds: list(),
+      reason: str()
+    }
+  },
+  state: {
+    fields: { bundle: { type: "object", d: "An export bundle (object or JSON string)." } }
+  }
+};
+var COMMON = {
+  taskId: str("Omit for this branch's task."),
+  expectedRevision: str(),
+  expectedWorkspaceRevision: str()
+};
+var READ_TASK_FIELDS = new Set(["status", "query", "limit", "view"]);
+var READ_ONLY_ACTIONS = new Set(["list", "inspect", "preview", "explain", "export"]);
+var ENVELOPE = new Set([
+  "schemaVersion",
+  "action",
+  "taskId",
+  "expectedRevision",
+  "expectedWorkspaceRevision",
+  "judgment"
+]);
 // packages/workit-core/src/core/package-root.ts
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -8292,6 +8374,25 @@ var heldInProcess = new Map;
 // packages/workit-core/src/git/rev.ts
 var MAX_BUFFER = 256 * 1024 * 1024;
 var MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
+
+// packages/workit-core/src/ledger.ts
+var PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
+var FAILING = new Set(["failed", "blocked"]);
+var STRONG_RESULTS = new Set(["verified", "tests-verified"]);
+var PR_ROW_TYPES = new Set(["pr.created", "pr.status", "pr.merged"]);
+var NETWORK_FS_TYPES = new Set([
+  26985,
+  20859,
+  4266872130,
+  4283649346,
+  1702057286,
+  1397113167,
+  12805120,
+  16914839,
+  1196443219,
+  198183888
+]);
+var OBSERVED_ONLY = new Set(["check", ...PR_ROW_TYPES]);
 // packages/workit-core/src/core/config.ts
 var PRESETS = {
   gitflow: {
@@ -8356,26 +8457,31 @@ var versionSourceSchema = discriminatedUnion("kind", [
   object({ kind: literal("manual") }).strict()
 ]);
 var releaseTrackSchema = object({
-  strategy: branchPreset,
+  strategy: branchPreset.optional(),
   productionBranch: nonBlank,
   integrationBranch: nonBlank,
-  naming: object({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
-  baseBranch: nonBlank,
-  mergeBackBranches: array(nonBlank),
-  pullRequestTarget: nonBlank,
-  tagNamespace: string2(),
-  versionSource: versionSourceSchema,
-  requiredChecks: array(nonBlank)
-}).strict().superRefine((track, context) => {
+  naming: object({
+    feature: nonBlank.optional(),
+    release: nonBlank.optional(),
+    hotfix: nonBlank.optional()
+  }).passthrough().optional(),
+  baseBranch: nonBlank.optional(),
+  mergeBackBranches: array(nonBlank).optional(),
+  pullRequestTarget: nonBlank.optional(),
+  tagNamespace: string2().optional(),
+  versionSource: versionSourceSchema.optional(),
+  requiredChecks: array(nonBlank).optional(),
+  critical: array(nonBlank).optional()
+}).passthrough().superRefine((track, context) => {
   for (const [field, values] of [
-    ["mergeBackBranches", track.mergeBackBranches],
-    ["requiredChecks", track.requiredChecks]
+    ["mergeBackBranches", track.mergeBackBranches ?? []],
+    ["requiredChecks", track.requiredChecks ?? []]
   ]) {
     if (new Set(values).size !== values.length) {
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource.kind === "package-json" && (path2.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path2.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -8394,6 +8500,7 @@ var workspaceConfigSchema = object({
   }).passthrough().optional(),
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
   defaultEndpoint: _enum(["commit", "pr"]).optional(),
+  verification: _enum(["self", "independent"]).optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
     union([boolean2(), literal("verified")]).optional()
@@ -8437,18 +8544,35 @@ var workspacesFileSchema = object({ workspaces: array(workspaceConfigSchema).opt
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-// packages/workit-core/src/core/policy-resolver.ts
-var resolverInputSchema = object({
-  intent: intentSchema,
-  assessment: assessmentSchema,
-  constraints: array(constraintSchema),
-  prior: object({
-    decisions: array(decisionSchema),
-    findings: array(findingSchema),
-    requirements: array(requirementSchema)
-  }).strict(),
-  preferences: object({ fast: boolean2().optional(), thorough: boolean2().optional() }).strict().optional()
-}).strict();
+
+// packages/workit-core/src/core/release-tracks.ts
+var KNOWN_FIELDS = new Set([
+  "strategy",
+  "productionBranch",
+  "integrationBranch",
+  "naming",
+  "baseBranch",
+  "mergeBackBranches",
+  "pullRequestTarget",
+  "tagNamespace",
+  "versionSource",
+  "requiredChecks",
+  "critical"
+]);
+var memo2 = new Map;
+// packages/workit-core/src/core/policy/judgment.ts
+var LEGACY_KEYS = new Set(["assessment", "facts", "signals", "consequences", "verification"]);
+var YES = new Set(["true", "yes", "y", "1", "on"]);
+var NO = new Set(["false", "no", "n", "0", "off", "none"]);
+
+// packages/workit-core/src/autonomy.ts
+var DEFAULT_GRANTS = Object.freeze({
+  push: true,
+  pr: true,
+  merge: false,
+  release: false,
+  rerun: true
+});
 
 // packages/workit-core/src/core/task-engine.ts
 var verifiedWorkers = new WeakMap;