@brainervirus/workit-pi 8.13.0 → 8.13.1

package/dist/worker.js

@@ -8616,6 +8616,23 @@ var NETWORK_FS_TYPES = new Set([
   198183888
 ]);
 var TAIL_BYTES = 64 * 1024;
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
 var OBSERVED_ONLY = new Set([
   "check",
   "merge.unverified",

package/dist/workit.js

@@ -9597,7 +9597,7 @@ function acquireFileLockSync(targetPath, options) {
   }
 }
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 import fs5 from "node:fs";
 import path5 from "node:path";
 
@@ -9969,9 +9969,10 @@ function hostSessionFromEnv(env) {
   return inner ? { host: inner.host, session: inner.session } : { host: declared, session: null };
 }
 var ISSUED_PER_LEAD = 64;
-var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/2";
+var ISSUED_SESSIONS_MARKER = "workit-issued-sessions/3";
 var hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32);
 var userIssuedRoot = () => path5.join(resolveStateDir(), "issued");
+var userTokenRoot = () => path5.join(resolveStateDir(), "issued-tokens");
 function migrateRepoIssued(cwd) {
   if (cwd === undefined)
     return;
@@ -9994,7 +9995,12 @@ function migrateRepoIssued(cwd) {
       const to = path5.join(userIssuedRoot(), lead);
       fs5.mkdirSync(to, { recursive: true, mode: 448 });
       for (const id of fs5.readdirSync(from)) {
-        fs5.copyFileSync(path5.join(from, id), path5.join(to, id));
+        try {
+          fs5.copyFileSync(path5.join(from, id), path5.join(to, id), fs5.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
         fs5.rmSync(path5.join(from, id), { force: true });
       }
       removeIfEmpty(from);
@@ -10014,21 +10020,71 @@ var removeIfEmpty = (dir) => {
     fs5.rmdirSync(dir);
   } catch {}
 };
+var tokenHash = (token) => createHash3("sha256").update(token).digest("hex");
 function recordIssuedSession(cwd, lead, issued) {
+  const token = randomBytes2(18).toString("base64url");
   try {
     migrateRepoIssued(cwd);
+    const own = hash(issued);
+    const tokens = path5.join(userTokenRoot(), hash(lead));
+    fs5.mkdirSync(tokens, { recursive: true, mode: 448 });
+    fs5.writeFileSync(path5.join(tokens, own), `${tokenHash(token)}
+`, { mode: 384, flag: "wx" });
     const dir = path5.join(userIssuedRoot(), hash(lead));
     fs5.mkdirSync(dir, { recursive: true, mode: 448 });
-    const own = hash(issued);
-    fs5.writeFileSync(path5.join(dir, own), ISSUED_SESSIONS_MARKER);
+    fs5.writeFileSync(path5.join(dir, own), `${ISSUED_SESSIONS_MARKER}
+`, { mode: 384 });
+    pruneIssued(dir, own, tokens);
+    return token;
+  } catch {
+    return null;
+  }
+}
+function pruneIssued(dir, own, tokens) {
+  try {
     const entries = fs5.readdirSync(dir);
     if (entries.length <= ISSUED_PER_LEAD)
       return;
     const byAge = entries.filter((name) => name !== own).map((name) => ({ name, at: fs5.statSync(path5.join(dir, name)).mtimeMs })).toSorted((a, b) => a.at - b.at);
-    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD))
+    for (const { name } of byAge.slice(0, entries.length - ISSUED_PER_LEAD)) {
       fs5.rmSync(path5.join(dir, name), { force: true });
+      fs5.rmSync(path5.join(tokens, name), { force: true });
+    }
   } catch {}
 }
+var issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
+  migrateRepoIssued(cwd);
+  try {
+    return fs5.readFileSync(path5.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
+  } catch {
+    return null;
+  }
+};
+var TOKEN_HASH = /^([0-9a-f]{64})$/mu;
+var issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path5.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs5.readFileSync(path5.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
+  }
+};
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
 var OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
 var SESSION_UNSAFE = /[^A-Za-z0-9_.:@/+-]/g;
 function childSessionId(lead, child) {
@@ -10070,8 +10126,10 @@ var metadataLockSchema = object({
 var FOREIGN_LOCK_TTL_MS = 10 * 60000;
 var UNREADABLE_LOCK_TTL_MS = 30000;
 var RECLAIM_GUARD_TTL_MS = 30000;
-var defaultLockTimeoutMs = 250;
+var IN_PROCESS_LOCK_TIMEOUT_MS = 250;
+var defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
 var defaultLockTimeout = () => defaultLockTimeoutMs;
+var hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS;
 var parseMetadataLock = (raw) => {
   let value;
   try {
@@ -12740,7 +12798,7 @@ import path15 from "node:path";
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
 import fs12 from "node:fs";
 import path14 from "node:path";
 
@@ -14289,7 +14347,7 @@ function ledgerPath(cwd) {
   const root = storeRoot(cwd);
   return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
-var newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`;
+var newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`;
 var NETWORK_FS_TYPES = new Set([
   26985,
   20859,
@@ -14339,14 +14397,14 @@ var ledgerLock = {
         return null;
       throw error;
     }
-    const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+    const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
     fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
     return token;
   },
   release(lock, token) {
     if (lockToken(lock) !== token)
       return false;
-    const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
+    const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
     try {
       fs12.renameSync(lock, tomb);
     } catch {
@@ -14363,7 +14421,7 @@ var ledgerLock = {
   },
   token: lockToken,
   reap(lock, observed) {
-    const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
+    const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
     try {
       fs12.renameSync(lock, tomb);
     } catch {
@@ -14381,7 +14439,7 @@ var ledgerLock = {
     return false;
   }
 };
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -14439,10 +14497,18 @@ var lastLine = (fd, size) => {
   }
   return null;
 };
+var tighten = (fd) => {
+  try {
+    if ((fs12.fstatSync(fd).mode & 63) !== 0)
+      fs12.fchmodSync(fd, 384);
+  } catch {}
+};
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs12.openSync(file, "a+");
+    const fd = fs12.openSync(file, "a+", 384);
     try {
+      if (process.platform !== "win32")
+        tighten(fd);
       const size = fs12.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
@@ -14537,7 +14603,9 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
+    stat = fs12.statSync(file.value);
     text = fs12.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
@@ -14557,6 +14625,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -14590,6 +14659,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -14613,7 +14686,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -14641,18 +14715,48 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+var TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+var tamperCache = new Map;
+var fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`;
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs12.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
+var tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`;
 function verdictBasis(verdict, current) {
   if (verdict.head && verdict.head === current.head)
     return "fresh";
@@ -14660,7 +14764,7 @@ function verdictBasis(verdict, current) {
     return "carried";
   return "stale";
 }
-var isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded;
+var isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id);
 function trailerSessions(cwd, base, head) {
   if (!base || !head || !safeRef(base) || !safeRef(head))
     return [];
@@ -14741,6 +14845,56 @@ var authoredBy = (authors, session) => {
       return true;
   return false;
 };
+var TRUST_REASONS = new Set([
+  "unsigned",
+  "hash_mismatch",
+  "broken_link",
+  "duplicate_id",
+  "unissued_session",
+  "unbound_session"
+]);
+var SHELL_VOUCHED_HOSTS = new Set([
+  "cli",
+  "opencode",
+  "pi",
+  "codex_cli",
+  "codex_desktop"
+]);
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+var untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason));
 var independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
@@ -14751,15 +14905,17 @@ var independenceReasons = (row, authors) => {
     reasons.push("self");
   return reasons;
 };
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -14773,7 +14929,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -14789,7 +14945,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -14819,21 +14976,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -14850,23 +15033,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -21898,10 +22089,10 @@ function stopObligation(input, descriptor) {
     const branch = currentBranch(input.cwd);
     if (!branch || guardedBranch(input.cwd, branch))
       return null;
-    const ledger = readLedger(input.cwd);
+    const ledger = readLedger(input.cwd, { integrity: true });
     if (!ledger.ok)
       return null;
-    const all = ledger.value.rows;
+    const all = ledger.value.rows.filter((row) => row.integrity !== "unverified");
     const rows = all.filter((row) => row.branch === branch);
     const mine = rows.filter((row) => sessionOf(row) === session);
     const commits = new Set(mine.filter((row) => row.type === "commit.recorded").map((row) => typeof row.sha === "string" ? row.sha : row.head).filter((sha) => typeof sha === "string"));
@@ -22240,9 +22431,9 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
-  if (session)
-    recordIssuedSession(input.cwd || process.cwd(), session, own);
-  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> --session ${own} ...\` so the ledger tells it apart from the author.`;
+  const token = session ? recordIssuedSession(input.cwd || process.cwd(), session, own) : null;
+  const flags = token ? `--session ${own} --token ${token}` : `--session ${own}`;
+  return `${readOnly} Its own Workit session is ${own}: record verdicts with \`workit ledger verdict <result> ${flags} ...\` so the ledger tells it apart from the author.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 function handleHook(input, deps) {
   const { descriptor } = deps;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-pi",
-  "version": "8.13.0",
+  "version": "8.13.1",
   "description": "Workit native extension for Pi — tools, method skills, and session continuity",
   "keywords": [
     "agentic-coding",

package/skills/workit-fanout/references/orchestration.md

@@ -72,11 +72,12 @@ Which session id a verdict carries, per host:
 
 - Claude Code: subagents inherit your `WORKIT_SESSION_ID`, so the
   SubagentStart hook names each `verifier` and `reviewer` its own session
-  (`<lead>:<agent id>`), passed exactly as `--session`: the hook records the
-  ids it issues, and only those are accepted. An `implementer` is issued
+  (`<lead>:<agent id>`) and a token only that subagent sees, passed exactly as
+  `--session` and `--token`: the hook records the ids it issues, and only
+  those, with their token, are accepted. An `implementer` is issued
   none: it keeps your id in its env for its workit commands and commits.
 - Codex: the `workit-verifier` and `workit-reviewer` agents get the same
-  issued `--session` from SubagentStart; any other verifier passes
+  issued `--session` and `--token` from SubagentStart; any other verifier passes
   `--as verifier`.
 - OpenCode: a child session's shell already has
   `WORKIT_SESSION_ID=<lead>:<child>`; Pi: a supervised worker's shell has

package/skills/workit-review/SKILL.md

@@ -8,7 +8,7 @@ description: Independent review of a diff, branch or PR - intent fidelity and st
 Review the candidate, never the author's summary of it. A session that wrote a
 commit on the branch cannot record a passing verdict: if that is you, hand the
 review to a fresh agent with its own host-derived session: Claude Code and
-Codex, the `reviewer` or `verifier` agent (`--session` from SubagentStart);
+Codex, the `reviewer` or `verifier` agent (`--session` and `--token` from SubagentStart);
 OpenCode, a child session; Pi, a supervised worker. Never hand-mint one such
 as `<lead>-v1`: it is refused as `forged_session`.
 An author's `--self` verdict reads self-reviewed and never counts as