@brainervirus/workit-pi 8.28.1 → 8.29.1

package/dist/worker.js

@@ -7988,6 +7988,7 @@ var LAUNCHERS = new Set([
   "command"
 ]);
 var PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+var OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var VALUE_OPTIONS = {
   git: new Set([

package/dist/workit.js

@@ -13141,9 +13141,22 @@ function detectedChecks(root) {
   return checks;
 }
 var GATES = ["testing", "verification"];
+function configFileFor(root) {
+  const own = checksConfigFile(root);
+  if (fs11.existsSync(own))
+    return own;
+  const common = git3(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (!common || path13.basename(common) !== ".git")
+    return own;
+  const main = path13.dirname(common);
+  if (path13.resolve(main) === path13.resolve(root))
+    return own;
+  const shared = checksConfigFile(main);
+  return fs11.existsSync(shared) ? shared : own;
+}
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = checksConfigFile(root);
+  const file = configFileFor(root);
   const legacy = path13.basename(file) === LEGACY_CHECKS_FILE;
   const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
   const note = legacy ? {
@@ -17267,17 +17280,22 @@ function workitCheckTail(words) {
     return null;
   return args.slice(0, split).includes("--shell") ? { script: tail.join(" "), cwd } : { argv: tail, cwd };
 }
-function simpleCommand(command, dialect = "posix", depth = 0) {
+var OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
+function simpleCommand(command, dialect = "posix", depth = 0, shaped = false) {
   let segments;
   try {
     segments = segmentsOf(command, dialect);
   } catch {
     return null;
   }
-  if (segments.length !== 1)
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (!segments[0].pipe || !OUTPUT_FILTERS.has(commandName(filter.words[0])) || filter.group || filter.pipe || filter.unanalyzable || filter.subs?.length || filter.stdin?.length)
+      return null;
+  } else if (segments.length !== 1)
     return null;
   const [segment] = segments;
-  if (segment.group || segment.pipe || segment.unanalyzable || segment.redirects.length || segment.subs?.length || segment.stdin?.length)
+  if (segment.group || segment.pipe && !filter || segment.unanalyzable || segment.redirects.length && !shaped || segment.subs?.length || segment.stdin?.length)
     return null;
   const { words } = stripPrefixes(segment.words);
   const name = commandName(words[0]);
@@ -22411,7 +22429,7 @@ function heavyPlan(command, options) {
   const heavy = heavyLines(lines, options);
   if (!heavy.length)
     return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName2(simple[0])) && heavyLines([simple], options)[0];
   const judged = single ? [{ words: lines.flat(), text: command }] : heavy.map((match) => ({
     words: match.line,
@@ -22423,7 +22441,7 @@ function heavyPlan(command, options) {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`
+          note: ""
         };
     }
   if (single) {
@@ -22433,7 +22451,7 @@ function heavyPlan(command, options) {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null
   };
 }
@@ -24411,12 +24429,15 @@ ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
     return readOnly;
   const own = subagentSession(session, event.agentId);
   const cwd = input.cwd || process.cwd();
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const branch = judgeBranch(cwd);
+  if (descriptor.host === "codex_cli" || descriptor.host === "codex_desktop")
+    return `${readOnly} Its shell already acts as its own Workit session, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${verdictCommand({ branch, judge })}\`. Add no session or token option to it, and never set WORKIT_SESSION_ID by hand.`;
   const token = session ? recordIssuedSession(cwd, session, own) : null;
   if (session && !token)
     return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
-  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
-  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
-  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const line = verdictCommand({ branch, judge, session: own, token });
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-pi",
-  "version": "8.28.1",
+  "version": "8.29.1",
   "description": "Workit native extension for Pi — tools, method skills, and session continuity",
   "keywords": [
     "agentic-coding",