@brainervirus/workit-pi 8.29.0 → 8.29.2

package/dist/worker.js

@@ -7988,6 +7988,7 @@ var LAUNCHERS = new Set([
   "command"
 ]);
 var PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+var OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
 var PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
 var VALUE_OPTIONS = {
   git: new Set([

package/dist/workit.js

@@ -15987,13 +15987,13 @@ Autonomy contract:
   or an unresolved blocker; report open gaps and uncertain workers.
 - No endpoint named: stop at a local commit on a policy-compliant branch and
   state the next command. If the request implies delivery (fix, implement,
-  ship), go to the effective endpoint in \`workit grant show\`: \`pr\` opens
-  the PR; \`green\` babysits it without asking (workit-ship) to merge-ready,
-  never merging; \`merged\` also lands it with \`workit pr merge\`.
-  Merge and release need a workspace grant only the user raises from their
-  own terminal (a blocked verb names how); never edit workspaces.json or route
-  around grant_required. Release: \`workit release start <v>\`, commits,
-  \`finish\`; \`publish\` if asked.
+  ship), go to the effective endpoint in \`workit grant show\`: \`pr\` stops
+  at the PR even with merge granted; \`green\` babysits it (workit-ship) to
+  merge-ready, never merging; \`merged\` lands it with \`workit pr merge\`.
+  Only the user raises a grant or the endpoint, in a terminal outside the agent
+  host (\`workit grant set <ws> defaultEndpoint=merged\`); never edit
+  workspaces.json or route around grant_required. Release: \`workit release
+  start <v>\`, commits, \`finish\`; \`publish\` if asked.
 - Ask only for a product or preference choice, or for authority you lack, with
   your recommended answer. Facts are yours: read, run or prototype.
 - Label claims measured (run and seen this session), inferred, or guess.
@@ -16007,9 +16007,8 @@ Autonomy contract:
   is not evidence of a requested remote push. Before reporting delivery,
   reconcile every requested item and observe it (\`workit verify-delivery\`).
 
-CLI first: if a step has one right answer, use the \`workit\` verb instead of
-hand-running git, gh or glab (\`workit git|pr|ci|check|help\`;
-else \`npx -y @brainervirus/workit-cli\`).
+Read-only git and gh run raw; mutations go through workit verbs
+(\`workit git|pr|ci|check|help\`; else \`npx -y @brainervirus/workit-cli\`).
 Other checkout: \`workit <verb> --cwd <dir> …\` (verb first: host rules match it); one workit
 verb per shell call, never \`cd <dir> && workit\`. zsh-safe: no \`echo =====\`
 (\`printf '%s\\n' ---\`), quote globs and URLs, no variable named \`status\` or \`path\`.
@@ -17280,17 +17279,22 @@ function workitCheckTail(words) {
     return null;
   return args.slice(0, split).includes("--shell") ? { script: tail.join(" "), cwd } : { argv: tail, cwd };
 }
-function simpleCommand(command, dialect = "posix", depth = 0) {
+var OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
+function simpleCommand(command, dialect = "posix", depth = 0, shaped = false) {
   let segments;
   try {
     segments = segmentsOf(command, dialect);
   } catch {
     return null;
   }
-  if (segments.length !== 1)
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (!segments[0].pipe || !OUTPUT_FILTERS.has(commandName(filter.words[0])) || filter.group || filter.pipe || filter.unanalyzable || filter.subs?.length || filter.stdin?.length)
+      return null;
+  } else if (segments.length !== 1)
     return null;
   const [segment] = segments;
-  if (segment.group || segment.pipe || segment.unanalyzable || segment.redirects.length || segment.subs?.length || segment.stdin?.length)
+  if (segment.group || segment.pipe && !filter || segment.unanalyzable || segment.redirects.length && !shaped || segment.subs?.length || segment.stdin?.length)
     return null;
   const { words } = stripPrefixes(segment.words);
   const name = commandName(words[0]);
@@ -17975,7 +17979,6 @@ var nudgeFor = (action, host, session) => {
     case "pr-create":
       return `workit: prefer ${quote("workit pr create --fill")} (or --title/--body): it records the PR the merge gate checks.`;
     case "pr-read":
-      return `workit: ${quote("workit pr status")} shows the PR, its checks and the verdict state; ${quote("workit ci wait")} waits for checks.`;
     case "merge":
       return null;
   }
@@ -21634,12 +21637,38 @@ ${offer}` : ""}${options.addendum ? `
 ${options.addendum}` : ""}
 </workit-contract>`;
 };
+var checkoutAt = (cwd) => {
+  for (let dir = path27.resolve(cwd);; dir = path27.dirname(dir)) {
+    const dotGit = path27.join(dir, ".git");
+    if (fs19.existsSync(dotGit)) {
+      const admin = fs19.statSync(dotGit).isFile() ? path27.resolve(dir, /^gitdir:\s*(.+)$/mu.exec(fs19.readFileSync(dotGit, "utf8"))?.[1]?.trim() ?? "") : dotGit;
+      const head = fs19.readFileSync(path27.join(admin, "HEAD"), "utf8").trim();
+      return { root: dir, branch: /^ref: refs\/heads\/(.+)$/u.exec(head)?.[1] ?? null };
+    }
+    if (path27.dirname(dir) === dir)
+      return null;
+  }
+};
+var whereLine = (cwd) => {
+  try {
+    const checkout = checkoutAt(cwd);
+    if (!checkout)
+      return null;
+    const allowed = branchPolicySnapshotFor(cwd).namePolicy.allowed;
+    const kinds = allowed.some((pattern) => pattern.source === "^.*$") ? "any" : allowedKinds(allowed).join(", ") || "see `workit help git`";
+    const place = checkout.root === path27.resolve(cwd) ? "" : ` in ${checkout.root}`;
+    return `cwd ${cwd}${place} on ${checkout.branch ?? "detached HEAD"}; branch kinds: ${kinds}`;
+  } catch {
+    return null;
+  }
+};
 var turnContextText = (input, descriptor) => {
   try {
     const text = sessionCompactContext(new TaskStore(input.cwd), { host: input.host, handle: input.session.id }, hookOperationContext(input, descriptor), descriptor.context.task);
     if (text === MIGRATION_PENDING_NOTE)
       return text;
-    return text ? `<workit-task-context>${text}</workit-task-context>` : null;
+    return text ? `<workit-task-context>${[whereLine(input.cwd), text].filter(Boolean).join(`
+`)}</workit-task-context>` : null;
   } catch {
     return null;
   }
@@ -22424,7 +22453,7 @@ function heavyPlan(command, options) {
   const heavy = heavyLines(lines, options);
   if (!heavy.length)
     return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName2(simple[0])) && heavyLines([simple], options)[0];
   const judged = single ? [{ words: lines.flat(), text: command }] : heavy.map((match) => ({
     words: match.line,
@@ -22436,7 +22465,7 @@ function heavyPlan(command, options) {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`
+          note: ""
         };
     }
   if (single) {
@@ -22446,7 +22475,7 @@ function heavyPlan(command, options) {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null
   };
 }
@@ -24387,11 +24416,7 @@ function confineImplementerShell(input, command, dialect = "posix") {
   return confineImplementer(input, shellMutationTargets(input.cwd, command, dialect, true));
 }
 
-// packages/workit-core/src/hooks/handle.ts
-var usable2 = (value) => value === "native" || value === "partial";
-var NONE6 = { kind: "none" };
-var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
-var offered = new Set;
+// packages/workit-core/src/hooks/steering.ts
 var ROLES = {
   implementer: "implementer",
   verifier: "judge",
@@ -24402,34 +24427,56 @@ var workitRole = (descriptor, agentType) => {
   const name = agentType.startsWith(prefix) ? agentType.slice(prefix.length) : "";
   return Object.hasOwn(ROLES, name) ? ROLES[name] : null;
 };
+var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
+var roleSteering = (role, isolated) => ({
+  role,
+  isolated,
+  git: role === "implementer" ? isolated ? "plain" : "workit" : null,
+  nudges: role === null
+});
+var agentSteering = (descriptor, cwd, agent) => {
+  const role = agent.type ? workitRole(descriptor, agent.type) : null;
+  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(cwd, agent.id) : CLAUDE_WORKTREE.test(cwd));
+  return roleSteering(role, isolated);
+};
+
+// packages/workit-core/src/hooks/handle.ts
+var usable2 = (value) => value === "native" || value === "partial";
+var NONE6 = { kind: "none" };
+var resendsOnChange = (descriptor) => descriptor.context.turnResend === "on-change" && usable2(descriptor.context.perTurn);
+var offered = new Set;
 var implementerAgent = (input, descriptor) => Boolean(input.session.agentId) && input.session.agentType !== null && workitRole(descriptor, input.session.agentType) === "implementer";
 var subagentSession = (session, agentId) => [session, agentId].filter((part) => Boolean(part)).join(":").replace(/[^A-Za-z0-9_.:@/+-]/g, "-").slice(0, 128);
-var CLAUDE_WORKTREE = /[\\/]\.claude[\\/]worktrees[\\/]/;
 var isolatedGit = (cwd) => `Run git as plain, separate commands inside your worktree (\`git switch -c <branch> <base>\`, ${workspaceTrailers(cwd).enabled ? '`git commit --trailer "Workit-Session=<your session>"`, `git push`; `workit doctor --fix` can install a prepare-commit-msg hook that adds the trailer' : "`git commit` (this workspace sets trailers: false: add no Workit-Session trailer), `git push`"}; add Co-Authored-By with \`git commit --trailer\` in the same commit, never by amending), never \`workit git …\`: Claude Code's worktree isolation refuses a command that wraps git and cannot be turned off (https://code.claude.com/docs/en/worktrees#how-claude-code-enforces-isolation). Never dodge that check by renaming or re-wrapping git. Use workit for the non-git verbs (\`workit check\`, \`workit ledger\`, \`workit pr\`).`;
 var subagentStartText = (input, descriptor, event) => {
   const session = input.session.id ?? null;
-  const role = workitRole(descriptor, event.agentType);
+  const { role, isolated, git } = agentSteering(descriptor, input.cwd, {
+    type: event.agentType,
+    id: event.agentId
+  });
   const who = `${descriptor.label} subagent ${event.agentId} (${event.agentType})`;
-  const isolated = descriptor.subagents.worktreeIsolation === "native" && (role === "implementer" ? hostIsolated(input.cwd, event.agentId) : CLAUDE_WORKTREE.test(input.cwd));
   const guide = role === "implementer" ? branchGuidance(input.cwd) : null;
-  if (role === "implementer" && isolated)
+  if (git === "plain")
     return `Workit observed ${who} working in its own git worktree: it may edit and commit there, within its brief's scope. ${isolatedGit(input.cwd)} Plain git is expected here, and the branch name is still policy-checked: a raw \`git switch -c\`, \`git checkout -b\`, \`git branch\` or \`git worktree add -b\` onto a protected or non-compliant name is denied, so use a policy-compliant branch.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   if (isolated)
     return `${isolatedGit(input.cwd)}
 ${subagentStartText({ ...input, cwd: "" }, descriptor, event)}`;
-  if (role === "implementer")
+  if (git === "workit")
     return `Workit observed ${who} as an implementer: it edits and commits only in its own git worktree, the one its brief names (the lead makes it with \`workit fanout worktree create <slice>\` before spawning), never in the lead's checkout, within its brief's scope. Workit binds it to the first Workit worktree it changes: from then on an edit or a mutating git command outside that worktree is denied, and before then so is one outside every Workit worktree. Run Workit against the worktree one verb per call, never \`cd … &&\` chains or \`$VAR\` paths: \`workit git --cwd <worktree> commit -m "<message>" -- <paths>\`, \`workit check --cwd <worktree> <name>\` (verb first, so host allow rules match). The worktree is on the brief's branch once the lead made it; otherwise switch with \`workit git --cwd <worktree> branch <branch> --base <base>\` (or \`--kind <kind> --slug <slug>\`, which picks the base); branch policy hooks still deny protected or non-compliant branches, raw git included.${guide ? ` ${guide}` : " (e.g. feature/<slug>)"} Never record a verdict on your own work. Never push, open a PR, or merge unless the brief asks for it.`;
   const readOnly = `Workit observed ${who} as read-only/agent-guided.`;
   if (role !== "judge" || !event.agentId)
     return readOnly;
   const own = subagentSession(session, event.agentId);
   const cwd = input.cwd || process.cwd();
+  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
+  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const branch = judgeBranch(cwd);
+  if (descriptor.host === "codex_cli" || descriptor.host === "codex_desktop")
+    return `${readOnly} Its shell already acts as its own Workit session, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${verdictCommand({ branch, judge })}\`. Add no session or token option to it, and never set WORKIT_SESSION_ID by hand.`;
   const token = session ? recordIssuedSession(cwd, session, own) : null;
   if (session && !token)
     return `${readOnly} ${own} was already issued to an earlier subagent, so no token is handed out again and a verdict under it would be refused (unbound_session). Record no verdict as ${own}: spawn a fresh verifier or reviewer, which gets its own session and token.`;
-  const judge = event.agentType.endsWith("reviewer") ? "reviewer" : "verifier";
-  const line = verdictCommand({ branch: judgeBranch(cwd), judge, session: own, token });
-  const pick = judge === "verifier" ? ", --kind live when you drove the real surface" : "";
+  const line = verdictCommand({ branch, judge, session: own, token });
   return `${readOnly} Its own Workit session is ${own}, so the ledger tells its verdicts apart from the author's. Record the verdict with exactly this command (pick the result${pick}, name the candidate branch if it differs, say what you ran): \`${line}\`.${token ? " The token is this subagent's alone: never write it into a report, a file or a commit. --token needs a workit CLI at least as new as this plugin; if the CLI answers that --token is an unknown option, update the workit CLI (workit upgrade --cli) and record again." : ""}`;
 };
 var PRE_TOOL = new Set(["shell.pre", "write.pre", "tool.pre"]);
@@ -24517,7 +24564,12 @@ function decide(input, deps) {
       } : NONE6;
       if (descriptor.transport !== "hook-process")
         return rewritten(null);
-      const nudged = withContextLine(withContextLine(canDeny ? rawGitPre(input, event.command) : NONE6, aside), shipNudge(input, event.command));
+      const { nudges } = agentSteering(descriptor, input.cwd, {
+        type: input.session.agentType,
+        id: input.session.agentId
+      });
+      const nudge = canDeny ? rawGitPre(input, event.command, { nudge: nudges }) : NONE6;
+      const nudged = withContextLine(withContextLine(nudge, aside), shipNudge(input, event.command));
       if (!lease)
         return cwdCommand && nudged.kind !== "deny" ? rewritten(nudged.kind === "context" ? nudged.text : null) : nudged;
       return rewritten([rewriteNote(lease), nudged.kind === "context" ? nudged.text : null].filter(Boolean).join(`
@@ -24860,7 +24912,9 @@ var observeToolResult = (event, ctx) => {
       toolUseId: event.toolCallId
     });
     handleHook(post, { descriptor: PI_DESCRIPTOR, addendum: null });
-    const nudge = process.env.WORKIT_PI_WORKER_SESSION ? rawGitPre(post, command) : shellNudge(post, command);
+    const named = process.env.WORKIT_PI_WORKER_ROLE;
+    const role = named === "implementer" ? "implementer" : named ? "judge" : null;
+    const nudge = process.env.WORKIT_PI_WORKER_SESSION ? rawGitPre(post, command, { nudge: roleSteering(role, false).nudges }) : shellNudge(post, command);
     return nudge.kind === "context" ? { content: [...event.content, { type: "text", text: nudge.text }] } : undefined;
   } catch {
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-pi",
-  "version": "8.29.0",
+  "version": "8.29.2",
   "description": "Workit native extension for Pi — tools, method skills, and session continuity",
   "keywords": [
     "agentic-coding",