@brunosps00/dev-workflow 2.5.0 → 2.6.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "dev-workflow",
   "description": "Standalone, à-la-carte skills from the dev-workflow pipeline: minimalism, search-first, simplification, verification, security review, and more.",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "author": {
     "name": "Bruno Santos"
   },

package/CHANGELOG.md

@@ -10,6 +10,35 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 > those versions were released, so they are summaries of what shipped, not
 > contemporaneous release notes. `git log` remains the authoritative record.
 
+## [2.6.0] — 2026-10-07
+
+### Added
+
+- **Git guardrails under Codex.** `init` and `update` also write the git-guardrails
+  `PreToolUse` hook to `.codex/hooks.json` — same payload and deny contract as Claude Code,
+  matcher `Bash`. It is the only hook Codex gets: the session-cost tracker parses Claude Code
+  transcripts and Codex has no statusLine command. Codex runs project hooks only after the
+  project and the hook are trusted. Merge-aware like the Claude side: a malformed
+  `.codex/hooks.json` is left untouched, and `uninstall` removes only our entry, deleting the
+  file when nothing else is left. `doctor` warns when the Codex guardrail is missing or
+  outdated.
+
+### Fixed
+
+- **Hooks stopped running whenever the shell left the project root.** The hook and statusLine
+  commands were cwd-relative (`node .dw/scripts/hooks/…`). Claude Code runs hooks in the
+  session's current directory, which follows every `cd`, so from any subdirectory they failed
+  with `Cannot find module` — and a failing `PreToolUse` hook is non-blocking, so Bash ran with
+  no git guardrail at all. In one real session, 843 of 1,243 Bash calls ran unguarded this way.
+  Commands now resolve `${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel || pwd)}`:
+  Claude Code exports the variable to hooks, and Codex, which exports none, gets the git root.
+  `update` rewrites the old entries in place, and `doctor` reports a cwd-relative guardrail as
+  an issue.
+- The statusline read `.dw/` state (active spec, minimalism mode, today's spend) from the
+  current directory. It now reads it from the payload's `workspace.project_dir`.
+- The guardrail's deny message pointed only at `.claude/settings.json`; it now names
+  `.codex/hooks.json` too, as does the invariants floor.
+
 ## [2.5.0] — 2026-09-28
 
 ### Added

package/README.md

@@ -16,7 +16,7 @@ This will:
 5. Install bundled skills (`dw-verify`, `dw-memory`, `dw-review-rigor`, `dw-ui-discipline`, `dw-testing-discipline`, `security-review`, etc.) to `.agents/skills/`
 6. Generate skill wrappers and project agents for Claude Code, Codex, Copilot, and OpenCode
 7. Configure MCP servers (Context7 + Playwright)
-8. Install enforcement hooks (git guardrails + a `SessionEnd` token-cost tracker → `.dw/metrics/costs.jsonl`) + a statusline (branch · active spec · minimalism mode · today's estimated spend) into `.claude/settings.json` (merge-aware — your own hooks/statusline are never overwritten)
+8. Install enforcement hooks (git guardrails + a `SessionEnd` token-cost tracker → `.dw/metrics/costs.jsonl`) + a statusline (branch · active spec · minimalism mode · today's estimated spend) into `.claude/settings.json`, and the git guardrails into `.codex/hooks.json` for Codex (merge-aware — your own hooks/statusline are never overwritten; Codex runs project hooks only after you trust them)
 
 > **Compozy-inspired disciplines.** Since 0.5.0, dev-workflow bundles three primitives — `dw-verify`, `dw-memory`, `dw-review-rigor` — adapted from the [Compozy](https://github.com/compozy/compozy) project and invoked internally by existing commands. See [docs/compozy-integration.md](docs/compozy-integration.md) for what was ported and what was not.
 

package/lib/doctor.js

@@ -10,7 +10,7 @@ const {
 } = require('./agents');
 const { readInstallState, STATE_RELATIVE_PATH } = require('./install-state');
 const { validateSkillRegistry, readSkillRegistry, validateSkillStructuredReturn } = require('./skill-registry');
-const { GIT_GUARDRAILS_CMD, STATUSLINE_CMD, HOOKS_DIR_MARKER } = require('./hooks');
+const { GIT_GUARDRAILS_SCRIPT, GIT_GUARDRAILS_CMD, STATUSLINE_CMD, HOOKS_DIR_MARKER, CODEX_HOOKS_FILE } = require('./hooks');
 const removedCommands = require('./removed-commands');
 
 function run() {
@@ -212,6 +212,8 @@ function checkHooks(projectRoot, issues, warnings) {
     if (!fs.existsSync(file)) issues.push(`Missing hook script: ${path.relative(projectRoot, file)}`);
   }
 
+  checkCodexHooks(projectRoot, warnings);
+
   const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
   if (!fs.existsSync(settingsPath)) return; // checkMcp already reports this
 
@@ -222,17 +224,52 @@ function checkHooks(projectRoot, issues, warnings) {
     return; // checkMcp already reports malformed settings
   }
 
-  const preToolUse = (settings.hooks && settings.hooks.PreToolUse) || [];
-  const guardrailWired = preToolUse.some(
-    (g) => g && Array.isArray(g.hooks) && g.hooks.some((h) => h && h.command === GIT_GUARDRAILS_CMD),
-  );
-  if (!guardrailWired) issues.push('Missing git-guardrails PreToolUse hook in .claude/settings.json');
+  const guardrailCommands = guardrailCommandsOf(settings);
+  if (guardrailCommands.length === 0) {
+    issues.push('Missing git-guardrails PreToolUse hook in .claude/settings.json');
+  } else if (!guardrailCommands.includes(GIT_GUARDRAILS_CMD)) {
+    // Pre-2.5.1 installs wired a cwd-relative path: it fails (non-blocking) and stops
+    // guarding as soon as the shell leaves the project root.
+    issues.push('Outdated git-guardrails PreToolUse hook in .claude/settings.json. Run `dev-workflow update`.');
+  }
 
   const statusLine = settings.statusLine;
+  const statusCommand = String((statusLine && statusLine.command) || '');
   if (!statusLine) {
     issues.push('Missing statusLine in .claude/settings.json');
-  } else if (statusLine.command !== STATUSLINE_CMD && !String(statusLine.command || '').includes(HOOKS_DIR_MARKER)) {
-    warnings.push('Custom statusLine set; dev-workflow statusline is not active (add `node .dw/scripts/hooks/statusline.mjs`).');
+  } else if (!statusCommand.includes(HOOKS_DIR_MARKER)) {
+    warnings.push(`Custom statusLine set; dev-workflow statusline is not active (add \`${STATUSLINE_CMD}\`).`);
+  } else if (statusCommand !== STATUSLINE_CMD) {
+    warnings.push('Outdated dev-workflow statusLine in .claude/settings.json. Run `dev-workflow update`.');
+  }
+}
+
+function guardrailCommandsOf(config) {
+  const preToolUse = (config && config.hooks && config.hooks.PreToolUse) || [];
+  return preToolUse.flatMap((g) =>
+    g && Array.isArray(g.hooks)
+      ? g.hooks.map((h) => h && h.command).filter((c) => typeof c === 'string' && c.includes(GIT_GUARDRAILS_SCRIPT))
+      : [],
+  );
+}
+
+// Codex is one of several supported agents, so a missing Codex guardrail is a
+// warning rather than an issue.
+function checkCodexHooks(projectRoot, warnings) {
+  const file = path.join(projectRoot, CODEX_HOOKS_FILE);
+  let commands = [];
+  if (fs.existsSync(file)) {
+    try {
+      commands = guardrailCommandsOf(JSON.parse(fs.readFileSync(file, 'utf-8')));
+    } catch {
+      warnings.push(`Malformed ${CODEX_HOOKS_FILE}; Codex cannot load the git guardrail.`);
+      return;
+    }
+  }
+  if (commands.length === 0) {
+    warnings.push(`Missing git-guardrails hook in ${CODEX_HOOKS_FILE} (Bash under Codex is unguarded). Run \`dev-workflow update\`.`);
+  } else if (!commands.includes(GIT_GUARDRAILS_CMD)) {
+    warnings.push(`Outdated git-guardrails hook in ${CODEX_HOOKS_FILE}. Run \`dev-workflow update\`.`);
   }
 }
 
@@ -245,4 +282,4 @@ function checkLegacyCommands(projectRoot, warnings) {
   }
 }
 
-module.exports = { run };
+module.exports = { run, checkHooks };

package/lib/hooks.js

@@ -1,14 +1,33 @@
+const fs = require('fs');
+const path = require('path');
 const { readSettings, writeSettings } = require('./mcp');
 
 // dev-workflow-owned hook/statusline scripts live under this path. The substring
-// is the marker used to identify OUR entries in .claude/settings.json so we can
-// add/refresh them on update without ever touching the user's own hooks.
+// is the marker used to identify OUR entries in .claude/settings.json and
+// .codex/hooks.json so we can add/refresh them on update without ever touching
+// the user's own hooks.
 const HOOKS_DIR_MARKER = '.dw/scripts/hooks/';
-const GIT_GUARDRAILS_CMD = 'node .dw/scripts/hooks/git-guardrails.mjs';
-const STATUSLINE_CMD = 'node .dw/scripts/hooks/statusline.mjs';
+
+// Hooks run in the session's *current* directory, which in Claude Code follows
+// every `cd` in the Bash tool. A cwd-relative `node .dw/...` breaks with "Cannot
+// find module" as soon as the shell sits in a subdirectory, and a failing
+// PreToolUse hook is non-blocking: the command runs unguarded. Claude Code exports
+// $CLAUDE_PROJECT_DIR to hooks; Codex exports no project variable, so fall back to
+// the git root (a worktree's own root), then to the cwd. The fallback is only
+// evaluated when the variable is unset.
+const PROJECT_ROOT = '${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}';
+const hookCommand = (script) => `node "${PROJECT_ROOT}/${HOOKS_DIR_MARKER}${script}"`;
+
+// Codex reads project hooks from .codex/hooks.json (same shape as Claude Code's
+// "hooks" block; PreToolUse matches tool_name "Bash"). It only runs them once the
+// project's .codex/ layer and the hook itself are trusted in Codex.
+const CODEX_HOOKS_FILE = path.join('.codex', 'hooks.json');
+
 const GIT_GUARDRAILS_SCRIPT = 'git-guardrails.mjs';
-const SESSION_COST_CMD = 'node .dw/scripts/hooks/session-cost.mjs';
+const GIT_GUARDRAILS_CMD = hookCommand(GIT_GUARDRAILS_SCRIPT);
+const STATUSLINE_CMD = hookCommand('statusline.mjs');
 const SESSION_COST_SCRIPT = 'session-cost.mjs';
+const SESSION_COST_CMD = hookCommand(SESSION_COST_SCRIPT);
 
 function isOurs(command) {
   return typeof command === 'string' && command.includes(HOOKS_DIR_MARKER);
@@ -25,8 +44,11 @@ function isOurs(command) {
  *  - leaves a user-defined statusLine untouched (reports it so the caller can
  *    surface a post-update note).
  *
- * Returns { hooks, statusLine } where each is 'added' | 'updated' | 'unchanged'
- * (statusLine may also be 'skipped-user').
+ * Also reconciles the git guardrail into .codex/hooks.json (see installCodexHooks).
+ *
+ * Returns { hooks, sessionCost, statusLine, codex } where each is 'added' |
+ * 'updated' | 'unchanged' (statusLine may also be 'skipped-user', codex
+ * 'skipped-malformed').
  */
 function installHooks(projectRoot) {
   const settings = readSettings(projectRoot);
@@ -40,7 +62,44 @@ function installHooks(projectRoot) {
     writeSettings(projectRoot, settings);
   }
 
-  return { hooks: hooksResult, sessionCost: sessionCostResult, statusLine: statusLineResult };
+  return {
+    hooks: hooksResult,
+    sessionCost: sessionCostResult,
+    statusLine: statusLineResult,
+    codex: installCodexHooks(projectRoot),
+  };
+}
+
+function readCodexHooks(projectRoot) {
+  const file = path.join(projectRoot, CODEX_HOOKS_FILE);
+  if (!fs.existsSync(file)) return {};
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeCodexHooks(projectRoot, config) {
+  const file = path.join(projectRoot, CODEX_HOOKS_FILE);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+}
+
+/**
+ * Reconcile the git guardrail into .codex/hooks.json — the only dev-workflow hook
+ * Codex gets: session-cost parses Claude Code transcripts and Codex has no
+ * statusLine command. Same marker-based contract as the Claude side.
+ * Returns 'added' | 'updated' | 'unchanged' | 'skipped-malformed'.
+ */
+function installCodexHooks(projectRoot) {
+  const config = readCodexHooks(projectRoot);
+  if (config === null) return 'skipped-malformed';
+  const before = JSON.stringify(config);
+  const result = reconcilePreToolUseGitGuardrails(config);
+  if (JSON.stringify(config) !== before) writeCodexHooks(projectRoot, config);
+  return result;
 }
 
 /**
@@ -135,30 +194,14 @@ function reconcileStatusLine(settings) {
 }
 
 /**
- * Remove ONLY dev-workflow-owned hook + statusLine entries (used by uninstall).
- * Returns the number of entries removed.
+ * Remove ONLY dev-workflow-owned hook + statusLine entries from .claude/settings.json
+ * and .codex/hooks.json (used by uninstall). Returns the number of entries removed.
  */
 function removeHooks(projectRoot) {
   const settings = readSettings(projectRoot);
-  let removed = 0;
-
   // Remove OUR hook entries from every event (PreToolUse, SessionEnd, PostToolUse, …),
   // identified by the .dw/scripts/hooks/ marker; never touch user-added hooks.
-  if (settings.hooks && typeof settings.hooks === 'object') {
-    for (const event of Object.keys(settings.hooks)) {
-      const groups = settings.hooks[event];
-      if (!Array.isArray(groups)) continue;
-      for (const group of groups) {
-        if (!group || !Array.isArray(group.hooks)) continue;
-        const kept = group.hooks.filter((h) => !(h && isOurs(h.command)));
-        removed += group.hooks.length - kept.length;
-        group.hooks = kept;
-      }
-      settings.hooks[event] = groups.filter((g) => g && Array.isArray(g.hooks) && g.hooks.length > 0);
-      if (settings.hooks[event].length === 0) delete settings.hooks[event];
-    }
-    if (Object.keys(settings.hooks).length === 0) delete settings.hooks;
-  }
+  let removed = removeOurHookEntries(settings);
 
   if (settings.statusLine && isOurs(settings.statusLine.command)) {
     delete settings.statusLine;
@@ -166,6 +209,46 @@ function removeHooks(projectRoot) {
   }
 
   if (removed > 0) writeSettings(projectRoot, settings);
+  return removed + removeCodexHooks(projectRoot);
+}
+
+function removeOurHookEntries(config) {
+  let removed = 0;
+  if (!config.hooks || typeof config.hooks !== 'object') return 0;
+  for (const event of Object.keys(config.hooks)) {
+    const groups = config.hooks[event];
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      if (!group || !Array.isArray(group.hooks)) continue;
+      const kept = group.hooks.filter((h) => !(h && isOurs(h.command)));
+      removed += group.hooks.length - kept.length;
+      group.hooks = kept;
+    }
+    config.hooks[event] = groups.filter((g) => g && Array.isArray(g.hooks) && g.hooks.length > 0);
+    if (config.hooks[event].length === 0) delete config.hooks[event];
+  }
+  if (Object.keys(config.hooks).length === 0) delete config.hooks;
+  return removed;
+}
+
+// Remove OUR entries from .codex/hooks.json; delete the file only when nothing
+// of the user's is left in it.
+function removeCodexHooks(projectRoot) {
+  const config = readCodexHooks(projectRoot);
+  if (!config) return 0;
+  const removed = removeOurHookEntries(config);
+  if (removed === 0) return 0;
+  const file = path.join(projectRoot, CODEX_HOOKS_FILE);
+  if (Object.keys(config).length === 0) {
+    fs.rmSync(file);
+    try {
+      fs.rmdirSync(path.dirname(file));
+    } catch {
+      /* .codex/ still holds other files */
+    }
+  } else {
+    writeCodexHooks(projectRoot, config);
+  }
   return removed;
 }
 
@@ -173,6 +256,8 @@ module.exports = {
   installHooks,
   removeHooks,
   HOOKS_DIR_MARKER,
+  CODEX_HOOKS_FILE,
+  GIT_GUARDRAILS_SCRIPT,
   GIT_GUARDRAILS_CMD,
   STATUSLINE_CMD,
   SESSION_COST_CMD,

package/lib/init.js

@@ -4,7 +4,7 @@ const { ensureDir, copyDir, writeFile, upsertDelimitedBlock, log, listFilesRecur
 const { selectLanguage } = require('./prompts');
 const { generateWrappers } = require('./wrappers');
 const { installMCPs } = require('./mcp');
-const { installHooks } = require('./hooks');
+const { installHooks, STATUSLINE_CMD } = require('./hooks');
 const { generateAgents } = require('./agents');
 const { migrate: migrateGsd } = require('./migrate-gsd');
 const { migrate: migrateSkills } = require('./migrate-skills');
@@ -408,13 +408,19 @@ async function run({ force = false, lang = null, mode = 'init', profile = null,
   const mcpResults = installMCPs(projectRoot);
   console.log(`    ${mcpResults.added} configured, ${mcpResults.skipped} already present\n`);
 
-  // 9.2. Reconcile dev-workflow hooks + statusline (marker-based, merge-aware:
-  // refreshes our entries, never touches user-defined hooks/statusLine).
+  // 9.2. Reconcile dev-workflow hooks + statusline into .claude/settings.json and the
+  // git guardrail into .codex/hooks.json (marker-based, merge-aware: refreshes our
+  // entries, never touches user-defined hooks/statusLine).
   console.log('  Hooks & statusline:');
   const hookResults = installHooks(projectRoot);
-  console.log(`    git-guardrails: ${hookResults.hooks}, session-cost: ${hookResults.sessionCost}, statusline: ${hookResults.statusLine}\n`);
+  console.log(`    git-guardrails: ${hookResults.hooks}, session-cost: ${hookResults.sessionCost}, statusline: ${hookResults.statusLine}, codex git-guardrails: ${hookResults.codex}\n`);
+  if (hookResults.codex === 'skipped-malformed') {
+    console.log('    Note: .codex/hooks.json is not valid JSON; the Codex git guardrail was not installed.\n');
+  } else if (hookResults.codex !== 'unchanged') {
+    console.log('    Note: Codex runs .codex/hooks.json only after you trust the project and review the hook in Codex.\n');
+  }
   if (hookResults.statusLine === 'skipped-user') {
-    console.log('    Note: a custom statusLine is set; to show dev-workflow state add `node .dw/scripts/hooks/statusline.mjs`.\n');
+    console.log(`    Note: a custom statusLine is set; to show dev-workflow state add \`${STATUSLINE_CMD}\`.\n`);
   }
 
   // 9.5. Persist install state for diagnostics and repair.

package/lib/uninstall.js

@@ -104,8 +104,8 @@ function run() {
   }
   console.log();
 
-  // 4.5. Remove dev-workflow hooks + statusline from .claude/settings.json
-  // (marker-based; user-defined hooks/statusLine are left intact). The hook
+  // 4.5. Remove dev-workflow hooks + statusline from .claude/settings.json and
+  // .codex/hooks.json (marker-based; user-defined hooks/statusLine are left intact). The hook
   // scripts themselves were removed with .dw/scripts/ above.
   console.log('  Hooks & statusline:');
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"

package/scaffold/en/references/invariants.md

@@ -50,8 +50,9 @@ it is the boundary working. An agent that cannot destroy work cannot be talked i
 
 **How this is enforced:** partly by `.dw/scripts/hooks/git-guardrails.mjs`, a `PreToolUse` hook that denies
 these patterns on Bash. The hook is **one implementation, not the source of the rule**, and it has two
-known limits: it only covers Bash under Claude Code, and it **fails open** — a parse error or a runtime
-fault allows the command through. So the rule binds even where the hook does not run.
+known limits: it only covers Bash under Claude Code and Codex (Codex runs it only once the project and the
+hook are trusted), and it **fails open** — a parse error or a runtime fault allows the command through. So
+the rule binds even where the hook does not run.
 
 Two operations are deliberately left out of the hook and live only here: `rebase` and `commit --amend`.
 Both are routine on unpushed work, and a command line cannot tell pushed from unpushed. Denying them would

package/scaffold/pt-br/references/invariants.md

@@ -49,8 +49,9 @@ funcionando. Um agente que não consegue destruir trabalho não pode ser convenc
 
 **Como isso é verificado:** em parte pelo `.dw/scripts/hooks/git-guardrails.mjs`, um hook `PreToolUse` que
 nega esses padrões no Bash. O hook é **uma implementação, não a fonte da regra**, e tem dois limites
-conhecidos: só cobre Bash no Claude Code, e **falha aberto** — erro de parse ou exceção em runtime deixa o
-comando passar. Então a regra obriga mesmo onde o hook não roda.
+conhecidos: só cobre Bash no Claude Code e no Codex (o Codex só o roda depois que o projeto e o hook são
+marcados como confiáveis), e **falha aberto** — erro de parse ou exceção em runtime deixa o comando passar.
+Então a regra obriga mesmo onde o hook não roda.
 
 Duas operações ficam de fora do hook de propósito e vivem só aqui: `rebase` e `commit --amend`. As duas são
 rotina em trabalho não pushado, e uma linha de comando não distingue pushado de não pushado. Negá-las

package/scaffold/scripts/hooks/git-guardrails.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
- * dev-workflow git guardrails — Claude Code PreToolUse hook (matcher: Bash).
+ * dev-workflow git guardrails — PreToolUse hook (matcher: Bash) for Claude Code
+ * (.claude/settings.json) and Codex (.codex/hooks.json); both send the same payload.
  *
  * Blocks irreversible git commands (force push, hard reset, clean -f, branch
  * deletion, remote branch deletion). Everything else is allowed.
@@ -76,7 +77,7 @@ export function evaluatePayload(input) {
           permissionDecision: 'deny',
           permissionDecisionReason:
             `Blocked by dev-workflow git guardrails: ${rule.why}. ` +
-            `If this is intentional, run it yourself outside the agent, or adjust .claude/settings.json hooks.`,
+            `If this is intentional, run it yourself outside the agent, or adjust the hook in .claude/settings.json or .codex/hooks.json.`,
         },
       };
     }

package/scaffold/scripts/hooks/statusline.mjs

@@ -3,9 +3,11 @@
  * dev-workflow statusline — Claude Code statusLine command.
  *
  * Prints one line: git branch · dev-workflow active spec (if any) · minimalism
- * mode. Reads the session payload (JSON on stdin) for the working dir; falls
- * back to process.cwd(). Fails SAFE — any error prints a minimal line so the
- * statusline never breaks the session.
+ * mode. Reads the session payload (JSON on stdin): the branch comes from the
+ * current dir, the .dw/ state from the project dir, since the shell may sit in a
+ * subdirectory. Falls back to $CLAUDE_PROJECT_DIR, then process.cwd(). Fails
+ * SAFE — any error prints a minimal line so the statusline never breaks the
+ * session.
  *
  * Minimalism mode is read from .dw/minimalism.json (see the dw-minimalism skill).
  */
@@ -93,23 +95,24 @@ function activeSpec(cwd) {
 
 async function main() {
   let cwd = process.cwd();
+  let root = process.env.CLAUDE_PROJECT_DIR || '';
   try {
     const payload = JSON.parse(await readStdin());
-    cwd =
-      (payload && payload.workspace && payload.workspace.current_dir) ||
-      (payload && payload.cwd) ||
-      cwd;
+    const workspace = (payload && payload.workspace) || {};
+    cwd = workspace.current_dir || (payload && payload.cwd) || cwd;
+    root = workspace.project_dir || root;
   } catch {
-    /* use process.cwd() */
+    /* use $CLAUDE_PROJECT_DIR / process.cwd() */
   }
+  root = root || cwd;
 
   const parts = [];
   const branch = gitBranch(cwd);
   if (branch) parts.push(`⎇ ${branch}`);
-  const spec = activeSpec(cwd);
+  const spec = activeSpec(root);
   if (spec) parts.push(spec);
-  parts.push(`min:${minimalismMode(cwd)}`);
-  const cost = costToday(cwd);
+  parts.push(`min:${minimalismMode(root)}`);
+  const cost = costToday(root);
   if (cost) parts.push(cost);
 
   process.stdout.write(`dw · ${parts.join(' · ')}`);