@workit-dev/core 0.0.1 → 1.0.0

package/scripts/sync-release-manifests.ts

@@ -0,0 +1,82 @@
+#!/usr/bin/env bun
+// Optional manual manifest sync. The release never runs it: since #704
+// semantic-release and rewrite-workspace-deps.ts stamp the version into the
+// manifests of the CI checkout at publish time, and main is not synced, so the
+// committed manifests keep the version of the last manual sync. Run it in any
+// PR to align every tracked manifest with the latest `workit-dev-v*` tag (or a version
+// given as argv[2]); it is idempotent. plugin.test.ts reads
+// SYNC_MANIFEST_PATHS to keep every plugin manifest on this list.
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { RELEASE_TAG, TAG_GLOB } from "./analyze-release-scope";
+
+export const SYNC_MANIFEST_PATHS = [
+  "package.json",
+  "packages/workit-core/package.json",
+  "packages/workit-mcp/package.json",
+  "packages/workit-cli/package.json",
+  "packages/workit-opencode/package.json",
+  "packages/workit-cursor/package.json",
+  "packages/workit-codex/package.json",
+  "packages/workit-pi/package.json",
+  "packages/workit-claude-code/package.json",
+  // Kept in lockstep with packages/workit-core/package.json by contract test.
+  "packages/workit-cursor/.cursor-plugin/plugin.json",
+  "packages/workit-codex/.codex-plugin/plugin.json",
+  // Claude Code reads the plugin version from here (the marketplace entry
+  // carries none), so it must track the published npm version.
+  "packages/workit-claude-code/.claude-plugin/plugin.json",
+];
+
+export type ManifestSyncResult = { version: string; changed: string[] };
+
+/**
+ * Write `version` (a bare semver or a `workit-dev-v` release tag) into every tracked
+ * manifest under `root`. Idempotent: manifests already at the target version
+ * are left byte-untouched and omitted from `changed`. Throws on a value that
+ * is not a plain release version (`latest`, branches, ranges).
+ */
+export function syncManifests(root: string, tagOrVersion: string): ManifestSyncResult {
+  const value = tagOrVersion.trim();
+  const version = RELEASE_TAG.exec(value)?.[1] ?? RELEASE_TAG.exec(`workit-dev-v${value}`)?.[1];
+  if (!version) throw new Error(`invalid version tag: ${JSON.stringify(tagOrVersion)}`);
+  const changed: string[] = [];
+  for (const rel of SYNC_MANIFEST_PATHS) {
+    const file = resolve(root, ...rel.split("/"));
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    if (parsed.version === version) continue;
+    parsed.version = version;
+    writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+    changed.push(rel);
+  }
+  return { version, changed };
+}
+
+/** The newest release tag by descending semver refname order (none throws). */
+function latestReleaseTag(cwd?: string): string {
+  const tag = execFileSync("git", ["tag", "--list", TAG_GLOB, "--sort=-v:refname"], {
+    cwd,
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+  })
+    .split("\n")
+    .map((line) => line.trim())
+    .find((line) => RELEASE_TAG.test(line));
+  if (!tag)
+    throw new Error(`no ${TAG_GLOB} release tag found — run after the first semantic-release`);
+  return tag;
+}
+
+if (import.meta.main) {
+  const root = process.argv[3]
+    ? resolve(process.argv[3])
+    : resolve(import.meta.dir, "..", "..", "..");
+  const tag = process.argv[2] ?? latestReleaseTag(root);
+  const { version, changed } = syncManifests(root, tag);
+  console.log(
+    changed.length > 0
+      ? `synced ${changed.length} manifest(s) to ${version}: ${changed.join(", ")}`
+      : `manifests already at ${version}`,
+  );
+}

package/scripts/sync-runtime.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Sync workit runtime for Cursor + OpenCode.
+# Prefer local monorepo (dev) when present; otherwise git-pull the share clone.
+set -euo pipefail
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/lib/config-dir.sh"
+
+SHARE="$(workit_data_dir)"
+PLUGIN_DIR="${HOME}/.cursor/plugins/local/workit"
+DEV_DEFAULT="${HOME}/Documents/projects/personal/workit"
+DEV="${WORKIT_DEV:-$DEV_DEFAULT}"
+REPO_SLUG="${WORKIT_REPO:-BrainerVirus/workit}"
+LOCK_DIR="$(workit_runtime_dir)"
+LOCK="$LOCK_DIR/sync.lock"
+
+# RR-05: missing required tools, an unacquirable lock, or a failed clone must
+# never look like a successful sync.
+if ! command -v flock >/dev/null 2>&1; then
+  echo "FATAL: sync-runtime requires flock (util-linux) — not found in PATH" >&2
+  exit 1
+fi
+mkdir -p "$LOCK_DIR"
+exec 9>"$LOCK"
+if ! flock -n 9; then
+  echo "sync-runtime: another process holds $LOCK — state unverified, failing" >&2
+  exit 1
+fi
+
+SRC=""
+if [ -f "${DEV}/packages/workit-opencode/src/plugin.ts" ] && [ -d "${DEV}/packages/workit-cursor/.cursor-plugin" ]; then
+  SRC="$DEV"
+elif [ -d "${SHARE}/.git" ]; then
+  # RR-05: a failed update of an existing share clone must not look like a
+  # successful sync — propagate fetch/pull failures to a FATAL nonzero exit.
+  if ! git -C "$SHARE" fetch --quiet origin; then
+    echo "FATAL: could not fetch updates for $SHARE" >&2
+    exit 1
+  fi
+  if ! git -C "$SHARE" pull --ff-only --quiet origin main; then
+    echo "FATAL: could not update $SHARE from origin/main" >&2
+    exit 1
+  fi
+  SRC="$SHARE"
+elif [ ! -d "${SHARE}/packages/workit-core/src" ]; then
+  mkdir -p "$(dirname "$SHARE")"
+  if ! git clone --depth 1 "https://github.com/${REPO_SLUG}.git" "$SHARE"; then
+    echo "FATAL: could not clone https://github.com/${REPO_SLUG}.git into $SHARE" >&2
+    exit 1
+  fi
+  SRC="$SHARE"
+else
+  SRC="$SHARE"
+fi
+
+CURSOR_SRC="$SRC/packages/workit-cursor"
+BUN_BIN=""
+if [ -n "${BUN:-}" ]; then
+  BUN_BIN="$BUN"
+  if [ ! -x "$BUN_BIN" ]; then
+    echo "FATAL: BUN is set but unusable: $BUN_BIN" >&2
+    exit 1
+  fi
+elif [ -x "$HOME/.bun/bin/bun" ]; then
+  BUN_BIN="$HOME/.bun/bin/bun"
+elif command -v bun >/dev/null 2>&1; then
+  BUN_BIN="$(command -v bun)"
+else
+  echo "FATAL: Bun is required to build the Cursor adapter" >&2
+  exit 1
+fi
+
+for DEP in @workit-dev/core @workit-dev/mcp @modelcontextprotocol/sdk zod; do
+  if [ ! -e "$SRC/node_modules/$DEP" ]; then
+    if [ ! -f "$SRC/bun.lock" ]; then
+      echo "FATAL: dependency install requires $SRC/bun.lock" >&2
+      exit 1
+    fi
+    if ! (cd "$SRC" && "$BUN_BIN" install --frozen-lockfile); then
+      echo "FATAL: root dependency install failed in $SRC" >&2
+      exit 1
+    fi
+    break
+  fi
+done
+
+if ! (cd "$SRC" && PATH="$(dirname "$BUN_BIN"):$PATH" "$BUN_BIN" "$SRC/packages/workit-mcp/scripts/build.ts"); then
+  echo "FATAL: shared MCP build failed in $SRC" >&2
+  exit 1
+fi
+if ! (cd "$SRC" && PATH="$(dirname "$BUN_BIN"):$PATH" "$BUN_BIN" "$CURSOR_SRC/scripts/build.ts"); then
+  echo "FATAL: Cursor adapter build failed in $CURSOR_SRC" >&2
+  exit 1
+fi
+for ENTRY in mcp-server.js cursor-session-start.js workit-hook.js; do
+  DIST_ENTRY="$CURSOR_SRC/dist/$ENTRY"
+  if [ ! -f "$DIST_ENTRY" ] || [ ! -s "$DIST_ENTRY" ] || [ "$(IFS= read -r LINE <"$DIST_ENTRY"; printf '%s' "$LINE")" != '#!/usr/bin/env node' ]; then
+    echo "FATAL: Cursor adapter invalid dist entry: $DIST_ENTRY" >&2
+    exit 1
+  fi
+done
+
+if [ "$SRC" != "$SHARE" ]; then
+  mkdir -p "$SHARE"
+  # Keep .git if share is a clone; never wipe it when syncing from the monorepo
+  # versions/, current and bin/ are the owned CLI install (workit upgrade): never delete them
+  rsync -a --delete \
+    --exclude '/versions' --exclude '/current' --exclude '/bin' \
+    --exclude '.git' \
+    --exclude 'node_modules' \
+    --exclude 'cursor/mcp/node_modules' \
+    --exclude '.cache' \
+    "$SRC/" "$SHARE/"
+fi
+
+# Cursor IDE package (real directory)
+mkdir -p "${HOME}/.cursor/plugins/local"
+mkdir -p "$PLUGIN_DIR"
+rsync -a --delete \
+  --exclude 'mcp/node_modules' \
+  "$SHARE/packages/workit-cursor/" "$PLUGIN_DIR/"
+
+if ! "$BUN_BIN" "$SHARE/packages/workit-core/src/core/skill-manifests.ts" "$PLUGIN_DIR"; then
+  echo "FATAL: Cursor skill validation failed: $PLUGIN_DIR" >&2
+  exit 1
+fi
+# Canonical user rules -> Cursor .mdc (compiled by the shared core)
+CONFIG_RULES_DIR="$(resolve_config_dir)/rules"
+if [ -d "$CONFIG_RULES_DIR" ]; then
+  # rules.ts is loaded only here (scripts/check-reachability.ts allowlists it):
+  # a failure must surface, never leave the Cursor rules silently stale.
+  if ! "$BUN_BIN" -e "
+    const { writeCompiledCursorRules } = await import('${SHARE}/packages/workit-core/src/core/rules.ts');
+    writeCompiledCursorRules('${PLUGIN_DIR}/rules');
+  " >/dev/null; then
+    echo "FATAL: Cursor rule compilation failed: $CONFIG_RULES_DIR -> $PLUGIN_DIR/rules" >&2
+    exit 1
+  fi
+fi
+printf '%s\n' "$SHARE/packages/workit-core" >"$PLUGIN_DIR/.workit-root"
+
+exit 0

package/scripts/validate-cursor-marketplace.ts

@@ -0,0 +1,171 @@
+#!/usr/bin/env bun
+// Cursor Marketplace validator (Task 9, CA-13/CA-15/CA-17/CA-21): validates the
+// tracked Marketplace artifact against the official Cursor JSON schemas plus the
+// repository-specific invariants that a JSON Schema cannot express. Runs from a
+// clean `git ls-files` checkout — it never reads dist/ or other ignored build
+// output, so `bun run validate:cursor-marketplace` is a truthful clean-checkout
+// gate for CI.
+//
+// Official schema snapshots (test/fixtures/cursor-schemas/) are verbatim copies
+// of the current official schemas, retrieved 2026-08-13 from:
+//   - https://raw.githubusercontent.com/cursor/plugins/main/schemas/plugin.schema.json
+//   - https://raw.githubusercontent.com/cursor/plugins/main/schemas/marketplace.schema.json
+//
+// `source` path resolution (Task 7 carry-forward, RESOLVED): the official
+// marketplace.schema.json documents `plugins[].source` as "Path to the plugin
+// directory (relative to the marketplace root)". The marketplace root is the
+// directory that CONTAINS `.cursor-plugin/marketplace.json` — the repo root —
+// NOT `.cursor-plugin/` itself. Evidence: the official cursor/plugins repo keeps
+// `.cursor-plugin/marketplace.json` at the repo root and lists sources such as
+// `continual-learning` and `third_party/gmail` with no `../` prefix, even though
+// `.cursor-plugin/` is a sibling of those directories. Therefore
+// `source: "packages/workit-cursor"` is correct and kept verbatim.
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+import { WORKIT_METHOD_SKILLS, validateSkillManifests } from "../src/core/skill-manifests";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(scriptDir, "..", "..", "..");
+const root = process.argv[2] ? path.resolve(process.argv[2]) : repoRoot;
+
+const MARKETPLACE_REL = ".cursor-plugin/marketplace.json";
+
+const frontmatterKeys = (file: string): Set<string> => {
+  const head = readFileSync(file, "utf8").slice(0, 4096);
+  const keys = new Set<string>();
+  if (!head.startsWith("---")) return keys;
+  const end = head.indexOf("\n---", 3);
+  if (end === -1) return keys;
+  for (const line of head.slice(3, end).split("\n")) {
+    const m = /^([A-Za-z0-9_-]+):/.exec(line);
+    if (m) keys.add(m[1]);
+  }
+  return keys;
+};
+
+export const validateMarketplace = (rootArg: string): string[] => {
+  const errors: string[] = [];
+
+  if (!existsSync(path.join(rootArg, MARKETPLACE_REL))) {
+    errors.push(`missing ${MARKETPLACE_REL}`);
+    return errors;
+  }
+
+  // 1. Official JSON Schema evaluation (AJV + ajv-formats), verbatim snapshots.
+  const validate = new Ajv({ strict: true, allErrors: true });
+  addFormats(validate);
+  const schemaDir = path.join(rootArg, "test/fixtures/cursor-schemas");
+  const pluginSchema = JSON.parse(readFileSync(path.join(schemaDir, "plugin.schema.json"), "utf8"));
+  const marketSchema = JSON.parse(
+    readFileSync(path.join(schemaDir, "marketplace.schema.json"), "utf8"),
+  );
+  const market = JSON.parse(readFileSync(path.join(rootArg, MARKETPLACE_REL), "utf8"));
+  if (!validate.validate(marketSchema, market)) {
+    errors.push(
+      `marketplace.json invalid: ${(validate.errors ?? []).map((e) => e.message).join("; ")}`,
+    );
+  }
+
+  // 2. Resolve each plugin source relative to the repo root; name must match.
+  for (const entry of (market.plugins ?? []) as { name: string; source: string }[]) {
+    const pluginDir = path.join(rootArg, entry.source);
+    if (!existsSync(path.join(pluginDir, ".cursor-plugin/plugin.json"))) {
+      errors.push(`plugin ${entry.name}: source ${entry.source} has no .cursor-plugin/plugin.json`);
+      continue;
+    }
+    const plugin = JSON.parse(
+      readFileSync(path.join(pluginDir, ".cursor-plugin/plugin.json"), "utf8"),
+    );
+    if (!validate.validate(pluginSchema, plugin)) {
+      errors.push(
+        `plugin ${entry.name} plugin.json invalid: ${(validate.errors ?? []).map((e) => e.message).join("; ")}`,
+      );
+    }
+    if (plugin.name !== entry.name) {
+      errors.push(`plugin ${entry.name}: plugin.json name ${plugin.name} does not match index`);
+    }
+
+    // 3. Component paths resolve inside the plugin root (no `..`, no absolute).
+    // `skills`/`rules` are path-like (string or string[]). `mcpServers`/`hooks`
+    // may also be inline objects or arrays of objects, which the JSON-schema
+    // check already validates — only string/string[] values get the
+    // path-escape/existence check; non-string forms are skipped gracefully.
+    for (const field of ["skills", "rules", "mcpServers", "hooks"] as const) {
+      const value = plugin[field];
+      const rels: string[] =
+        typeof value === "string"
+          ? [value]
+          : Array.isArray(value)
+            ? value.filter((v): v is string => typeof v === "string")
+            : [];
+      for (const rel of rels) {
+        if (rel.includes("..") || rel.startsWith("/")) {
+          errors.push(`plugin ${entry.name}: ${field} path escapes root: ${rel}`);
+          continue;
+        }
+        if (!existsSync(path.join(pluginDir, rel))) {
+          errors.push(`plugin ${entry.name}: ${field} path missing: ${rel}`);
+        }
+      }
+    }
+
+    // 4. Logo resolves inside the plugin root and exists.
+    const logo = plugin.logo as string | undefined;
+    if (logo && (logo.includes("..") || logo.startsWith("/"))) {
+      errors.push(`plugin ${entry.name}: logo path escapes root: ${logo}`);
+    } else if (logo && !existsSync(path.join(pluginDir, logo))) {
+      errors.push(`plugin ${entry.name}: logo missing: ${logo}`);
+    }
+
+    // 5. Skills and rules carry valid frontmatter.
+    const skillRoots: [string, readonly string[]][] = [
+      [path.join(pluginDir, "skills"), WORKIT_METHOD_SKILLS],
+    ];
+    for (const [dir, expected] of skillRoots) {
+      const mismatch = validateSkillManifests(dir, expected, "skills");
+      if (mismatch) errors.push(`plugin ${entry.name}: ${mismatch}`);
+      for (const skill of expected) {
+        const keys = frontmatterKeys(path.join(dir, skill, "SKILL.md"));
+        if (!keys.has("name"))
+          errors.push(`plugin ${entry.name}: ${skill}/SKILL.md missing frontmatter name`);
+        if (!keys.has("description"))
+          errors.push(`plugin ${entry.name}: ${skill}/SKILL.md missing frontmatter description`);
+      }
+    }
+    const rulesDir = path.join(pluginDir, "rules");
+    if (existsSync(rulesDir)) {
+      for (const rule of readdirSync(rulesDir).filter((f) => f.endsWith(".mdc"))) {
+        const keys = frontmatterKeys(path.join(rulesDir, rule));
+        if (!keys.has("description"))
+          errors.push(`plugin ${entry.name}: ${rule} missing frontmatter description`);
+      }
+    }
+
+    // 6. No active runtime path targets an ignored dist file.
+    for (const rel of ["mcp.json", "hooks/hooks-cursor.json"]) {
+      const p = path.join(pluginDir, rel);
+      if (!existsSync(p)) continue;
+      const raw = readFileSync(p, "utf8");
+      if (raw.includes("dist/") || raw.includes("run-server") || raw.includes("session-start.js")) {
+        errors.push(`plugin ${entry.name}: ${rel} references ignored runtime output`);
+      }
+    }
+  }
+
+  return errors;
+};
+
+if (import.meta.main) {
+  const errors = validateMarketplace(root);
+  if (errors.length > 0) {
+    for (const e of errors) process.stderr.write(`${e}\n`);
+    process.stderr.write(
+      `marketplace validation FAILED (${errors.length} error${errors.length === 1 ? "" : "s"})\n`,
+    );
+    process.exit(1);
+  }
+  console.log(`marketplace validation passed (root: ${root})`);
+}

package/scripts/verify-bundle-sources.ts

@@ -0,0 +1,134 @@
+#!/usr/bin/env bun
+// Release guard: every adapter dist/ must inline the workspace's own
+// @workit-dev sources, never a registry copy. bun build resolves the nearest
+// node_modules first, so an installed packages/<pkg>/node_modules/@workit-dev
+// copy silently replaces the tagged source (8.0.0 shipped 7.7.0's core that
+// way). Two checks:
+//  - installs: no packages/*/node_modules/@workit-dev/* entry, and every root
+//    node_modules/@workit-dev/* entry resolves inside packages/ (run before
+//    the build; it also covers minified bundles, which carry no path headers);
+//  - bundles: bun prefixes each inlined module with a `// <path>` header; a
+//    header under node_modules/@workit-dev/ names a stale copy, and every
+//    non-minified entry (with its split chunks) must inline core from
+//    packages/workit-core/src/.
+// `--installs-only` runs only the first check (prepareCmd, before the build).
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { RELEASE_PACKAGES } from "./analyze-release-scope";
+
+// Separator-agnostic: a Windows build may write `\` in module headers.
+const REGISTRY_COPY = /^\/\/ (.*node_modules[\\/]@workit-dev[\\/].+)$/gmu;
+const WORKSPACE_CORE = /^\/\/ packages[\\/]workit-core[\\/]src[\\/]/mu;
+/** bun's unminified output averages well under 100 bytes a line; --minify is thousands. */
+const MINIFIED_BYTES_PER_LINE = 1000;
+
+const entries = (dir: string): string[] => (existsSync(dir) ? readdirSync(dir) : []);
+/** `root`-relative path with `/` separators, for messages on every OS. */
+const rel = (root: string, file: string): string => relative(root, file).split(sep).join("/");
+/** Windows paths compare case-insensitively. */
+const fold = (file: string): string => (process.platform === "win32" ? file.toLowerCase() : file);
+
+/** Installed @workit-dev packages a build could resolve instead of workspace source. */
+export function registryInstalls(root: string): string[] {
+  const nested = entries(join(root, "packages")).flatMap((pkg) => {
+    const scope = join(root, "packages", pkg, "node_modules", "@workit-dev");
+    return entries(scope).map((name) => rel(root, join(scope, name)));
+  });
+  const packages = fold(join(realpathSync(root), "packages") + sep);
+  const scope = join(root, "node_modules", "@workit-dev");
+  const hoisted = entries(scope)
+    .filter((name) => !fold(realpathSync(join(scope, name))).startsWith(packages))
+    .map((name) => rel(root, join(scope, name)));
+  return [...nested, ...hoisted];
+}
+
+function bundles(dir: string): string[] {
+  return entries(dir).flatMap((name) => {
+    const file = join(dir, name);
+    if (statSync(file).isDirectory()) return bundles(file);
+    return name.endsWith(".js") ? [file] : [];
+  });
+}
+
+export type BundleProblem = { bundle: string; problem: string };
+
+/** Sibling chunks a split bundle imports (`from "./x.js"`, `import("./x.js")`). */
+const LOCAL_CHUNK = /(?:\bfrom|\bimport\s*\()\s*["']\.\/([^"']+\.js)["']/gu;
+
+/**
+ * Built adapter bundles under `root`, and what each one inlined wrongly. A
+ * code-split entry (codex's hook) inlines core through its chunks, so the
+ * core-header requirement applies to each entry together with the chunks it
+ * reaches; a chunk only another bundle imports is not an entry.
+ */
+export function bundleSources(root: string): { scanned: string[]; problems: BundleProblem[] } {
+  const scanned = RELEASE_PACKAGES.filter((pkg) => pkg !== "workit-core").flatMap((pkg) =>
+    bundles(join(root, "packages", pkg, "dist")),
+  );
+  const text = new Map(scanned.map((file) => [file, readFileSync(file, "utf8")]));
+  const chunks = (file: string): string[] =>
+    [...(text.get(file) ?? "").matchAll(LOCAL_CHUNK)]
+      .map((m) => join(dirname(file), m[1]))
+      .filter((chunk) => text.has(chunk));
+  const imported = new Set(scanned.flatMap(chunks));
+  const reachesCore = (entry: string): boolean => {
+    const seen = new Set<string>();
+    const queue = [entry];
+    while (queue.length) {
+      const file = queue.shift() as string;
+      if (seen.has(file)) continue;
+      seen.add(file);
+      if (WORKSPACE_CORE.test(text.get(file) ?? "")) return true;
+      queue.push(...chunks(file));
+    }
+    return false;
+  };
+  const problems = scanned.flatMap((file): BundleProblem[] => {
+    const bundle = rel(root, file);
+    const body = text.get(file) ?? "";
+    const copies = [...body.matchAll(REGISTRY_COPY)].map((m) => m[1].replaceAll("\\", "/"));
+    if (copies.length)
+      return [{ bundle, problem: `${copies.length} registry-copy modules, e.g. ${copies[0]}` }];
+    const minified = body.length / (body.split("\n").length || 1) > MINIFIED_BYTES_PER_LINE;
+    if (minified || imported.has(file) || reachesCore(file)) return [];
+    const first = /^\s*\/\/ (\S.*)$/mu.exec(body)?.[1] ?? "none";
+    return [
+      {
+        bundle,
+        problem: `no \`// packages/workit-core/src/\` module header in it or its chunks (first header: ${first})`,
+      },
+    ];
+  });
+  return { scanned: scanned.map((file) => rel(root, file)), problems };
+}
+
+/** Every failure under `root` as printable lines; empty when the release may proceed. */
+export function verifyBundleSources(root: string, options: { installsOnly?: boolean } = {}) {
+  const failures = registryInstalls(root).map(
+    (path) => `${path}: installed copy outside packages/ (bundles would inline it)`,
+  );
+  if (options.installsOnly) return { failures, scanned: 0 };
+  const { scanned, problems } = bundleSources(root);
+  if (scanned.length === 0)
+    failures.push(`no adapter bundles under packages/*/dist; run \`bun run build\` first`);
+  for (const { bundle, problem } of problems) failures.push(`${bundle}: ${problem}`);
+  return { failures, scanned: scanned.length };
+}
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  const installsOnly = args.includes("--installs-only");
+  const root = resolve(args.find((arg) => !arg.startsWith("--")) ?? process.cwd());
+  const { failures, scanned } = verifyBundleSources(root, { installsOnly });
+  if (failures.length) {
+    console.error("adapter bundles would not inline the workspace's own sources:");
+    for (const failure of failures) console.error(`  - ${failure}`);
+    console.error("remove the copies and rebuild; see release.yml NPM_CONFIG_WORKSPACES_UPDATE");
+    process.exit(1);
+  }
+  console.log(
+    installsOnly
+      ? "no registry copies of workspace packages installed"
+      : `verified ${scanned} adapter bundles inline workspace sources`,
+  );
+}

package/scripts/write-schemas.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env bun
+// Rewrites packages/workit-core/schemas/ from the zod config schemas.
+// test/workit-core/config-schemas.test.ts fails when a committed file drifts.
+import { mkdirSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { CONFIG_SCHEMA_FILES, renderConfigSchema } from "../src/core/config-schemas";
+
+export const SCHEMAS_DIR = path.join(import.meta.dir, "..", "schemas");
+
+if (import.meta.main) {
+  mkdirSync(SCHEMAS_DIR, { recursive: true });
+  for (const file of CONFIG_SCHEMA_FILES) {
+    writeFileSync(path.join(SCHEMAS_DIR, file), renderConfigSchema(file));
+    console.log(`wrote ${path.relative(process.cwd(), path.join(SCHEMAS_DIR, file))}`);
+  }
+}

package/skills/workit-architecture/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: workit-architecture
+description: Rank cited deepening refactors from churn and ledger friction; never applied unapproved. Use for architecture.
+disable-model-invocation: true
+---
+
+# Architecture: deepen the modules that cause friction
+
+User-invoked: offer it, never start it yourself. It proposes and grills; it
+never refactors without the user's approval. Use the words in
+`references/vocabulary.md` exactly and the domain words in `GLOSSARY.md`.
+
+## Deepening
+
+1. **Scope by YAGNI.** A direction the user names wins. Otherwise find hot
+   spots: churn (`git log --since=6.months --name-only --format=`, counted per
+   file, skipping lockfiles, version-bump manifests, generated files, docs and
+   `chore(release)` commits), friction in `workit ledger list --last 200`
+   (failed checks and verdicts, rulings, `retro:` decisions) and
+   `workit test-audit <paths> --json`. State the window and paths in one line.
+2. **Settled decisions stand.** Read `GLOSSARY.md`, `CODING_STANDARDS.md` and
+   ADRs when present. Never re-litigate an ADR without new evidence.
+3. **Explore organically.** A read-only explorer (Claude Code: Explore; or
+   you) walks the hot spots under the limits in `references/vocabulary.md`
+   and returns cited friction. Run the deletion test on every suspect.
+4. **Report 3-5 ranked candidates, then stop and wait for approval.** Each:
+   - files and modules;
+   - the friction, with **2 or more cited occurrences** (commit, ledger row,
+     PR, test-audit finding); a one-off is not a candidate;
+   - an interface sketch: what callers see, what moves behind the seam;
+   - what gets simpler and what becomes testable through that interface;
+   - **merge danger**: one-way or two-way door, plus blast radius (callers,
+     packages, public surface).
+   The text list is primary; offer an HTML report only if the host renders one.
+5. **Grill the chosen one**: numbered questions, each with a recommended
+   answer; challenge a weak premise with evidence first. Settle the interface,
+   the seam, the tests to replace and the migration order; a module named for
+   a new concept gets its glossary entry (workit-shape).
+6. **Hand off on approval.** Several slices go into a plan for
+   `workit fanout plan <plan.json>`, with scopes and dependencies
+   (workit-fanout). One slice goes to a build (workit-implement). Record the
+   choice with `workit ledger decision "architecture: <id>" --why "<why>"`;
+   offer an ADR for a lasting rejection so the next run does not repeat it.
+
+## Instruction files
+
+Restructure AGENTS.md or CLAUDE.md in three escalating passes, **each its own
+commit in one PR**, so the user can drop the later ones: remove no-ops;
+progressive disclosure into topic files; coding rules to `CODING_STANDARDS.md`
+and mechanical rules to checks. No commit adds a `workit knowledge lint`
+finding. Never scaffold an empty file (`references/instruction-files.md`).
+
+## Test sweep
+
+Run `workit test-audit <paths> --json` over the suite or one hot spot and
+report findings by module, worst first. On approval, the bad tests are
+replaced (workit-test-audit).
+
+## Example
+
+Bad: "The CLI is messy, so I split router.ts in five." Uncited, unapproved.
+
+Good: "1. Check runner (check.ts, evidence.ts), 3 occurrences: commits a1b2c3
+and d4e5f6 edit both for one fix; ledger row 41 is a `check` red on a hidden
+timeout. Sketch: `runCheck(spec)` returns evidence, the timeout behind it, so
+timeouts test without a shell. Two-way door, 2 callers in one package."
+
+## Check
+
+```sh
+workit knowledge lint   # no new finding after each instruction-files commit
+```

package/skills/workit-architecture/agents/openai.yaml

@@ -0,0 +1,3 @@
+# Codex: user-invoked only (the counterpart of disable-model-invocation).
+policy:
+  allow_implicit_invocation: false