@brainervirus/workit-core 0.5.5 → 0.6.0

package/README.md

@@ -4,12 +4,12 @@ Multi-platform Superpowers workflow plugin for **Cursor** and **OpenCode**: veri
 
 | Platform | Path | Version |
 | --- | --- | --- |
-| **OpenCode** | `packages/workit-opencode/src/plugin.ts` | 0.4.0 |
-| **Cursor** | `packages/workit-cursor/` (MCP + hooks + rules + skills) | 0.4.0 |
-| **Shared core** | `packages/workit-core/` (src, skills, commands, scripts, templates) | 0.4.0 |
-| **CLI** | `packages/workit-cli/` (Ink wizard, bin `workit`) | 0.4.0 |
+| **OpenCode** | `packages/workit-opencode/src/plugin.ts` | ![npm](https://img.shields.io/npm/v/@brainervirus/workit-opencode) |
+| **Cursor** | `packages/workit-cursor/` (MCP + hooks + rules + skills) | ![npm](https://img.shields.io/npm/v/@brainervirus/workit-cursor) |
+| **Shared core** | `packages/workit-core/` (src, skills, commands, scripts, templates) | ![npm](https://img.shields.io/npm/v/@brainervirus/workit-core) |
+| **CLI** | `packages/workit-cli/` (Ink wizard, bin `workit`) | ![npm](https://img.shields.io/npm/v/@brainervirus/workit-cli) |
 
-Config directory (both platforms): `~/.config/workflow-toolkit/` (kept as-is for install stability).
+Config directory (both platforms): `~/.config/workit/` — legacy `~/.config/workflow-toolkit/` is auto-migrated on first run and kept as a fallback.
 
 [![npm version](https://img.shields.io/npm/v/@brainervirus/workit-opencode)](https://www.npmjs.com/package/@brainervirus/workit-opencode)
 [![CI](https://img.shields.io/github/actions/workflow/status/BrainerVirus/workit/ci.yml?branch=main&label=CI)](https://github.com/BrainerVirus/workit/actions)
@@ -119,7 +119,6 @@ GitHub Actions:
 
 - **CI** — on push/PR to `main`: matrix of 3 OS (ubuntu, macos, windows) running `actions/checkout@v7` + `oven-sh/setup-bun@v2`, then `bun install --frozen-lockfile` + `bun run check`
 - **Release** — on push to `main`: [semantic-release](https://github.com/semantic-release/semantic-release) computes the next version from Conventional Commits, publishes the four workspaces to npm in dependency order — `workit-core`, `workit-opencode`, `workit-cursor`, `workit-cli` (with provenance), and creates the git tag + GitHub Release
-- **Code review** — on every PR: the [OpenCode GitHub integration](https://opencode.ai/docs/github/) reviews the diff (see [Code review](#code-review))
 
 No manual tags — semantic-release owns the version/tag flow:
 
@@ -127,22 +126,10 @@ No manual tags — semantic-release owns the version/tag flow:
 git push origin main
 ```
 
-## Code review
+## Quality gates
 
-Every pull request is automatically reviewed by [OpenCode](https://opencode.ai/docs/github/) via `.github/workflows/opencode-review.yml` — it checks code quality, potential bugs, and this repo's own standards (the spec/plan contract, Conventional Commits, the CONTRIBUTING.md review flow). Model: `opencode-go/deepseek-v4-flash`.
-
-Checks fall into two categories:
-
-- **BLOCKING — the `pull_request` review** (`review` job): runs on every PR (opened/synchronized/reopened/ready_for_review) and is registered as a required check in branch protection — the PR cannot merge while it's red.
-- **ADVISORY — on-demand and triage flows** (never block merge): mention `/oc` or `/opencode` in a comment — issue, PR thread, or a specific line in the Files tab — to have OpenCode fix, explain, or update the PR (`oc` job); new issues are triaged with guidance and doc links (`triage` job).
-
-To activate the review on a fork or fresh clone:
-
-1. Install the [OpenCode GitHub app](https://github.com/apps/opencode-agent) on the repository.
-2. Add the `OPENCODE_API_KEY` secret under Settings → Secrets and variables → Actions.
-3. PRs trigger the review on opened/synchronized/reopened events automatically.
-
-[Cursor Bugbot](https://cursor.com/dashboard/bugbot) is an optional alternative to the OpenCode review.
+- **CI checks** — the per-package check jobs (workit-core/opencode/cursor/cli/shared) are required in branch protection; the PR cannot merge while any is red.
+- **Subagent review** — `wk-implement` runs a two-stage review (spec compliance + code quality) per task with fresh `general` agents.
 
 ## Architecture
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "0.5.5",
+  "version": "0.6.0",
   "private": false,
   "description": "Workit — workflow rails for agentic coding: specs, plans, YouTrack, CI-gated commits (shared core)",
   "license": "MIT",

package/scripts/lib/config-dir.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Resolve the config dir (workit default) with one-time legacy migration.
+# Mirrors src/core/config.ts resolveConfigDir + ensureConfigDir.
+# Env overrides bypass migration (explicit user intent wins); migration is
+# idempotent: only runs when workit/ is absent; never overwrites, never
+# deletes the legacy workflow-toolkit/ dir.
+resolve_config_dir() {
+  if [ -n "${WORKFLOW_TOOLKIT_CONFIG:-}" ]; then
+    printf '%s\n' "$WORKFLOW_TOOLKIT_CONFIG"
+    return
+  fi
+  if [ -n "${WORKFLOW_TOOLKIT_CONFIG_DIR:-}" ]; then
+    printf '%s\n' "$WORKFLOW_TOOLKIT_CONFIG_DIR"
+    return
+  fi
+  local base="${XDG_CONFIG_HOME:-$HOME/.config}"
+  local NEW="$base/workit"
+  local LEGACY="$base/workflow-toolkit"
+  if [ ! -d "$NEW" ] && [ -d "$LEGACY" ]; then
+    mkdir -p "$NEW"
+    if ! cp -r "$LEGACY/." "$NEW/"; then
+      printf 'workit: warning: partial config migration from %s (kept in place; retry on next run)\n' "$LEGACY" >&2
+    fi
+  fi
+  printf '%s\n' "$NEW"
+}

package/scripts/rewrite-workspace-deps.ts

@@ -1,8 +1,11 @@
 #!/usr/bin/env bun
-// Rewrite workspace:* core deps to ^<released version> in the platform packages
-// before publish: neither npm nor bun rewrites the protocol, so a packed tarball
-// with workspace:* silently drops the core dependency. Runs as semantic-release
-// prepareCmd (after the version bumps, before the npm publish phase).
+// Release-sync before publish: rewrite workspace:* core deps to ^<released
+// version> in the platform packages, and mirror the core version + canonical
+// URLs into the cursor plugin/marketplace manifests. Neither npm nor bun
+// rewrites workspace:*, so a packed tarball with it silently drops the core
+// dependency. Runs as semantic-release prepareCmd (after the version bumps,
+// before the npm publish phase); the writes stay in CI and never reach the
+// repo (semantic-release does not commit back).
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
@@ -15,3 +18,13 @@ for (const pkg of ["workit-opencode", "workit-cursor", "workit-cli"]) {
   data.dependencies["@brainervirus/workit-core"] = `^${core.version}`;
   writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
 }
+for (const file of [
+  resolve(root, "packages/workit-cursor/.cursor-plugin/plugin.json"),
+  resolve(root, "packages/workit-cursor/marketplace.json"),
+]) {
+  const data = JSON.parse(readFileSync(file, "utf8"));
+  data.version = core.version;
+  if (data.homepage) data.homepage = data.homepage.replace("BrainerVirus/workflow-toolkit", "BrainerVirus/workit");
+  if (data.repository) data.repository = data.repository.replace("BrainerVirus/workflow-toolkit", "BrainerVirus/workit");
+  writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
+}

package/scripts/sync-runtime.sh

@@ -3,6 +3,9 @@
 # Prefer local monorepo (dev) when present; otherwise git-pull the share clone.
 set -euo pipefail
 
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$SCRIPT_DIR/lib/config-dir.sh"
+
 SHARE="${HOME}/.local/share/workflow-toolkit"
 PLUGIN_DIR="${HOME}/.cursor/plugins/local/workflow-toolkit"
 OPENCODE_PLUGINS="${HOME}/.config/opencode/plugins"
@@ -54,7 +57,7 @@ if [ -d "$SHARE/packages/workit-core/vendor/superpowers/skills" ]; then
   rsync -a --delete "$SHARE/packages/workit-core/vendor/superpowers/skills" "$PLUGIN_DIR/vendor/superpowers/"
 fi
 # Canonical user rules -> Cursor .mdc (compiled by the shared core)
-CONFIG_RULES_DIR="${HOME}/.config/workflow-toolkit/rules"
+CONFIG_RULES_DIR="$(resolve_config_dir)/rules"
 if [ -d "$CONFIG_RULES_DIR" ]; then
   "$HOME/.bun/bin/bun" -e "
     import('${SHARE}/packages/workit-core/src/core/rules.ts').then(async ({ writeCompiledCursorRules }) => {

package/src/core/config.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
@@ -18,10 +18,57 @@ export const PRESETS: Record<BranchPreset, { allowed: string[]; protected: strin
   custom: { allowed: [], protected: [] },
 };
 
-export const configDir = (): string =>
+export const resolveConfigDir = (): string =>
   process.env.WORKFLOW_TOOLKIT_CONFIG
   ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR
-  ?? path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "workflow-toolkit");
+  ?? path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "workit");
+
+// One-time lazy migration from the legacy ~/.config/workflow-toolkit dir.
+// migratedDir remembers the resolved dir already checked: configDir() is on
+// hot paths, so subsequent calls are one string compare. Re-checking per
+// unique dir also keeps tests with swapped env working.
+// ponytail: cache keyed by dir value — an env override explicitly set to the
+// default path caches before migration could trigger; only matters if that
+// env is cleared mid-process (next unique dir value re-checks).
+let migratedDir: string | null = null;
+// A mid-loop copy failure leaves the new dir half-populated; keep retrying
+// until a full pass succeeds instead of silently skipping the failed entry.
+let migrationFailed = false;
+
+export const ensureConfigDir = (dir: string = resolveConfigDir()): string => {
+  if (migratedDir === dir) return dir;
+  if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
+    migratedDir = dir;
+    return dir;
+  }
+  const legacy = path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "workflow-toolkit");
+  if (!existsSync(legacy)) {
+    migratedDir = dir;
+    return dir;
+  }
+  if (!migrationFailed && existsSync(dir)) {
+    migratedDir = dir;
+    return dir;
+  }
+  migrationFailed = false;
+  mkdirSync(dir, { recursive: true });
+  for (const entry of readdirSync(legacy, { withFileTypes: true })) {
+    const src = path.join(legacy, entry.name);
+    const dest = path.join(dir, entry.name);
+    if (existsSync(dest)) continue;
+    try {
+      if (entry.isDirectory()) cpSync(src, dest, { recursive: true });
+      else if (entry.isFile()) copyFileSync(src, dest);
+    } catch (err) {
+      migrationFailed = true;
+      console.warn(`[workit] config migration: failed to copy ${src}: ${(err as Error).message}`);
+    }
+  }
+  if (!migrationFailed) migratedDir = dir;
+  return dir;
+};
+
+export const configDir = (): string => ensureConfigDir();
 
 export const LOCALE_RE = /^[a-z]{2,3}(-[A-Z]{2})?$/;
 

package/src/core/docs-repo.ts

@@ -1,11 +1,11 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import os from "node:os";
 import path from "node:path";
+import { configDir } from "./config";
 
 const configPath = () =>
   process.env.WORKFLOW_DOCS_REPO_CONFIG
-  ?? path.join(os.homedir(), ".config", "workflow-toolkit", "docs-repo.json");
+  ?? path.join(configDir(), "docs-repo.json");
 
 export const readDocsRepoConfig = (): { path: string } | null => {
   try {

package/src/core/vcs-config.ts

@@ -1,5 +1,4 @@
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { configDir } from "./config";
@@ -69,7 +68,7 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   if (!cfgOk) return { ok: false, error: "missing or invalid vcs.json" };
 
   const prov = (cfg[provider] ?? {}) as Record<string, any>;
-  const tokenFile = String(prov.tokenFile ?? path.join(os.homedir(), ".config", "workflow-toolkit", `${provider}.token`));
+  const tokenFile = String(prov.tokenFile ?? path.join(configDir(), `${provider}.token`));
   const tokenPath = path.resolve(tokenFile);
   let tokenOk = false;
   if (fs.existsSync(tokenPath)) {
@@ -170,13 +169,13 @@ export function vcsTokenCreateUrls(): Record<string, any> {
   const provider = String(cfg.provider ?? "gitlab").toLowerCase();
   const active = {
     gitlab: {
-      tokenFile: gitlab.tokenFile ?? path.join(os.homedir(), ".config", "workflow-toolkit", "gitlab.token"),
+      tokenFile: gitlab.tokenFile ?? path.join(configDir(), "gitlab.token"),
       createUrl: gitlabUrl,
       scopes: gitlabScopes,
       name,
     },
     github: {
-      tokenFile: (cfg.github as Record<string, any>)?.tokenFile ?? path.join(os.homedir(), ".config", "workflow-toolkit", "github.token"),
+      tokenFile: (cfg.github as Record<string, any>)?.tokenFile ?? path.join(configDir(), "github.token"),
       createUrl: githubFineUrl,
       createUrlClassic: githubClassicUrl,
       permissions: githubPerms,

package/src/core/youtrack.ts

@@ -1,18 +1,18 @@
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { readTemplate } from "./templates";
 import { resolveWorkspaceRoot } from "./scripts";
+import { configDir } from "./config";
 
 const ISSUE_RE = /^[A-Z]+-\d+$/;
 const TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
 
 // Port of scripts/youtrack/config.sh chain: WORKFLOW_YOUTRACK_CONFIG ->
-// XDG_CONFIG_HOME / HOME .config + workflow-toolkit/youtrack.json.
+// configDir() (XDG_CONFIG_HOME / HOME .config + workit).
 export const youTrackConfigPath = (): string =>
   process.env.WORKFLOW_YOUTRACK_CONFIG ??
-  path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "workflow-toolkit", "youtrack.json");
+  path.join(configDir(), "youtrack.json");
 
 const youTrackTokenModeOk = (p: string): boolean => {
   if (process.platform === "win32") return true;

package/src/tools/youtrack.ts

@@ -4,6 +4,7 @@ import path from "node:path";
 import { tool, type ToolContext } from "@opencode-ai/plugin";
 import { fail, ok, resolveInside, type Result } from "../core";
 import { configGuardError, describeConfigGaps } from "../core/config-guard";
+import { configDir } from "../core/config";
 import {
   buildDraft as legacyBuildDraft,
   context as legacyContext,
@@ -20,11 +21,14 @@ const message = (error: unknown) => error instanceof Error ? error.message : Str
 
 // Both override names point at the config dir itself, same precedence as
 // src/core/config.ts and scripts/init/status.sh: WORKFLOW_TOOLKIT_CONFIG → WORKFLOW_TOOLKIT_CONFIG_DIR → XDG.
+// Default env (no args) routes through configDir() so the legacy migration runs.
 export const configPath = (env: NodeJS.ProcessEnv = process.env, home = os.homedir()) =>
   path.join(
-    env.WORKFLOW_TOOLKIT_CONFIG
-    ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR
-    ?? path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "workflow-toolkit"),
+    env === process.env
+      ? configDir()
+      : env.WORKFLOW_TOOLKIT_CONFIG
+        ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR
+        ?? path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "workit"),
     "youtrack.json",
   );