@brainervirus/workit-core 0.6.0 → 0.7.0

package/src/core/plan-tasks.ts

@@ -4,13 +4,19 @@ import { parseTasksFromPlan } from "./docs-validate";
 import { resolveBranch } from "./branch";
 
 const readSafe = (p: string): string | null => {
-  try { return readFileSync(p, "utf8"); } catch { return null; }
+  try {
+    return readFileSync(p, "utf8");
+  } catch {
+    return null;
+  }
 };
 
 export function parsePlanTasks(
   planPath: string,
   workspaceRoot: string,
-): { task_count: number; tasks: { id: number; title: string; section_text: string }[] } | { error: string } {
+):
+  | { task_count: number; tasks: { id: number; title: string; section_text: string }[] }
+  | { error: string } {
   const cwd = path.resolve(workspaceRoot);
   const resolved = path.isAbsolute(planPath) ? planPath : path.join(cwd, planPath);
   const text = readSafe(resolved);
@@ -27,7 +33,11 @@ export function resolveHandoffBranch(
   planPath: string,
   workspaceRoot: string,
 ): { branch: string } | { error: string } {
-  const resolved = resolveBranch({ spec_path: specPath, plan_path: planPath, workspace_root: workspaceRoot });
+  const resolved = resolveBranch({
+    spec_path: specPath,
+    plan_path: planPath,
+    workspace_root: workspaceRoot,
+  });
   if ("error" in resolved) return { error: resolved.error as string };
   return { branch: resolved.branch };
 }

package/src/core/ports/init-toolkit-status.ts

@@ -1,4 +1,4 @@
 // CLI port of scripts/init/toolkit-status.sh.
 import { toolkitStatusData } from "../init";
 
-console.log(JSON.stringify(toolkitStatusData(), null, 2));
+console.log(JSON.stringify(await toolkitStatusData(), null, 2));

package/src/core/ports/vcs-verify-token.ts

@@ -1,4 +1,4 @@
 // CLI port of scripts/vcs/verify-token.sh — soft-fail JSON, exit 0.
 import { vcsVerifyToken } from "../vcs-config";
 
-console.log(JSON.stringify(vcsVerifyToken()));
+console.log(JSON.stringify(await vcsVerifyToken()));

package/src/core/ports/youtrack-api.ts

@@ -5,11 +5,13 @@ const args = process.argv.slice(2);
 const cmd = args[0];
 if (cmd === "log-time" || cmd === "post-comment") {
   if ((process.env.WORKFLOW_YT_WRITE ?? "") !== "1") {
-    console.error("ERROR: YouTrack write operations require WORKFLOW_YT_WRITE=1 (refusing to mutate production)");
+    console.error(
+      "ERROR: YouTrack write operations require WORKFLOW_YT_WRITE=1 (refusing to mutate production)",
+    );
     process.exit(1);
   }
 }
-const out = youTrackApi(args, process.env.WORKFLOW_YT_WRITE ?? "");
+const out = await youTrackApi(args, process.env.WORKFLOW_YT_WRITE ?? "");
 if ("error" in out) {
   console.log(JSON.stringify({ ok: false, error: out.error }));
   process.exit(1);

package/src/core/ports/youtrack-config.ts

@@ -1,7 +1,5 @@
 // CLI port of scripts/youtrack/config.sh — JSON out, argv/env in.
-import {
-  youTrackConfigLoad,
-} from "../youtrack";
+import { youTrackConfigLoad } from "../youtrack";
 
 const args = process.argv.slice(2);
 const cmd = args[0] ?? "load";

package/src/core/ports/youtrack-verify-token.ts

@@ -1,7 +1,7 @@
 // CLI port of scripts/youtrack/verify-token.sh.
 import { youTrackVerifyToken } from "../youtrack";
 
-const out = youTrackVerifyToken();
+const out = await youTrackVerifyToken();
 if ("error" in out) {
   const payload: Record<string, any> = { ok: false, error: out.error };
   if (out.http_status !== undefined) payload.http_status = out.http_status;

package/src/core/pr-create.ts

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { vcsConfig } from "./vcs-config";
+import { resolveBranchPolicyFor } from "./branch";
 
 // Port of scripts/pr-create.sh — build MR/PR body issue linking + create via glab/gh.
 
@@ -19,6 +20,23 @@ function parseGhIssue(value: string): string {
   return m ? m[1] : String(value).trim().replace(/^#/, "");
 }
 
+// RL-03/CA-25/AR-08: a branch-derived numeric issue id must be a bare number at
+// a segment or dash boundary — and never part of a date segment. Year-first
+// (feature/2024-01-15/x) and day-first (feature/15-01-2024/x) dates are both
+// skipped — a complete date anywhere in a segment (release-2024-01-15,
+// v2-2024-01-15-fix) — so no date digit ever closes an issue. Deliberate
+// numeric issue branches (feature/42-title, feature/2024-fix) keep linking.
+function deriveGhIssueFromBranch(branch: string): string {
+  for (const segment of branch.split("/")) {
+    if (/^\d{4}-\d/.test(segment)) continue; // year-first date-like segment (incl. year-month)
+    if (/\d{4}-\d{1,2}-\d{1,2}/.test(segment)) continue; // complete year-first date anywhere
+    if (/\d{1,2}-\d{1,2}-\d{4}/.test(segment)) continue; // complete day-first date anywhere
+    const m = /(?:^|-)(\d+)(?:-|$)/.exec(segment);
+    if (m) return m[1];
+  }
+  return "";
+}
+
 function buildBody(
   body: string,
   branch: string,
@@ -44,9 +62,7 @@ function buildBody(
     if (!issue && branch) {
       // pure-number issue id (feature/42-title -> 42); digits must be followed by a dash or end-of-string
       // so version tokens (release/1.2.3, backport/8.0.1, lodash-4.17.21, 2024.1) never link
-      // ponytail: known date-style false positive (feature/2024-01-fix -> Closes #2024); accepted — bare 42-title support is deliberate
-      const m = /(?:^|\/|-)(\d+)(?:-|$)/.exec(branch);
-      if (m) issue = m[1];
+      issue = deriveGhIssueFromBranch(branch);
     }
     if (issue) {
       if (ghRelation === "related") {
@@ -61,17 +77,25 @@ function buildBody(
   return body ? `${body}\n\n${line}` : line;
 }
 
-const truthy = (v: string | undefined): boolean => ["1", "true", "yes"].includes(String(v ?? "").toLowerCase());
+const truthy = (v: string | undefined): boolean =>
+  ["1", "true", "yes"].includes(String(v ?? "").toLowerCase());
 
 // Port of python's shutil.which — scan PATH in-process (no `which` binary needed).
 function whichOnPath(tool: string): string | null {
-  for (const dir of (process.env.PATH ?? "").split(":")) {
+  // win32 CLIs/stubs carry .exe/.cmd suffixes (gh.exe, gh.cmd), so probe them
+  // too — accessSync with the bare name would never find them.
+  const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
+  for (const dir of (process.env.PATH ?? "").split(path.delimiter)) {
     if (!dir) continue;
-    const candidate = path.join(dir, tool);
-    try {
-      fs.accessSync(candidate, fs.constants.X_OK);
-      return candidate;
-    } catch { /* keep scanning */ }
+    for (const name of names) {
+      const candidate = path.join(dir, name);
+      try {
+        fs.accessSync(candidate, fs.constants.X_OK);
+        return candidate;
+      } catch {
+        /* keep scanning */
+      }
+    }
   }
   return null;
 }
@@ -105,14 +129,96 @@ export function prBuildBody(env: NodeJS.ProcessEnv, cwd?: string): string {
 /** Port of scripts/pr-create.sh create mode — glab/gh MR/PR creation. */
 export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, any> {
   const root = process.env.WORKFLOW_WORKSPACE_ROOT ?? repoRoot(cwd);
+  const policy = resolveBranchPolicyFor(root);
   const cfg = vcsConfig("load", root);
   if (!cfg.ok) return { error: cfg.error ?? "vcs config missing" };
-  if (!cfg.tokenReady) return { error: "VCS token not ready — run /wk-init and edit token file locally" };
+  // Merge mode finishes the feature locally (git merge + push) — no glab/gh,
+  // no API token, so token readiness is only required for the PR path.
+  if (policy.integration !== "merge" && !cfg.tokenReady)
+    return { error: "VCS token not ready — run /wk-init and edit token file locally" };
 
   const provider = cfg.provider as string;
-  if (provider !== "gitlab" && provider !== "github") return { error: `unsupported provider: ${provider}` };
+  if (provider !== "gitlab" && provider !== "github")
+    return { error: `unsupported provider: ${provider}` };
+
+  // B1/RL-03: WF_PR_TARGET is the one deliberate override knob on the create
+  // surface (resolvePrBranchContext/docsBranch have none). Unlike the config
+  // default — which is authoritative by construction — a caller-supplied
+  // target is validated against the resolved branch policy so a PR can never
+  // be aimed at a protected or disallowed branch.
+  const targetOverride = env.WF_PR_TARGET;
+  const target =
+    targetOverride || String(cfg.defaultTargetBranch ?? policy.defaultTargetBranch ?? "develop");
+  if (targetOverride) {
+    const { allowed, protected: protectedTargets } = policy;
+    if (protectedTargets.has(targetOverride.toLowerCase()))
+      return {
+        error: `PR target ${JSON.stringify(targetOverride)} is a protected branch — override must be an allowed non-protected target`,
+      };
+    if (!allowed.some((r) => r.test(targetOverride)))
+      return {
+        error: `PR target ${JSON.stringify(targetOverride)} is not allowed by the branch policy`,
+      };
+  }
+
+  const title = String(env.WF_PR_TITLE ?? "");
+  const br = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: root,
+    encoding: "utf8",
+  });
+  const branch = br.status === 0 ? (br.stdout ?? "").trim() : "";
+
+  if (policy.integration === "merge") {
+    const finish = (): Record<string, any> => {
+      const merge = spawnSync("git", ["merge", "--no-ff", branch, "-m", title], {
+        cwd: root,
+        encoding: "utf8",
+      });
+      if (merge.status !== 0)
+        return {
+          error: "merge failed",
+          mode: "merge",
+          targetBranch: target,
+          stderr: (merge.stderr ?? "").slice(0, 800),
+        };
+      const push = spawnSync("git", ["push", "origin", target], { cwd: root, encoding: "utf8" });
+      if (push.status !== 0)
+        return {
+          error: "push failed",
+          mode: "merge",
+          targetBranch: target,
+          stderr: (push.stderr ?? "").slice(0, 800),
+        };
+      return {
+        ok: true,
+        mode: "merge",
+        targetBranch: target,
+        merged: true,
+        pushed: true,
+        output: (push.stdout ?? "").trim(),
+      };
+    };
+    const co = spawnSync("git", ["checkout", target], { cwd: root, encoding: "utf8" });
+    if (co.status !== 0)
+      return {
+        error: `cannot checkout target ${target}`,
+        mode: "merge",
+        targetBranch: target,
+        stderr: (co.stderr ?? "").slice(0, 800),
+      };
+    // finish() returns error objects, it never throws, so the best-effort
+    // `git checkout branch` restore below runs on ALL outcomes (success,
+    // merge failure, and push failure) — the tree always returns to the
+    // feature branch. Deliberately not a try/finally: the restore is
+    // best-effort and its own failure is not actionable on this path.
+    const result = finish();
+    spawnSync("git", ["checkout", branch], { cwd: root, encoding: "utf8" }); // best-effort return
+    return result;
+  }
+
   const cli = provider === "gitlab" ? "glab" : "gh";
-  const installUrl = provider === "gitlab" ? "https://gitlab.com/gitlab-org/cli" : "https://cli.github.com";
+  const installUrl =
+    provider === "gitlab" ? "https://gitlab.com/gitlab-org/cli" : "https://cli.github.com";
   if (whichOnPath(cli) === null) {
     return {
       ok: false,
@@ -124,21 +230,20 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
 
   const pr = (cfg.pr ?? {}) as Record<string, any>;
   const token = fs.readFileSync(cfg.tokenPath as string, "utf8").trim();
-  const title = String(env.WF_PR_TITLE ?? "");
   const body = env.WF_PR_BODY ?? "";
   const draft = String(env.WF_PR_DRAFT ?? "false").toLowerCase() === "true";
-  const target = env.WF_PR_TARGET || String(cfg.defaultTargetBranch ?? "develop");
-
-  const br = spawnSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root, encoding: "utf8" });
-  const branch = br.status === 0 ? (br.stdout ?? "").trim() : "";
 
   let baseUrl = cfg.youtrack_base_url as string | undefined;
   if (!baseUrl) {
-    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path.join(path.dirname(String(cfg.configPath)), "youtrack.json");
+    const ytCfg =
+      process.env.WORKFLOW_YOUTRACK_CONFIG ??
+      path.join(path.dirname(String(cfg.configPath)), "youtrack.json");
     try {
       const yt = JSON.parse(fs.readFileSync(ytCfg, "utf8")) as Record<string, any>;
       if (yt && typeof yt === "object") baseUrl = yt.baseUrl;
-    } catch { /* optional */ }
+    } catch {
+      /* optional */
+    }
   }
   const ghLinkOnPr = cfg.issues_provider === "github" && cfg.link_on_pr === true;
   let ghRepo: string | null = null;
@@ -147,8 +252,15 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
     if (rr.status === 0) ghRepo = parseGhRepo(rr.stdout ?? "");
   }
   const finalBody = buildBody(
-    body, branch, cfg.link_issues === true, baseUrl ?? "", env.WORKFLOW_YT_ISSUE ?? "",
-    ghLinkOnPr, env.WORKFLOW_GH_ISSUE ?? "", env.WORKFLOW_GH_ISSUE_RELATION ?? "closes", ghRepo,
+    body,
+    branch,
+    cfg.link_issues === true,
+    baseUrl ?? "",
+    env.WORKFLOW_YT_ISSUE ?? "",
+    ghLinkOnPr,
+    env.WORKFLOW_GH_ISSUE ?? "",
+    env.WORKFLOW_GH_ISSUE_RELATION ?? "closes",
+    ghRepo,
   );
 
   const squash = pr.squashOnMerge !== false;
@@ -166,21 +278,30 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
     if (draft) cmd.push("--draft");
     if (push) cmd.push("--push");
     if (skipConfirm) cmd.push("--yes");
-    cmdEnv = { ...process.env, GITLAB_TOKEN: token };
+    // bun's Windows spawn only consults PATH when the env object carries an
+    // explicit PATH key — a spread-only PATH is invisible to the lookup and
+    // uv_spawn fails with ENOENT even though the CLI is on PATH.
+    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GITLAB_TOKEN: token };
   } else {
     cmd = ["gh", "pr", "create", "--title", title, "--base", target];
     if (finalBody) cmd.push("--body", finalBody);
     if (draft) cmd.push("--draft");
-    cmdEnv = { ...process.env, GH_TOKEN: token };
+    cmdEnv = { ...process.env, PATH: process.env.PATH ?? "", GH_TOKEN: token };
   }
 
   const result = spawnSync(cmd[0], cmd.slice(1), { cwd: root, encoding: "utf8", env: cmdEnv });
   if (result.status !== 0) {
     const err = (result.stderr ?? result.stdout ?? "").trim();
     let hint: Record<string, any> | null = null;
-    if (provider === "gitlab" && (err.includes("409") || err.toLowerCase().includes("already exists"))) {
-      const list = spawnSync("glab", ["mr", "list", `--source-branch=${branch}`, "--output=json"],
-        { cwd: root, encoding: "utf8", env: cmdEnv });
+    if (
+      provider === "gitlab" &&
+      (err.includes("409") || err.toLowerCase().includes("already exists"))
+    ) {
+      const list = spawnSync("glab", ["mr", "list", `--source-branch=${branch}`, "--output=json"], {
+        cwd: root,
+        encoding: "utf8",
+        env: cmdEnv,
+      });
       if (list.status === 0 && (list.stdout ?? "").trim()) {
         try {
           const mrs = JSON.parse(list.stdout ?? "") as Array<Record<string, any>>;
@@ -191,10 +312,16 @@ export function prCreate(env: NodeJS.ProcessEnv, cwd: string): Record<string, an
               next_step: "Use glab mr update or close the open MR before creating again",
             };
           }
-        } catch { /* no hint */ }
+        } catch {
+          /* no hint */
+        }
       }
     }
-    const payload: Record<string, any> = { error: "create failed", provider, stderr: err.slice(0, 800) };
+    const payload: Record<string, any> = {
+      error: "create failed",
+      provider,
+      stderr: err.slice(0, 800),
+    };
     if (hint) payload.hint = hint;
     return payload;
   }

package/src/core/present.ts

@@ -30,7 +30,12 @@ export function renderAsciiWireframe(spec: unknown): string {
     }
     if (kind === "button") {
       const label = "[ " + String(row?.label ?? "Button") + " ]";
-      lines.push(boxLine(label.padStart(Math.max(0, (width - 4 + label.length) / 2)).padEnd(width - 4), width));
+      lines.push(
+        boxLine(
+          label.padStart(Math.max(0, (width - 4 + label.length) / 2)).padEnd(width - 4),
+          width,
+        ),
+      );
       continue;
     }
     if (kind === "field") {
@@ -42,7 +47,11 @@ export function renderAsciiWireframe(spec: unknown): string {
     if (kind === "columns") {
       const cols = Array.isArray(row?.columns) ? row.columns : [];
       const colW = Math.floor((width - 4 - cols.length + 1) / Math.max(cols.length, 1));
-      const parts = cols.map((c: any) => String(c?.label ?? "").slice(0, Math.max(0, colW - 1)).padEnd(Math.max(0, colW)));
+      const parts = cols.map((c: any) =>
+        String(c?.label ?? "")
+          .slice(0, Math.max(0, colW - 1))
+          .padEnd(Math.max(0, colW)),
+      );
       lines.push(boxLine(parts.join(" | ").trim(), width));
       continue;
     }

package/src/core/registration.ts

@@ -0,0 +1,215 @@
+// Registration merge helpers for the OpenCode/Cursor installers (RR-06).
+// Pure functions: accept the existing user config, return the deduplicated
+// config PLUS the explicit list of keys changed. Unrelated user settings are
+// never rewritten — their values round-trip JSON-identical. The install
+// scripts (`packages/workit-core/scripts/install-*-plugin.sh`) import these so
+// there is exactly one source of truth for registration merging.
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+export interface MergeResult<T> {
+  config: T;
+  changed: string[];
+}
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** Exact identity match — `name` or `name@version` — never a substring (D3). */
+const named = (s: string, name: string) => s === name || s.startsWith(`${name}@`);
+
+/**
+ * True when a plugin identity is a current or legacy Workit entry. Matched by
+ * exact identity, never by substring: an unrelated plugin whose id merely
+ * contains "workflow-toolkit" is preserved (D3). Path-style identities are
+ * compared with normalized separators so a Windows file:// pin (backslashes)
+ * still matches the packages/workit-* path checks.
+ */
+export function isWorkitPlugin(value: unknown): boolean {
+  const s = String(value).replaceAll("\\", "/");
+  const url = s.startsWith("file://") || s.startsWith("git+file://");
+  const pkgPath =
+    s.includes("/packages/workit-opencode/") ||
+    s.includes("/packages/workit-cursor/") ||
+    s.includes("/node_modules/@brainervirus/workit-opencode/") ||
+    s.includes("/node_modules/@brainervirus/workit-cursor/");
+  return (
+    named(s, "workflow-toolkit") ||
+    named(s, "workflow-toolkit-opencode") ||
+    named(s, "local/workflow-toolkit") ||
+    named(s, "@brainervirus/workit-opencode") ||
+    named(s, "@brainervirus/workit-cursor") ||
+    (url && pkgPath) ||
+    (s.startsWith("git+file://") && s.includes("workflow-toolkit"))
+  );
+}
+
+/** Deduplicate every legacy/current Workit plugin identity to one dev pin. */
+export function mergeOpenCodePlugins(plugin: unknown, pin: string): MergeResult<unknown[]> {
+  const existing = Array.isArray(plugin) ? plugin : typeof plugin === "string" ? [plugin] : [];
+  const config = [pin, ...existing.filter((p) => !isWorkitPlugin(p))];
+  const changed = JSON.stringify(config) !== JSON.stringify(existing) ? ["plugin"] : [];
+  return { config, changed };
+}
+
+/** Merge an existing OpenCode config with a dev pin; preserve unrelated keys. */
+export function mergeOpenCodeConfig(
+  config: unknown,
+  pin: string,
+): MergeResult<Record<string, unknown>> {
+  const base = isRecord(config) ? { ...config } : {};
+  const changed: string[] = [];
+
+  const plugins = mergeOpenCodePlugins(base.plugin, pin);
+  if (plugins.changed.length > 0) {
+    base.plugin = plugins.config;
+    changed.push("plugin");
+  }
+
+  // Drop share skills.paths — native ~/.config/opencode/skills links avoid
+  // triple-load duplicates. Matched by exact path segment, never substring: an
+  // unrelated dir like `~/projects/my-workflow-toolkit-skills` is preserved (D3).
+  const skills = base.skills;
+  if (isRecord(skills) && Array.isArray(skills.paths)) {
+    const next = skills.paths.filter((p) => {
+      const segment = String(p).split(/[\\/]/);
+      return !segment.some((seg) => named(seg, "workflow-toolkit"));
+    });
+    if (next.length !== skills.paths.length) {
+      base.skills = { ...skills, paths: next };
+      changed.push("skills.paths");
+    }
+  }
+
+  return { config: base, changed };
+}
+
+/** Collapse current + legacy Cursor plugin identities to a single one. */
+export function mergeCursorEnabledPlugins(enabled: unknown): MergeResult<Record<string, boolean>> {
+  const prev = isRecord(enabled) ? { ...(enabled as Record<string, boolean>) } : {};
+  const next: Record<string, boolean> = { ...prev, "workflow-toolkit": true };
+  delete next["local/workflow-toolkit"]; // legacy duplicate identity
+  const changed = JSON.stringify(next) !== JSON.stringify(prev) ? ["enabled_plugins"] : [];
+  return { config: next, changed };
+}
+
+/** Append the plugin dir once, preserving any existing plugin directories. */
+export function mergeCursorPluginDirs(
+  pluginDirs: unknown,
+  pluginDir: string,
+): MergeResult<string[]> {
+  // path.join does not strip a single trailing separator; do it explicitly for
+  // the dedup comparison (guarding the filesystem-root case).
+  const strip = (p: string) => {
+    const j = path.join(p);
+    return path.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+  };
+  const normalized = strip(pluginDir);
+  const prev = Array.isArray(pluginDirs) ? pluginDirs.map(String) : [];
+  // Normalize both sides for comparison so a trailing-slash variant of an
+  // existing entry is not appended as a duplicate; existing entries are kept
+  // verbatim.
+  const exists = prev.some((d) => strip(d) === normalized);
+  const next = exists ? prev : [...prev, normalized];
+  const changed = next.length !== prev.length ? ["plugin_dirs"] : [];
+  return { config: next, changed };
+}
+
+/** Merge Cursor settings: one plugin identity, dirs appended, unrelated keys kept. */
+export function mergeCursorSettings(
+  settings: unknown,
+  pluginDir: string,
+): MergeResult<Record<string, unknown>> {
+  const base = isRecord(settings) ? { ...settings } : {};
+  const changed: string[] = [];
+
+  const enabled = mergeCursorEnabledPlugins(base.enabled_plugins);
+  if (enabled.changed.length > 0) {
+    base.enabled_plugins = enabled.config;
+    changed.push("enabled_plugins");
+  }
+
+  const dirs = mergeCursorPluginDirs(base.plugin_dirs, pluginDir);
+  if (dirs.changed.length > 0) {
+    base.plugin_dirs = dirs.config;
+    changed.push("plugin_dirs");
+  }
+
+  return { config: base, changed };
+}
+
+/** Set one portable workit MCP server, dropping the legacy server name. */
+export function mergeCursorMcp(
+  mcp: unknown,
+  serverName: string,
+  server: Record<string, unknown>,
+): MergeResult<Record<string, unknown>> {
+  const base = isRecord(mcp) ? { ...mcp } : {};
+  const servers = isRecord(base.mcpServers)
+    ? { ...(base.mcpServers as Record<string, unknown>) }
+    : {};
+  delete servers["workflow-toolkit"]; // legacy duplicate registration
+  servers[serverName] = server;
+  const changed = JSON.stringify(servers) !== JSON.stringify(base.mcpServers) ? ["mcpServers"] : [];
+  base.mcpServers = servers;
+  return { config: base, changed };
+}
+
+/** Swap the sessionStart hook command, preserving other hooks and fields. */
+export function mergeCursorHooks(
+  hooks: unknown,
+  sessionStartEntry: Record<string, unknown>,
+): MergeResult<Record<string, unknown>> {
+  const base: Record<string, unknown> = isRecord(hooks) ? { ...hooks } : { version: 1 };
+  const hooksMap = isRecord(base.hooks) ? { ...(base.hooks as Record<string, unknown>) } : {};
+  const list = Array.isArray(hooksMap.sessionStart) ? hooksMap.sessionStart : [];
+  const same =
+    list.length === 1 &&
+    isRecord(list[0]) &&
+    JSON.stringify(list[0]) === JSON.stringify(sessionStartEntry);
+  if (same) return { config: base, changed: [] };
+  hooksMap.sessionStart = [sessionStartEntry];
+  base.hooks = hooksMap;
+  return { config: base, changed: ["hooks.sessionStart"] };
+}
+
+/**
+ * Portable Cursor MCP server entry for an installed plugin dir: prefer the
+ * self-contained node dist bundle (PT-10); fall back to the bash shim for a
+ * dist-less dev checkout.
+ */
+export function cursorMcpServerEntry(packageDir: string): {
+  command: string;
+  args: string[];
+} {
+  if (existsSync(path.join(packageDir, "dist", "mcp-server.js"))) {
+    return {
+      command: "node",
+      args: [path.join(packageDir, "dist", "mcp-server.js"), "${workspaceFolder}"],
+    };
+  }
+  return {
+    command: "bash",
+    args: [path.join(packageDir, "mcp", "run-server.sh"), "${workspaceFolder}"],
+  };
+}
+
+/**
+ * Portable Cursor sessionStart hook entry: prefer the self-contained node dist
+ * bundle; fall back to the bash shim for a dist-less dev checkout (AR-06).
+ */
+export function cursorHooksEntry(packageDir: string): {
+  command: string;
+  args: string[];
+} {
+  if (existsSync(path.join(packageDir, "dist", "cursor-session-start.js"))) {
+    return {
+      command: "node",
+      args: [path.join(packageDir, "dist", "cursor-session-start.js")],
+    };
+  }
+  return {
+    command: "bash",
+    args: [path.join(packageDir, "hooks", "session-start")],
+  };
+}

package/src/core/reminder.ts

@@ -57,8 +57,7 @@ Skill: receiving-code-review. Verify before implementing — evaluate review fee
 export const shouldInjectVerification = (currentText: string): boolean =>
   !currentText.includes(VERIFICATION_TEXT);
 
-export const shouldInjectTdd = (currentText: string): boolean =>
-  !currentText.includes(TDD_TEXT);
+export const shouldInjectTdd = (currentText: string): boolean => !currentText.includes(TDD_TEXT);
 
 export const shouldInjectBrainstorm = (currentText: string): boolean =>
   !currentText.includes(BRAINSTORM_TEXT);