@brainervirus/workit-core 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "private": false,
   "description": "Workit — workflow rails for agentic coding: specs, plans, YouTrack, CI-gated commits (shared core)",
   "keywords": [

package/scripts/run-cursor-mcp.sh

@@ -3,4 +3,4 @@
 # Launch the published package's MCP bin through npx, never a repo-relative
 # dist or share clone; a startup/network failure surfaces via npx's nonzero exit.
 set -euo pipefail
-exec npx -y --package=@brainervirus/workit-cursor@latest workit-cursor-mcp "$@"
+exec npx -y --package=@brainervirus/workit-cursor@0.8.0 workit-cursor-mcp "$@"

package/src/core/doctor.ts

@@ -11,7 +11,7 @@ import path from "node:path";
 import { SUPPORT_MATRIX } from "./support-matrix";
 import { EVENT } from "./boundary";
 import { getDiagnosticLogger, isConfigObject } from "./config";
-import { isWorkitPlugin } from "./registration";
+import { CURSOR_RUNTIME_PACKAGE, cursorHooksEntry, isWorkitPlugin } from "./registration";
 import { resolveWorkspaceFrom } from "./workspaces";
 import { validateCursorSkills } from "./skill-manifests";
 
@@ -422,7 +422,7 @@ const registeredCursorLauncher = (res: Resolved): CursorLauncher | null | "inval
     // CA-17: exact positional tokens — a substring match would accept
     // `@latest-alpha` or `workit-cursor-mcp-foo`.
     if (args[0] !== "-y") return "invalid";
-    if (args[1] !== "--package=@brainervirus/workit-cursor@latest") return "invalid";
+    if (args[1] !== `--package=${CURSOR_RUNTIME_PACKAGE}`) return "invalid";
     if (args[2] !== "workit-cursor-mcp") return "invalid";
     return { kind: "npx" };
   }
@@ -434,6 +434,26 @@ const registeredCursorLauncher = (res: Resolved): CursorLauncher | null | "inval
   };
 };
 
+// CA-17: the canonical session-start hook runs the published package through
+// npx as a single command string (Cursor's documented hook format). The doctor
+// validates its shape exactly like the MCP launcher — no substring matching,
+// no version abstraction.
+const canonicalCursorHook = cursorHooksEntry("").command;
+
+const registeredCursorHook = (res: Resolved): string | null | "invalid" => {
+  const hooksFile = path.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  if (!existsSync(hooksFile)) return "invalid";
+  const config = readJson(hooksFile);
+  // Unlike mcp.json, the hook file is not covered by checkMalformedConfig, so
+  // an unparseable hook must fail the launcher check rather than slip through.
+  if (!config) return "invalid";
+  const sessionStart = config.hooks?.sessionStart;
+  if (!Array.isArray(sessionStart) || sessionStart.length !== 1) return "invalid";
+  const entry = sessionStart[0];
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return "invalid";
+  return typeof entry.command === "string" ? entry.command : "invalid";
+};
+
 const checkLauncher = (res: Resolved): DoctorCheck => {
   const dev = res.dev;
   const hosts = hostsFor(res.host);
@@ -458,6 +478,16 @@ const checkLauncher = (res: Resolved): DoctorCheck => {
     ) {
       missing.push(`cursor: registered ${registered.entry}`);
     }
+    const hook = registeredCursorHook(res);
+    if (hook === "invalid") {
+      missing.push(
+        `cursor: canonical session-start hook in ${path.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`,
+      );
+    } else if (hook !== null && hook !== canonicalCursorHook) {
+      missing.push(
+        `cursor: canonical session-start hook in ${path.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`,
+      );
+    }
   }
   if (dev) {
     missing.push(

package/src/core/registration.ts

@@ -179,6 +179,13 @@ export function mergeCursorHooks(
   return { config: base, changed: ["hooks.sessionStart"] };
 }
 
+/**
+ * Canonical reviewed pin for the Cursor npm runtime (README "Update review").
+ * The single source for every source-derived Cursor runtime selector; the
+ * committed manifests keep the literal (static data cannot import TS).
+ */
+export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@0.8.0";
+
 /**
  * Portable Cursor MCP server entry (CA-16/CA-17): launch the published package
  * through npx against its npm bin, so the Marketplace plugin never depends on a
@@ -190,12 +197,7 @@ export function cursorMcpServerEntry(_packageDir: string): {
 } {
   return {
     command: "npx",
-    args: [
-      "-y",
-      "--package=@brainervirus/workit-cursor@latest",
-      "workit-cursor-mcp",
-      "${workspaceFolder}",
-    ],
+    args: ["-y", `--package=${CURSOR_RUNTIME_PACKAGE}`, "workit-cursor-mcp", "${workspaceFolder}"],
   };
 }
 
@@ -208,7 +210,7 @@ export function cursorHooksEntry(_packageDir: string): {
   args: string[];
 } {
   return {
-    command: "npx -y --package=@brainervirus/workit-cursor@latest workit-cursor-session-start",
+    command: `npx -y --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
     args: [],
   };
 }