@brainervirus/workit-core 0.8.6 → 0.8.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": false,
   "description": "Workit — workflow rails for agentic coding: specs, plans, YouTrack, CI-gated commits (shared core)",
   "keywords": [

package/scripts/run-cursor-mcp.sh

@@ -3,4 +3,4 @@
 # Launch the published package's MCP bin through npx, never a repo-relative
 # dist or share clone; a startup/network failure surfaces via npx's nonzero exit.
 set -euo pipefail
-exec npx -y --package=@brainervirus/workit-cursor@0.8.5 workit-cursor-mcp "$@"
+exec npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-mcp "$@"

package/src/core/doctor.ts

@@ -11,7 +11,7 @@ import path from "node:path";
 import { SUPPORT_MATRIX } from "./support-matrix";
 import { EVENT } from "./boundary";
 import { getDiagnosticLogger, isConfigObject } from "./config";
-import { CURSOR_RUNTIME_PACKAGE, cursorHooksEntry, isWorkitPlugin } from "./registration";
+import { cursorHooksEntry, cursorMcpServerEntry, isWorkitPlugin } from "./registration";
 import { resolveWorkspaceFrom } from "./workspaces";
 import { validateCursorSkills } from "./skill-manifests";
 
@@ -418,12 +418,13 @@ const registeredCursorLauncher = (res: Resolved): CursorLauncher | null | "inval
   const executable = path.basename(command).toLowerCase();
   // CA-17: the canonical launcher runs the published package through npx; the
   // offline doctor validates its shape (never the registry reachability).
+  // Exact positional tokens — a substring match would accept `@latest-alpha`
+  // or `workit-cursor-mcp-foo`, and any extra/missing token would weaken the
+  // freshness guarantee (`--prefer-online` is mandatory).
+  const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
-    // CA-17: exact positional tokens — a substring match would accept
-    // `@latest-alpha` or `workit-cursor-mcp-foo`.
-    if (args[0] !== "-y") return "invalid";
-    if (args[1] !== `--package=${CURSOR_RUNTIME_PACKAGE}`) return "invalid";
-    if (args[2] !== "workit-cursor-mcp") return "invalid";
+    if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
+      return "invalid";
     return { kind: "npx" };
   }
   if (executable !== "node" && executable !== "node.exe") return "invalid";

package/src/core/flow-state.ts

@@ -696,7 +696,8 @@ const readCanonicalDigest = (root: string, rel: string): CanonicalDigestResult =
  * Approval-integrity reconciliation (CA-02, CA-03): recompute approved
  * document digests in spec-before-plan order and return the reset state plus
  * the structured drift reasons. Spec drift resets the whole approval chain;
- * plan drift (spec valid) preserves the spec approval and digest.
+ * plan drift (spec valid) preserves the spec approval/digest and the execution
+ * lifecycle, resetting only the plan's approval digest.
  */
 const resetForSpecDrift = (state: FlowState): FlowState => ({
   ...state,
@@ -711,9 +712,11 @@ const resetForSpecDrift = (state: FlowState): FlowState => ({
 const resetForPlanDrift = (state: FlowState): FlowState => ({
   ...state,
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
-  menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null },
-  handoff_destination: false,
+  // A plan edit resets only the plan's approval digest (fresh re-approval is
+  // required before any plan-gated transition). The execution lifecycle, the
+  // recorded menu choice, and the handoff context are lifecycle facts, not
+  // plan-approval facts: an in-progress or completed run must not be rewound
+  // to pending by a doc edit made during or after implementation.
   updated_at: Date.now(),
 });
 

package/src/core/registration.ts

@@ -180,11 +180,13 @@ export function mergeCursorHooks(
 }
 
 /**
- * Canonical reviewed pin for the Cursor npm runtime (README "Update review").
- * The single source for every source-derived Cursor runtime selector; the
- * committed manifests keep the literal (static data cannot import TS).
+ * Canonical selector for the Cursor npm runtime: `@latest` with `--prefer-online`
+ * (README "Update review"). The single source for every source-derived Cursor
+ * runtime selector; the committed manifests keep the literal (static data
+ * cannot import TS). `--prefer-online` is mandatory — it forces npx to check
+ * the registry so a stale cached `latest` resolution is never reused.
  */
-export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@0.8.5";
+export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
 
 /**
  * Portable Cursor MCP server entry (CA-16/CA-17): launch the published package
@@ -197,7 +199,13 @@ export function cursorMcpServerEntry(_packageDir: string): {
 } {
   return {
     command: "npx",
-    args: ["-y", `--package=${CURSOR_RUNTIME_PACKAGE}`, "workit-cursor-mcp", "${workspaceFolder}"],
+    args: [
+      "-y",
+      "--prefer-online",
+      `--package=${CURSOR_RUNTIME_PACKAGE}`,
+      "workit-cursor-mcp",
+      "${workspaceFolder}",
+    ],
   };
 }
 
@@ -210,7 +218,7 @@ export function cursorHooksEntry(_packageDir: string): {
   args: string[];
 } {
   return {
-    command: `npx -y --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
+    command: `npx -y --prefer-online --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
     args: [],
   };
 }