@brainervirus/workit-core 1.0.6 → 1.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/scripts/run-cursor-mcp.sh

@@ -3,4 +3,4 @@
 # Launch the published package's MCP bin through npx, never a repo-relative
 # dist or share clone; a startup/network failure surfaces via npx's nonzero exit.
 set -euo pipefail
-exec npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-mcp "$@"
+exec npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-mcp "$@"

package/src/core/cutover.ts

@@ -235,8 +235,9 @@ export const detectCursorLatest = (cursorMcp: string): boolean => {
     return (
       server.args[0] === "-y" &&
       server.args[1] === "--prefer-online" &&
-      server.args[2] === `--package=${CURSOR_RUNTIME_PACKAGE}` &&
-      server.args[3] === "workit-cursor-mcp"
+      server.args[2] === "--min-release-age=0" &&
+      server.args[3] === `--package=${CURSOR_RUNTIME_PACKAGE}` &&
+      server.args[4] === "workit-cursor-mcp"
     );
   } catch {
     return false;

package/src/core/doctor.ts

@@ -531,7 +531,8 @@ const registeredCursorLauncher = (res: Resolved): CursorLauncher | null | "inval
   // offline doctor validates its shape (never the registry reachability).
   // Exact positional tokens — a substring match would accept `@latest-alpha`
   // or `workit-cursor-mcp-foo`, and any extra/missing token would weaken the
-  // freshness guarantee (`--prefer-online` is mandatory).
+  // freshness guarantee (`--prefer-online` and the npm release-age workaround
+  // are mandatory).
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))

package/src/core/external-action-effects.ts

@@ -820,7 +820,7 @@ export const resolveExternalActionRequest = (
         if (preview.error) return failure("invalid_input", preview.error);
         const target = String(preview.path);
         const relative =
-          path.relative(path.resolve(root), target).replaceAll(path.sep, "/") || "CHANGELOG.md";
+          path.relative(fs.realpathSync(root), target).replaceAll(path.sep, "/") || "CHANGELOG.md";
         const normalized = {
           operation: request.operation,
           payload: {

package/src/core/external-action.ts

@@ -524,7 +524,7 @@ export async function runAuthorizedExternalAction<T>(
         (contract.details as Record<string, unknown>).outcome === "not_started";
       const outcome = input.failureOutcome ?? (preflight ? "not_started" : "unknown");
       const settled = settleWithRefresh(outcome, settle(outcome));
-      if (!settled.ok && outcome === "unknown") return settled as ExternalActionResult<T>;
+      if (!settled.ok) return settled as ExternalActionResult<T>;
       return contract;
     }
     effectValue = contract.data;

package/src/core/registration.ts

@@ -206,8 +206,8 @@ export function mergeCursorHooks(
  * Canonical selector for the Cursor npm runtime: `@latest` with `--prefer-online`
  * (README "Update review"). The single source for every source-derived Cursor
  * runtime selector; the committed manifests keep the literal (static data
- * cannot import TS). `--prefer-online` is mandatory — it forces npx to check
- * the registry so a stale cached `latest` resolution is never reused.
+ * cannot import TS). `--min-release-age=0` works around npm/cli#9765, where
+ * npx ignores the user's scoped release-age exclusion.
  */
 export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
 
@@ -215,7 +215,7 @@ export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
  * Canonical Cursor hook launcher (single source of truth for the shipped
  * hooks-cursor.json, the installer merge, and the doctor drift check).
  */
-export const CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
+export const CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
 
 /**
  * preToolUse matcher covering every name the hook's write-tool guard treats
@@ -270,6 +270,7 @@ export function cursorMcpServerEntry(_packageDir: string): {
     args: [
       "-y",
       "--prefer-online",
+      "--min-release-age=0",
       `--package=${CURSOR_RUNTIME_PACKAGE}`,
       "workit-cursor-mcp",
       "${workspaceFolder}",
@@ -286,7 +287,7 @@ export function cursorHooksEntry(_packageDir: string): {
   args: string[];
 } {
   return {
-    command: `npx -y --prefer-online --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
+    command: `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
     args: [],
   };
 }