@brainervirus/workit-core 1.0.6 → 1.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "private": false,
   "description": "Workit shared core — task, policy, evidence, review, decision, worker, and writer state for agentic coding workflows",
   "keywords": [

package/scripts/run-cursor-mcp.sh

@@ -3,4 +3,4 @@
 # Launch the published package's MCP bin through npx, never a repo-relative
 # dist or share clone; a startup/network failure surfaces via npx's nonzero exit.
 set -euo pipefail
-exec npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-mcp "$@"
+exec npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-mcp "$@"

package/skills/workit-babysit/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: workit-babysit
-description: Use when a PR needs driving to merge-ready, CI is red, or the user says babysit
+description: Use after creating a PR (auto-starts, drive default), when a PR needs driving to merge-ready, CI is red, or the user says babysit
 ---
 
 # Babysit a PR to merge-ready
 
-Babysit starts automatically on PR creation unless declined (`--no-babysit`).
+Babysit starts automatically on PR creation unless declined (`babysit:false`).
 One babysitter per PR; never mutate PR topology (no rebase strategy changes,
 no force-push).
 
@@ -17,8 +17,11 @@ selects requirements; do not wait for a rule that can only exist after assess.
 
 ## Method
 
-1. Declare mode: drive (fix + merge), watch (report only), or threads-only.
+1. Declare mode in the same turn as the PR URL: drive (fix + merge, the
+   default), watch (report only), or threads-only.
 2. Work the merge frontier in order: conflicts → review threads → CI.
+   Record a frontier brief (frontier state, next action) in task progress
+   per pass so the steps stay visible.
 3. Classify CI before retry: flake (rerun once) vs stale base (verify with
    `git merge-base --is-ancestor` before updating) vs real failure (fix).
 4. Triage bot findings skeptically: reproduce or quote code before acting;

package/src/core/cutover.ts

@@ -235,8 +235,9 @@ export const detectCursorLatest = (cursorMcp: string): boolean => {
     return (
       server.args[0] === "-y" &&
       server.args[1] === "--prefer-online" &&
-      server.args[2] === `--package=${CURSOR_RUNTIME_PACKAGE}` &&
-      server.args[3] === "workit-cursor-mcp"
+      server.args[2] === "--min-release-age=0" &&
+      server.args[3] === `--package=${CURSOR_RUNTIME_PACKAGE}` &&
+      server.args[4] === "workit-cursor-mcp"
     );
   } catch {
     return false;

package/src/core/doctor.ts

@@ -531,7 +531,8 @@ const registeredCursorLauncher = (res: Resolved): CursorLauncher | null | "inval
   // offline doctor validates its shape (never the registry reachability).
   // Exact positional tokens — a substring match would accept `@latest-alpha`
   // or `workit-cursor-mcp-foo`, and any extra/missing token would weaken the
-  // freshness guarantee (`--prefer-online` is mandatory).
+  // freshness guarantee (`--prefer-online` and the npm release-age workaround
+  // are mandatory).
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))

package/src/core/external-action-effects.ts

@@ -820,7 +820,7 @@ export const resolveExternalActionRequest = (
         if (preview.error) return failure("invalid_input", preview.error);
         const target = String(preview.path);
         const relative =
-          path.relative(path.resolve(root), target).replaceAll(path.sep, "/") || "CHANGELOG.md";
+          path.relative(fs.realpathSync(root), target).replaceAll(path.sep, "/") || "CHANGELOG.md";
         const normalized = {
           operation: request.operation,
           payload: {
@@ -937,6 +937,9 @@ export const resolveExternalActionRequest = (
   }
 };
 
+export const prBabysitNext = (output: string): string =>
+  `Babysit ${output} to merge-ready (drive mode default). Follow skill workit-babysit: declare mode in this turn, work conflicts, review threads, then CI, and record a frontier brief in task progress per pass. Opt out with babysit:false.`;
+
 export const executeConcreteExternalAction = async (
   request: ExternalActionRequest,
   root: string,
@@ -1015,6 +1018,9 @@ export const executeConcreteExternalAction = async (
             ...result,
             babysit: request.payload.babysit ?? true,
             babysitSkill: "workit-babysit",
+            ...((request.payload.babysit ?? true)
+              ? { next: prBabysitNext(String((result as { output?: unknown }).output ?? "")) }
+              : {}),
           });
     }
     case "changelog.apply": {

package/src/core/external-action.ts

@@ -524,7 +524,7 @@ export async function runAuthorizedExternalAction<T>(
         (contract.details as Record<string, unknown>).outcome === "not_started";
       const outcome = input.failureOutcome ?? (preflight ? "not_started" : "unknown");
       const settled = settleWithRefresh(outcome, settle(outcome));
-      if (!settled.ok && outcome === "unknown") return settled as ExternalActionResult<T>;
+      if (!settled.ok) return settled as ExternalActionResult<T>;
       return contract;
     }
     effectValue = contract.data;

package/src/core/registration.ts

@@ -206,8 +206,8 @@ export function mergeCursorHooks(
  * Canonical selector for the Cursor npm runtime: `@latest` with `--prefer-online`
  * (README "Update review"). The single source for every source-derived Cursor
  * runtime selector; the committed manifests keep the literal (static data
- * cannot import TS). `--prefer-online` is mandatory — it forces npx to check
- * the registry so a stale cached `latest` resolution is never reused.
+ * cannot import TS). `--min-release-age=0` works around npm/cli#9765, where
+ * npx ignores the user's scoped release-age exclusion.
  */
 export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
 
@@ -215,7 +215,7 @@ export const CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
  * Canonical Cursor hook launcher (single source of truth for the shipped
  * hooks-cursor.json, the installer merge, and the doctor drift check).
  */
-export const CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
+export const CURSOR_HOOK_RUN_COMMAND = `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-hook`;
 
 /**
  * preToolUse matcher covering every name the hook's write-tool guard treats
@@ -270,6 +270,7 @@ export function cursorMcpServerEntry(_packageDir: string): {
     args: [
       "-y",
       "--prefer-online",
+      "--min-release-age=0",
       `--package=${CURSOR_RUNTIME_PACKAGE}`,
       "workit-cursor-mcp",
       "${workspaceFolder}",
@@ -286,7 +287,7 @@ export function cursorHooksEntry(_packageDir: string): {
   args: string[];
 } {
   return {
-    command: `npx -y --prefer-online --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
+    command: `npx -y --prefer-online --min-release-age=0 --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
     args: [],
   };
 }