@brainervirus/workit-cursor 0.10.0 → 1.0.0

package/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "workit",
   "displayName": "Workit",
-  "description": "OpenCode-style verify, PR, changelog, commit, and session handoff for Cursor",
-  "version": "0.10.0",
+  "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
+  "version": "1.0.0",
   "author": {
     "name": "Cristhofer Pincetti"
   },
@@ -28,11 +28,11 @@
     "commit",
     "handoff"
   ],
-  "skills": [
-    "skills/",
-    "vendor/superpowers/skills/"
+  "skills": "skills/",
+  "commands": "commands/",
+  "rules": [
+    "rules/workit-contract.mdc"
   ],
-  "rules": "rules/",
   "mcpServers": "mcp.json",
   "hooks": "hooks/hooks-cursor.json"
 }

package/README.md

@@ -1,6 +1,10 @@
 # @brainervirus/workit-cursor
 
-Cursor plugin for workit — MCP server, session-start hook, rules, and skills for agentic coding workflows (specs, plans, YouTrack, CI-gated commits).
+[![CI](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml/badge.svg)](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/@brainervirus/workit-cursor.svg)](https://www.npmjs.com/package/@brainervirus/workit-cursor)
+[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](../../LICENSE)
+
+Cursor plugin for workit — shared MCP tools, documented native hooks, compact continuity, and adaptive method skills.
 
 ## Install
 
@@ -35,26 +39,26 @@ npx @brainervirus/workit-cli init
 
 ### Requirements
 
-- **Node.js ≥ 22** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
+- **Node.js ≥ 24** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
 - **Network** — `npx -y --prefer-online …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
 
 ## What it provides
 
-- MCP server exposing the `workit_*` tools (branch setup, PR create/context, docs validate/promote, YouTrack post/log/time, templates, rules, presentation, doctor, handoff, and plan lifecycle `workit_plan_pause`/`resume`/`complete`).
-- Session-start contract hook.
-- 4 rules and 12 `wk-*` skills (plus 14 sanitized Superpowers skills).
+- MCP server exposing exactly the eight shared operation families: `workit_task`, `workit_policy`, `workit_evidence`, `workit_finding`, `workit_decision`, `workit_worker`, `workit_writer`, and `workit_state`.
+- One bounded native hook executable for session context, recognized product-write and shell interception, and native subagent lifecycle observations.
+- Fourteen canonical `workit-*` method skills and the `workit-contract` rule.
 
 ## Host limitations
 
-Cursor adapts workit through policy-only confirmation: approvals and lifecycle transitions are recorded as policy decisions (`attested: false`) rather than fabricated delegated identity, and subagent-driven plan execution is not supported on this host. Cursor consumes the same core outcomes but stays inline-only (the subagent-driven menu choice returns `unsupported_mode`); model selection remains a host-native action. Approvals bind to the document's exact SHA-256 digest — editing an approved spec/plan invalidates the approval and forces a fresh reapproval. OpenCode records native `question` receipts and runs delegated tasks; see the root [README](../../README.md#host-capabilities) for the full host-capability matrix.
+Cursor maps shared Workit operations through the shared MCP transport. AskQuestion remains policy-only (`agent_guided`), session start and compaction are non-blocking, and arbitrary shell writes, Tab edits, and exact subagent stop identity are unavailable. Known Write/Edit/Delete targets are enforced only when the documented Cursor hook inputs prove them. Native subagent delegation is read-only for reviewer/investigator assignments; implementer delegation is unavailable because Cursor exposes no attested writer identity or stable child-stop identity.
 
 ## Configuration
 
 - Plugin metadata: `packages/workit-cursor/.cursor-plugin/plugin.json` (`name: "workit"`, `displayName: "Workit"`).
 - MCP server: `mcp.json`.
 - Session-start hook: `hooks/hooks-cursor.json`.
-- Rules: `rules/` (`ask-question-only.mdc`, `cursor-todowrite.mdc`, `no-worktrees.mdc`, `sdd-docs-path.mdc`).
-- Skills: `skills/` (12 `wk-*`) and `vendor/superpowers/skills/` (14).
+- Rule: `rules/workit-contract.mdc`.
+- Skills: `skills/` (fourteen canonical Workit methods).
 
 ## Runtime
 
@@ -66,27 +70,25 @@ Cursor launches the MCP server and session-start hook through `npx`, so the ship
 
 The runtime runs from `@latest` with the mandatory `--prefer-online` flag: Cursor reviews plugin metadata from Git, while npm serves the runtime. `--prefer-online` forces npx to check the registry so a stale cached `latest` resolution is never reused. See [Update review](#update-review).
 
-## Security and data handling
+## Capability boundaries
 
-- **Secrets** — tokens are stored in files with mode 600 (`~/.config/workit/*.token`) and are never printed by tools; edit them locally.
-- **Logs** — a persistent JSONL journal records redacted structured diagnostics under the configuration directory; Cursor keeps `stderr` diagnostics for protocol safety, and `stdout` remains reserved for the MCP/hook protocol (the logger never writes to it).
-- **External interactions** — Git/VCS (branch resolution, PR/MR creation) and YouTrack (task updates, time logging) happen only when you invoke the corresponding tools; local setup copies files under `~/.cursor/plugins/local/workit` and `~/.config/workit/`.
+- Authority-sensitive MCP mutations require an attested caller. A standalone or ordinary Cursor launch stays usable for read-only inspection and reports `capability_unavailable` for authority mutations.
+- Native hook enforcement is limited to documented inputs and blocking behavior. The plugin does not claim a `beforeMCPExecution` hook, cross-process receipts, delegation tokens, or automatic compaction restoration.
 
 ## Plugin layout
 
-| Path | Contents |
-| --- | --- |
-| `mcp/` + `dist/mcp-server.js` | MCP server entry (built). |
-| `hooks/` | session-start hook manifest. |
-| `rules/` | 4 `.mdc` rules. |
-| `skills/` | 12 `wk-*` skills. |
-| `vendor/superpowers/skills/` | 14 sanitized Superpowers skills. |
-| `.cursor-plugin/plugin.json` | authoritative plugin manifest. |
+| Path                          | Contents                                                      |
+| ----------------------------- | ------------------------------------------------------------- |
+| `mcp/` + `dist/mcp-server.js` | MCP server entry (built).                                     |
+| `hooks/`                      | session-start hook manifest.                                  |
+| `rules/workit-contract.mdc`   | Adaptive task contract and truthful Cursor capability limits. |
+| `skills/`                     | Fourteen canonical adaptive Workit method skills.               |
+| `.cursor-plugin/plugin.json`  | authoritative plugin manifest.                                |
 
 ## Package scripts
 
 ```bash
-bun run build   # bundle dist/mcp-server.js, dist/cursor-session-start.js, sanitize vendor skills
+  bun run build   # bundle MCP + native hook entries and copy fourteen method skills
 ```
 
 From the repository root, `bun run validate:cursor-marketplace` validates the tracked Marketplace artifact against the official Cursor JSON schemas and clean-checkout invariants (component paths, frontmatter, logo, sanitized vendor parity, no ignored-`dist` runtime references).
@@ -97,16 +99,10 @@ The repository root carries `.cursor-plugin/marketplace.json`, indexing `package
 
 - **Installing from Marketplace** — a Marketplace admin adds the repository URL through Cursor's authenticated publisher flow; end users then install the plugin from the Cursor Marketplace UI, which reads `.cursor-plugin/plugin.json` and the tracked components directly from Git.
 - **Submission** — Marketplace submission is a separate, later authenticated action at `https://cursor.com/marketplace/publish`. It is **not** performed here and no publication or acceptance is claimed; the repository is kept validated and submission-ready.
-- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online`. The selector is shared across `mcp.json`, `hooks-cursor.json`, and `run-cursor-mcp.sh`, and a stale `latest` resolution is prevented by the mandatory `--prefer-online` flag.
-- **Troubleshooting** — `workit doctor` (or the `workit_doctor` tool) reports installation health including runtime, token, VCS/YouTrack, and log-writability checks; it exits nonzero on failure. An MCP/hook startup failure with no network is an `npx`/registry reachability issue, not a Workit defect.
-
-## Auto-load repair
-
-Workit self-heals stale Cursor plugin installs so the workflow features never silently drop out of auto-load (CA-01/CA-04):
-
-- **Detection** — the doctor's `stale_install` finding reads the installed `~/.cursor/plugins/local/workit` directory and fails on a legacy `--package=` pin in the plugin's own `mcp.json`, a sessionStart hook running a legacy selector, or a local-dist install behind the current/published runtime; each finding carries the exact repair step.
-- **Self-heal** — `install-cursor-plugin.sh` runs `doctor-check.ts cursor --stale` as a pre-check: exit 2 (stale) triggers a refresh of the plugin directory plus a rewrite of the workit MCP/hook entries to the canonical `@latest` + `--prefer-online` selector, preserving unrelated MCP servers; a healthy install is byte-untouched.
-- **Fail-open** — the one network probe (the npm registry version comparison for local-dist installs) never blocks an install: an unreachable registry warns as `registry_unreachable`, never `stale_install` and never a failure. Canonical `@latest` installs skip the probe entirely — the selector resolves fresh at launch, so the installed `package.json` version is metadata, not a freshness signal.
+- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online`. The selector is shared across `mcp.json` and `hooks-cursor.json`, and a stale `latest` resolution is prevented by the mandatory `--prefer-online` flag.
+  An MCP or hook startup failure with no network is an `npx`/registry reachability
+  issue; inspect the host's startup diagnostics and retry after connectivity is
+  restored.
 
 ## Docs
 

package/assets/templates/workit-contract.md

@@ -0,0 +1,12 @@
+# Workit contract
+
+Workit keeps one accountable lead and one shared task state. Inspect current
+task state before acting; use only the shared operations for task, policy,
+evidence, finding, decision, worker, writer, and state changes. Authority is
+bounded by the requested scope, current revision, caller/session provenance, and
+observed capabilities. Never claim host enforcement or evidence that the host
+cannot provide. Preserve unresolved requirements, gaps, and uncertain workers.
+
+Focused methods are loaded only when the resolved policy requires them. A method
+must call the shared operations and must not create a second lifecycle, approval
+chain, or task-state representation.

package/commands/wk-babysit.md

@@ -0,0 +1,7 @@
+# /wk-babysit
+
+Load and apply the bundled `workit-babysit` skill to the current PR.
+
+Drive it to merge-ready: work the frontier (conflicts, review threads, CI), classify CI failures before retrying, batch fixes into one push wave, and merge only when green per the repo's PR settings.
+
+Extra context: $ARGUMENTS

package/commands/wk-blast-radius.md

@@ -0,0 +1,7 @@
+# /wk-blast-radius
+
+Load and apply the bundled `workit-blast-radius` skill to the change at hand.
+
+Prove the one fact it is safe because of, with runnable proof — grep every caller, label unproven risks UNPROVEN, fix at the shared root.
+
+Extra context: $ARGUMENTS

package/commands/wk-challenge.md

@@ -0,0 +1,7 @@
+# /wk-challenge
+
+Load and apply the bundled `workit-challenge` skill to the current proposal or plan.
+
+Treat the proposal as a hypothesis to test: label consequential statements FACT / INFERENCE / OPINION / UNKNOWN, surface hidden assumptions and simpler alternatives, recommend one option with its tradeoff, and ask only for decisions the user owns.
+
+Extra context: $ARGUMENTS

package/commands/wk-debug.md

@@ -0,0 +1,7 @@
+# /wk-debug
+
+Load and apply the bundled `workit-debug` skill to the failing behavior.
+
+Build a loop that goes red on the exact failure before hypothesizing, trace to the root cause, fix at the shared root, and leave a regression test at the seam.
+
+Extra context: $ARGUMENTS

package/commands/wk-deslop.md

@@ -0,0 +1,7 @@
+# /wk-deslop
+
+Load and apply the bundled `workit-deslop` skill before opening a PR or after implementation.
+
+Remove AI slop from code and prose with a minimal diff: delete dead weight and filler, keep real symbol names and numbers, never refactor behavior.
+
+Extra context: $ARGUMENTS

package/commands/wk-diagram.md

@@ -0,0 +1,7 @@
+# /wk-diagram
+
+Load and apply the bundled `workit-diagram` skill when a spec or plan needs a flow or architecture diagram.
+
+Mermaid only when needed (flowchart/sequence/state/ER), real symbol names, verified by reading before commit — never a diagram suite.
+
+Extra context: $ARGUMENTS

package/commands/wk-green-run.md

@@ -0,0 +1,7 @@
+# /wk-green-run
+
+Load and apply the bundled `workit-green-run` skill to drive a red CI pipeline back to green.
+
+Read the failing logs, classify (flake/stale-base/real failure), fix at root cause with a regression test, push one wave, re-verify green on the new head.
+
+Extra context: $ARGUMENTS

package/commands/wk-handoff.md

@@ -0,0 +1,7 @@
+# /wk-handoff
+
+Load and apply the bundled `workit-handoff` skill to package the current state for another session or host.
+
+Preserve objective, decisions, gaps, blockers, and next action — continuity without transcript archaeology.
+
+Extra context: $ARGUMENTS

package/commands/wk-implement.md

@@ -0,0 +1,7 @@
+# /wk-implement
+
+Load and apply the bundled `workit-implement` skill to carry out the scoped task.
+
+Implement the smallest change behind the agreed scope, verify behavior with the relevant checks, and reconcile task state, evidence, and findings when done.
+
+Extra context: $ARGUMENTS

package/commands/wk-mockup.md

@@ -0,0 +1,7 @@
+# /wk-mockup
+
+Load and apply the bundled `workit-mockup` skill when a UI decision needs sketching before implementation.
+
+ASCII wireframes, at most three layout hypotheses, states and nav flow covered, decision lands in the spec dir. Sketch, don't build.
+
+Extra context: $ARGUMENTS

package/commands/wk-plan.md

@@ -0,0 +1,7 @@
+# /wk-plan
+
+Load and apply the bundled `workit-plan` skill to the current work.
+
+Record only the useful sequence (objective, dependency, bounded task, evidence needed, owner, next action) with the size-appropriate ceremony: spec + plan for large work, compact plan for medium, progress only for small.
+
+Extra context: $ARGUMENTS

package/commands/wk-review.md

@@ -0,0 +1,7 @@
+# /wk-review
+
+Load and apply the bundled `workit-review` skill to the current candidate.
+
+Review the real diff on two axes (standards + spec fidelity) with proof-required findings, then fix, dismiss with evidence, or escalate — never relabel self-review as independent.
+
+Extra context: $ARGUMENTS

package/commands/wk-steer.md

@@ -0,0 +1,7 @@
+# /wk-steer
+
+Load and apply the bundled `workit-steer` skill when new instructions, interruptions, or forgotten items arrive mid-task.
+
+Park state verbatim, classify (same-task/new-task/quick-question), handle with full rigor, re-anchor with a one-line resume brief.
+
+Extra context: $ARGUMENTS

package/commands/wk-tdd.md

@@ -0,0 +1,7 @@
+# /wk-tdd
+
+Load and apply the bundled `workit-behavioral-tdd` skill to the behavior at hand.
+
+Test the observable result at a stable boundary: one vertical RED slice, smallest change, GREEN, then reconcile. Reject noisy, tautological, and ghost-loop tests.
+
+Extra context: $ARGUMENTS