@brainervirus/workit-cursor 0.8.0 → 0.8.1

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "OpenCode-style verify, PR, changelog, commit, and session handoff for Cursor",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/README.md

@@ -23,7 +23,7 @@ npx @brainervirus/workit-cli init
       "command": "npx",
       "args": [
         "-y",
-        "--package=@brainervirus/workit-cursor@latest",
+        "--package=@brainervirus/workit-cursor@0.8.0",
         "workit-cursor-mcp",
         "${workspaceFolder}"
       ]
@@ -35,7 +35,7 @@ npx @brainervirus/workit-cli init
 ### Requirements
 
 - **Node.js ≥ 22** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
-- **Network** — `npx -y …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
+- **Network** — `npx -y …@0.8.0` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
 
 ## What it provides
 
@@ -59,11 +59,11 @@ Cursor adapts workit through policy-only confirmation: approvals and commits are
 
 Cursor launches the MCP server and session-start hook through `npx`, so the shipped manifests contain no repository-relative `dist` paths:
 
-- **MCP server** — `npx -y --package=@brainervirus/workit-cursor@latest workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
-- **Session-start hook** — `npx -y --package=@brainervirus/workit-cursor@latest workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
+- **MCP server** — `npx -y --package=@brainervirus/workit-cursor@0.8.0 workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
+- **Session-start hook** — `npx -y --package=@brainervirus/workit-cursor@0.8.0 workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
 - `npx` startup or network failure is surfaced by Cursor as an MCP/hook startup failure; Workit never silently substitutes stale local runtime code.
 
-The `@latest` tag means the runtime updates independently of the Marketplace metadata: Cursor reviews plugin metadata from Git, while npm serves the runtime. See [Update review](#update-review).
+The runtime runs from the exact reviewed pin `@0.8.0`: Cursor reviews plugin metadata from Git, while npm serves the pinned runtime. Bumping the pin is a deliberate reviewed update, made only after the target npm version is public — never a mutable `latest` dist-tag. See [Update review](#update-review).
 
 ## Security and data handling
 
@@ -96,7 +96,7 @@ The repository root carries `.cursor-plugin/marketplace.json`, indexing `package
 
 - **Installing from Marketplace** — a Marketplace admin adds the repository URL through Cursor's authenticated publisher flow; end users then install the plugin from the Cursor Marketplace UI, which reads `.cursor-plugin/plugin.json` and the tracked components directly from Git.
 - **Submission** — Marketplace submission is a separate, later authenticated action at `https://cursor.com/marketplace/publish`. It is **not** performed here and no publication or acceptance is claimed; the repository is kept validated and submission-ready.
-- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime tagged `@latest` updates independently. Reviewing an npm runtime change is a manual step: pin `--package=@brainervirus/workit-cursor@<version>` in `mcp.json` / `hooks-cursor.json` if you need immutable reviewed code instead of `@latest`.
+- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime is pinned to the exact reviewed `@0.8.0`. Bumping that pin in `mcp.json` / `hooks-cursor.json` is a deliberate reviewed change: only after the target npm version is public, never a mutable `latest` dist-tag.
 - **Troubleshooting** — `workit doctor` (or the `workflow_doctor` tool) reports installation health including runtime, token, VCS/YouTrack, and log-writability checks; it exits nonzero on failure. An MCP/hook startup failure with no network is an `npx`/registry reachability issue, not a Workit defect.
 
 ## Docs

package/dist/mcp-server.js

@@ -21839,7 +21839,13 @@ function isWorkitPlugin(value) {
   const pkgPath = s.includes("/packages/workit-opencode/") || s.includes("/packages/workit-cursor/") || s.includes("/node_modules/@brainervirus/workit-opencode/") || s.includes("/node_modules/@brainervirus/workit-cursor/");
   return named(s, "workflow-toolkit") || named(s, "workflow-toolkit-opencode") || named(s, "local/workflow-toolkit") || named(s, "workit") || named(s, "local/workit") || named(s, "@brainervirus/workit-opencode") || named(s, "@brainervirus/workit-cursor") || url && pkgPath || s.startsWith("git+file://") && s.includes("workflow-toolkit");
 }
-var named = (s, name) => s === name || s.startsWith(`${name}@`);
+function cursorHooksEntry(_packageDir) {
+  return {
+    command: `npx -y --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
+    args: []
+  };
+}
+var named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@0.8.0";
 var init_registration = () => {};
 
 // packages/workit-core/src/core/skill-manifests.ts
@@ -22183,7 +22189,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args[0] !== "-y")
       return "invalid";
-    if (args[1] !== "--package=@brainervirus/workit-cursor@latest")
+    if (args[1] !== `--package=${CURSOR_RUNTIME_PACKAGE}`)
       return "invalid";
     if (args[2] !== "workit-cursor-mcp")
       return "invalid";
@@ -22196,6 +22202,20 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     runtime: command,
     entry: path9.isAbsolute(args[0]) ? args[0] : path9.resolve(path9.dirname(res.cursorMcp), args[0])
   };
+}, canonicalCursorHook, registeredCursorHook = (res) => {
+  const hooksFile = path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  if (!existsSync5(hooksFile))
+    return "invalid";
+  const config2 = readJson(hooksFile);
+  if (!config2)
+    return "invalid";
+  const sessionStart = config2.hooks?.sessionStart;
+  if (!Array.isArray(sessionStart) || sessionStart.length !== 1)
+    return "invalid";
+  const entry = sessionStart[0];
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+    return "invalid";
+  return typeof entry.command === "string" ? entry.command : "invalid";
 }, checkLauncher = (res) => {
   const dev = res.dev;
   const hosts = hostsFor(res.host);
@@ -22208,6 +22228,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     } else if (registered && registered.kind === "node" && !validNodeEntry(registered.entry, registered.runtime, res.env)) {
       missing.push(`cursor: registered ${registered.entry}`);
     }
+    const hook = registeredCursorHook(res);
+    if (hook === "invalid") {
+      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+    } else if (hook !== null && hook !== canonicalCursorHook) {
+      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+    }
   }
   if (dev) {
     missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync5(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
@@ -22493,6 +22519,7 @@ var init_doctor = __esm(() => {
   init_registration();
   init_workspaces();
   init_skill_manifests();
+  canonicalCursorHook = cursorHooksEntry("").command;
   RUN_CHECKS = [
     checkRuntime,
     checkVersions,

package/hooks/hooks-cursor.json

@@ -3,7 +3,7 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "npx -y --package=@brainervirus/workit-cursor@latest workit-cursor-session-start"
+        "command": "npx -y --package=@brainervirus/workit-cursor@0.8.0 workit-cursor-session-start"
       }
     ]
   }

package/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "workit": {
       "command": "npx",
-      "args": ["-y", "--package=@brainervirus/workit-cursor@latest", "workit-cursor-mcp", "${workspaceFolder}"]
+      "args": ["-y", "--package=@brainervirus/workit-cursor@0.8.0", "workit-cursor-mcp", "${workspaceFolder}"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "private": false,
   "description": "Workit Cursor plugin: MCP server, hooks, rules, marketplace manifest (thin over @brainervirus/workit-core)",
   "keywords": [
@@ -39,7 +39,7 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^0.8.0",
+    "@brainervirus/workit-core": "^0.8.1",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },