@brainervirus/workit-cursor 0.8.6 → 0.8.7

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "OpenCode-style verify, PR, changelog, commit, and session handoff for Cursor",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/README.md

@@ -23,7 +23,8 @@ npx @brainervirus/workit-cli init
       "command": "npx",
       "args": [
         "-y",
-        "--package=@brainervirus/workit-cursor@0.8.5",
+        "--prefer-online",
+        "--package=@brainervirus/workit-cursor@latest",
         "workit-cursor-mcp",
         "${workspaceFolder}"
       ]
@@ -35,7 +36,7 @@ npx @brainervirus/workit-cli init
 ### Requirements
 
 - **Node.js ≥ 22** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
-- **Network** — `npx -y …@0.8.5` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
+- **Network** — `npx -y --prefer-online …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
 
 ## What it provides
 
@@ -59,11 +60,11 @@ Cursor adapts workit through policy-only confirmation: approvals and lifecycle t
 
 Cursor launches the MCP server and session-start hook through `npx`, so the shipped manifests contain no repository-relative `dist` paths:
 
-- **MCP server** — `npx -y --package=@brainervirus/workit-cursor@0.8.5 workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
-- **Session-start hook** — `npx -y --package=@brainervirus/workit-cursor@0.8.5 workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
+- **MCP server** — `npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
+- **Session-start hook** — `npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
 - `npx` startup or network failure is surfaced by Cursor as an MCP/hook startup failure; Workit never silently substitutes stale local runtime code.
 
-The runtime runs from the exact reviewed pin `@0.8.5`: Cursor reviews plugin metadata from Git, while npm serves the pinned runtime. Bumping the pin is a deliberate reviewed update, made only after the target npm version is public — never a mutable `latest` dist-tag. See [Update review](#update-review).
+The runtime runs from `@latest` with the mandatory `--prefer-online` flag: Cursor reviews plugin metadata from Git, while npm serves the runtime. `--prefer-online` forces npx to check the registry so a stale cached `latest` resolution is never reused. See [Update review](#update-review).
 
 ## Security and data handling
 
@@ -96,7 +97,7 @@ The repository root carries `.cursor-plugin/marketplace.json`, indexing `package
 
 - **Installing from Marketplace** — a Marketplace admin adds the repository URL through Cursor's authenticated publisher flow; end users then install the plugin from the Cursor Marketplace UI, which reads `.cursor-plugin/plugin.json` and the tracked components directly from Git.
 - **Submission** — Marketplace submission is a separate, later authenticated action at `https://cursor.com/marketplace/publish`. It is **not** performed here and no publication or acceptance is claimed; the repository is kept validated and submission-ready.
-- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime is pinned to the exact reviewed `@0.8.5`. Bumping that pin in `mcp.json` / `hooks-cursor.json` is a deliberate reviewed change: only after the target npm version is public, never a mutable `latest` dist-tag.
+- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online`. The selector is shared across `mcp.json`, `hooks-cursor.json`, and `run-cursor-mcp.sh`, and a stale `latest` resolution is prevented by the mandatory `--prefer-online` flag.
 - **Troubleshooting** — `workit doctor` (or the `workflow_doctor` tool) reports installation health including runtime, token, VCS/YouTrack, and log-writability checks; it exits nonzero on failure. An MCP/hook startup failure with no network is an `npx`/registry reachability issue, not a Workit defect.
 
 ## Docs

package/dist/mcp-server.js

@@ -21842,13 +21842,25 @@ function isWorkitPlugin(value) {
   const pkgPath = s.includes("/packages/workit-opencode/") || s.includes("/packages/workit-cursor/") || s.includes("/node_modules/@brainervirus/workit-opencode/") || s.includes("/node_modules/@brainervirus/workit-cursor/");
   return named(s, "workflow-toolkit") || named(s, "workflow-toolkit-opencode") || named(s, "local/workflow-toolkit") || named(s, "workit") || named(s, "local/workit") || named(s, "@brainervirus/workit-opencode") || named(s, "@brainervirus/workit-cursor") || url && pkgPath || s.startsWith("git+file://") && s.includes("workflow-toolkit");
 }
+function cursorMcpServerEntry(_packageDir) {
+  return {
+    command: "npx",
+    args: [
+      "-y",
+      "--prefer-online",
+      `--package=${CURSOR_RUNTIME_PACKAGE}`,
+      "workit-cursor-mcp",
+      "${workspaceFolder}"
+    ]
+  };
+}
 function cursorHooksEntry(_packageDir) {
   return {
-    command: `npx -y --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
+    command: `npx -y --prefer-online --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
     args: []
   };
 }
-var named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@0.8.5";
+var named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest";
 var init_registration = () => {};
 
 // packages/workit-core/src/core/skill-manifests.ts
@@ -22189,12 +22201,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return "invalid";
   }
   const executable = path9.basename(command).toLowerCase();
+  const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
-    if (args[0] !== "-y")
-      return "invalid";
-    if (args[1] !== `--package=${CURSOR_RUNTIME_PACKAGE}`)
-      return "invalid";
-    if (args[2] !== "workit-cursor-mcp")
+    if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
       return "invalid";
     return { kind: "npx" };
   }
@@ -24503,9 +24512,6 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
 }), resetForPlanDrift = (state) => ({
   ...state,
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
-  menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null },
-  handoff_destination: false,
   updated_at: Date.now()
 }), driftCodeFor = (root, relPath, storedDigest) => {
   if (storedDigest === null)

package/hooks/hooks-cursor.json

@@ -3,7 +3,7 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "npx -y --package=@brainervirus/workit-cursor@0.8.5 workit-cursor-session-start"
+        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-session-start"
       }
     ]
   }

package/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "workit": {
       "command": "npx",
-      "args": ["-y", "--package=@brainervirus/workit-cursor@0.8.5", "workit-cursor-mcp", "${workspaceFolder}"]
+      "args": ["-y", "--prefer-online", "--package=@brainervirus/workit-cursor@latest", "workit-cursor-mcp", "${workspaceFolder}"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "private": false,
   "description": "Workit Cursor plugin: MCP server, hooks, rules, marketplace manifest (thin over @brainervirus/workit-core)",
   "keywords": [
@@ -39,7 +39,7 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^0.8.6",
+    "@brainervirus/workit-core": "^0.8.7",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },