@brainervirus/workit-cursor 0.8.7 → 0.8.8

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "OpenCode-style verify, PR, changelog, commit, and session handoff for Cursor",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/README.md

@@ -100,6 +100,14 @@ The repository root carries `.cursor-plugin/marketplace.json`, indexing `package
 - **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online`. The selector is shared across `mcp.json`, `hooks-cursor.json`, and `run-cursor-mcp.sh`, and a stale `latest` resolution is prevented by the mandatory `--prefer-online` flag.
 - **Troubleshooting** — `workit doctor` (or the `workflow_doctor` tool) reports installation health including runtime, token, VCS/YouTrack, and log-writability checks; it exits nonzero on failure. An MCP/hook startup failure with no network is an `npx`/registry reachability issue, not a Workit defect.
 
+## Auto-load repair
+
+Workit self-heals stale Cursor plugin installs so the workflow features never silently drop out of auto-load (CA-01/CA-04):
+
+- **Detection** — the doctor's `stale_install` finding reads the installed `~/.cursor/plugins/local/workit` directory and fails on a legacy `--package=` pin in the plugin's own `mcp.json`, a sessionStart hook running a legacy selector, or a local-dist install behind the current/published runtime; each finding carries the exact repair step.
+- **Self-heal** — `install-cursor-plugin.sh` runs `doctor-check.ts cursor --stale` as a pre-check: exit 2 (stale) triggers a refresh of the plugin directory plus a rewrite of the workit MCP/hook entries to the canonical `@latest` + `--prefer-online` selector, preserving unrelated MCP servers; a healthy install is byte-untouched.
+- **Fail-open** — the one network probe (the npm registry version comparison for local-dist installs) never blocks an install: an unreachable registry warns as `registry_unreachable`, never `stale_install` and never a failure. Canonical `@latest` installs skip the probe entirely — the selector resolves fresh at launch, so the installed `package.json` version is metadata, not a freshness signal.
+
 ## Docs
 
 Full usage: https://github.com/BrainerVirus/workit#readme

package/dist/mcp-server.js

@@ -21835,6 +21835,25 @@ var init_support_matrix = __esm(() => {
   };
 });
 
+// packages/workit-core/src/core/package-root.ts
+import { existsSync as existsSync4 } from "node:fs";
+import path8 from "node:path";
+import { fileURLToPath } from "node:url";
+var packageRoot = () => {
+  let dir = path8.dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const parent = path8.dirname(dir);
+    if (existsSync4(path8.join(dir, "package.json")) || parent === dir)
+      return dir;
+    dir = parent;
+  }
+}, assetRoot = () => {
+  const root = packageRoot();
+  const assets = path8.join(root, "assets");
+  return existsSync4(assets) ? assets : root;
+};
+var init_package_root = () => {};
+
 // packages/workit-core/src/core/registration.ts
 function isWorkitPlugin(value) {
   const s = String(value).replaceAll("\\", "/");
@@ -21864,18 +21883,18 @@ var named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_
 var init_registration = () => {};
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
-import path8 from "node:path";
-var CANONICAL_SKILLS, skillManifestNames = (root) => existsSync4(root) ? readdirSync4(root).filter((name) => existsSync4(path8.join(root, name, "SKILL.md"))).sort() : [], validateSkillManifests = (root, expected, label) => {
+import { existsSync as existsSync5, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
+import path9 from "node:path";
+var CANONICAL_SKILLS, skillManifestNames = (root) => existsSync5(root) ? readdirSync4(root).filter((name) => existsSync5(path9.join(root, name, "SKILL.md"))).sort() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
   const missing = expected.filter((name) => !actual.includes(name));
   const extra = actual.filter((name) => !expected.includes(name));
   return missing.length === 0 && extra.length === 0 ? null : `${label} mismatch at ${root} (missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"})`;
 }, validateCursorSkills = (pluginDir) => {
-  const workit = validateSkillManifests(path8.join(pluginDir, "skills"), CANONICAL_SKILLS.workit, "Cursor Workit skills");
+  const workit = validateSkillManifests(path9.join(pluginDir, "skills"), CANONICAL_SKILLS.workit, "Cursor Workit skills");
   if (workit)
     return workit;
-  const vendor = path8.join(pluginDir, "vendor/superpowers/skills");
+  const vendor = path9.join(pluginDir, "vendor/superpowers/skills");
   const superpowers = validateSkillManifests(vendor, CANONICAL_SKILLS.superpowers, "Cursor Superpowers skills");
   if (superpowers)
     return superpowers;
@@ -21883,7 +21902,7 @@ var CANONICAL_SKILLS, skillManifestNames = (root) => existsSync4(root) ? readdir
   while (pending.length > 0) {
     const dir = pending.pop();
     for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-      const file = path8.join(dir, entry.name);
+      const file = path9.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
       else if ((statSync2(file).mode & 73) !== 0 || readFileSync6(file).subarray(0, 2).toString("latin1") === "#!") {
@@ -21931,15 +21950,15 @@ var init_skill_manifests = __esm(() => {
 
 // packages/workit-core/src/core/doctor.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync7, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync7, statSync as statSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import os3 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
-  let dir = path9.resolve(cwd);
+  let dir = path10.resolve(cwd);
   while (true) {
-    if (existsSync5(path9.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync6(path10.join(dir, "packages", "workit-core", "package.json")))
       return dir;
-    const parent = path9.dirname(dir);
+    const parent = path10.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -21947,8 +21966,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, resolve = (options) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os3.homedir();
-  const configDir2 = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path9.join(home, ".config", "workit");
-  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path9.join(home, ".local", "state", "workit");
+  const configDir2 = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path10.join(home, ".config", "workit");
+  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path10.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
   const dev = options.dev ?? env.WORKFLOW_TOOLKIT_DEV ?? findDevFromCwd(cwd);
   return {
@@ -21958,10 +21977,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     stateDir,
     cwd,
     dev,
-    opencodeConfig: options.opencodeConfig ?? path9.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path9.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path9.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path9.join(home, ".cursor", "plugins", "local", "workit"),
+    opencodeConfig: options.opencodeConfig ?? path10.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path10.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path10.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path10.join(home, ".cursor", "plugins", "local", "workit"),
     env,
     installer: options.installer ?? false
   };
@@ -21983,13 +22002,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const list = Array.isArray(plugin) ? plugin : typeof plugin === "string" ? [plugin] : [];
   return list.map(String).filter(isWorkitPlugin);
 }, commandOnPath2 = (name, env) => {
-  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path9.delimiter);
+  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path10.delimiter);
   const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
   for (const dir of dirs) {
     if (!dir)
       continue;
     for (const candidateName of names) {
-      const candidate = path9.join(dir, candidateName);
+      const candidate = path10.join(dir, candidateName);
       try {
         const st = statSync3(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
@@ -22015,14 +22034,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return true;
 }, resolveBun = (env) => {
-  if (env.BUN && existsSync5(env.BUN))
+  if (env.BUN && existsSync6(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path9.join(os3.homedir(), ".bun/bin/bun"),
+    path10.join(os3.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
-    if (existsSync5(candidate))
+    if (existsSync6(candidate))
       return candidate;
   }
   return commandOnPath2("bun", env) ? "bun" : null;
@@ -22070,7 +22089,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping version parity"
     };
   }
-  const corePkg = readJson(path9.join(res.dev, "packages/workit-core/package.json"));
+  const corePkg = readJson(path10.join(res.dev, "packages/workit-core/package.json"));
   if (!corePkg) {
     return {
       id: "versions",
@@ -22080,7 +22099,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
-    const pkg = readJson(path9.join(res.dev, "packages", name, "package.json"));
+    const pkg = readJson(path10.join(res.dev, "packages", name, "package.json"));
     const dep = pkg?.dependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
@@ -22096,7 +22115,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (refs.size > 1) {
     problems.push(`adapters pin different core versions: ${[...refs].join(", ")}`);
   }
-  const opencodePkg = readJson(path9.join(res.dev, "packages/workit-opencode/package.json"));
+  const opencodePkg = readJson(path10.join(res.dev, "packages/workit-opencode/package.json"));
   const sdk = opencodePkg?.dependencies?.["@opencode-ai/plugin"];
   const sdkVersion = typeof sdk === "string" ? (sdk.match(/^\d+(?:\.\d+){0,2}/) ?? [])[0] : null;
   if (sdkVersion && !semverAtLeast(sdkVersion, SUPPORT_MATRIX.opencode.minimum)) {
@@ -22116,27 +22135,27 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Align every adapter to the same @brainervirus/workit-core version (rewrite-workspace-deps.ts) or reinstall"
   };
 }, assetPathsFor = (host, dev) => {
-  const pkg = path9.join(dev, "packages", `workit-${host}`);
+  const pkg = path10.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
       return [
-        path9.join(pkg, "assets", "commands", "wk-init.md"),
-        path9.join(pkg, "assets", "skills", "wk-init", "SKILL.md"),
-        path9.join(pkg, "assets", "templates", "spec-template.md"),
-        path9.join(pkg, "assets", "vendor", "superpowers", "skills", "brainstorming", "SKILL.md")
+        path10.join(pkg, "assets", "commands", "wk-init.md"),
+        path10.join(pkg, "assets", "skills", "wk-init", "SKILL.md"),
+        path10.join(pkg, "assets", "templates", "spec-template.md"),
+        path10.join(pkg, "assets", "vendor", "superpowers", "skills", "brainstorming", "SKILL.md")
       ];
     case "cursor":
       return [
-        path9.join(pkg, "assets", "templates", "spec-template.md"),
-        path9.join(pkg, "mcp.json"),
-        path9.join(pkg, ".cursor-plugin")
+        path10.join(pkg, "assets", "templates", "spec-template.md"),
+        path10.join(pkg, "mcp.json"),
+        path10.join(pkg, ".cursor-plugin")
       ];
     case "cli":
-      return [path9.join(pkg, "assets", "templates", "spec-template.md")];
+      return [path10.join(pkg, "assets", "templates", "spec-template.md")];
   }
 }, hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host], checkAssets = (res) => {
   const dev = res.dev;
-  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync5(p)).map((p) => `${h}: ${p}`)) : [];
+  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync6(p)).map((p) => `${h}: ${p}`)) : [];
   if (res.host === "cursor" || res.host === "cli") {
     const cursorError = validateCursorSkills(res.cursorPluginDir);
     if (cursorError)
@@ -22163,17 +22182,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Reinstall or rebuild the workit package (missing assets under packages/workit-<host>)"
   };
 }, launcherSlotsFor = (host, dev) => {
-  const pkg = path9.join(dev, "packages", `workit-${host}`);
+  const pkg = path10.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
-      return [[path9.join(pkg, "src", "plugin.ts"), path9.join(pkg, "dist", "plugin.js")]];
+      return [[path10.join(pkg, "src", "plugin.ts"), path10.join(pkg, "dist", "plugin.js")]];
     case "cursor":
       return [
-        [path9.join(pkg, "dist", "mcp-server.js")],
-        [path9.join(pkg, "dist", "cursor-session-start.js")]
+        [path10.join(pkg, "dist", "mcp-server.js")],
+        [path10.join(pkg, "dist", "cursor-session-start.js")]
       ];
     case "cli":
-      return [[path9.join(pkg, "src", "index.tsx"), path9.join(pkg, "dist", "index.js")]];
+      return [[path10.join(pkg, "src", "index.tsx"), path10.join(pkg, "dist", "index.js")]];
   }
 }, validNodeEntry = (entry, runtime, env) => {
   try {
@@ -22187,7 +22206,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return false;
   }
 }, registeredCursorLauncher = (res) => {
-  if (!existsSync5(res.cursorMcp))
+  if (!existsSync6(res.cursorMcp))
     return "invalid";
   const config2 = readJson(res.cursorMcp);
   if (!config2)
@@ -22200,7 +22219,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (typeof command !== "string" || !Array.isArray(args) || typeof args[0] !== "string") {
     return "invalid";
   }
-  const executable = path9.basename(command).toLowerCase();
+  const executable = path10.basename(command).toLowerCase();
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
@@ -22212,11 +22231,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return {
     kind: "node",
     runtime: command,
-    entry: path9.isAbsolute(args[0]) ? args[0] : path9.resolve(path9.dirname(res.cursorMcp), args[0])
+    entry: path10.isAbsolute(args[0]) ? args[0] : path10.resolve(path10.dirname(res.cursorMcp), args[0])
   };
 }, canonicalCursorHook, registeredCursorHook = (res) => {
-  const hooksFile = path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
-  if (!existsSync5(hooksFile))
+  const hooksFile = path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  if (!existsSync6(hooksFile))
     return "invalid";
   const config2 = readJson(hooksFile);
   if (!config2)
@@ -22233,9 +22252,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!m)
     return false;
   const entry = m[1].trim();
-  if (!path9.isAbsolute(entry))
+  if (!path10.isAbsolute(entry))
     return false;
-  if (path9.resolve(entry) !== path9.resolve(path9.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
+  if (path10.resolve(entry) !== path10.resolve(path10.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
     return false;
   }
   return validNodeEntry(entry, "node", res.env);
@@ -22244,7 +22263,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const hosts = hostsFor(res.host);
   const registered = hosts.includes("cursor") ? registeredCursorLauncher(res) : null;
   const runtime = registered && registered !== "invalid" && registered.kind === "node" ? registered.runtime : "node";
-  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path9.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
+  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path10.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
   if (hosts.includes("cursor")) {
     if (registered === "invalid") {
       missing.push(`cursor: canonical workit MCP launcher in ${res.cursorMcp}`);
@@ -22253,13 +22272,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
     const hook = registeredCursorHook(res);
     if (hook === "invalid") {
-      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+      missing.push(`cursor: canonical session-start hook in ${path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
     } else if (hook !== null && hook !== canonicalCursorHook && !validLocalDistHook(hook, res)) {
-      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+      missing.push(`cursor: canonical session-start hook in ${path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
     }
   }
   if (dev) {
-    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync5(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
+    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync6(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
   }
   if (missing.length > 0) {
     return {
@@ -22276,7 +22295,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping non-Cursor launcher checks"
     };
   }
-  return { id: "launcher", status: "pass", detail: `${res.host} launcher/hook entries present` };
+  return {
+    id: "launcher",
+    status: "pass",
+    detail: `${res.host} launcher/hook entries present`
+  };
 }, checkUtility = (res) => {
   const git = commandOnPath2("git", res.env);
   if (!git) {
@@ -22295,7 +22318,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Install util-linux (flock)"
     };
   }
-  return { id: "utility", status: "pass", detail: "git (and flock where required) on PATH" };
+  return {
+    id: "utility",
+    status: "pass",
+    detail: "git (and flock where required) on PATH"
+  };
 }, staleEntry = (entry) => {
   if (!entry)
     return "stale";
@@ -22303,7 +22330,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return "stale";
   if (entry.startsWith("file:")) {
     const target = entry.replace(/^file:\/\//, "").replace(/^file:/, "");
-    return existsSync5(target) ? "ok" : "missing-file";
+    return existsSync6(target) ? "ok" : "missing-file";
   }
   return "ok";
 }, checkStalePin = (res) => {
@@ -22314,8 +22341,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "opencode pin not inspected on the cursor host"
     };
   }
-  if (!existsSync5(res.opencodeConfig)) {
-    return { id: "stale_pin", status: "pass", detail: "no opencode config — not registered" };
+  if (!existsSync6(res.opencodeConfig)) {
+    return {
+      id: "stale_pin",
+      status: "pass",
+      detail: "no opencode config — not registered"
+    };
   }
   const cfg = readJson(res.opencodeConfig);
   const entries = pluginEntries(cfg);
@@ -22345,17 +22376,125 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   }
   return { id: "stale_pin", status: "pass", detail: "opencode pin resolves" };
+}, pluginMcpSelectors = (res) => {
+  const p = path10.join(res.cursorPluginDir, "mcp.json");
+  if (!existsSync6(p))
+    return null;
+  const cfg = readJson(p);
+  const server = cfg?.mcpServers?.workit;
+  if (!server || typeof server !== "object" || Array.isArray(server))
+    return null;
+  const args = server.args;
+  if (!Array.isArray(args))
+    return null;
+  return args.map(String).filter((a) => a.startsWith("--package="));
+}, registryLatestVersion = (res) => {
+  const seam = res.env.WORKIT_DOCTOR_STALE_REGISTRY_VERSION;
+  if (typeof seam === "string" && seam) {
+    return /^\d+(?:\.\d+){1,2}$/.test(seam) ? seam : null;
+  }
+  const cmd = res.env.WORKIT_DOCTOR_STALE_REGISTRY_CMD ?? (commandOnPath2("npm", res.env) ? "npm" : null);
+  if (!cmd)
+    return null;
+  try {
+    const r = spawnSync4(cmd, ["view", CURSOR_RUNTIME_PACKAGE, "version"], {
+      encoding: "utf8",
+      timeout: 20000,
+      env: res.env
+    });
+    const v = (r.stdout ?? "").trim().split(/\s+/)[0];
+    return r.status === 0 && /^\d+(?:\.\d+){1,2}$/.test(v) ? v : null;
+  } catch {
+    return null;
+  }
+}, installedPluginVersion = (res) => {
+  const pkg = readJson(path10.join(res.cursorPluginDir, "package.json"));
+  return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
+}, checkStaleInstall = (res) => {
+  if (res.host !== "cursor" && res.host !== "cli") {
+    return {
+      id: "stale_install",
+      status: "pass",
+      detail: "cursor plugin not inspected on the opencode host"
+    };
+  }
+  const canonicalMcp = cursorMcpServerEntry("").args.find((a) => a.startsWith("--package="));
+  const mcpSelectors = pluginMcpSelectors(res);
+  const legacyPin = (mcpSelectors ?? []).find((s) => s !== canonicalMcp && s.includes("@brainervirus/workit-cursor@"));
+  if (legacyPin) {
+    return {
+      id: "stale_install",
+      status: "fail",
+      detail: `stale_install: plugin mcp.json pins a legacy selector ${legacyPin} (canonical: ${canonicalMcp})`,
+      fix: "Re-run install-cursor-plugin.sh — it rewrites the workit MCP entry to the canonical @latest selector"
+    };
+  }
+  const hooksFile = path10.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hookCmd = readJson(hooksFile)?.hooks?.sessionStart?.[0]?.command ?? null;
+  const canonicalHook = canonicalCursorHook;
+  const staleHook = hookCmd !== null && hookCmd !== canonicalHook && !hookCmd.startsWith("node ") && hookCmd.includes("@brainervirus/workit-cursor@");
+  if (staleHook) {
+    return {
+      id: "stale_install",
+      status: "fail",
+      detail: `stale_install: sessionStart hook runs a legacy selector (canonical: ${canonicalHook})`,
+      fix: "Re-run install-cursor-plugin.sh — it rewrites the sessionStart hook to the canonical @latest selector"
+    };
+  }
+  const installed = installedPluginVersion(res);
+  const source = res.dev ? readJson(path10.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path10.join(packageRoot(), "package.json"))?.version ?? null;
+  const localDist = mcpSelectors === null && hookCmd !== null && hookCmd.startsWith("node ");
+  if (localDist && installed !== null && source !== null && !semverAtLeast(installed, source)) {
+    return {
+      id: "stale_install",
+      status: "fail",
+      detail: `stale_install: installed workit-cursor ${installed} is behind the current runtime ${source}`,
+      fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory and rewrites the workit MCP/hook entries"
+    };
+  }
+  if (installed !== null && localDist) {
+    const expected = registryLatestVersion(res);
+    if (expected === null) {
+      return {
+        id: "registry_unreachable",
+        status: "warn",
+        registryProbed: true,
+        detail: "registry_unreachable: cannot compare installed workit-cursor against the published runtime",
+        fix: "Retry when the npm registry is reachable, or re-run install-cursor-plugin.sh to refresh the install"
+      };
+    }
+    if (!semverAtLeast(installed, expected)) {
+      return {
+        id: "stale_install",
+        status: "fail",
+        registryProbed: true,
+        detail: `stale_install: local-dist workit-cursor ${installed} is behind the published runtime ${expected}`,
+        fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory with the current build"
+      };
+    }
+    return {
+      id: "stale_install",
+      status: "pass",
+      registryProbed: true,
+      detail: `installed local-dist workit-cursor ${installed} matches the published runtime ${expected}`
+    };
+  }
+  return {
+    id: "stale_install",
+    status: "pass",
+    detail: installed === null ? "installed workit-cursor selectors are canonical" : `installed workit-cursor ${installed} is metadata on the canonical @latest install (fresh at launch)`
+  };
 }, checkDuplicateRegistration = (res) => {
   const problems = [];
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync5(res.opencodeConfig)) {
+  if (opencodeHost && existsSync6(res.opencodeConfig)) {
     const cfg = readJson(res.opencodeConfig);
     const entries = pluginEntries(cfg);
     if (entries.length > 1)
       problems.push(`opencode registers ${entries.length} workit plugin entries`);
   }
-  if (cursorHost && existsSync5(res.cursorSettings)) {
+  if (cursorHost && existsSync6(res.cursorSettings)) {
     const settings = readJson(res.cursorSettings);
     const enabled = settings?.enabled_plugins;
     if (enabled && typeof enabled === "object") {
@@ -22370,7 +22509,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     if (dirs.length > 1)
       problems.push(`cursor plugin_dirs has ${dirs.length} workit entries`);
   }
-  if (cursorHost && existsSync5(res.cursorMcp)) {
+  if (cursorHost && existsSync6(res.cursorMcp)) {
     const mcp = readJson(res.cursorMcp);
     const servers = mcp?.mcpServers ?? {};
     if (servers && typeof servers === "object") {
@@ -22380,7 +22519,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
   }
   if (problems.length === 0) {
-    return { id: "duplicate_registration", status: "pass", detail: "no duplicate registrations" };
+    return {
+      id: "duplicate_registration",
+      status: "pass",
+      detail: "no duplicate registrations"
+    };
   }
   return {
     id: "duplicate_registration",
@@ -22391,21 +22534,25 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkMalformedConfig = (res) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
-    const p = path9.join(res.configDir, name);
-    if (existsSync5(p))
+    const p = path10.join(res.configDir, name);
+    if (existsSync6(p))
       files.push(p);
   }
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync5(res.opencodeConfig))
+  if (opencodeHost && existsSync6(res.opencodeConfig))
     files.push(res.opencodeConfig);
-  if (cursorHost && existsSync5(res.cursorSettings))
+  if (cursorHost && existsSync6(res.cursorSettings))
     files.push(res.cursorSettings);
-  if (cursorHost && existsSync5(res.cursorMcp))
+  if (cursorHost && existsSync6(res.cursorMcp))
     files.push(res.cursorMcp);
   const bad = files.filter((p) => !parsesAsConfigObject(p));
   if (bad.length === 0)
-    return { id: "malformed_config", status: "pass", detail: "config files parse" };
+    return {
+      id: "malformed_config",
+      status: "pass",
+      detail: "config files parse"
+    };
   return {
     id: "malformed_config",
     status: "fail",
@@ -22413,12 +22560,20 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: `Repair the malformed config in ${bad[0]}`
   };
 }, checkWorkspaceMismatch = (res) => {
-  const file = path9.join(res.configDir, "workspaces.json");
-  if (!existsSync5(file))
-    return { id: "workspace_mismatch", status: "pass", detail: "no workspaces configured" };
+  const file = path10.join(res.configDir, "workspaces.json");
+  if (!existsSync6(file))
+    return {
+      id: "workspace_mismatch",
+      status: "pass",
+      detail: "no workspaces configured"
+    };
   const ws = readJson(file);
   if (!Array.isArray(ws?.workspaces)) {
-    return { id: "workspace_mismatch", status: "pass", detail: "no workspaces configured" };
+    return {
+      id: "workspace_mismatch",
+      status: "pass",
+      detail: "no workspaces configured"
+    };
   }
   const match = resolveWorkspaceFrom(res.cwd, res.configDir);
   if (match)
@@ -22441,29 +22596,33 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
 }, checkCredentialMetadata = (res) => {
   const tokenPaths = [];
-  const youtrackJson = readJson(path9.join(res.configDir, "youtrack.json"));
+  const youtrackJson = readJson(path10.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
-    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path9.join(res.configDir, "youtrack.token"));
-  } else if (existsSync5(path9.join(res.configDir, "youtrack.token"))) {
-    tokenPaths.push(path9.join(res.configDir, "youtrack.token"));
+    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path10.join(res.configDir, "youtrack.token"));
+  } else if (existsSync6(path10.join(res.configDir, "youtrack.token"))) {
+    tokenPaths.push(path10.join(res.configDir, "youtrack.token"));
   }
-  const vcsJson = readJson(path9.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(path10.join(res.configDir, "vcs.json"));
   for (const key of ["gitlab", "github"]) {
     const provider = vcsJson?.[key];
     if (provider && typeof provider === "object") {
       const tf = provider.tokenFile;
-      tokenPaths.push(typeof tf === "string" ? tf : path9.join(res.configDir, `${key}.token`));
-    } else if (!vcsJson && existsSync5(path9.join(res.configDir, `${key}.token`))) {
-      tokenPaths.push(path9.join(res.configDir, `${key}.token`));
+      tokenPaths.push(typeof tf === "string" ? tf : path10.join(res.configDir, `${key}.token`));
+    } else if (!vcsJson && existsSync6(path10.join(res.configDir, `${key}.token`))) {
+      tokenPaths.push(path10.join(res.configDir, `${key}.token`));
     }
   }
   if (tokenPaths.length === 0) {
-    return { id: "credential_metadata", status: "pass", detail: "no credentials configured" };
+    return {
+      id: "credential_metadata",
+      status: "pass",
+      detail: "no credentials configured"
+    };
   }
   const problems = [];
   for (const raw of tokenPaths) {
-    const p = path9.isAbsolute(raw) ? raw : path9.resolve(res.configDir, raw);
-    if (!existsSync5(p)) {
+    const p = path10.isAbsolute(raw) ? raw : path10.resolve(res.configDir, raw);
+    if (!existsSync6(p)) {
       problems.push(`${p} is missing`);
       continue;
     }
@@ -22489,13 +22648,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Create or fix the token file (mode 0600, real value) — see /wk-status for the exact path"
   };
 }, checkLogWritable = (res) => {
-  const logsDir = path9.join(res.stateDir, "logs");
-  const probe = path9.join(logsDir, "doctor-probe.tmp");
+  const logsDir = path10.join(res.stateDir, "logs");
+  const probe = path10.join(logsDir, "doctor-probe.tmp");
   try {
     mkdirSync4(logsDir, { recursive: true, mode: 448 });
     writeFileSync3(probe, `{"probe":true}
 `, { mode: 384 });
-    return { id: "log_writable", status: "pass", detail: "log directory writable" };
+    return {
+      id: "log_writable",
+      status: "pass",
+      detail: "log directory writable"
+    };
   } catch (err) {
     return {
       id: "log_writable",
@@ -22511,15 +22674,20 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, RUN_CHECKS, INSTALLER_REQUIRED, runDoctor = (options = {}) => {
   const res = resolve(options);
   const raw = RUN_CHECKS.map((fn) => fn(res));
-  const checks4 = res.installer ? raw.map((c) => c.status === "fail" && !INSTALLER_REQUIRED.has(c.id) ? { ...c, status: "warn", detail: `${c.detail} (not enforced by installer)` } : c) : raw;
+  const checks4 = res.installer ? raw.map((c) => c.status === "fail" && !INSTALLER_REQUIRED.has(c.id) ? {
+    ...c,
+    status: "warn",
+    detail: `${c.detail} (not enforced by installer)`
+  } : c) : raw;
   const failed = checks4.filter((c) => c.status === "fail").length;
   const warned = checks4.filter((c) => c.status === "warn").length;
   const passed = checks4.filter((c) => c.status === "pass").length;
   const exitCode = failed > 0 ? 1 : 0;
+  const offline = !raw.some((c) => ("registryProbed" in c) && c.registryProbed);
   const report = {
     ok: failed === 0,
     exitCode,
-    offline: true,
+    offline,
     host: res.host,
     checked_at: new Date().toISOString(),
     summary: { passed, warned, failed, total: checks4.length },
@@ -22529,7 +22697,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   getDiagnosticLogger()?.info(EVENT.doctor, {
     host: res.host,
     exit_code: exitCode,
-    offline: true,
+    offline,
     failed: checks4.filter((c) => c.status === "fail").map((c) => c.id),
     total: checks4.length
   });
@@ -22539,6 +22707,7 @@ var init_doctor = __esm(() => {
   init_support_matrix();
   init_boundary();
   init_config();
+  init_package_root();
   init_registration();
   init_workspaces();
   init_skill_manifests();
@@ -22550,6 +22719,7 @@ var init_doctor = __esm(() => {
     checkLauncher,
     checkUtility,
     checkStalePin,
+    checkStaleInstall,
     checkDuplicateRegistration,
     checkMalformedConfig,
     checkWorkspaceMismatch,
@@ -22562,6 +22732,7 @@ var init_doctor = __esm(() => {
     "launcher",
     "utility",
     "stale_pin",
+    "stale_install",
     "duplicate_registration",
     "malformed_config"
   ]);
@@ -22569,7 +22740,7 @@ var init_doctor = __esm(() => {
 
 // packages/workit-core/src/core/pr-create.ts
 import fs2 from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function parseGhRepo(remote) {
   remote = (remote || "").trim().replace(/\/+$/, "");
@@ -22634,11 +22805,11 @@ ${line}` : line;
 }
 function whichOnPath(tool) {
   const names = process.platform === "win32" ? [tool, `${tool}.exe`, `${tool}.cmd`] : [tool];
-  for (const dir of (process.env.PATH ?? "").split(path10.delimiter)) {
+  for (const dir of (process.env.PATH ?? "").split(path11.delimiter)) {
     if (!dir)
       continue;
     for (const name of names) {
-      const candidate = path10.join(dir, name);
+      const candidate = path11.join(dir, name);
       try {
         fs2.accessSync(candidate, fs2.constants.X_OK);
         return candidate;
@@ -22740,7 +22911,7 @@ function prCreate(env, cwd) {
   const draft = String(env.WF_PR_DRAFT ?? "false").toLowerCase() === "true";
   let baseUrl = cfg.youtrack_base_url;
   if (!baseUrl) {
-    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path10.join(path10.dirname(String(cfg.configPath)), "youtrack.json");
+    const ytCfg = process.env.WORKFLOW_YOUTRACK_CONFIG ?? path11.join(path11.dirname(String(cfg.configPath)), "youtrack.json");
     try {
       const yt = JSON.parse(fs2.readFileSync(ytCfg, "utf8"));
       if (yt && typeof yt === "object")
@@ -22849,25 +23020,6 @@ var init_pr_create = __esm(() => {
   init_branch();
 });
 
-// packages/workit-core/src/core/package-root.ts
-import { existsSync as existsSync6 } from "node:fs";
-import path11 from "node:path";
-import { fileURLToPath } from "node:url";
-var packageRoot = () => {
-  let dir = path11.dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const parent = path11.dirname(dir);
-    if (existsSync6(path11.join(dir, "package.json")) || parent === dir)
-      return dir;
-    dir = parent;
-  }
-}, assetRoot = () => {
-  const root = packageRoot();
-  const assets = path11.join(root, "assets");
-  return existsSync6(assets) ? assets : root;
-};
-var init_package_root = () => {};
-
 // packages/workit-core/src/core/scripts.ts
 var PLUGIN_ROOT, ASSET_ROOT, resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
 var init_scripts = __esm(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "private": false,
   "description": "Workit Cursor plugin: MCP server, hooks, rules, marketplace manifest (thin over @brainervirus/workit-core)",
   "keywords": [
@@ -39,7 +39,7 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^0.8.7",
+    "@brainervirus/workit-core": "^0.8.8",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },