@brainervirus/workit-cursor 0.9.2 → 0.11.0

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "OpenCode-style verify, PR, changelog, commit, and session handoff for Cursor",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/README.md

@@ -46,7 +46,7 @@ npx @brainervirus/workit-cli init
 
 ## Host limitations
 
-Cursor adapts workit through policy-only confirmation: approvals and lifecycle transitions are recorded as policy decisions (`attested: false`) rather than fabricated delegated identity, and subagent-driven plan execution is not supported on this host. Cursor consumes the same core outcomes but stays inline-only (the subagent-driven menu choice returns `unsupported_mode`); model selection remains a host-native action. Approvals bind to the document's exact SHA-256 digest — editing an approved spec/plan invalidates the approval and forces a fresh reapproval. OpenCode records native `question` receipts and runs delegated tasks; see the root [README](../../README.md#host-capabilities) for the full host-capability matrix.
+Cursor adapts workit through policy-only confirmation: approvals and lifecycle transitions are recorded as policy decisions (`attested: false`) rather than fabricated delegated identity; model selection remains a host-native action. Both execution modes are supported: **Subagent-driven** — `workit_plan_menu` returns a one-time `coordinator_lease`, `workit_delegate` mints a task-scoped `delegation_token` per task (fail-closed validation; only hashes persist), and the coordinator dispatches Cursor-native subagents that pass the token as `delegation_token` on mutation calls (the task token is revoked when the worker's progress line lands); **Inline** — `executing-plans` runs every task single-agent in the current session with no dispatch and no token minting. Approvals bind to the document's exact SHA-256 digest — editing an approved spec/plan invalidates the approval and forces a fresh reapproval. OpenCode records native `question` receipts and derives delegated status from session parentage (`parentID`), which Cursor does not have; see the root [README](../../README.md#host-capabilities) for the full host-capability matrix.
 
 ## Configuration
 

package/assets/templates/execution-contract.md

@@ -24,10 +24,10 @@ This session is a handoff destination for a continued plan. The originating sess
 - Working state, briefs, ledgers, and review diffs live only under gitignored `<SDD_DIR>` in `docs/<slug>/sdd/` and use `workit_sdd_*` tools.
 - Use native `todowrite` for visible task state as well as the gitignored ledger.
 - Use native `question` for branch/stash choices and guarded external mutations; call mutation tools only after approval with `confirmed: true` (grounded in the recorded NativeChoiceEvidence).
-- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`) and subagent-driven execution is rejected as unsupported.
+- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`), Subagent-driven execution is supported through the one-time `coordinator_lease` and per-task `delegation_token` minted by `workit_delegate` (fail-closed validation; no `parentID` identity exists on Cursor), and Inline runs single-agent in the current session.
 - Delegated authority is direct-child-only: a worker is the session whose host `parentID` exactly equals the activating coordinator's recorded `coordinator_session_id`; missing, mismatched, or multi-owner lineage fails closed with `delegation_lineage_denied`, and nested `opencode` launches are denied during active delegated work. An authorized child receives only the compact worker contract (execute the supplied brief, follow TDD, land one contiguous non-empty commit range, report results) — never coordinator guidance, `wk-implement`, or ledger management; coordinator bookkeeping via `workit_sdd_*` stays with the coordinator session.
 - On Cursor, for every repository-scoped `workit_*` call, pass the active Cursor workspace as `workspace_root`; never rely on the MCP process default.
-- Use native `task` with only the built-in `explore` and `general` agents.
+- Use native `task` with only the built-in `explore` and `general` agents (OpenCode); on Cursor, Subagent-driven dispatches Cursor-native subagents with a task `delegation_token`, Inline runs single-agent in the current session.
 
 ## Flow gates (HARD)
 
@@ -51,7 +51,7 @@ For each top-level task absent from `completed_task_ids`:
 
 1. Mark it `in_progress` with `todowrite`.
 2. Create a working-state brief with `workit_sdd_task_brief` and `confirmed: true`.
-3. Delegate read-only discovery, when needed, to an `explore` agent. Delegate implementation to a fresh `general` agent. Product changes follow TDD.
+3. Route by the approved execution mode: **Subagent-driven** delegates read-only discovery to an `explore` (OpenCode) agent, delegates implementation to a fresh `general` (OpenCode) agent (on Cursor, the coordinator mints a `delegation_token` with `workit_delegate` and the subagent prompt carries the raw token — the worker passes it as `delegation_token` on its mutation calls, and appending progress revokes it), and the coordinator never edits product code; **Inline** executes every task in the current agent with no dispatch and no token minting. Product changes follow TDD.
 4. Create a working-state diff with `workit_sdd_review_package` and `confirmed: true`.
 5. Delegate spec-compliance review and code-quality review to separate `general` agents.
 6. **Blocking** findings (Critical, Important, or spec-compliance) may trigger at most **two** fix+re-review rounds per task. **Advisory** findings (Minor, style, YAGNI, taste) never pause the loop — append them with `workit_sdd_append_advisory` (`--task <id> --text <text>`, `confirmed: true`) instead of an unrestricted file edit.

package/assets/templates/plan-template.md

@@ -1,6 +1,6 @@
 # <Feature> Implementation Plan
 
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. On Cursor the two paths are: **Subagent-driven** — Cursor-native subagents dispatched by the coordinator, each carrying a task-scoped `delegation_token` minted with `workit_delegate` from the one-time `coordinator_lease`; **Inline** — `executing-plans` in the current session, single-agent, no dispatch, no token minting. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Spec:** `docs/<slug>/spec.md`
 **Branch:** `feature/<slug>`

package/assets/templates/superpowers-doc-contract.md

@@ -1,6 +1,6 @@
 # Superpowers document contract
 
-Use OpenCode's native `question` for every bounded user choice. Give concise choices and allow a custom answer; if the tool is unavailable, ask one concise plain-text question. Use `skill` to load workflow and Superpowers skills, `todowrite` for task state, and `task` for delegated work.
+Use OpenCode's native `question` for every bounded user choice. Give concise choices and allow a custom answer; if the tool is unavailable, ask one concise plain-text question. Use `skill` to load workflow and Superpowers skills, `todowrite` for task state, and `task` for delegated work (OpenCode) or the host-native equivalent — on Cursor, Subagent-driven dispatches Cursor-native subagents with a task `delegation_token`, Inline runs single-agent in the current session.
 
 ## Tracked document layout
 
@@ -35,7 +35,7 @@ Before writing **Branch:** into a new spec or plan, call `workit_docs_branch` an
 - Commits use `wk-commit` after its native `question` confirmation.
 - Continuation uses `wk-handoff`, whose `workit_handoff_session` creates and seeds the OpenCode session automatically.
 - Never use worktrees. Resolve the declared branch with `workit_resolve_branch`, preview dirty-tree stash choices with `question`, and apply an approved in-place checkout through `workit_branch_setup` with `confirmed: true` (grounded in the recorded NativeChoiceEvidence).
-- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`) and subagent-driven execution is rejected as unsupported.
+- Flow-tool confirmations are never agent-typed booleans and never caller-supplied evidence objects: on OpenCode the plugin records the user's native-`question` answer as a host-observed one-use receipt (`attested: true`, `callID`, `selectedLabel`, `recordedAt`) consumed by `workit_spec_approve` / `workit_plan_approve` / `workit_plan_menu` — no evidence argument exists, and delegated worker status comes from host session parentage (`parentID`), never a caller `role` field. On Cursor, confirmations are policy-only (`attested: false`), Subagent-driven execution is supported through the one-time `coordinator_lease` and per-task `delegation_token` minted by `workit_delegate` (fail-closed validation; no `parentID` identity exists on Cursor), and Inline runs single-agent in the current session.
 - Keep all SDD state under the gitignored `docs/<slug>/sdd/`; use `workit_sdd_context` and the registered `workit_sdd_*` tools.
 - After implementation, use `question` before an approved stash reapply through `workit_branch_setup` with `confirmed: true`.
 

package/dist/mcp-server.js

@@ -20376,7 +20376,7 @@ var init_config = __esm(() => {
     "trunk-based": { allowed: ["*"], protected: ["main"] },
     custom: { allowed: [], protected: [] }
   };
-  LOCALE_RE = /^[a-z]{2,3}(-[A-Z]{2})?$/;
+  LOCALE_RE = /^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/;
   DEFAULTS = {
     locale: "en",
     localeOptions: ["en", "es-CL", "es-MX", "es-AR", "pt-BR"],
@@ -24576,7 +24576,7 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 import path20 from "node:path";
 
 class HostReceiptStore {
@@ -24666,7 +24666,7 @@ class HostReceiptStore {
     return { ok: true, receipt };
   }
 }
-var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, err2 = (code, error2, details) => ({
+var COORDINATOR_RECOVERY_TEXT, MENU_CHOICES, err2 = (code, error2, details) => ({
   ok: false,
   code,
   error: error2,
@@ -24714,18 +24714,39 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
       status: execution.status ?? "pending",
       mode: execution.mode ?? null,
       evidence: execution.evidence ?? null,
-      coordinator_session_id: execution.coordinator_session_id ?? null
+      coordinator_session_id: execution.coordinator_session_id ?? null,
+      ...execution.delegation !== undefined ? { delegation: normalizeDelegation(execution.delegation) } : {}
     },
     handoff_destination: p.handoff_destination ?? false,
     updated_at: p.updated_at ?? Date.now()
   };
-}, emptyState = (slug) => ({
+}, normalizeDelegation = (v) => {
+  if (v === null || v === undefined)
+    return null;
+  if (!isRecord(v))
+    return null;
+  const hash = (x) => typeof x === "string" && HEX64_RE.test(x) ? x : null;
+  return {
+    coordinator_lease_hash: hash(v.coordinator_lease_hash),
+    active_task_id: typeof v.active_task_id === "number" && Number.isSafeInteger(v.active_task_id) ? v.active_task_id : null,
+    token_hash: hash(v.token_hash),
+    token_workspace: typeof v.token_workspace === "string" ? v.token_workspace : null,
+    token_slug: typeof v.token_slug === "string" ? v.token_slug : null,
+    status: v.status === "active" ? "active" : "revoked"
+  };
+}, delegationHash = (raw) => createHash2("sha256").update(raw).digest("hex"), emptyState = (slug) => ({
   slug,
   activated: false,
   spec: { path: "", status: "draft", evidence: null, approved_digest: null },
   plan: { path: "", status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+  execution: {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null,
+    delegation: null
+  },
   handoff_destination: false,
   updated_at: Date.now()
 }), readFlowState = (root, slug) => {
@@ -24856,7 +24877,8 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
         status: execRaw?.status ?? "pending",
         mode: execRaw?.mode ?? null,
         evidence: execRaw?.evidence ?? null,
-        coordinator_session_id: execRaw?.coordinator_session_id ?? null
+        coordinator_session_id: execRaw?.coordinator_session_id ?? null,
+        ...execRaw?.delegation !== undefined ? { delegation: normalizeDelegation(execRaw.delegation) } : {}
       },
       handoff_destination: parsed.handoff_destination ?? false,
       updated_at: parsed.updated_at ?? Date.now()
@@ -24983,7 +25005,13 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
   plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
   menu: { presented: false, chosen: "", evidence: null },
-  execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+  execution: {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null,
+    ...state.execution.delegation !== undefined ? { delegation: null } : {}
+  },
   handoff_destination: false,
   updated_at: Date.now()
 }), resetForPlanDrift = (state) => ({
@@ -25029,7 +25057,12 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
       coordinator_session_id: null
     };
   }
-  return { status: "pending", mode: null, evidence: null, coordinator_session_id: null };
+  return {
+    status: "pending",
+    mode: null,
+    evidence: null,
+    coordinator_session_id: null
+  };
 }, normalizeCompatibility = (root, slug, parsed, state) => {
   if (!isRecord(parsed) || !("execution" in parsed)) {
     const derived = deriveLegacyExecution(root, slug, state);
@@ -25310,7 +25343,12 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
         spec: { path: specPath, status: "draft", evidence: null, approved_digest: null },
         plan: { path: planPath, status: "draft", evidence: null, approved_digest: null },
         menu: { presented: false, chosen: "", evidence: null },
-        execution: { status: "pending", mode: null, evidence: null, coordinator_session_id: null },
+        execution: {
+          status: "pending",
+          mode: null,
+          evidence: null,
+          coordinator_session_id: null
+        },
         handoff_destination: false,
         updated_at: Date.now()
       });
@@ -25435,16 +25473,16 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
   if (typeof choice !== "string" || !MENU_CHOICES.includes(choice)) {
     return err2("menu_choice_invalid", `invalid menu choice: ${JSON.stringify(choice)}`);
   }
-  if (recorded.evidence.host === "cursor" && choice === "subagent-driven") {
-    return err2("unsupported_mode", CURSOR_SUBAGENT_UNSUPPORTED_TEXT);
-  }
   if (recorded.evidence.host === "opencode" && !sameChoiceLabel(recorded.evidence.selectedLabel, choice)) {
     return err2("evidence_mismatch", `evidence selectedLabel ${JSON.stringify(recorded.evidence.selectedLabel)} does not match choice ${JSON.stringify(choice)}`);
   }
   const doc2 = resolveDoc(root, slug, planPath, "plan");
   if (!doc2.ok)
     return err2("path_invalid", doc2.error);
-  return readModifyWrite(root, slug, (state) => {
+  const cursorSubagent = recorded.evidence.host === "cursor" && choice === "subagent-driven";
+  const lease = cursorSubagent ? randomBytes(32).toString("hex") : null;
+  const leaseHash = lease === null ? null : delegationHash(lease);
+  const result = readModifyWrite(root, slug, (state) => {
     if (state.spec.status !== "approved")
       return err2("spec_not_approved", "spec must be approved before the execution menu");
     if (state.plan.status !== "approved")
@@ -25454,6 +25492,14 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
     }
     const executing = choice === "subagent-driven" || choice === "inline";
     const coordinatorSessionId = choice === "subagent-driven" && recorded.evidence.host === "opencode" ? ctx?.sessionId ?? null : null;
+    const delegation = cursorSubagent ? {
+      coordinator_lease_hash: leaseHash,
+      active_task_id: null,
+      token_hash: null,
+      token_workspace: null,
+      token_slug: null,
+      status: "active"
+    } : state.execution.delegation;
     return {
       ok: true,
       next: {
@@ -25464,17 +25510,133 @@ var COORDINATOR_RECOVERY_TEXT, CURSOR_SUBAGENT_UNSUPPORTED_TEXT, MENU_CHOICES, e
           status: "active",
           mode: choice,
           evidence: recorded.evidence,
-          coordinator_session_id: coordinatorSessionId
+          coordinator_session_id: coordinatorSessionId,
+          delegation
         } : {
           status: "pending",
           mode: null,
           evidence: recorded.evidence,
-          coordinator_session_id: null
+          coordinator_session_id: null,
+          delegation
+        },
+        updated_at: Date.now()
+      }
+    };
+  });
+  if (!result.ok)
+    return result;
+  return cursorSubagent && lease !== null ? { ok: true, coordinator_lease: lease } : { ok: true };
+}, mintDelegateToken = (root, slug, planPath, taskId, coordinatorLease) => {
+  if (typeof taskId !== "number" || !Number.isSafeInteger(taskId) || taskId <= 0) {
+    return err2("task_invalid", `task id must be a positive safe integer: ${JSON.stringify(taskId)}`);
+  }
+  if (typeof coordinatorLease !== "string" || coordinatorLease === "") {
+    return err2("coordinator_lease_invalid", "a coordinator lease is required to mint a delegation token");
+  }
+  const doc2 = resolveDoc(root, slug, planPath, "plan");
+  if (!doc2.ok)
+    return err2("path_invalid", doc2.error);
+  const token = randomBytes(32).toString("hex");
+  const tokenHash = delegationHash(token);
+  const result = readModifyWrite(root, slug, (state) => {
+    const exec = state.execution;
+    if (exec.status !== "active" || exec.mode !== "subagent-driven") {
+      return err2("flow_not_active", "a delegation token requires an active subagent-driven execution");
+    }
+    const delegation = exec.delegation;
+    if (!delegation || delegation.status !== "active" || !delegation.coordinator_lease_hash) {
+      return err2("coordinator_lease_invalid", "this flow has no active coordinator lease — record the execution menu with Cursor subagent-driven first");
+    }
+    if (delegation.coordinator_lease_hash !== delegationHash(coordinatorLease)) {
+      return err2("coordinator_lease_invalid", "the supplied coordinator lease does not match the flow's recorded lease");
+    }
+    if (state.plan.status !== "approved") {
+      return err2("plan_not_approved", "plan must be approved before delegating a task");
+    }
+    let planText;
+    try {
+      planText = readFileSync13(doc2.path, "utf8");
+    } catch {
+      return err2("plan_missing", `plan not found: ${planPath}`);
+    }
+    if (!parseTasksFromPlan(planText).some((t) => t.id === taskId)) {
+      return err2("task_invalid", `task ${taskId} does not exist in the approved plan`);
+    }
+    if (ledgerCompletion(root, slug).completed.includes(taskId)) {
+      return err2("task_completed", `task ${taskId} is already completed in the SDD ledger`);
+    }
+    return {
+      ok: true,
+      next: {
+        ...state,
+        execution: {
+          ...exec,
+          delegation: {
+            ...delegation,
+            active_task_id: taskId,
+            token_hash: tokenHash,
+            token_workspace: root,
+            token_slug: slug,
+            status: "active"
+          }
         },
         updated_at: Date.now()
       }
     };
   });
+  if (!result.ok)
+    return result;
+  return { ok: true, token };
+}, validateDelegateToken = (root, token) => {
+  if (typeof token !== "string" || token === "") {
+    return err2("delegation_token_invalid", "a delegation token is required");
+  }
+  const hash = delegationHash(token);
+  let entries = [];
+  try {
+    entries = readdirSync7(path20.join(root, "docs"), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return err2("delegation_token_invalid", `no flows exist under ${JSON.stringify(root)}`);
+  }
+  for (const slug of entries) {
+    try {
+      const state = readFlowState(root, slug);
+      const delegation = state.execution.delegation;
+      if (!delegation || !delegation.token_hash)
+        continue;
+      if (delegation.token_hash !== hash)
+        continue;
+      if (delegation.token_workspace !== root || delegation.token_slug !== slug)
+        continue;
+      if (delegation.status !== "active" || state.execution.status !== "active" || state.execution.mode !== "subagent-driven" || delegation.active_task_id === null) {
+        return err2("delegation_token_revoked", "the delegation token is no longer active for this flow");
+      }
+      return {
+        ok: true,
+        context: { slug, taskId: delegation.active_task_id, hostWorkspace: root }
+      };
+    } catch {}
+  }
+  return err2("delegation_token_invalid", "the delegation token does not match any active flow token in this workspace");
+}, revokeDelegateToken = (root, slug, taskId) => {
+  if (typeof taskId !== "number" || !Number.isSafeInteger(taskId) || taskId <= 0) {
+    return err2("task_invalid", `task id must be a positive safe integer: ${JSON.stringify(taskId)}`);
+  }
+  return readModifyWrite(root, slug, (state) => {
+    const exec = state.execution;
+    const delegation = exec.delegation;
+    if (!delegation || delegation.status !== "active" || delegation.active_task_id !== taskId || !delegation.token_hash) {
+      return err2("delegation_token_not_active", `no active delegation token for task ${taskId} in ${slug}`);
+    }
+    return {
+      ok: true,
+      next: {
+        ...state,
+        execution: { ...exec, delegation: { ...delegation, status: "revoked" } },
+        updated_at: Date.now()
+      }
+    };
+  });
 }, markHandoffDestination = (root, slug, planPath) => {
   const doc2 = resolveDoc(root, slug, planPath, "plan");
   if (!doc2.ok)
@@ -25656,7 +25818,6 @@ var init_flow_state = __esm(() => {
   init_verify_project();
   init_menu();
   COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations to an authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
-  CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
   MENU_CHOICES = [
     "subagent-driven",
     "inline",
@@ -25810,12 +25971,30 @@ var init_flow_state = __esm(() => {
 });
 
 // packages/workit-cursor/mcp/flow-evidence.ts
-var cursorQuestionEvidence = () => createCursorConfirmation(), CURSOR_HOST = "cursor", cursorMutationContext = (workspaceRoot) => ({
+var cursorQuestionEvidence = () => createCursorConfirmation(), CURSOR_HOST = "cursor", cursorCoordinatorContext = (workspaceRoot) => ({
   hostWorkspace: workspaceRoot,
   role: "coordinator",
   sessionId: `${CURSOR_HOST}:${workspaceRoot}`,
   taskIdentity: undefined
-});
+}), cursorMutationContext = (workspaceRoot, delegationToken) => {
+  if (delegationToken === undefined) {
+    return { ok: true, context: cursorCoordinatorContext(workspaceRoot) };
+  }
+  const validated = validateDelegateToken(workspaceRoot, delegationToken);
+  if (!validated.ok) {
+    return { ok: false, code: validated.code, error: validated.error };
+  }
+  return {
+    ok: true,
+    slug: validated.context.slug,
+    context: {
+      hostWorkspace: workspaceRoot,
+      role: "delegated",
+      sessionId: `${CURSOR_HOST}:${workspaceRoot}:task-${validated.context.taskId}`,
+      taskIdentity: String(validated.context.taskId)
+    }
+  };
+};
 var init_flow_evidence = __esm(() => {
   init_flow_state();
 });
@@ -27874,7 +28053,7 @@ var logger, readServerVersion = () => {
   if (!result.ok)
     throw new Error(result.error);
   return result.evidence;
-}, workspaceRootSchema, server, registerTool = (name, config2, cb) => {
+}, workspaceRootSchema, delegationTokenSchema, server, registerTool = (name, config2, cb) => {
   server.registerTool(name, config2, async (args) => {
     try {
       return await cb(args);
@@ -27901,7 +28080,7 @@ var logger, readServerVersion = () => {
       return jsonResult(withWorkspace(workspace_root, { error: resolved.error }));
     }
     const { workspace, slug } = resolved.layout;
-    const result = transitionExecution(workspace, slug, plan_path, action, cursorConfirmation(), cursorMutationContext(workspace));
+    const result = transitionExecution(workspace, slug, plan_path, action, cursorConfirmation(), cursorCoordinatorContext(workspace));
     if (result.ok === false) {
       return jsonResult(withWorkspace(workspace_root, {
         error: result.error,
@@ -27965,6 +28144,7 @@ var init_server3 = __esm(async () => {
     process.exit(1);
   });
   workspaceRootSchema = exports_external.string().optional().default(() => process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd()).describe("Git repository root. Defaults to the launcher workspace (WORKFLOW_WORKSPACE_ROOT), then the Cursor workspace folder (${workspaceFolder}), then the process cwd.");
+  delegationTokenSchema = exports_external.string().optional().describe("Task-scoped delegation token from workit_delegate for delegated workers.");
   server = new McpServer({
     name: "workit",
     version: VERSION
@@ -28067,9 +28247,13 @@ var init_server3 = __esm(async () => {
       body: exports_external.string().optional(),
       draft: exports_external.boolean().optional(),
       target_branch: exports_external.string().optional(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ confirmed, title, body, draft, target_branch, workspace_root }) => {
+  }, async ({ confirmed, title, body, draft, target_branch, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     if (!confirmed)
       return jsonResult({ error: "confirmed: true required" });
     const data = prCreate({
@@ -28131,9 +28315,13 @@ var init_server3 = __esm(async () => {
       ]).optional(),
       normalize_only: exports_external.boolean().optional().describe("If true, only collapse duplicate ### headings under [Unreleased] (no new bullets)."),
       path: exports_external.string().optional().describe("Defaults to CHANGELOG.md"),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ entries, normalize_only, path: changelogPath, workspace_root }) => {
+  }, async ({ entries, normalize_only, path: changelogPath, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const data = changelogApply({
       entries,
       path: changelogPath,
@@ -28221,9 +28409,13 @@ var init_server3 = __esm(async () => {
       sdd_dir: exports_external.string().optional(),
       target_branch: exports_external.string().optional(),
       stash: exports_external.enum(["yes", "no"]).optional(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ action, sdd_dir, target_branch, stash, workspace_root }) => {
+  }, async ({ action, sdd_dir, target_branch, stash, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const data = branchSetup({
       action,
       sdd_dir,
@@ -28255,13 +28447,23 @@ var init_server3 = __esm(async () => {
       sdd_dir: exports_external.string(),
       task_id: exports_external.number(),
       section_text: exports_external.string(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ sdd_dir, task_id, section_text, workspace_root }) => {
+  }, async ({ sdd_dir, task_id, section_text, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const slug = slugFromSddPath(sdd_dir);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    if (identity.slug !== undefined && identity.slug !== slug) {
+      return jsonResult({
+        error: `delegation token is bound to flow ${JSON.stringify(identity.slug)}, not ${JSON.stringify(slug)}`,
+        code: "slug_mismatch"
+      });
+    }
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, identity.context);
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddTaskBrief({
@@ -28278,13 +28480,23 @@ var init_server3 = __esm(async () => {
       sdd_dir: exports_external.string(),
       base_sha: exports_external.string(),
       head_sha: exports_external.string(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ sdd_dir, base_sha, head_sha, workspace_root }) => {
+  }, async ({ sdd_dir, base_sha, head_sha, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const slug = slugFromSddPath(sdd_dir);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    if (identity.slug !== undefined && identity.slug !== slug) {
+      return jsonResult({
+        error: `delegation token is bound to flow ${JSON.stringify(identity.slug)}, not ${JSON.stringify(slug)}`,
+        code: "slug_mismatch"
+      });
+    }
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, identity.context);
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddReviewPackage({
@@ -28302,18 +28514,31 @@ var init_server3 = __esm(async () => {
     inputSchema: {
       progress_path: exports_external.string(),
       line: exports_external.string(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ progress_path, line, workspace_root }) => {
+  }, async ({ progress_path, line, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const slug = slugFromSddPath(progress_path);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    if (identity.slug !== undefined && identity.slug !== slug) {
+      return jsonResult({
+        error: `delegation token is bound to flow ${JSON.stringify(identity.slug)}, not ${JSON.stringify(slug)}`,
+        code: "slug_mismatch"
+      });
+    }
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, identity.context);
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddAppendProgress({ progress_path, line, workspace_root });
     if (data.error)
       return jsonResult({ error: data.error });
+    if (identity.context.role === "delegated" && identity.context.taskIdentity) {
+      revokeDelegateToken(workspace_root, slug, Number(identity.context.taskIdentity));
+    }
     return jsonResult(withWorkspace(workspace_root, data));
   });
   registerTool("workit_sdd_append_advisory", {
@@ -28328,7 +28553,7 @@ var init_server3 = __esm(async () => {
     const slug = slugFromSddPath(advisories_path);
     if (!slug)
       return jsonResult({ error: "could not derive slug — expected docs/<slug>/sdd/..." });
-    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorMutationContext(workspace_root));
+    const gate = assertSddControlGates(workspace_root, slug, { requireMenu: true, requireDocs: true }, cursorCoordinatorContext(workspace_root));
     if (!gate.ok)
       return jsonResult({ error: gate.error, code: gate.code });
     const data = sddAppendAdvisory({ advisories_path, task_id, text, workspace_root });
@@ -28357,9 +28582,13 @@ var init_server3 = __esm(async () => {
       spec_path: exports_external.string().optional(),
       plan_path: exports_external.string().optional(),
       confirmed: exports_external.boolean().optional(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ action, slug, spec_path, plan_path, confirmed, workspace_root }) => {
+  }, async ({ action, slug, spec_path, plan_path, confirmed, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     if (action === "migrate") {
       const detect = detectLegacyDocs(workspace_root);
       if (confirmed === undefined) {
@@ -28579,7 +28808,7 @@ var init_server3 = __esm(async () => {
       return jsonResult(result);
     }
     if (action === "config") {
-      if (locale !== undefined && !/^[a-z]{2,3}(-[A-Z]{2})?$/.test(locale)) {
+      if (locale !== undefined && !/^[a-z]{2,3}(-(?:[A-Z]{2}|[0-9]{3}))?$/.test(locale)) {
         return jsonResult({
           error: `invalid locale: ${JSON.stringify(locale)} — expected BCP-47 like en or es-CL`
         });
@@ -28690,9 +28919,13 @@ var init_server3 = __esm(async () => {
       minutes: exports_external.number(),
       text: exports_external.string().optional(),
       dateMs: exports_external.number().optional().describe("Epoch ms for work item date; omit for today in config timezone"),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ issueId, minutes, text, dateMs, workspace_root }) => {
+  }, async ({ issueId, minutes, text, dateMs, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const data = await logTime({
       issueId,
       minutes,
@@ -28723,9 +28956,13 @@ var init_server3 = __esm(async () => {
       issueId: exports_external.string(),
       markdown: exports_external.string(),
       minutes: exports_external.number().optional(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ confirmed, issueId, markdown, minutes, workspace_root }) => {
+  }, async ({ confirmed, issueId, markdown, minutes, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const data = await postUpdate({
       confirmed,
       issueId,
@@ -28790,7 +29027,7 @@ var init_server3 = __esm(async () => {
     const { workspace, slug } = resolved.layout;
     let effective = readEffectiveFlowState(workspace, slug);
     if (!effective.ok && effective.code === "flow_not_activated") {
-      const prepared = prepareFlowState(workspace, slug, { spec_path, plan_path }, cursorMutationContext(workspace));
+      const prepared = prepareFlowState(workspace, slug, { spec_path, plan_path }, cursorCoordinatorContext(workspace));
       if (!prepared.ok)
         return jsonResult({ error: prepared.error, code: prepared.code });
       effective = readEffectiveFlowState(workspace, slug);
@@ -28819,7 +29056,7 @@ var init_server3 = __esm(async () => {
     if (!resolved.ok)
       return jsonResult(withWorkspace(workspace_root, { error: resolved.error }));
     const { workspace, slug } = resolved.layout;
-    const result = transitionSpec(workspace, slug, spec_path, cursorConfirmation(), cursorMutationContext(workspace));
+    const result = transitionSpec(workspace, slug, spec_path, cursorConfirmation(), cursorCoordinatorContext(workspace));
     if (result.ok === false)
       return jsonResult({ error: result.error, code: result.code });
     return jsonResult({ spec: spec_path, status: readFlowState(workspace, slug).spec.status });
@@ -28835,13 +29072,13 @@ var init_server3 = __esm(async () => {
     if (!resolved.ok)
       return jsonResult(withWorkspace(workspace_root, { error: resolved.error }));
     const { workspace, slug } = resolved.layout;
-    const result = transitionPlan(workspace, slug, plan_path, cursorConfirmation(), cursorMutationContext(workspace));
+    const result = transitionPlan(workspace, slug, plan_path, cursorConfirmation(), cursorCoordinatorContext(workspace));
     if (result.ok === false)
       return jsonResult({ error: result.error, code: result.code });
     return jsonResult({ plan: plan_path, status: readFlowState(workspace, slug).plan.status });
   });
   registerTool("workit_plan_menu", {
-    description: "Record the answered post-plan choice menu with the Cursor policy-only confirmation. subagent-driven is rejected as unsupported on Cursor (CA-42); there is no evidence argument.",
+    description: "Record the answered post-plan choice menu with the Cursor policy-only confirmation. An accepted Cursor subagent-driven choice activates execution and returns a coordinator_lease (mint delegation tokens with it); there is no evidence argument.",
     inputSchema: {
       plan_path: exports_external.string(),
       choice: exports_external.enum(["subagent-driven", "inline", "handoff", "review-spec", "review-plan"]),
@@ -28852,10 +29089,28 @@ var init_server3 = __esm(async () => {
     if (!resolved.ok)
       return jsonResult(withWorkspace(workspace_root, { error: resolved.error }));
     const { workspace, slug } = resolved.layout;
-    const result = recordMenuChoice(workspace, slug, plan_path, choice, cursorConfirmation(), cursorMutationContext(workspace));
+    const result = recordMenuChoice(workspace, slug, plan_path, choice, cursorConfirmation(), cursorCoordinatorContext(workspace));
     if (result.ok === false)
       return jsonResult({ error: result.error, code: result.code });
-    return jsonResult({ menu: { presented: true, chosen: choice } });
+    return jsonResult({
+      menu: { presented: true, chosen: choice },
+      ...result.coordinator_lease !== undefined ? { coordinator_lease: result.coordinator_lease } : {}
+    });
+  });
+  registerTool("workit_delegate", {
+    description: "Mint a task-scoped delegation token for a Cursor-native subagent. Requires the coordinator_lease returned once by workit_plan_menu with choice subagent-driven. Pass the returned delegation_token to the subagent; mutation tools accept it as delegation_token.",
+    inputSchema: {
+      slug: exports_external.string(),
+      plan_path: exports_external.string(),
+      task_id: exports_external.number(),
+      coordinator_lease: exports_external.string(),
+      workspace_root: workspaceRootSchema
+    }
+  }, async ({ slug, plan_path, task_id, coordinator_lease, workspace_root }) => {
+    const minted = mintDelegateToken(workspace_root, slug, plan_path, task_id, coordinator_lease);
+    if (!minted.ok)
+      return jsonResult({ error: minted.error, code: minted.code });
+    return jsonResult({ delegation_token: minted.token, slug, task_id });
   });
   lifecycleTool("pause", "Pause a running plan with the Cursor policy-only confirmation: active -> paused. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
   lifecycleTool("resume", "Resume a paused plan with the Cursor policy-only confirmation: paused -> active. The MCP cannot observe AskQuestion results, so it records attested: false; there is no evidence argument (CA-42). Requires plan_path and workspace_root.");
@@ -28864,9 +29119,13 @@ var init_server3 = __esm(async () => {
     description: "Link the component docs repo in the toolkit config",
     inputSchema: {
       path: exports_external.string(),
-      confirmed: exports_external.boolean()
+      confirmed: exports_external.boolean(),
+      delegation_token: delegationTokenSchema
     }
-  }, async ({ path: docsPath, confirmed }) => {
+  }, async ({ path: docsPath, confirmed, delegation_token }) => {
+    const identity = cursorMutationContext(process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const result = linkDocsRepo(docsPath, confirmed);
     if (!result.ok)
       return jsonResult({ error: result.error });
@@ -28882,9 +29141,13 @@ var init_server3 = __esm(async () => {
       slug: exports_external.string(),
       confirmed: exports_external.boolean(),
       force: exports_external.boolean().optional(),
+      delegation_token: delegationTokenSchema,
       workspace_root: workspaceRootSchema
     }
-  }, async ({ slug, confirmed, force, workspace_root }) => {
+  }, async ({ slug, confirmed, force, delegation_token, workspace_root }) => {
+    const identity = cursorMutationContext(workspace_root, delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const result = promoteSpec(workspace_root, slug, { confirmed, force });
     if (!result.ok)
       return jsonResult({ error: result.error, findings: result.findings ?? [] });
@@ -28903,9 +29166,13 @@ var init_server3 = __esm(async () => {
     inputSchema: {
       name: exports_external.enum(["issue-update", "greeting", "headers"]),
       content: exports_external.string(),
-      confirmed: exports_external.boolean()
+      confirmed: exports_external.boolean(),
+      delegation_token: delegationTokenSchema
     }
-  }, async ({ name, content, confirmed }) => {
+  }, async ({ name, content, confirmed, delegation_token }) => {
+    const identity = cursorMutationContext(process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const result = writeTemplate(name, content, confirmed);
     if (!result.ok)
       return jsonResult({ error: result.error });
@@ -28922,9 +29189,13 @@ var init_server3 = __esm(async () => {
       description: exports_external.string(),
       platforms: exports_external.array(exports_external.enum(["cursor", "opencode"])),
       body: exports_external.string(),
-      confirmed: exports_external.boolean()
+      confirmed: exports_external.boolean(),
+      delegation_token: delegationTokenSchema
     }
-  }, async ({ name, description, platforms, body, confirmed }) => {
+  }, async ({ name, description, platforms, body, confirmed, delegation_token }) => {
+    const identity = cursorMutationContext(process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), delegation_token);
+    if (!identity.ok)
+      return jsonResult({ error: identity.error, code: identity.code });
     const result = writeRule({ name, description, platforms, body }, confirmed);
     if (!result.ok)
       return jsonResult({ error: result.error });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "private": false,
   "description": "Workit Cursor plugin: MCP server, hooks, rules, marketplace manifest (thin over @brainervirus/workit-core)",
   "keywords": [
@@ -39,7 +39,7 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^0.9.2",
+    "@brainervirus/workit-core": "^0.11.0",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "zod": "^3.24.0"
   },

package/rules/ask-question-only.mdc

@@ -39,7 +39,7 @@ After writing a plan, **do not emit** Superpowers' inline text beginning “Two
 
 After `workit_docs_validate` succeeds on the saved spec/plan pair, call Cursor `AskQuestion` with exactly:
 
-- Subagent-driven → **unsupported on Cursor** (the MCP rejects it as `unsupported_mode`; use OpenCode `wk-implement`)
+- Subagent-driven → dispatches Cursor-native subagents: `workit_plan_menu` returns a one-time `coordinator_lease`, `workit_delegate` mints a task-scoped `delegation_token` per task, and the worker passes it as `delegation_token` on mutation calls
 - Inline → execute in this session
 - Handoff → `/wk-handoff` (new session only)
 - Review spec first

package/skills/wk-implement/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: wk-implement
-description: Execute an approved Superpowers plan on Cursor as the coordinator session (inline only). subagent-driven is unsupported on Cursor and the MCP rejects that menu choice. Use for /wk-implement or "implement from plan".
+description: Execute an approved Superpowers plan on Cursor as the coordinator session in either approved execution mode. Subagent-driven dispatches Cursor-native subagents through a lease/token capability; Inline executes every task in this session. Use for /wk-implement or "implement from plan".
 disable-model-invocation: true
 ---
 
 # Implement
 
-Execute the plan **inline in this coordinator session**. subagent-driven execution is unsupported on Cursor: the MCP rejects the subagent-driven menu choice (`unsupported_mode`) — Cursor has no child sessions. Plan-level edits stay coordinator-gated.
+Execute the plan in the **approved execution mode** recorded by `workit_plan_menu` (call `workit_flow_status` to read it). In Subagent-driven mode this session never edits product code — dispatch Cursor-native subagents; in Inline mode it executes every task itself. Plan-level edits stay coordinator-gated.
 
 ## Step 1 — Gather facts (required)
 
@@ -20,11 +20,11 @@ Use the returned `tasks[]` as ground truth. Cache each `section_text` for subage
 
 Resolve plugin root: `WORKFLOW_TOOLKIT_ROOT` env or `~/.cursor/plugins/local/workit/`.
 
-Load `templates/execution-contract.md`. Substitute `<SPEC_PATH>`, `<PLAN_PATH>`, `<BRANCH>`, `<SDD_DIR>`, `<TASK_LIST>` from MCP. OMIT the `## Handoff destination` section and its `<workflow-handoff-destination>` marker line — that section is only for sessions started from a `workit_handoff_prompt` destination prompt. This inline executor is NOT a destination and must never present itself as one (five-choice source menu, Handoff still available). If template missing, stop with error.
+Load `templates/execution-contract.md`. Substitute `<SPEC_PATH>`, `<PLAN_PATH>`, `<BRANCH>`, `<SDD_DIR>`, `<TASK_LIST>` from MCP. OMIT the `## Handoff destination` section and its `<workflow-handoff-destination>` marker line — that section is only for sessions started from a `workit_handoff_prompt` destination prompt. This executor is NOT a destination and must never present itself as one (five-choice source menu, Handoff still available). If template missing, stop with error.
 
-## Step 3 — Follow contract
+## Step 3 — Route by execution mode
 
-Announce: "Using implement + inline."
+Announce: "Using implement + <mode>."
 
 **Before Task 1 — validate + SDD + TodoWrite UI + branch (no worktrees):**
 
@@ -41,4 +41,18 @@ Each task lands exactly one contiguous non-empty commit range (`base..head`): fi
 
 Do not emit a handoff fence — this is in-session execution.
 
+### Subagent-driven
+
+Requires the flow's execution mode `subagent-driven` (set by `workit_plan_menu`).
+
+1. `workit_plan_menu` returned the raw **`coordinator_lease`** exactly once — use that stored value; the flow state persists only its hash.
+2. Per task: call MCP `workit_delegate` with `{slug, plan_path, task_id, coordinator_lease, workspace_root}` to mint a task-scoped **`delegation_token`**.
+3. Dispatch a Cursor-native subagent whose prompt includes the task brief and the raw `delegation_token`; the worker passes it as `delegation_token` on its mutation calls (`workit_sdd_task_brief`, `workit_sdd_review_package`, `workit_sdd_append_progress`, `workit_branch_setup`, `workit_pr_create`, …). The MCP validates the token against the flow state and fails closed on invalid, wrong-task, wrong-workspace, or revoked tokens.
+4. Coordinator product edits stay blocked — implementation, reviews, and fix rounds happen in the dispatched subagents.
+5. Appending the task's progress line with the worker's token via `workit_sdd_append_progress` revokes that task's token; mint a fresh token per task.
+
+### Inline
+
+Load and follow `executing-plans` in the current session. Every task runs in this agent — single-agent, no dispatch, no token minting.
+
 **Mandatory:** end the run by calling MCP `workit_plan_complete` after the final task once the SDD ledger is complete (all task IDs appended) and `workit_verify` passes — a complete ledger and green verification are the tool's gates. Never finish the run while the plan is still `active`.

package/vendor/superpowers/skills/executing-plans/SKILL.md

@@ -7,11 +7,11 @@ description: Use when you have a written implementation plan to execute in a sep
 
 ## Overview
 
-Load plan, review critically, execute all tasks, report when complete.
+Load plan, review critically, execute all tasks in the current session, report when complete. This is the single-agent Inline execution path.
 
 **Announce at start:** "I'm using the executing-plans skill to implement this plan."
 
-**Note:** Tell your human partner that Superpowers works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (Claude Code, Codex CLI, Codex App, and Copilot CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
+**Note:** This skill is the single-agent Inline execution path: every task runs in the current session — no token minting, no subagent dispatching. Tell your human partner that Superpowers works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (Claude Code, Codex CLI, Codex App, and Copilot CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available and the plan's approved execution mode is Subagent-driven, use superpowers:subagent-driven-development instead of this skill.
 
 ## The Process
 

package/vendor/superpowers/skills/subagent-driven-development/SKILL.md

@@ -11,6 +11,8 @@ Execute plan by dispatching a fresh implementer subagent per task, a task review
 
 **Core principle:** Fresh subagent per task + task review (spec + quality) + broad final review = high quality, fast iteration
 
+On Cursor, the coordinator mints a task-scoped delegation token via `workit_delegate` (from the `workit_plan_menu` coordinator lease) and the subagent prompt must carry it as `delegation_token` for mutation calls.
+
 **Narration:** between tool calls, narrate at most one short line — the
 ledger and the tool results carry the record.