@brainervirus/workit-cursor 1.0.5 → 1.0.7

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/README.md

@@ -28,6 +28,7 @@ npx @brainervirus/workit-cli init
       "args": [
         "-y",
         "--prefer-online",
+        "--min-release-age=0",
         "--package=@brainervirus/workit-cursor@latest",
         "workit-cursor-mcp",
         "${workspaceFolder}"
@@ -40,7 +41,7 @@ npx @brainervirus/workit-cli init
 ### Requirements
 
 - **Node.js ≥ 24** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
-- **Network** — `npx -y --prefer-online …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
+- **Network** — `npx -y --prefer-online --min-release-age=0 …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
 
 ## What it provides
 
@@ -64,11 +65,11 @@ Cursor maps shared Workit operations through the shared MCP transport. AskQuesti
 
 Cursor launches the MCP server and session-start hook through `npx`, so the shipped manifests contain no repository-relative `dist` paths:
 
-- **MCP server** — `npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
-- **Session-start hook** — `npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
+- **MCP server** — `npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
+- **Session-start hook** — `npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
 - `npx` startup or network failure is surfaced by Cursor as an MCP/hook startup failure; Workit never silently substitutes stale local runtime code.
 
-The runtime runs from `@latest` with the mandatory `--prefer-online` flag: Cursor reviews plugin metadata from Git, while npm serves the runtime. `--prefer-online` forces npx to check the registry so a stale cached `latest` resolution is never reused. See [Update review](#update-review).
+The runtime runs from `@latest` with `--prefer-online` and `--min-release-age=0`: Cursor reviews plugin metadata from Git, while npm serves the runtime. The explicit age override works around npm/cli#9765, where `npx` ignores a matching scoped exclusion. See [Update review](#update-review).
 
 ## Capability boundaries
 
@@ -99,7 +100,7 @@ The repository root carries `.cursor-plugin/marketplace.json`, indexing `package
 
 - **Installing from Marketplace** — a Marketplace admin adds the repository URL through Cursor's authenticated publisher flow; end users then install the plugin from the Cursor Marketplace UI, which reads `.cursor-plugin/plugin.json` and the tracked components directly from Git.
 - **Submission** — Marketplace submission is a separate, later authenticated action at `https://cursor.com/marketplace/publish`. It is **not** performed here and no publication or acceptance is claimed; the repository is kept validated and submission-ready.
-- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online`. The selector is shared across `mcp.json` and `hooks-cursor.json`, and a stale `latest` resolution is prevented by the mandatory `--prefer-online` flag.
+- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online` and the npm/cli#9765 `--min-release-age=0` workaround. The selector is shared across `mcp.json` and `hooks-cursor.json`.
   An MCP or hook startup failure with no network is an `npx`/registry reachability
   issue; inspect the host's startup diagnostics and retry after connectivity is
   restored.

package/dist/cursor-session-start.js

@@ -10219,10 +10219,9 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
       if (requirement.dimension !== "review")
         return true;
       const reviewSession = sessionFromRef(entry.data.reviewContext);
-      const implementationSession = sessionFromRef(task.intent.provenance.session);
-      const sameImplementation = sameSession(reviewSession, implementationSession);
+      const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
       const sameEvidenceSession = task.evidence.some((other) => other.id !== entry.id && sameSession(reviewSession, other.provenance.session));
-      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && !sameImplementation && !sameEvidenceSession;
+      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
     });
     if (passed.length) {
       const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt)) : passed;
@@ -10583,6 +10582,9 @@ revisions, policy.assess {assessment: {facts, signals, consequences,
 verification}} where facts are inferred or observed with file refs,
 writer.acquire {taskId} before product writes, evidence.record {evidence} where
 check and review kinds auto-bind the current tree and need no digests. Record
+self-review requirements with kind review and reviewContext matching your own
+host session; the lead may also record checks. Fresh-context review requires a
+session distinct from the task creator and every other evidence recorder. Record
 verification evidence last: later evidence or commits can reopen fixed findings
 for re-verification, so verify, resolve, then close with nothing in between.
 decision.record {binding with taskId/workspaceId from inspect plus presented and

package/dist/mcp-server.js

@@ -23011,10 +23011,9 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
       if (requirement.dimension !== "review")
         return true;
       const reviewSession = sessionFromRef(entry.data.reviewContext);
-      const implementationSession = sessionFromRef(task.intent.provenance.session);
-      const sameImplementation = sameSession(reviewSession, implementationSession);
+      const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
       const sameEvidenceSession = task.evidence.some((other) => other.id !== entry.id && sameSession(reviewSession, other.provenance.session));
-      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && !sameImplementation && !sameEvidenceSession;
+      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
     });
     if (passed.length) {
       const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt)) : passed;

package/dist/workit-hook.js

@@ -10256,10 +10256,9 @@ function evaluateRequirements(task, workspace, capabilities, candidate, checkout
       if (requirement.dimension !== "review")
         return true;
       const reviewSession = sessionFromRef(entry.data.reviewContext);
-      const implementationSession = sessionFromRef(task.intent.provenance.session);
-      const sameImplementation = sameSession(reviewSession, implementationSession);
+      const sameImplementation = sameSession(reviewSession, task.intent.provenance.session);
       const sameEvidenceSession = task.evidence.some((other) => other.id !== entry.id && sameSession(reviewSession, other.provenance.session));
-      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && !sameImplementation && !sameEvidenceSession;
+      return entry.data.kind === "review" && reviewSession !== null && sameSession(reviewSession, entry.provenance.session) && (requirement.ruleId === "self-review" || !sameImplementation && !sameEvidenceSession);
     });
     if (passed.length) {
       const withRed = requirement.dimension === "testing" ? passed.filter(({ entry }) => related.some((other) => other.entry.data.kind === "check" && other.evaluation.status === "failed" && other.entry.data.requirementIds.includes(requirement.id) && other.entry.recordedAt <= entry.recordedAt)) : passed;
@@ -10486,6 +10485,9 @@ revisions, policy.assess {assessment: {facts, signals, consequences,
 verification}} where facts are inferred or observed with file refs,
 writer.acquire {taskId} before product writes, evidence.record {evidence} where
 check and review kinds auto-bind the current tree and need no digests. Record
+self-review requirements with kind review and reviewContext matching your own
+host session; the lead may also record checks. Fresh-context review requires a
+session distinct from the task creator and every other evidence recorder. Record
 verification evidence last: later evidence or commits can reopen fixed findings
 for re-verification, so verify, resolve, then close with nothing in between.
 decision.record {binding with taskId/workspaceId from inspect plus presented and

package/hooks/hooks-cursor.json

@@ -3,36 +3,36 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-session-start"
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-session-start"
       }
     ],
     "preToolUse": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
         "matcher": "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch",
         "failClosed": true
       }
     ],
     "beforeShellExecution": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
         "failClosed": true
       }
     ],
     "subagentStart": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
         "failClosed": true
       }
     ],
     "subagentStop": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
       }
     ],
     "preCompact": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
       }
     ]
   }

package/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "workit": {
       "command": "npx",
-      "args": ["-y", "--prefer-online", "--package=@brainervirus/workit-cursor@latest", "workit-cursor-mcp", "${workspaceFolder}"]
+      "args": ["-y", "--prefer-online", "--min-release-age=0", "--package=@brainervirus/workit-cursor@latest", "workit-cursor-mcp", "${workspaceFolder}"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and fourteen method skills",
   "keywords": [
@@ -44,8 +44,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^1.0.5",
-    "@brainervirus/workit-mcp": "^1.0.5"
+    "@brainervirus/workit-core": "^1.0.7",
+    "@brainervirus/workit-mcp": "^1.0.7"
   },
   "engines": {
     "node": ">=24"