@brainervirus/workit-cursor 1.0.6 → 1.0.7

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/README.md

@@ -28,6 +28,7 @@ npx @brainervirus/workit-cli init
       "args": [
         "-y",
         "--prefer-online",
+        "--min-release-age=0",
         "--package=@brainervirus/workit-cursor@latest",
         "workit-cursor-mcp",
         "${workspaceFolder}"
@@ -40,7 +41,7 @@ npx @brainervirus/workit-cli init
 ### Requirements
 
 - **Node.js ≥ 24** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
-- **Network** — `npx -y --prefer-online …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
+- **Network** — `npx -y --prefer-online --min-release-age=0 …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
 
 ## What it provides
 
@@ -64,11 +65,11 @@ Cursor maps shared Workit operations through the shared MCP transport. AskQuesti
 
 Cursor launches the MCP server and session-start hook through `npx`, so the shipped manifests contain no repository-relative `dist` paths:
 
-- **MCP server** — `npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
-- **Session-start hook** — `npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
+- **MCP server** — `npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-mcp ${workspaceFolder}`. It speaks the MCP stdio protocol; `stdout` is reserved for protocol messages and diagnostics go to `stderr`.
+- **Session-start hook** — `npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-session-start`. It emits valid hook output and a diagnostic on runtime failure, and remains fail-open where Cursor's hook contract requires startup continuity.
 - `npx` startup or network failure is surfaced by Cursor as an MCP/hook startup failure; Workit never silently substitutes stale local runtime code.
 
-The runtime runs from `@latest` with the mandatory `--prefer-online` flag: Cursor reviews plugin metadata from Git, while npm serves the runtime. `--prefer-online` forces npx to check the registry so a stale cached `latest` resolution is never reused. See [Update review](#update-review).
+The runtime runs from `@latest` with `--prefer-online` and `--min-release-age=0`: Cursor reviews plugin metadata from Git, while npm serves the runtime. The explicit age override works around npm/cli#9765, where `npx` ignores a matching scoped exclusion. See [Update review](#update-review).
 
 ## Capability boundaries
 
@@ -99,7 +100,7 @@ The repository root carries `.cursor-plugin/marketplace.json`, indexing `package
 
 - **Installing from Marketplace** — a Marketplace admin adds the repository URL through Cursor's authenticated publisher flow; end users then install the plugin from the Cursor Marketplace UI, which reads `.cursor-plugin/plugin.json` and the tracked components directly from Git.
 - **Submission** — Marketplace submission is a separate, later authenticated action at `https://cursor.com/marketplace/publish`. It is **not** performed here and no publication or acceptance is claimed; the repository is kept validated and submission-ready.
-- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online`. The selector is shared across `mcp.json` and `hooks-cursor.json`, and a stale `latest` resolution is prevented by the mandatory `--prefer-online` flag.
+- **Update review** — Git plugin metadata (manifest, rules, skills, assets) is reviewed by Cursor on Marketplace updates, while the npm runtime runs from `@latest` with `--prefer-online` and the npm/cli#9765 `--min-release-age=0` workaround. The selector is shared across `mcp.json` and `hooks-cursor.json`.
   An MCP or hook startup failure with no network is an `npx`/registry reachability
   issue; inspect the host's startup diagnostics and retry after connectivity is
   restored.

package/hooks/hooks-cursor.json

@@ -3,36 +3,36 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-session-start"
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-session-start"
       }
     ],
     "preToolUse": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
         "matcher": "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch",
         "failClosed": true
       }
     ],
     "beforeShellExecution": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
         "failClosed": true
       }
     ],
     "subagentStart": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook",
         "failClosed": true
       }
     ],
     "subagentStop": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
       }
     ],
     "preCompact": [
       {
-        "command": "npx -y --prefer-online --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
+        "command": "npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest workit-cursor-hook"
       }
     ]
   }

package/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "workit": {
       "command": "npx",
-      "args": ["-y", "--prefer-online", "--package=@brainervirus/workit-cursor@latest", "workit-cursor-mcp", "${workspaceFolder}"]
+      "args": ["-y", "--prefer-online", "--min-release-age=0", "--package=@brainervirus/workit-cursor@latest", "workit-cursor-mcp", "${workspaceFolder}"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and fourteen method skills",
   "keywords": [
@@ -44,8 +44,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^1.0.6",
-    "@brainervirus/workit-mcp": "^1.0.6"
+    "@brainervirus/workit-core": "^1.0.7",
+    "@brainervirus/workit-mcp": "^1.0.7"
   },
   "engines": {
     "node": ">=24"