@brainervirus/workit-cursor 5.0.0 → 6.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.cursor-plugin/plugin.json +1 -1
- package/README.md +20 -94
- package/assets/templates/workit-contract.md +3 -2
- package/dist/cursor-session-start.js +2651 -4340
- package/dist/mcp-server.js +2200 -3931
- package/dist/workit-hook.js +2377 -4106
- package/package.json +3 -3
- package/rules/workit-contract.mdc +6 -6
package/README.md
CHANGED
|
@@ -1,110 +1,36 @@
|
|
|
1
1
|
# @brainervirus/workit-cursor
|
|
2
2
|
|
|
3
3
|
[](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
|
|
4
|
-
[](
|
|
4
|
+
[](https://www.npmjs.com/package/@brainervirus/workit-cursor)
|
|
5
|
+
[](https://github.com/BrainerVirus/workit/blob/main/LICENSE)
|
|
6
6
|
|
|
7
|
-
|
|
7
|
+
[Workit](https://github.com/BrainerVirus/workit) for Cursor: the shared MCP server, one native hook
|
|
8
|
+
dispatcher, the `workit-contract` rule, the eleven method skills and `/wk-*`
|
|
9
|
+
commands. Requires Node.js 24+ and network access on first run.
|
|
8
10
|
|
|
9
11
|
## Install
|
|
10
12
|
|
|
11
|
-
**Wizard (recommended)** — configures Cursor and/or OpenCode and installs the platform packages:
|
|
12
|
-
|
|
13
13
|
```bash
|
|
14
|
-
npx @brainervirus/workit-cli init
|
|
14
|
+
npx @brainervirus/workit-cli init # select Cursor
|
|
15
15
|
```
|
|
16
16
|
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
**Manual** — add the MCP server to `.cursor/mcp.json`:
|
|
22
|
-
|
|
23
|
-
```json
|
|
24
|
-
{
|
|
25
|
-
"mcpServers": {
|
|
26
|
-
"workit": {
|
|
27
|
-
"command": "npx",
|
|
28
|
-
"args": [
|
|
29
|
-
"-y",
|
|
30
|
-
"--prefer-online",
|
|
31
|
-
"--min-release-age=0",
|
|
32
|
-
"--package=@brainervirus/workit-cursor@latest",
|
|
33
|
-
"workit-cursor-mcp",
|
|
34
|
-
"${workspaceFolder}"
|
|
35
|
-
]
|
|
36
|
-
}
|
|
37
|
-
}
|
|
38
|
-
}
|
|
39
|
-
```
|
|
40
|
-
|
|
41
|
-
### Requirements
|
|
42
|
-
|
|
43
|
-
- **Node.js ≥ 24** — the MCP server and session-start hook are self-contained Node bundles invoked through `npx`.
|
|
44
|
-
- **Network** — `npx -y --prefer-online --min-release-age=0 …@latest` resolves and downloads the package on first run in each environment; a machine that cannot reach the npm registry cannot start the MCP server or hook (see [Runtime](#runtime)).
|
|
45
|
-
|
|
46
|
-
## What it provides
|
|
47
|
-
|
|
48
|
-
- MCP server exposing exactly the eight shared operation families: `workit_task`, `workit_policy`, `workit_evidence`, `workit_finding`, `workit_decision`, `workit_worker`, `workit_writer`, and `workit_state`.
|
|
49
|
-
- One bounded native hook executable for session context, recognized product-write and shell interception, and native subagent lifecycle observations.
|
|
50
|
-
- Eleven canonical `workit-*` method skills and the `workit-contract` rule.
|
|
51
|
-
|
|
52
|
-
## Host limitations
|
|
53
|
-
|
|
54
|
-
Cursor maps shared Workit operations through the shared MCP transport. AskQuestion remains policy-only (`agent_guided`), session start and compaction are non-blocking, and arbitrary shell writes, Tab edits, and exact subagent stop identity are unavailable. Known Write/Edit/Delete targets are enforced only when the documented Cursor hook inputs prove them. Native subagent delegation is read-only for reviewer/investigator assignments; implementer delegation is unavailable because Cursor exposes no attested writer identity or stable child-stop identity.
|
|
55
|
-
|
|
56
|
-
## Configuration
|
|
57
|
-
|
|
58
|
-
- Plugin metadata: `packages/workit-cursor/.cursor-plugin/plugin.json` (`name: "workit"`, `displayName: "Workit"`).
|
|
59
|
-
- MCP server: `mcp.json`.
|
|
60
|
-
- Session-start hook: `hooks/hooks-cursor.json`.
|
|
61
|
-
- Rule: `rules/workit-contract.mdc`.
|
|
62
|
-
- Skills: `skills/` (eleven canonical Workit methods).
|
|
17
|
+
The wizard copies the plugin into `~/.cursor/plugins/local/workit` (a real
|
|
18
|
+
directory) and registers the MCP server and hooks. Manual MCP config and host
|
|
19
|
+
limits: [hosts guide](https://github.com/BrainerVirus/workit/blob/main/docs/guides/hosts.md#cursor).
|
|
63
20
|
|
|
64
21
|
## Runtime
|
|
65
22
|
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
-
|
|
71
|
-
|
|
72
|
-
The runtime runs from `@latest` with `--prefer-online` and `--min-release-age=0`: Cursor reviews plugin metadata from Git, while npm serves the runtime. The explicit age override works around npm/cli#9765, where `npx` ignores a matching scoped exclusion. See [Update review](#update-review).
|
|
73
|
-
|
|
74
|
-
## Capability boundaries
|
|
75
|
-
|
|
76
|
-
- Authority-sensitive MCP mutations require an attested caller. A standalone or ordinary Cursor launch stays usable for read-only inspection and reports `capability_unavailable` for authority mutations.
|
|
77
|
-
- Native hook enforcement is limited to documented inputs and blocking behavior. The plugin does not claim a `beforeMCPExecution` hook, cross-process receipts, delegation tokens, or automatic compaction restoration.
|
|
78
|
-
|
|
79
|
-
## Plugin layout
|
|
80
|
-
|
|
81
|
-
| Path | Contents |
|
|
82
|
-
| ----------------------------- | ------------------------------------------------------------- |
|
|
83
|
-
| `mcp/` + `dist/mcp-server.js` | MCP server entry (built). |
|
|
84
|
-
| `hooks/` | session-start hook manifest. |
|
|
85
|
-
| `rules/workit-contract.mdc` | Adaptive task contract and truthful Cursor capability limits. |
|
|
86
|
-
| `skills/` | Eleven canonical adaptive Workit method skills. |
|
|
87
|
-
| `.cursor-plugin/plugin.json` | authoritative plugin manifest. |
|
|
88
|
-
|
|
89
|
-
## Package scripts
|
|
90
|
-
|
|
91
|
-
```bash
|
|
92
|
-
bun run build # bundle MCP + native hook entries and copy eleven method skills
|
|
93
|
-
```
|
|
94
|
-
|
|
95
|
-
From the repository root, `bun run validate:cursor-marketplace` validates the tracked Marketplace artifact against the official Cursor JSON schemas and clean-checkout invariants (component paths, frontmatter, logo, sanitized vendor parity, no ignored-`dist` runtime references).
|
|
23
|
+
The MCP server and hooks run through
|
|
24
|
+
`npx -y --prefer-online --min-release-age=0 --package=@brainervirus/workit-cursor@latest …`,
|
|
25
|
+
so manifests carry no repository-relative `dist` paths. The age override
|
|
26
|
+
works around npm/cli#9765; `workit doctor` enforces this exact shape. MCP is
|
|
27
|
+
read-only for unattested callers; mutations run through the `workit` CLI.
|
|
96
28
|
|
|
97
29
|
## Marketplace
|
|
98
30
|
|
|
99
|
-
The repository root carries `.cursor-plugin/marketplace.json
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
issue; inspect the host's startup diagnostics and retry after connectivity is
|
|
106
|
-
restored.
|
|
107
|
-
|
|
108
|
-
## Docs
|
|
109
|
-
|
|
110
|
-
Full usage: https://github.com/BrainerVirus/workit#readme
|
|
31
|
+
The repository root carries `.cursor-plugin/marketplace.json` indexing this
|
|
32
|
+
package. Cursor installs Marketplace plugins from git without building, so
|
|
33
|
+
`skills/`, `commands/`, `rules/` and assets are committed; regenerate skills
|
|
34
|
+
with `bun packages/workit-cursor/scripts/build.ts --skills-only`.
|
|
35
|
+
`bun run validate:cursor-marketplace` checks the artifact against the pinned
|
|
36
|
+
Cursor schemas. The plugin is submission-ready but not published there.
|
|
@@ -2,9 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
Workit keeps one accountable lead and one shared task state. Inspect current
|
|
4
4
|
task state before acting; use only the shared operations for task, policy,
|
|
5
|
-
evidence, finding, decision, worker,
|
|
5
|
+
evidence, finding, decision, worker, and state changes. Authority is
|
|
6
6
|
bounded by the requested scope, current revision, caller/session provenance, and
|
|
7
|
-
observed capabilities
|
|
7
|
+
observed capabilities; delivery is bounded by the workspace autonomy grants
|
|
8
|
+
(`workit grant show`). Never claim host enforcement or evidence that the host
|
|
8
9
|
cannot provide. Preserve unresolved requirements, gaps, and uncertain workers.
|
|
9
10
|
|
|
10
11
|
Focused methods are loaded only when the resolved policy requires them. A method
|