@brainervirus/workit-cursor 8.14.0 → 8.14.1

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "8.14.0",
+  "version": "8.14.1",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/dist/cursor-session-start.js

@@ -7624,6 +7624,16 @@ var init_zod = __esm(() => {
 
 // packages/workit-core/src/core/task-contract.ts
 import { createHash, randomUUID } from "node:crypto";
+function resolveIdRef(kind, ref, ids) {
+  if (ids.includes(ref))
+    return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1)
+    return success(null, null, matches[0]);
+  if (matches.length === 0)
+    return failure2("not_found", `${kind} not found`);
+  return failure2("invalid_input", `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`);
+}
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
@@ -7726,7 +7736,7 @@ var SCHEMA_VERSION = 1, POLICY_VERSION = "1.0.0", OPERATION_FAMILIES, uuidPatter
       return true;
   }
   return false;
-}, text, id, digest, revision, validUtc = (value) => {
+}, text, id, idRefPattern, idRef, digest, revision, validUtc = (value) => {
   const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?Z$/.exec(value);
   if (!match)
     return false;
@@ -7909,6 +7919,8 @@ var init_task_contract = __esm(() => {
       ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
   });
   id = text.regex(uuidPattern, "expected lowercase UUID");
+  idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+  idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
   digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
   revision = text.regex(uuidPattern, "expected UUID revision");
   utcSchema = text.check((ctx) => {
@@ -8177,7 +8189,7 @@ var init_task_contract = __esm(() => {
     outcome: _enum(["completed", "failed", "cancelled"]),
     summary: text,
     evidenceIds: array(id),
-    findingIds: array(id)
+    findingIds: array(idRef)
   }).strict();
   workerSchema = object({
     assignment: assignmentSchema,
@@ -8369,7 +8381,7 @@ var init_task_contract = __esm(() => {
       action: literal("resolve"),
       ...taskId,
       expectedRevision: revision.optional(),
-      findingId: id,
+      findingId: idRef,
       disposition: _enum(["open", "fixed", "dismissed", "deferred"]),
       reason: text,
       evidenceIds: array(id),
@@ -8410,7 +8422,7 @@ var init_task_contract = __esm(() => {
       ...taskId,
       expectedRevision: revision.optional(),
       expectedWorkspaceRevision: revision.optional(),
-      workerId: id,
+      workerId: idRef,
       report: workerReportSchema
     }),
     cancel: operation({
@@ -8418,7 +8430,7 @@ var init_task_contract = __esm(() => {
       ...taskId,
       ...revisions,
       expectedWorkspaceRevision: revision.optional(),
-      workerId: id,
+      workerId: idRef,
       reason: text
     })
   };
@@ -13462,20 +13474,26 @@ class TaskStore {
     return success(null, null, { key: key.data, bound: bound.data });
   }
   taskForWorker(workerId) {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
     const listed = this.listTaskIndex();
     if (!listed.ok)
       return listed;
+    const owners = new Map;
     for (const entry of listed.data) {
       if (entry.status === "closed")
         continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok)
         return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? [])
+        owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok)
+      return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found")
+      return resolved;
     return success(null, null, null);
   }
   originTaskEntry() {
@@ -16734,6 +16752,10 @@ class WorkitCore {
     }
     if (helper?.ok)
       return failure2("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef("finding", input.findingId, task.data.findings.map((entry) => entry.id));
+    if (!findingRef.ok)
+      return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
       return failure2("not_found", "finding not found");
@@ -16885,15 +16907,31 @@ class WorkitCore {
         return changed;
       return success(changed.data.task.revision, changed.data.workspace.revision, changed.data.task.workers.at(-1));
     }
+    const workerRef = resolveIdRef("worker", input.workerId, helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId]);
+    if (!workerRef.ok)
+      return helperId === null ? workerRef : failure2("permission_denied", input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL);
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
       return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure2("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
+      const ownFindings = task.data.findings.filter((candidate) => candidate.provenance.workerId === helperId).map((candidate) => candidate.id);
+      const reported = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok)
+          reported.push(found.data);
+        else if (found.code === "not_found")
+          reported.push(findingRef);
+        else
+          return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
@@ -16921,7 +16959,7 @@ class WorkitCore {
       return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure2("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {
@@ -17450,7 +17488,7 @@ var MAX_JUDGED_REFS = 5, workspaceVerification = (root) => {
     return changed;
   const updated = changed.data.task.workers.find((candidate) => candidate.id === input.workerId);
   return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during lifecycle observation");
-}, refsWithinScope = (refs, scope) => refs.every((ref) => ref.kind !== "file" || scopeCovers(scope, { description: "", paths: [ref.path], exclusions: [] })), TASK_SCOPED_ACTIONS, WORKER_ADDRESSED_ACTIONS, workerCommand = (taskId, request) => {
+}, refsWithinScope = (refs, scope) => refs.every((ref) => ref.kind !== "file" || scopeCovers(scope, { description: "", paths: [ref.path], exclusions: [] })), TASK_SCOPED_ACTIONS, ONLY_OWN_REPORT = "workers can submit only their own report", NO_HELPER_CONTROL = "helpers cannot cancel or control workers", WORKER_ADDRESSED_ACTIONS, workerCommand = (taskId, request) => {
   const { action, workerId, reason, report } = request;
   const rest = JSON.stringify({ reason, report });
   const payload = rest === "{}" ? "" : ` --payload '${rest.replace(/'/gu, "'\\''")}'`;

package/dist/mcp-server.js

@@ -16617,6 +16617,8 @@ var text = string2().check((ctx) => {
     ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
 });
 var id = text.regex(uuidPattern, "expected lowercase UUID");
+var idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+var idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
 var digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
 var revision = text.regex(uuidPattern, "expected UUID revision");
 var validUtc = (value) => {
@@ -16994,7 +16996,7 @@ var workerReportSchema = object2({
   outcome: _enum(["completed", "failed", "cancelled"]),
   summary: text,
   evidenceIds: array(id),
-  findingIds: array(id)
+  findingIds: array(idRef)
 }).strict();
 var workerSchema = object2({
   assignment: assignmentSchema,
@@ -17240,7 +17242,7 @@ var findingOperations = {
     action: literal("resolve"),
     ...taskId,
     expectedRevision: revision.optional(),
-    findingId: id,
+    findingId: idRef,
     disposition: _enum(["open", "fixed", "dismissed", "deferred"]),
     reason: text,
     evidenceIds: array(id),
@@ -17281,7 +17283,7 @@ var workerOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     report: workerReportSchema
   }),
   cancel: operation({
@@ -17289,7 +17291,7 @@ var workerOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     reason: text
   })
 };
@@ -17339,6 +17341,16 @@ var success = (revisionValue, workspaceRevisionValue, data) => ({
   data
 });
 var failure2 = (code, error, details = {}) => ({ ok: false, schemaVersion: 1, code, error, details });
+function resolveIdRef(kind, ref, ids) {
+  if (ids.includes(ref))
+    return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1)
+    return success(null, null, matches[0]);
+  if (matches.length === 0)
+    return failure2("not_found", `${kind} not found`);
+  return failure2("invalid_input", `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`);
+}
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
@@ -19857,20 +19869,26 @@ class TaskStore {
     return success(null, null, { key: key.data, bound: bound.data });
   }
   taskForWorker(workerId) {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
     const listed = this.listTaskIndex();
     if (!listed.ok)
       return listed;
+    const owners = new Map;
     for (const entry of listed.data) {
       if (entry.status === "closed")
         continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok)
         return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? [])
+        owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok)
+      return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found")
+      return resolved;
     return success(null, null, null);
   }
   originTaskEntry() {
@@ -25588,6 +25606,8 @@ var TASK_SCOPED_ACTIONS = new Set([
   "worker.cancel",
   "state.export"
 ]);
+var ONLY_OWN_REPORT = "workers can submit only their own report";
+var NO_HELPER_CONTROL = "helpers cannot cancel or control workers";
 var WORKER_ADDRESSED_ACTIONS = new Set(["worker.cancel", "worker.report"]);
 var workerCommand = (taskId, request) => {
   const { action, workerId, reason, report } = request;
@@ -26485,6 +26505,10 @@ class WorkitCore {
     }
     if (helper?.ok)
       return failure2("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef("finding", input.findingId, task.data.findings.map((entry) => entry.id));
+    if (!findingRef.ok)
+      return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
       return failure2("not_found", "finding not found");
@@ -26636,15 +26660,31 @@ class WorkitCore {
         return changed;
       return success(changed.data.task.revision, changed.data.workspace.revision, changed.data.task.workers.at(-1));
     }
+    const workerRef = resolveIdRef("worker", input.workerId, helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId]);
+    if (!workerRef.ok)
+      return helperId === null ? workerRef : failure2("permission_denied", input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL);
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
       return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure2("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
+      const ownFindings = task.data.findings.filter((candidate) => candidate.provenance.workerId === helperId).map((candidate) => candidate.id);
+      const reported = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok)
+          reported.push(found.data);
+        else if (found.code === "not_found")
+          reported.push(findingRef);
+        else
+          return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
@@ -26672,7 +26712,7 @@ class WorkitCore {
       return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure2("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {

package/dist/workit-hook.js

@@ -7548,6 +7548,8 @@ var text = string2().check((ctx) => {
     ctx.issues.push({ code: "custom", input: ctx.value, message: "invalid Unicode", path: [] });
 });
 var id = text.regex(uuidPattern, "expected lowercase UUID");
+var idRefPattern = /^[0-9a-f][0-9a-f-]{7,35}$/;
+var idRef = text.regex(idRefPattern, "expected a UUID or an id prefix of 8+ characters");
 var digest = text.regex(digestPattern, "expected lowercase SHA-256 digest");
 var revision = text.regex(uuidPattern, "expected UUID revision");
 var validUtc = (value) => {
@@ -7925,7 +7927,7 @@ var workerReportSchema = object({
   outcome: _enum(["completed", "failed", "cancelled"]),
   summary: text,
   evidenceIds: array(id),
-  findingIds: array(id)
+  findingIds: array(idRef)
 }).strict();
 var workerSchema = object({
   assignment: assignmentSchema,
@@ -8171,7 +8173,7 @@ var findingOperations = {
     action: literal("resolve"),
     ...taskId,
     expectedRevision: revision.optional(),
-    findingId: id,
+    findingId: idRef,
     disposition: _enum(["open", "fixed", "dismissed", "deferred"]),
     reason: text,
     evidenceIds: array(id),
@@ -8212,7 +8214,7 @@ var workerOperations = {
     ...taskId,
     expectedRevision: revision.optional(),
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     report: workerReportSchema
   }),
   cancel: operation({
@@ -8220,7 +8222,7 @@ var workerOperations = {
     ...taskId,
     ...revisions,
     expectedWorkspaceRevision: revision.optional(),
-    workerId: id,
+    workerId: idRef,
     reason: text
   })
 };
@@ -8270,6 +8272,16 @@ var success = (revisionValue, workspaceRevisionValue, data) => ({
   data
 });
 var failure2 = (code, error, details = {}) => ({ ok: false, schemaVersion: 1, code, error, details });
+function resolveIdRef(kind, ref, ids) {
+  if (ids.includes(ref))
+    return success(null, null, ref);
+  const matches = ids.filter((candidate) => candidate.startsWith(ref));
+  if (matches.length === 1)
+    return success(null, null, matches[0]);
+  if (matches.length === 0)
+    return failure2("not_found", `${kind} not found`);
+  return failure2("invalid_input", `${kind} prefix ${ref} is ambiguous; candidates: ${matches.join(", ")}`);
+}
 function parseOperation(family, input) {
   if (typeof input === "object" && input !== null && "schemaVersion" in input && input.schemaVersion !== SCHEMA_VERSION)
     return failure2("unsupported_version", "unsupported schema version", { operation: family });
@@ -13631,20 +13643,26 @@ class TaskStore {
     return success(null, null, { key: key.data, bound: bound.data });
   }
   taskForWorker(workerId) {
-    if (typeof workerId !== "string" || !validId(workerId))
+    if (typeof workerId !== "string" || !idRefPattern.test(workerId))
       return failure2("invalid_input", "needs a worker id: `workit worker cancel|report <workerId>`");
     const listed = this.listTaskIndex();
     if (!listed.ok)
       return listed;
+    const owners = new Map;
     for (const entry of listed.data) {
       if (entry.status === "closed")
         continue;
       const loaded = this.load(entry.id);
       if (!loaded.ok)
         return loaded;
-      if (loaded.data?.record.workers.some((worker) => worker.id === workerId))
-        return success(null, null, entry.id);
+      for (const worker of loaded.data?.record.workers ?? [])
+        owners.set(worker.id, entry.id);
     }
+    const resolved = resolveIdRef("worker", workerId, [...owners.keys()]);
+    if (resolved.ok)
+      return success(null, null, owners.get(resolved.data) ?? null);
+    if (resolved.code !== "not_found")
+      return resolved;
     return success(null, null, null);
   }
   originTaskEntry() {
@@ -16270,6 +16288,8 @@ var TASK_SCOPED_ACTIONS = new Set([
   "worker.cancel",
   "state.export"
 ]);
+var ONLY_OWN_REPORT = "workers can submit only their own report";
+var NO_HELPER_CONTROL = "helpers cannot cancel or control workers";
 var WORKER_ADDRESSED_ACTIONS = new Set(["worker.cancel", "worker.report"]);
 var workerCommand = (taskId, request) => {
   const { action, workerId, reason, report } = request;
@@ -17167,6 +17187,10 @@ class WorkitCore {
     }
     if (helper?.ok)
       return failure2("permission_denied", "helpers cannot resolve findings");
+    const findingRef = resolveIdRef("finding", input.findingId, task.data.findings.map((entry) => entry.id));
+    if (!findingRef.ok)
+      return findingRef;
+    input.findingId = findingRef.data;
     const finding = task.data.findings.find((entry) => entry.id === input.findingId);
     if (!finding)
       return failure2("not_found", "finding not found");
@@ -17318,15 +17342,31 @@ class WorkitCore {
         return changed;
       return success(changed.data.task.revision, changed.data.workspace.revision, changed.data.task.workers.at(-1));
     }
+    const workerRef = resolveIdRef("worker", input.workerId, helperId === null ? task.data.workers.map((candidate) => candidate.id) : [helperId]);
+    if (!workerRef.ok)
+      return helperId === null ? workerRef : failure2("permission_denied", input.action === "report" ? ONLY_OWN_REPORT : NO_HELPER_CONTROL);
+    input.workerId = workerRef.data;
     const entry = task.data.workers.find((candidate) => candidate.id === input.workerId);
     if (!entry)
       return failure2("not_found", "worker not found");
     if (input.action === "report") {
       if (helperId === null || helperId !== input.workerId)
-        return failure2("permission_denied", "workers can submit only their own report");
+        return failure2("permission_denied", ONLY_OWN_REPORT);
       const helper = this.helperEntry(task.data, true, true);
       if (!helper.ok)
         return helper;
+      const ownFindings = task.data.findings.filter((candidate) => candidate.provenance.workerId === helperId).map((candidate) => candidate.id);
+      const reported = [];
+      for (const findingRef of input.report.findingIds) {
+        const found = resolveIdRef("finding", findingRef, ownFindings);
+        if (found.ok)
+          reported.push(found.data);
+        else if (found.code === "not_found")
+          reported.push(findingRef);
+        else
+          return found;
+      }
+      input.report.findingIds = reported;
       const evidence = task.data.evidence.filter((candidate) => input.report.evidenceIds.includes(candidate.id));
       const findings = task.data.findings.filter((candidate) => input.report.findingIds.includes(candidate.id));
       if (evidence.length !== input.report.evidenceIds.length || findings.length !== input.report.findingIds.length)
@@ -17354,7 +17394,7 @@ class WorkitCore {
       return updated ? success(changed.data.task.revision, changed.data.workspace.revision, updated) : failure2("recovery_required", "worker disappeared during report");
     }
     if (helperId !== null)
-      return failure2("permission_denied", "helpers cannot cancel or control workers");
+      return failure2("permission_denied", NO_HELPER_CONTROL);
     if (task.data.status === "closed")
       return failure2("invalid_transition", "closed task cannot cancel workers");
     if (entry.data.state === "stopped") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "8.14.0",
+  "version": "8.14.1",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and sixteen method skills",
   "keywords": [
@@ -46,8 +46,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.14.0",
-    "@brainervirus/workit-mcp": "^8.14.0"
+    "@brainervirus/workit-core": "^8.14.1",
+    "@brainervirus/workit-mcp": "^8.14.1"
   },
   "engines": {
     "node": ">=24"