@brainervirus/workit-cursor 8.22.1 → 8.22.2

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "workit",
   "displayName": "Workit",
   "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
-  "version": "8.22.1",
+  "version": "8.22.2",
   "author": {
     "name": "Cristhofer Pincetti"
   },

package/dist/cursor-session-start.js

@@ -18403,9 +18403,15 @@ var sessionMarkerFile = (input, session, store) => {
   }
   const name = createHash14("sha256").update(`${input.host}\x00${session}`).digest("hex").slice(0, 32);
   return path20.join(dir, "hooks", `skills-${name}.json`);
-}, list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], readSessionMarker = (file) => {
+}, list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], EMPTY, readRaw = (file) => {
   try {
-    const value = JSON.parse(fs16.readFileSync(file, "utf8"));
+    return fs16.readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+}, parseMarker = (text) => {
+  try {
+    const value = JSON.parse(text);
     return {
       nudged: list2(value.nudged),
       loaded: list2(value.loaded),
@@ -18414,24 +18420,46 @@ var sessionMarkerFile = (input, session, store) => {
       judges: list2(value.judges)
     };
   } catch {
-    return { nudged: [], loaded: [], raw: [], stops: [], judges: [] };
+    return { ...EMPTY };
+  }
+}, readSessionMarker = (file) => parseMarker(readRaw(file)), writeAtomic = (file, marker) => {
+  fs16.mkdirSync(path20.dirname(file), { recursive: true });
+  const temp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    fs16.writeFileSync(temp, JSON.stringify(marker));
+    fs16.renameSync(temp, file);
+  } catch (error) {
+    fs16.rmSync(temp, { force: true });
+    throw error;
   }
 }, writeSessionMarker = (file, marker) => {
   try {
-    fs16.mkdirSync(path20.dirname(file), { recursive: true });
-    fs16.writeFileSync(file, JSON.stringify(marker));
+    writeAtomic(file, marker);
+  } catch {}
+}, updateSessionMarker = (file, change) => {
+  try {
+    for (let attempt = 0;attempt < 2; attempt++) {
+      const before = readRaw(file);
+      const next = change(parseMarker(before));
+      if (attempt === 0 && readRaw(file) !== before)
+        continue;
+      writeAtomic(file, next);
+      return;
+    }
   } catch {}
 }, trackJudge = (input, agentId, running) => {
   const session = input.session.id;
   const file = session && agentId ? sessionMarkerFile(input, session) : null;
   if (!file || !agentId)
     return;
-  const marker = readSessionMarker(file);
-  const rest = marker.judges.filter((id) => id !== agentId);
-  writeSessionMarker(file, { ...marker, judges: running ? [...rest, agentId] : rest });
+  updateSessionMarker(file, (marker) => {
+    const rest = marker.judges.filter((id) => id !== agentId);
+    return { ...marker, judges: running ? [...rest, agentId] : rest };
+  });
 };
 var init_session_marker = __esm(() => {
   init_paths();
+  EMPTY = { nudged: [], loaded: [], raw: [], stops: [], judges: [] };
 });
 
 // packages/workit-core/src/hooks/shell-words.ts
@@ -19941,8 +19969,8 @@ var NONE2, SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLA
 }, nudgeFor = (action, host, session) => {
   switch (action.kind) {
     case "commit": {
-      const prefix = host === "cursor" && session ? `WORKIT_SESSION_ID=${session} ` : "";
-      return action.amend ? `workit: raw ${quote("git commit --amend")} is recorded for this session; for new commits prefer ${quote(`${prefix}workit git commit -m '<msg>'`)} (adds the Workit-Session trailer and checks branch and commit policy).` : `workit: prefer ${quote(`${prefix}workit git commit -m '<msg>' [--all | -- <paths>]`)}: it adds the Workit-Session trailer and checks branch and commit policy.`;
+      const workit = host === "cursor" && session ? `workit --session ${session}` : "workit";
+      return action.amend ? `workit: raw ${quote("git commit --amend")} is recorded for this session; for new commits prefer ${quote(`${workit} git commit -m '<msg>'`)} (adds the Workit-Session trailer and checks branch and commit policy).` : `workit: prefer ${quote(`${workit} git commit -m '<msg>' [--all | -- <paths>]`)}: it adds the Workit-Session trailer and checks branch and commit policy.`;
     }
     case "push":
       return action.blindForce ? `workit: ${quote("git push --force")} overwrites without a lease; use ${quote("workit git push --force-with-lease")}.` : `workit: prefer ${quote("workit git push")}: it refuses protected branches and verifies the remote tip.`;
@@ -20447,7 +20475,7 @@ function claudeSettingsFiles(cwd, env, platform = process.platform) {
   ];
 }
 function claudeRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     for (const file of claudeSettingsFiles(cwd, env)) {
       const text = readText2(file);
@@ -20486,7 +20514,7 @@ function claudeRules(cwd, env = process.env) {
   return rules;
 }
 function opencodeRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     const config = env.XDG_CONFIG_HOME || path23.join(homeOf(env), ".config");
     const files = [
@@ -20507,7 +20535,7 @@ function opencodeRules(cwd, env = process.env) {
   return rules;
 }
 function codexRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     const home = env.CODEX_HOME || path23.join(homeOf(env), ".codex");
     const top = gitTop(cwd) ?? cwd;
@@ -20536,7 +20564,7 @@ function codexRules(cwd, env = process.env) {
   return rules;
 }
 function cursorRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     const top = gitTop(cwd) ?? cwd;
     for (const file of [
@@ -20592,7 +20620,7 @@ function wrapAllowed(read, words, command, options = {}) {
     return { ok: false, why: "allowlisted" };
   return { ok: true };
 }
-var EMPTY = () => ({ deny: [], allow: [] }), readText2 = (file) => {
+var EMPTY2 = () => ({ deny: [], allow: [] }), readText2 = (file) => {
   try {
     return fs18.readFileSync(file, "utf8");
   } catch (error) {
@@ -21886,7 +21914,7 @@ function stopDecision(input, descriptor) {
   if (file && marker) {
     if (marker.stops.includes(key))
       return NONE4;
-    writeSessionMarker(file, { ...marker, stops: [...marker.stops, key] });
+    updateSessionMarker(file, (fresh) => ({ ...fresh, stops: [...fresh.stops, key] }));
   }
   return {
     kind: "continue",
@@ -21965,24 +21993,28 @@ var NONE4, QUESTION, OFFER, YES_NO, LIST_ITEM, asksUser = (message) => {
     kind: "checks",
     reason: `PR #${pr}'s checks were last seen ${state} at ${short(head)}, and this workspace's endpoint is \`${endpoint}\`: run \`workit ci wait --pr ${pr}\`${state === "failing" ? " after fixing the failures `workit pr status` lists (then push)" : ""}.`
   };
-}, highRisk = (cwd) => {
+}, taskJudgment = (cwd) => {
   try {
     const store = new TaskStore(cwd);
     const listed = store.listTaskIndex();
     const key = store.currentKey();
     if (!listed.ok || !key.ok)
-      return false;
+      return null;
     const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
     const task = entry ? store.readTask(entry.id) : null;
-    return task?.ok === true && latestJudgment(task.data)?.riskTier === "high";
+    return task?.ok === true ? latestJudgment(task.data) : null;
   } catch {
-    return false;
+    return null;
   }
 }, unverified = (cwd, branch, all, descriptor, verification) => {
   const check = checkVerdicts(cwd, branch, all);
   if (check.accepted.accepted || check.accepted.reasons.includes("failing_verdict"))
     return null;
-  const independent = verification === "independent" || highRisk(cwd);
+  const judgment = taskJudgment(cwd);
+  const high = judgment?.riskTier === "high";
+  if (judgment && !judgment.behaviorChange && !high)
+    return null;
+  const independent = verification === "independent" || high;
   if (!independent && check.review === "self-reviewed")
     return null;
   const has = check.review === "self-reviewed" ? "only a self verdict" : "no current verdict";
@@ -23586,7 +23618,7 @@ var init_cursor = __esm(() => {
       };
     },
     render: render3,
-    addendum: (input) => input.session.id ? `<workit-session>Cursor puts no session id in the shell: prefix workit commands that record authorship with WORKIT_SESSION_ID=${input.session.id} (e.g. \`WORKIT_SESSION_ID=${input.session.id} workit git commit -m …\`). A verifier uses its own id, never this one.</workit-session>` : null
+    addendum: (input) => input.session.id ? `<workit-session>Cursor puts no session id in the shell: start workit commands that record authorship with the global flag \`--session ${input.session.id}\` (e.g. \`workit --session ${input.session.id} git commit -m …\`; a leading env assignment can miss the \`Shell(workit)\` allowlist). A verifier uses its own id, never this one.</workit-session>` : null
   };
 });
 

package/dist/workit-hook.js

@@ -18506,9 +18506,17 @@ var sessionMarkerFile = (input, session, store) => {
   return path20.join(dir, "hooks", `skills-${name}.json`);
 };
 var list2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-var readSessionMarker = (file) => {
+var EMPTY = { nudged: [], loaded: [], raw: [], stops: [], judges: [] };
+var readRaw = (file) => {
   try {
-    const value = JSON.parse(fs16.readFileSync(file, "utf8"));
+    return fs16.readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+};
+var parseMarker = (text) => {
+  try {
+    const value = JSON.parse(text);
     return {
       nudged: list2(value.nudged),
       loaded: list2(value.loaded),
@@ -18517,13 +18525,36 @@ var readSessionMarker = (file) => {
       judges: list2(value.judges)
     };
   } catch {
-    return { nudged: [], loaded: [], raw: [], stops: [], judges: [] };
+    return { ...EMPTY };
+  }
+};
+var readSessionMarker = (file) => parseMarker(readRaw(file));
+var writeAtomic = (file, marker) => {
+  fs16.mkdirSync(path20.dirname(file), { recursive: true });
+  const temp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    fs16.writeFileSync(temp, JSON.stringify(marker));
+    fs16.renameSync(temp, file);
+  } catch (error) {
+    fs16.rmSync(temp, { force: true });
+    throw error;
   }
 };
 var writeSessionMarker = (file, marker) => {
   try {
-    fs16.mkdirSync(path20.dirname(file), { recursive: true });
-    fs16.writeFileSync(file, JSON.stringify(marker));
+    writeAtomic(file, marker);
+  } catch {}
+};
+var updateSessionMarker = (file, change) => {
+  try {
+    for (let attempt = 0;attempt < 2; attempt++) {
+      const before = readRaw(file);
+      const next = change(parseMarker(before));
+      if (attempt === 0 && readRaw(file) !== before)
+        continue;
+      writeAtomic(file, next);
+      return;
+    }
   } catch {}
 };
 var trackJudge = (input, agentId, running) => {
@@ -18531,9 +18562,10 @@ var trackJudge = (input, agentId, running) => {
   const file = session && agentId ? sessionMarkerFile(input, session) : null;
   if (!file || !agentId)
     return;
-  const marker = readSessionMarker(file);
-  const rest = marker.judges.filter((id) => id !== agentId);
-  writeSessionMarker(file, { ...marker, judges: running ? [...rest, agentId] : rest });
+  updateSessionMarker(file, (marker) => {
+    const rest = marker.judges.filter((id) => id !== agentId);
+    return { ...marker, judges: running ? [...rest, agentId] : rest };
+  });
 };
 
 // packages/workit-core/src/hooks/shell-words.ts
@@ -20182,8 +20214,8 @@ var offPolicyPush = (action, repo, facts, remote) => {
 var nudgeFor = (action, host, session) => {
   switch (action.kind) {
     case "commit": {
-      const prefix = host === "cursor" && session ? `WORKIT_SESSION_ID=${session} ` : "";
-      return action.amend ? `workit: raw ${quote("git commit --amend")} is recorded for this session; for new commits prefer ${quote(`${prefix}workit git commit -m '<msg>'`)} (adds the Workit-Session trailer and checks branch and commit policy).` : `workit: prefer ${quote(`${prefix}workit git commit -m '<msg>' [--all | -- <paths>]`)}: it adds the Workit-Session trailer and checks branch and commit policy.`;
+      const workit = host === "cursor" && session ? `workit --session ${session}` : "workit";
+      return action.amend ? `workit: raw ${quote("git commit --amend")} is recorded for this session; for new commits prefer ${quote(`${workit} git commit -m '<msg>'`)} (adds the Workit-Session trailer and checks branch and commit policy).` : `workit: prefer ${quote(`${workit} git commit -m '<msg>' [--all | -- <paths>]`)}: it adds the Workit-Session trailer and checks branch and commit policy.`;
     }
     case "push":
       return action.blindForce ? `workit: ${quote("git push --force")} overwrites without a lease; use ${quote("workit git push --force-with-lease")}.` : `workit: prefer ${quote("workit git push")}: it refuses protected branches and verifies the remote tip.`;
@@ -20584,7 +20616,7 @@ var shellPolicy = (cwd, command, dialect = "posix") => {
 import fs18 from "node:fs";
 import os6 from "node:os";
 import path23 from "node:path";
-var EMPTY = () => ({ deny: [], allow: [] });
+var EMPTY2 = () => ({ deny: [], allow: [] });
 var readText2 = (file) => {
   try {
     return fs18.readFileSync(file, "utf8");
@@ -20661,7 +20693,7 @@ var bashPattern = (entry) => {
   return match ? match[1] ?? "" : null;
 };
 function claudeRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     for (const file of claudeSettingsFiles(cwd, env)) {
       const text = readText2(file);
@@ -20741,7 +20773,7 @@ var opencodeConfig = (value, rules) => {
   return Object.values(value.agent).every((agent) => isRecord4(agent) && opencodePermission(agent.permission, rules));
 };
 function opencodeRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     const config = env.XDG_CONFIG_HOME || path23.join(homeOf(env), ".config");
     const files = [
@@ -20788,7 +20820,7 @@ var codexRule = (body) => {
   return { pattern: words.join(" "), decision };
 };
 function codexRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     const home = env.CODEX_HOME || path23.join(homeOf(env), ".codex");
     const top = gitTop(cwd) ?? cwd;
@@ -20817,7 +20849,7 @@ function codexRules(cwd, env = process.env) {
   return rules;
 }
 function cursorRules(cwd, env = process.env) {
-  const rules = EMPTY();
+  const rules = EMPTY2();
   try {
     const top = gitTop(cwd) ?? cwd;
     for (const file of [
@@ -22145,25 +22177,29 @@ var redChecks = (rows, pr, head, endpoint) => {
     reason: `PR #${pr}'s checks were last seen ${state} at ${short(head)}, and this workspace's endpoint is \`${endpoint}\`: run \`workit ci wait --pr ${pr}\`${state === "failing" ? " after fixing the failures `workit pr status` lists (then push)" : ""}.`
   };
 };
-var highRisk = (cwd) => {
+var taskJudgment = (cwd) => {
   try {
     const store = new TaskStore(cwd);
     const listed = store.listTaskIndex();
     const key = store.currentKey();
     if (!listed.ok || !key.ok)
-      return false;
+      return null;
     const entry = listed.data.filter((item) => item.key === key.data.key && item.status !== "closed").toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))[0];
     const task = entry ? store.readTask(entry.id) : null;
-    return task?.ok === true && latestJudgment(task.data)?.riskTier === "high";
+    return task?.ok === true ? latestJudgment(task.data) : null;
   } catch {
-    return false;
+    return null;
   }
 };
 var unverified = (cwd, branch, all, descriptor, verification) => {
   const check = checkVerdicts(cwd, branch, all);
   if (check.accepted.accepted || check.accepted.reasons.includes("failing_verdict"))
     return null;
-  const independent = verification === "independent" || highRisk(cwd);
+  const judgment = taskJudgment(cwd);
+  const high = judgment?.riskTier === "high";
+  if (judgment && !judgment.behaviorChange && !high)
+    return null;
+  const independent = verification === "independent" || high;
   if (!independent && check.review === "self-reviewed")
     return null;
   const has = check.review === "self-reviewed" ? "only a self verdict" : "no current verdict";
@@ -22234,7 +22270,7 @@ function stopDecision(input, descriptor) {
   if (file && marker) {
     if (marker.stops.includes(key))
       return NONE4;
-    writeSessionMarker(file, { ...marker, stops: [...marker.stops, key] });
+    updateSessionMarker(file, (fresh) => ({ ...fresh, stops: [...fresh.stops, key] }));
   }
   return {
     kind: "continue",
@@ -23831,7 +23867,7 @@ var cursorAdapter = {
     };
   },
   render: render3,
-  addendum: (input) => input.session.id ? `<workit-session>Cursor puts no session id in the shell: prefix workit commands that record authorship with WORKIT_SESSION_ID=${input.session.id} (e.g. \`WORKIT_SESSION_ID=${input.session.id} workit git commit -m …\`). A verifier uses its own id, never this one.</workit-session>` : null
+  addendum: (input) => input.session.id ? `<workit-session>Cursor puts no session id in the shell: start workit commands that record authorship with the global flag \`--session ${input.session.id}\` (e.g. \`workit --session ${input.session.id} git commit -m …\`; a leading env assignment can miss the \`Shell(workit)\` allowlist). A verifier uses its own id, never this one.</workit-session>` : null
 };
 
 // packages/workit-core/src/hooks/run.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cursor",
-  "version": "8.22.1",
+  "version": "8.22.2",
   "private": false,
   "description": "Workit Cursor plugin — shared MCP transport, native hooks, and sixteen method skills",
   "keywords": [
@@ -46,8 +46,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.22.1",
-    "@brainervirus/workit-mcp": "^8.22.1"
+    "@brainervirus/workit-core": "^8.22.2",
+    "@brainervirus/workit-mcp": "^8.22.2"
   },
   "engines": {
     "node": ">=24"