@mutmutco/cursor-plugin 4.2.6 → 4.3.0

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.2.6",
+  "version": "4.3.0",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and organisation gates for Cursor.",
   "author": {
@@ -16,6 +16,5 @@
     "workflow",
     "organisation"
   ],
-  "skills": "./skills/",
-  "hooks": "./hooks/cursor-hooks.json"
+  "skills": "./skills/"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cursor-plugin",
-  "version": "4.2.6",
+  "version": "4.3.0",
   "description": "MMI workflow skills and organisation gates for Cursor.",
   "author": {
     "name": "MMI Future",

package/scripts/edit-tool-paths.mjs

@@ -4,9 +4,9 @@
 // whole patch in `tool_input.command` — there is no `file_path` at all. A gate that reads only
 // `file_path` therefore sees nothing to check and exits 0: on Codex the vault-edit gate FAILED OPEN and
 // `apply_patch` could create a `.env`, while the guide claimed the path was protected (cross-vendor
-// check, openai-sol). Matching `apply_patch` in a hook manifest does not rewrite the payload.
+// check, openai-sol). Matching `apply_patch` in a host manifest does not rewrite the payload.
 //
-// One extractor, used by every edit-shaped hook, so a new host contract is taught in one place.
+// One extractor, used by every edit-shaped integration, so a new host contract is taught in one place.
 
 /** Tool names that mean "this call writes files". `StrReplace` is Cursor's in-place edit tool: it
  *  carries its target in `tool_input.path` and was outside this set, so even once the adapter matched
@@ -63,7 +63,7 @@ const SHELL_WRAPPERS = new Set(['bash', 'sh', 'zsh', 'dash', 'pwsh', 'powershell
 export function invokesApplyPatch(command) {
   if (typeof command !== 'string' || !command) return false;
   // Redirects may abut the command word — `apply_patch<<'EOF'` and `apply_patch<<<"$P"` are both valid
-  // shell, and both hid the command name from a whitespace tokenizer (cross-vendor check, kimi-k3).
+  // shell, and both hid the command name from a whitespace tokenizer (cross-vendor check).
   // Separating the operators first is what makes the command word its own token in every form.
   const spaced = command.replace(/([<>]+)/g, ' $1 ');
   for (const segment of spaced.split(/\|\||&&|[;&|\n]|<<-?\s*['"]?\w+['"]?/)) {
@@ -85,7 +85,7 @@ export function invokesApplyPatch(command) {
 /**
  * Every file path a tool call writes to. Returns `[]` for non-edit tools and unreadable payloads —
  * callers treat an empty list as "nothing to check", exactly as they treated a missing `file_path`.
- * @param {{ tool_name?: unknown, tool_input?: Record<string, unknown> }} input raw hook payload
+ * @param {{ tool_name?: unknown, tool_input?: Record<string, unknown> }} input raw tool payload
  * @returns {string[]}
  */
 export function editedPaths(input) {

package/skills/bootstrap/SKILL.md

@@ -3,7 +3,7 @@ name: bootstrap
 description: Provision a repo into the org with board, registry, rules, and plugin setup.
 ---
 
-**Host-native invocation:** Claude `/mmi:bootstrap` · Codex `$mmi:bootstrap` · jervcode/Kimi `/skill:bootstrap` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:bootstrap` · Codex `$mmi:bootstrap` · Cursor `/bootstrap` · jervcode `/bootstrap` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /bootstrap — provision a repo into the org
 
@@ -506,7 +506,7 @@ mmi-cli devops bootstrap apply "$OWNER/$REPO" --class deployable \
 Tenant-container repos must carry a `docker-compose.yml` and Dockerfile that build from the shipped source
 archive; the train does not ship a prebuilt `dist/`. **Bootstrap seeds both files** for
 `deployModel: tenant-container` from `skills/bootstrap/seeds/` (rendered from
-`docs/Reference/tenant-runtime/docker-compose.yml` and `docs/Reference/tenant-runtime/Dockerfile`). The box
+the bootstrap seed Dockerfile and compose templates). The box
 writes the release `.env` from the registry + vault at deploy time; the compose file carries `env_file: .env`
 and the app reads plain env vars — it must **not** self-load SSM and must **not** ship a committed `.env`.
 

package/skills/bootstrap/seeds/README.template.md

@@ -1,7 +1,7 @@
 # {{REPO_NAME}}
 
 > One paragraph: what this repo **is** — the product/service and who it's for. (Write fresh — D35: do
-> not carry a legacy README over verbatim; the old docs are archived under `docs/Archive/`.)
+> not carry a legacy README over verbatim; write the current product map.)
 
 ## What's here
 
@@ -11,7 +11,7 @@
 
 (Owner/operator — who runs this day to day.) Access follows the MMI Future three-level model: read for
 org members, developer as GitHub `write`, project-admin as `write` plus train-branch allowlist. Authority
-detail → [org-architecture §4](https://github.com/mutmutco/MMI-Hub/blob/development/docs/org-architecture.md);
+detail → [Hub architecture](https://github.com/mutmutco/MMI-Hub/blob/main/architecture.md);
 access runbook → [repo-access](https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/repo-access.md).
 
 ## Agent context

package/skills/bootstrap/seeds/gate.template.yml

@@ -28,7 +28,7 @@ name: gate
 # Do not add a windows-compat (or any other) job that runs-on GH-hosted Windows. Linux self-hosted
 # (mmi-live / mmi-heavy) is the only CI merge gate. Rare Windows proof stays on the owner's machine or
 # a future self-hosted Windows runner — never windows-latest.
-# (seed touch: keep kilo mirror + BOM digests in lockstep after classifier land.)
+# (seed touch: keep BOM digests in lockstep after classifier land.)
 on:
   pull_request:
   push:
@@ -79,17 +79,17 @@ jobs:
           offenders=$(mktemp)
           trap 'rm -f "$offenders"' EXIT
           {
-            git grep -Il $'\r' -- '*.sh' || true
-            git grep -Il '^#!' | while IFS= read -r path; do
+            git grep --cached -Il $'\r' -- '*.sh' || true
+            git grep --cached -Il '^#!' | while IFS= read -r path; do
               case "$path" in
                 *.sh) ;;
-                *) git grep -Il $'\r' -- "$path" || true ;;
+                *) git grep --cached -Il $'\r' -- "$path" || true ;;
               esac
             done
           } | sort -u > "$offenders"
           if [[ -s "$offenders" ]]; then
             while IFS= read -r path; do
-              echo "::error title=Line-ending guard::CR byte in tracked script: $path. Run git add --renormalize . with this repo's .gitattributes."
+              printf "::error title=Line-ending guard::CR byte in tracked script: %s. Run git add --renormalize . with this repo's .gitattributes.\n" "$path"
             done < "$offenders"
             exit 1
           fi

package/skills/bootstrap/seeds/manifest.json

@@ -15,6 +15,7 @@
     { "target": "README.md", "source": "seed:README.template.md", "ownership": "repo", "classes": ["deployable", "content"], "managedBlock": { "source": "seed:readme-mmi-developer-environment.block.md", "begin": "<!-- mmi-developer-environment:start -->", "end": "<!-- mmi-developer-environment:end -->" } },
     { "target": "architecture.md", "source": "seed:architecture.template.md", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "docs/decisions/README.md", "source": "seed:decisions-readme.template.md", "ownership": "repo", "classes": ["deployable", "content"] },
+    { "target": "test-policy.json", "source": "seed:test-policy.template.json", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "docs/Guides/google-login.md", "source": "seed:google-login.template.md", "ownership": "repo", "classes": ["deployable"], "projectTypes": ["web-app"] },
     { "target": "docker-compose.yml", "source": "seed:docker-compose.template.yml", "ownership": "repo", "classes": ["deployable"], "deployModels": ["tenant-container"] },
     { "target": "Dockerfile", "source": "seed:Dockerfile.template", "ownership": "repo", "classes": ["deployable"], "deployModels": ["tenant-container"] }

package/skills/bootstrap/seeds/test-policy.template.json

@@ -0,0 +1,4 @@
+{
+  "mandatory": [],
+  "protected": []
+}

package/skills/hotfix/SKILL.md

@@ -3,7 +3,7 @@ name: hotfix
 description: Promote an already-merged development fix to main and production through the gated Hub train.
 ---
 
-**Host-native invocation:** Claude `/mmi:hotfix` · Codex `$mmi:hotfix` · jervcode/Kimi `/skill:hotfix` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:hotfix` · Codex `$mmi:hotfix` · Cursor `/hotfix` · jervcode `/hotfix` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /hotfix — promote a development fix to main + prod
 

package/skills/rcand/SKILL.md

@@ -3,7 +3,7 @@ name: rcand
 description: Promote development to a release-candidate branch.
 ---
 
-**Host-native invocation:** Claude `/mmi:rcand` · Codex `$mmi:rcand` · jervcode/Kimi `/skill:rcand` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:rcand` · Codex `$mmi:rcand` · Cursor `/rcand` · jervcode `/rcand` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /rcand — promote development to release-candidate
 

package/skills/release/SKILL.md

@@ -3,7 +3,7 @@ name: release
 description: Ship rc or direct-track development to main and production.
 ---
 
-**Host-native invocation:** Claude `/mmi:release` · Codex `$mmi:release` · jervcode/Kimi `/skill:release` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:release` · Codex `$mmi:release` · Cursor `/release` · jervcode `/release` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 **Argument (#4929):** `/release minor`, `/release major`, or `/release patch` — a bare bump word, never a
 `--flag` or env var. Map it to `MMI_BUMP_INTENT` exported for the whole run (the train and
@@ -187,13 +187,25 @@ Treating doctor's exit code as the gate halts a healthy train on cosmetic drift
 operator to ignore doctor's exit code entirely.
 
 **`mmi-cli devops release --apply` and `mmi-cli devops rcand --apply` now run an active npm-major preflight
-before any branch/tag mutation (#5666).** They read the repo's expected CI npm, in this order (#5866):
-an explicit `npm-version:` on the gate's `runner-node-toolchain` step; else the infra gate's exact node pin
-through the bundled-npm map (only for an estate that still carries a retired pre-#5870 pin); else the
-publish workflow's own npm pin (`npm install -g npm@12`, the #5870 retirement shape). Local `npm -v`
+before any branch/tag mutation (#5666).** They read the repo's expected CI npm, in this order (#5866,
+#5893): an explicit `npm-version:` on the gate's `runner-node-toolchain` step; else an explicit
+`npm install -g npm@<major>` step in gate.yml; else the infra gate's exact node pin through the
+bundled-npm map (only for an estate that still carries a retired pre-#5870 pin); else the publish
+workflow's own npm pin (`npm install -g npm@12`, the #5870 retirement shape). Local `npm -v`
 must match that npm **major**; a
 mismatch refuses `--apply` before any repository write.
 
+**Both gate shapes are a declaration; only a gate that declares NEITHER falls through (#5893).** A lane
+that installs its own npm has stated its npm as plainly as an `npm-version:` input — the shape differs, the
+intent does not. Reading only `npm-version:` skipped Jerv-JervCode's gate (floating `node-version: 24`
+plus `npm install -g npm@12`), fell through to publish.yml's stale npm 11, and prescribed a downgrade the
+repo had already retired (#2845, MMI-Hub#5871); the publish smoke then failed under npm 11 (`Cannot find
+module jiti/package.json` — a packed global install materializes no dependency closure under npm 11 once
+the root declares `bundleDependencies`), shipping v1.57.7 to main with a Release but no npm publish.
+**When gate.yml and publish.yml disagree on the npm major, that is a repo defect** — one lane will run the
+wrong toolchain whichever the preflight believes. The preflight names it and proceeds; fix it with a PR
+moving both pins together, never by silently trusting publish.yml.
+
 **Check which side is wrong before repairing (#5862).** The receipt names one direction — move the machine
 to the pin — and that is only right when the pin is current. Compare it against the registry first:
 
@@ -225,7 +237,8 @@ bad lockfile (#4578).** Before touching the lockfile, compare toolchains:
 npm -v
 gh api repos/{owner}/{repo}/actions/runs --jq '.workflow_runs[0].id'   # or read the gate log's
 # `node -v && npm -v` toolchain-preflight line (#3446) for the npm major CI ran with
-# When gate.yml has no bundled npm pin, read the publish workflow npm pin instead (#5666).
+# Read the gate's OWN declared npm first — `npm-version:` or `npm install -g npm@X` (#5893);
+# only a gate that declares neither falls back to the publish workflow npm pin (#5666).
 ```
 A different npm MAJOR (e.g. local 12 vs. CI's 11) resolves the same lockfile differently and throws `Missing:
 <pkg> from lock file` on a lockfile that is not actually broken. Align the local npm major
@@ -238,8 +251,9 @@ BEFORE inspecting package contents (deleted dir, malformed `package.json`, missi
 ```bash
 npm -v
 # green gate npm from the gate log's `node -v && npm -v` toolchain-preflight line (#3446),
-# the gate's declared `npm-version:`, or an exact node pin that maps to a bundled npm,
-# or the publish workflow npm pin when gate.yml has no bundled npm (#5666)
+# the gate's declared `npm-version:` or its `npm install -g npm@X` step (#5893), or an exact
+# node pin that maps to a bundled npm, or the publish workflow npm pin when the gate declares
+# no npm of its own (#5666)
 ```
 When local npm differs from the green gate (e.g. local npm 11 vs CI's 12), align local npm
 (`npm install -g npm@<gate npm>`) and rerun the train — do not rewrite the publish surface for an
@@ -400,7 +414,7 @@ What the fold bumps, by repo:
   `scripts/check-hook-contract.mjs`, which executes host adapter commands as a native argv without a
   shell (#5605), so a checkout path that contains spaces is supported; the spaced-path argv regression
   is pinned in `infra/plugin-set.test.mjs`. Publication and staging both derive from `surfaces.json`;
-  there is no second package list. Claude, Codex, Kimi, Cursor, and Kilo are active.
+  there is no second package list. Claude, Codex, Cursor, jervcode, and Hermes are active.
 - **App-style repos with a root `package.json`** (most products): the manifest + lockfile version via
   `npm version --no-git-tag-version`, kept in lockstep with the release tag.
 - **Repos with neither:** nothing to fold — the tag is the version.
@@ -589,8 +603,7 @@ Before running `--apply` for MMI-Hub, resolve the real tag first:
 `v2.43.0`) in summaries, Slack, chat, and the final report; never a placeholder like `vX.Y.0` or
 `v0.x.0`.
 
-**Write the announcement per `docs/Guides/release-notes.md`** — the canonical org guide for every
-release type. It is the authoritative contract; follow it and its checklist before posting. Key rules:
+**Write the announcement from the actual release evidence** — summarize the user-visible change, required action, and recovery path before posting. Key rules:
 
 - **Audience is the whole org** — no issue/PR numbers, repo names, commit SHAs, or internal tool jargon.
 - **Scale length and depth by release type** (major > minor > patch > hotfix): a major is a broad,
@@ -650,6 +663,11 @@ mmi-cli oracle org project sync-info --apply   # omit --apply for the read-only
   release: the alignment PR's own `cli`/`infra`/`docs` checks are still running, so a plain immediate merge is
   policy-blocked — `--auto` merges once they pass. If you await with `--wait` instead, still pass `--merge`
   (`mmi-cli devops pr merge <number> --wait --merge`); `--wait` alone must not land the alignment PR. Never force.
+  A pre-#5903 CLI can true-merge this PR and still exit 1 with `mergeStatus: partial-cleanup` after GitHub
+  refuses to delete its protected `main` head. Classify that legacy receipt from the live PR: `MERGED` with
+  merge method `MERGE` means alignment succeeded and protected-main retention is expected. Never delete
+  `main`, retry the release, or call the alignment failed. Current CLIs report the same retention as
+  `remoteBranch.status: retained-protected` with `mergeStatus: merged`.
 - Full-track repos: `mmi-cli devops release --apply` already aligned `rc` to the released `main` (#1036 — the
   push runs inside the authority-gated train; the result reports it as `rcAlignment`). No manual `rc`
   push — if the result reports a failed alignment, investigate and rerun via the train, never bare-push.
@@ -659,11 +677,10 @@ mmi-cli oracle org project sync-info --apply   # omit --apply for the read-only
   (`checkout`, #2340) and fast-forwards the others (`localSync`) — non-destructively: only a true
   fast-forward moves a branch; a diverged local branch is reported and left untouched (never a force).
   The one branch it **cannot** sync at release time is a check-gated `development` whose roll-forward is a
-  `pr-pending` alignment PR (Hub) — that PR merges on origin *after* the release returns. That case is
-  healed automatically by the **next session**: `mmi-cli plugin session-start` (invoked by the resume
-  channel — #3630 took SessionStart off the hook surface) runs the
-  same fast-forward first thing, so a stale local `development`/`main`/`rc` self-heals to origin before you
-  work — no manual `git pull`. Nothing here ever blocks or fails the release.
+  `pr-pending` alignment PR (Hub) — that PR merges on origin *after* the release returns. Once that PR
+  lands, fast-forward the local branch yourself (`git pull --ff-only` on `development`) — #5908 retired
+  the session-start self-heal along with the rest of the hook-era plumbing. Nothing here ever blocks or
+  fails the release.
 - **Read the `checkout:` clause — it does not always say "returned" (#4006).** The report always prints
   one, and restoration is deliberately skipped rather than forced when the repo is not in a fit state.
   A release leaves the repo on `main` until the train moves it back, so a non-`returned` outcome means
@@ -740,6 +757,28 @@ Release-blocking for Hub tooling changes: every public artifact must match the r
 identity. Manual fallback if CI can't publish: `node scripts/release-distribution.mjs publish "X.Y.0"`
 from a machine with npm auth.
 
+**Windows WebAuthn/passkey exception (#5920).** Normal publishing remains non-interactive and token-based;
+headless and CI hosts keep using automation tokens. When any npm write requires a human desktop passkey on
+Windows, **never run it from the agent shell**. Write the package loop to a durable `.cmd` outside disposable
+worktrees (for example, `C:\Users\<you>\Documents\mmi-npm-write.cmd`):
+```bat
+@echo off
+set "failures=%~dpn0.failures.txt"
+del "%failures%" 2>nul
+for %%P in (@scope/package-a @scope/package-b) do (
+  call npm deprecate "%%P@*" "replacement message"
+  if errorlevel 1 >>"%failures%" echo %%P
+)
+if exist "%failures%" type "%failures%"
+```
+Launch it visibly and leave the window open, then let the human tap once for each npm invocation:
+```powershell
+Start-Process cmd -ArgumentList '/k', 'C:\Users\<you>\Documents\mmi-npm-write.cmd'
+```
+Ignore any EOTP browser URL npm prints; it does not complete this passkey flow. Treat the failure file as the
+per-package receipt and verify the corresponding registry state, for example
+`npm view <pkg> deprecated --prefer-online` after `npm deprecate`.
+
 **npm tarball identity is packer-sensitive (#5366 / #5251).** `verify` without `--skip-npm-view`
 compares the registry's served `dist.integrity` (SSRI) against a live `npm pack` on THIS machine
 (`packedIntegrityBySurface`). A tarball SSRI covers file modes and packer (npm version) behavior, so

package/skills/secrets/SKILL.md

@@ -3,7 +3,7 @@ name: secrets
 description: Manage the full own-project vault and granted org-infra secret names.
 ---
 
-**Host-native invocation:** Claude `/mmi:secrets` · Codex `$mmi:secrets` · jervcode/Kimi `/skill:secrets` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:secrets` · Codex `$mmi:secrets` · Cursor `/secrets` · jervcode `/secrets` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /secrets — two-tier project secrets
 

package/skills/stage/SKILL.md

@@ -3,7 +3,7 @@ name: stage
 description: Run a local test stage, or a personal cloud dev stage with --live.
 ---
 
-**Host-native invocation:** Claude `/mmi:stage` · Codex `$mmi:stage` · jervcode/Kimi `/skill:stage` · Kilo `skill` tool. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:stage` · Codex `$mmi:stage` · Cursor `/stage` · jervcode `/stage` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /stage — local test environment
 

package/bin/mmi-hook

@@ -1,2 +0,0 @@
-#!/bin/sh
-exec node "$@"

package/bin/mmi-hook-console.cmd

@@ -1,16 +0,0 @@
-:; exec node "$@" # sh half: cmd sees a label, POSIX shells exec node exactly like bin/mmi-hook
-:: <#
-@echo off
-rem sh/cmd/PowerShell polyglot console launcher (#4878/#5591), stored CRLF: cmd mis-parses LF-only batch files.
-rem The trailing # on line 1 keeps the CR out of the sh exec. Line 2 opens a PowerShell block comment so
-rem `powershell -File` can parse this trampoline. Line 2 is a LABEL, not `rem`: echo is still on until
-rem line 3, so `rem <#` was echoed as `<cwd>>rem <# ` onto every hook stdout ahead of the payload, and
-rem cmd never echoes a label (#5828). The space in `:: <#` is load-bearing: `::<#` stops PowerShell parsing.
-rem PowerShell never waits on the GUI-subsystem mmi-hook.exe, so the batch half enters that same windowless
-rem exe through cmd (which PowerShell does wait on). Referenced WITH the .cmd extension: an extensionless
-rem sibling would win PowerShell path resolution and run as neither.
-"%~dp0mmi-hook.exe" %*
-exit /b %errorlevel%
-#>
-& (Join-Path $PSScriptRoot 'mmi-hook.exe') @args
-exit $LASTEXITCODE

package/hooks/cursor-hooks.json

@@ -1,26 +0,0 @@
-{
-  "version": 1,
-  "hooks": {
-    "preToolUse": [
-      {
-        "command": "'${CURSOR_PLUGIN_ROOT}/bin/mmi-hook-console.cmd' '${CURSOR_PLUGIN_ROOT}/scripts/hook-run.mjs' --surface cursor --gate command-ladder",
-        "matcher": "Shell",
-        "timeout": 10,
-        "failClosed": true
-      },
-      {
-        "command": "'${CURSOR_PLUGIN_ROOT}/bin/mmi-hook-console.cmd' '${CURSOR_PLUGIN_ROOT}/scripts/hook-run.mjs' --surface cursor --gate vault-edit",
-        "matcher": "Write",
-        "timeout": 5,
-        "failClosed": true
-      },
-      {
-        "command": "'${CURSOR_PLUGIN_ROOT}/bin/mmi-hook-console.cmd' '${CURSOR_PLUGIN_ROOT}/scripts/hook-run.mjs' --surface cursor --gate vault-edit",
-        "matcher": "StrReplace",
-        "timeout": 5,
-        "failClosed": true
-      }
-    ],
-    "postToolUse": []
-  }
-}