@workit-dev/core 0.0.1 → 1.0.0

package/schemas/youtrack.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://unpkg.com/@workit-dev/core/schemas/youtrack.json",
+  "title": "Workit YouTrack settings (youtrack.json in the Workit config dir)",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON Schema this file follows; Workit writes it and keeps your value."
+    },
+    "baseUrl": {
+      "description": "The YouTrack URL (required to use YouTrack).",
+      "type": "string"
+    },
+    "tokenFile": {
+      "description": "Obsolete: Workit reaches YouTrack only through ytrack and ignores this key.",
+      "type": "string"
+    },
+    "locale": {
+      "description": "The language of issue updates.",
+      "type": "string"
+    },
+    "timezone": {
+      "description": "The IANA timezone that decides a work item's day; default the process timezone.",
+      "type": "string"
+    },
+    "meetingIssue": {
+      "description": "The issue meeting time is logged on.",
+      "type": "string"
+    },
+    "meetingIssues": {
+      "description": "Named meetings, each with its issue, label, work item text and URL.",
+      "type": "object",
+      "propertyNames": {
+        "type": "string"
+      },
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "issue": {
+            "type": "string"
+          },
+          "label": {
+            "type": "string"
+          },
+          "workItemText": {
+            "type": "string"
+          },
+          "url": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": {}
+      }
+    },
+    "meetingWorkItemText": {
+      "description": "The work item text for meeting time (default Meetings).",
+      "type": "string"
+    },
+    "tokenDefaults": {
+      "description": "Obsolete: Workit no longer creates YouTrack tokens and ignores this key.",
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        },
+        "scopes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "profileTab": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": {}
+    }
+  },
+  "additionalProperties": {}
+}

package/scripts/analyze-release-scope.ts

@@ -0,0 +1,215 @@
+#!/usr/bin/env bun
+// AR-16: path-gated releases. A releasable commit counts only when it touches
+// a PRODUCT PATH (any of the four package dirs). Tooling-only merges produce no
+// release at all. A payload change typed docs/chore still publishes as patch —
+// skills and metadata live in the tarball, so installed users must receive
+// them; merge-backs and the release's own manifest sync never do.
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import BUNDLED_DEPS_JSON from "./bundled-deps.json" with { type: "json" };
+
+export const RELEASE_PACKAGES = [
+  "workit-core",
+  "workit-mcp",
+  "workit-cli",
+  "workit-opencode",
+  "workit-cursor",
+  "workit-codex",
+  "workit-pi",
+  "workit-claude-code",
+] as const;
+
+type ReleasePackage = (typeof RELEASE_PACKAGES)[number];
+
+/**
+ * Sources a package's published dist/ inlines from OUTSIDE its own directory.
+ * Every adapter build is a no-external `bun build`, so whatever it imports
+ * from another workspace package is copied into its bundle: a runtime
+ * dependency on that package does not reach the shipped code. A change in
+ * these sources must therefore republish the bundling package too. Verified
+ * against the build entries' metafiles by
+ * test/workit-core/bundled-sources.test.ts.
+ */
+const CORE = "packages/workit-core/"; // sources, skills, templates and package.json
+// Cursor and Codex inline the MCP transport and its declared dependencies.
+const MCP = ["packages/workit-mcp/src/", "packages/workit-mcp/package.json"];
+// The bundled CLI inlines its sources, package.json (`workit --version`) and
+// its third-party dependencies.
+const CLI = ["packages/workit-cli/src/", "packages/workit-cli/package.json"];
+export const BUNDLED_SOURCES: Partial<Record<ReleasePackage, readonly string[]>> = {
+  "workit-mcp": [CORE],
+  "workit-cli": [CORE],
+  "workit-opencode": [CORE],
+  "workit-cursor": [CORE, ...MCP],
+  "workit-codex": [CORE, ...MCP],
+  "workit-pi": [CORE],
+  "workit-claude-code": [CORE, ...CLI],
+};
+
+/**
+ * Third-party packages each dist/ inlines, as bun.lock `packages` keys
+ * (`zod`, or `@opencode-ai/plugin/zod` for a nested copy). A lockfile change
+ * republishes a package only when one of these resolves to a different
+ * version, so dev-tooling bumps never release. Kept in sync with the bundle
+ * metafiles by test/workit-core/bundled-sources.test.ts.
+ */
+export const BUNDLED_DEPS = BUNDLED_DEPS_JSON as Partial<Record<ReleasePackage, string[]>>;
+
+const LOCKFILE = "bun.lock";
+
+/** `packages` key → resolved `name@version` from a bun.lock text (JSONC). */
+export const lockResolutions = (text: string): Map<string, string> => {
+  // bun.lock is JSON with trailing commas.
+  const parsed = JSON.parse(text.replace(/,(\s*[}\]])/g, "$1")) as {
+    packages?: Record<string, unknown>;
+  };
+  const resolved = new Map<string, string>();
+  for (const [key, entry] of Object.entries(parsed.packages ?? {}))
+    if (Array.isArray(entry) && typeof entry[0] === "string") resolved.set(key, entry[0]);
+  return resolved;
+};
+
+const lockAt = (root: string, rev: string): Map<string, string> | null => {
+  try {
+    return lockResolutions(
+      execFileSync("git", ["show", `${rev}:${LOCKFILE}`], {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        maxBuffer: 64 * 1024 * 1024,
+      }),
+    );
+  } catch {
+    return null;
+  }
+};
+
+/** Packages whose inlined third-party resolutions differ between two revisions. */
+export const lockChangedPackages = (root: string, from: string, to: string): ReleasePackage[] => {
+  const before = lockAt(root, from);
+  const after = lockAt(root, to);
+  if (before === null && after === null) return [];
+  return RELEASE_PACKAGES.filter((pkg) =>
+    (BUNDLED_DEPS[pkg] ?? []).some((key) => before?.get(key) !== after?.get(key)),
+  );
+};
+
+/** Every repository path whose change alters `pkg`'s published payload. */
+export const payloadPaths = (pkg: ReleasePackage): string[] => [
+  `packages/${pkg}/`,
+  ...(BUNDLED_SOURCES[pkg] ?? []),
+];
+
+/** The release pipeline's own version-sync commit: never a release trigger. */
+const RELEASE_SYNC = /^chore\(release\): sync manifests\b/;
+
+const g = (root: string, args: string[]): string =>
+  execFileSync("git", args, { cwd: root, encoding: "utf8" }).trim();
+
+/** The npm scope every release package publishes under. */
+export const NPM_SCOPE = "@workit-dev";
+
+/** The npm name of a release package directory: `workit-cli` -> `@workit-dev/cli`. */
+export const npmName = (pkg: string): string => `${NPM_SCOPE}/${pkg.replace(/^workit-/, "")}`;
+
+/**
+ * Release tags are `workit-dev-v<semver>` (release.config.cjs tagFormat). The
+ * `v<semver>` tags before them belong to the pre-1.0.0 packages (14.x and
+ * earlier) and never seed a @workit-dev release.
+ */
+export const TAG_PREFIX = "workit-dev-v";
+export const TAG_GLOB = `${TAG_PREFIX}*`;
+export const RELEASE_TAG = /^workit-dev-v(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
+
+/** The newest release tag by version order, or null before the first release. */
+export function latestTag(root = process.cwd()): string | null {
+  const tag = g(root, ["tag", "--list", TAG_GLOB, "--sort=-v:refname"])
+    .split("\n")
+    .map((l) => l.trim())
+    .find((l) => RELEASE_TAG.test(l));
+  return tag ?? null;
+}
+
+type Level = "major" | "minor" | "patch";
+const LEVEL_RANK: Record<Level, number> = { patch: 1, minor: 2, major: 3 };
+const TYPE_LEVEL: Record<string, Level> = { fix: "patch", perf: "patch", feat: "minor" };
+
+const subjectLevel = (commit: string): Level | null => {
+  const firstLine = commit.split("\n")[0] ?? "";
+  const m = /^([a-z][a-z0-9-]*)(?:\([^)]*\))?(!)?:/.exec(firstLine);
+  if (!m) return null;
+  if (m[2]) return "major";
+  const body = commit.split("\n").slice(1).join("\n");
+  if (/BREAKING[- ]CHANGE:/.test(body)) return "major";
+  return TYPE_LEVEL[m[1]] ?? null;
+};
+
+// Two-pass collection (sanctioned by the task brief): the single-pass
+// `%H<NUL>%s%n%b` + `--name-only` interleave is brittle because execFileSync
+// rejects NUL bytes inside arguments. Bounded by commit count; acceptable for
+// this repo's cadence.
+//
+// diff-tree with -m unions files across a merge's parents (a plain `show`
+// combined diff drops files identical to either parent — e.g. hotfix-branch
+// back-merges), and -z returns raw NUL-delimited paths so spaces/non-ASCII
+// are never C-quoted. NUL is fine in captured output, never in argv.
+const commitsSince = (
+  root: string,
+  from: string,
+): { hash: string; message: string; files: string[] }[] => {
+  const hashes = g(root, ["log", "--reverse", "--format=%H", `${from}..HEAD`])
+    .split("\n")
+    .filter(Boolean);
+  return hashes.map((h) => ({
+    hash: h,
+    message: g(root, ["show", "-s", "--format=%B", h]),
+    files: g(root, ["diff-tree", "--no-commit-id", "--name-only", "-r", "-m", "--root", "-z", h])
+      .split("\0")
+      .filter(Boolean),
+  }));
+};
+
+export function analyzeReleaseScope(root = process.cwd()): {
+  level: Level | null;
+  productPkgs: string[];
+} {
+  const from = latestTag(root);
+  if (from === null) {
+    return { level: "minor", productPkgs: [...RELEASE_PACKAGES] };
+  }
+  const commits = commitsSince(root, from);
+  const levels: Level[] = [];
+  const pkgs = new Set<string>();
+  let payloadOnly = false;
+  for (const { hash, message, files } of commits) {
+    const subject = (message.split("\n")[0] ?? "").trim();
+    if (RELEASE_SYNC.test(subject)) continue;
+    const touched = files.filter((f) =>
+      RELEASE_PACKAGES.some((p) => payloadPaths(p).some((prefix) => f.startsWith(prefix))),
+    );
+    // A lockfile edit counts only for packages whose inlined deps moved.
+    const relocked = files.includes(LOCKFILE) ? lockChangedPackages(root, `${hash}^`, hash) : [];
+    if (touched.length === 0 && relocked.length === 0) continue;
+    const lvl = subjectLevel(message);
+    if (lvl) levels.push(lvl);
+    else if (!subject.startsWith("Merge ")) payloadOnly = true;
+    for (const pkg of RELEASE_PACKAGES)
+      if (
+        relocked.includes(pkg) ||
+        touched.some((f) => payloadPaths(pkg).some((prefix) => f.startsWith(prefix)))
+      )
+        pkgs.add(pkg);
+  }
+  if (levels.length === 0) return { level: payloadOnly ? "patch" : null, productPkgs: [...pkgs] };
+  const level = levels.reduce<Level>(
+    (best, l) => (LEVEL_RANK[l] > LEVEL_RANK[best] ? l : best),
+    "patch",
+  );
+  return { level, productPkgs: [...pkgs] };
+}
+
+if (import.meta.main) {
+  const root = process.argv[2] ? resolve(process.argv[2]) : process.cwd();
+  const { level } = analyzeReleaseScope(root);
+  if (level) process.stdout.write(`${level}\n`);
+}

package/scripts/bundled-deps.json

@@ -0,0 +1,131 @@
+{
+  "workit-mcp": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-cli": [
+    "@alcalzone/ansi-tokenize",
+    "@babel/parser",
+    "@inkjs/ui",
+    "@inkjs/ui/chalk",
+    "@openclaw/fs-safe",
+    "ansi-escapes",
+    "ansi-regex",
+    "ansi-styles",
+    "auto-bind",
+    "cli-boxes",
+    "cli-cursor",
+    "cli-truncate",
+    "code-excerpt",
+    "convert-to-spaces",
+    "deepmerge",
+    "environment",
+    "es-toolkit",
+    "escape-string-regexp",
+    "figures",
+    "get-east-asian-width",
+    "indent-string",
+    "ink",
+    "ink/chalk",
+    "is-fullwidth-code-point",
+    "is-in-ci",
+    "is-unicode-supported",
+    "patch-console",
+    "react",
+    "react-devtools-core",
+    "react-reconciler",
+    "restore-cursor",
+    "restore-cursor/onetime",
+    "restore-cursor/onetime/mimic-fn",
+    "scheduler",
+    "signal-exit",
+    "slice-ansi",
+    "stack-utils",
+    "string-width",
+    "strip-ansi",
+    "terminal-size",
+    "widest-line",
+    "wrap-ansi",
+    "ws",
+    "yoga-layout",
+    "zod"
+  ],
+  "workit-opencode": ["@openclaw/fs-safe", "@opencode/plugin", "zod"],
+  "workit-cursor": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-codex": [
+    "@modelcontextprotocol/sdk",
+    "@openclaw/fs-safe",
+    "ajv",
+    "ajv-formats",
+    "fast-deep-equal",
+    "fast-uri",
+    "json-schema-traverse",
+    "zod",
+    "zod-to-json-schema"
+  ],
+  "workit-pi": ["@openclaw/fs-safe", "zod"],
+  "workit-claude-code": [
+    "@alcalzone/ansi-tokenize",
+    "@babel/parser",
+    "@inkjs/ui",
+    "@inkjs/ui/chalk",
+    "@openclaw/fs-safe",
+    "ansi-escapes",
+    "ansi-regex",
+    "ansi-styles",
+    "auto-bind",
+    "cli-boxes",
+    "cli-cursor",
+    "cli-truncate",
+    "code-excerpt",
+    "convert-to-spaces",
+    "deepmerge",
+    "environment",
+    "es-toolkit",
+    "escape-string-regexp",
+    "figures",
+    "get-east-asian-width",
+    "indent-string",
+    "ink",
+    "ink/chalk",
+    "is-fullwidth-code-point",
+    "is-in-ci",
+    "is-unicode-supported",
+    "patch-console",
+    "react",
+    "react-devtools-core",
+    "react-reconciler",
+    "restore-cursor",
+    "restore-cursor/onetime",
+    "restore-cursor/onetime/mimic-fn",
+    "scheduler",
+    "signal-exit",
+    "slice-ansi",
+    "stack-utils",
+    "string-width",
+    "strip-ansi",
+    "terminal-size",
+    "widest-line",
+    "wrap-ansi",
+    "ws",
+    "yoga-layout",
+    "zod"
+  ]
+}

package/scripts/fixtures/sample-plan.md

@@ -0,0 +1,15 @@
+# Sample Plan
+
+## File Map
+
+Not a task.
+
+### Task 1: First task
+
+- [ ] Step 1: Do alpha
+- [ ] Step 2: Do beta
+- [ ] Step 3: Do gamma
+
+### Task 2: Second task
+
+- [ ] Step 1: Finish

package/scripts/fixtures/sample-sdd/progress.md

@@ -0,0 +1,2 @@
+Task 1: complete (commits abc1234..def5678, review clean)
+Task 2: complete (commits def5678..111aaaa, review skipped — trivial doc)

package/scripts/install-codex-plugin.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Install / refresh the Codex workit plugin from the local checkout or share clone.
+set -euo pipefail
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/../../.." && pwd)"
+. "$SCRIPT_DIR/lib/config-dir.sh"
+SHARE="$(workit_data_dir)"
+DEV="${WORKIT_DEV:-$ROOT}"
+PLUGIN_DIR="${HOME}/.codex/plugins/workit"
+
+chmod +x "$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+WORKIT_DEV="$ROOT" "$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+
+SOURCE="$DEV"
+if [ ! -d "$SOURCE/packages/workit-codex/.codex-plugin" ] && [ -d "$SHARE/packages/workit-codex/.codex-plugin" ]; then
+  SOURCE="$SHARE"
+fi
+
+mkdir -p "$PLUGIN_DIR"
+rsync -a --delete "$SOURCE/packages/workit-codex/" "$PLUGIN_DIR/"
+
+if ! bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" cli; then
+  echo "FATAL: post-install doctor found problems after Codex plugin sync" >&2
+  exit 1
+fi
+
+echo "Codex plugin installed at $PLUGIN_DIR"

package/scripts/install-cursor-plugin.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# Install / refresh Cursor plugin (+ OpenCode live loader via sync-runtime).
+set -euo pipefail
+
+REPO_SLUG="${WORKIT_REPO:-BrainerVirus/workit}"
+# core/workit-paths.mjs DATA_DIR_SH, verbatim (a test holds it): this script
+# also runs piped (curl | bash) without scripts/lib/.
+workit_data_dir() {
+  case "${XDG_DATA_HOME:-}" in /*) printf '%s\n' "$XDG_DATA_HOME/workit"; return ;; esac
+  case "$(uname -s 2>/dev/null)" in
+    MINGW*|MSYS*|CYGWIN*) printf '%s\n' "${LOCALAPPDATA:-$HOME/AppData/Local}/workit" ;;
+    *) printf '%s\n' "$HOME/.local/share/workit" ;;
+  esac
+}
+SHARE="$(workit_data_dir)"
+SKILLS_DIR="${HOME}/.cursor/skills"
+
+FROM_GITHUB=0
+LOCAL_DIST=0
+LOCAL_ROOT=""
+if [ -n "${BASH_SOURCE[0]:-}" ] && [ -f "${BASH_SOURCE[0]}" ]; then
+  SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  # RR-05: LOCAL_ROOT is the checkout root (scripts live under <root>/packages/workit-core/scripts)
+  LOCAL_ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/../../.." && pwd)"
+else
+  FROM_GITHUB=1
+fi
+
+for arg in "$@"; do
+  case "$arg" in
+    --github|--from-github) FROM_GITHUB=1 ;;
+    --local-dist) LOCAL_DIST=1 ;;
+  esac
+done
+
+if [ "$FROM_GITHUB" -eq 0 ] && [ ! -d "${LOCAL_ROOT}/packages/workit-cursor/.cursor-plugin" ]; then
+  FROM_GITHUB=1
+fi
+
+if [ "$FROM_GITHUB" -eq 1 ]; then
+  mkdir -p "$(dirname "$SHARE")"
+  if [ -d "$SHARE/.git" ]; then
+    git -C "$SHARE" fetch --tags --force origin
+    git -C "$SHARE" checkout main
+    git -C "$SHARE" pull --ff-only origin main
+  else
+    # Clone beside it and sync, so the owned CLI install (versions/, current, bin/) survives
+    TMP=$(mktemp -d)
+    git clone --depth 1 "https://github.com/${REPO_SLUG}.git" "$TMP"
+    mkdir -p "$SHARE"
+    rsync -a --delete --exclude '/versions' --exclude '/current' --exclude '/bin' "$TMP/" "$SHARE/"
+    rm -rf "$TMP"
+  fi
+  ROOT="$SHARE"
+else
+  ROOT="$LOCAL_ROOT"
+fi
+
+# CA-02: self-heal pre-check. The doctor's stale_install check runs against the
+# INSTALLED plugin dir (version/selectors vs the current runtime). Exit 2 means
+# stale: the refresh below syncs the plugin dir from ROOT and the registration
+# pass rewrites the workit MCP/hook entries to the canonical current selector.
+# The check reads only workit-owned files, so a healthy install is byte-untouched;
+# a registry-unreachable comparison reports registry_unreachable, never stale
+# (CA-04) — no false stale_install and no install failure.
+if bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" cursor --stale; then
+  :
+elif [ $? -eq 2 ]; then
+  echo "workit: stale Cursor plugin install detected — self-healing (refresh + canonical re-registration)" >&2
+else
+  echo "FATAL: pre-install doctor probe failed" >&2
+  exit 1
+fi
+
+chmod +x "$ROOT/packages/workit-core/scripts/sync-runtime.sh" "$ROOT/packages/workit-core/scripts/"*.sh
+# Prefer syncing from this ROOT (dev or freshly cloned share)
+export WORKIT_DEV="$ROOT"
+"$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+
+# Drop stale CLI skill symlinks (duplicate /wf-* and /wk-* entries)
+if [ -d "$SKILLS_DIR" ]; then
+  rm -f "$SKILLS_DIR"/wf-* "$SKILLS_DIR"/wk-*
+fi
+
+PLUGIN_DIR="$HOME/.cursor/plugins/local/workit"
+REGISTRATION_TS="$ROOT/packages/workit-cli/src/admin/registration.ts"
+CURSOR_SETTINGS="$HOME/.cursor/settings.json" CURSOR_MCP="$HOME/.cursor/mcp.json" PLUGIN_DIR="$PLUGIN_DIR" REGISTRATION_TS="$REGISTRATION_TS" LOCAL_DIST="$LOCAL_DIST" bun -e '
+import fs from "node:fs";
+import path from "node:path";
+const {
+  mergeCursorSettings,
+  mergeCursorMcp,
+  mergeCursorHooks,
+  cursorMcpServerEntry,
+  cursorHooksEntry,
+  cursorMcpLocalDistEntry,
+  cursorHookLocalDistEntry,
+} = await import(process.env.REGISTRATION_TS!);
+
+// RR-06: collapse current + legacy identities; never replace unrelated settings.
+const settingsPath = process.env.CURSOR_SETTINGS!;
+const settings = fs.existsSync(settingsPath)
+  ? JSON.parse(fs.readFileSync(settingsPath, "utf8"))
+  : {};
+const merged = mergeCursorSettings(settings, process.env.PLUGIN_DIR!);
+fs.writeFileSync(settingsPath, JSON.stringify(merged.config, null, 2) + "\n");
+
+// RR-06/CA-17: one portable workit MCP registration. Default is the published
+// npx pin (Marketplace-safe); --local-dist runs the installed plugin'"'"'s own
+// built dist through node so a checkout install carries the current code.
+const pluginDir = process.env.PLUGIN_DIR!;
+const localDist = process.env.LOCAL_DIST === "1";
+const server = localDist
+  ? cursorMcpLocalDistEntry(pluginDir)
+  : cursorMcpServerEntry(pluginDir);
+const mcpPath = process.env.CURSOR_MCP!;
+const mcp = fs.existsSync(mcpPath)
+  ? JSON.parse(fs.readFileSync(mcpPath, "utf8"))
+  : { mcpServers: {} };
+const mergedMcp = mergeCursorMcp(mcp, "workit", server);
+fs.writeFileSync(mcpPath, JSON.stringify(mergedMcp.config, null, 2) + "\n");
+
+// The shipped hooks-cursor.json reaches the launcher through
+// ${CURSOR_PLUGIN_ROOT}, which only a Marketplace install needs. A local
+// install writes the absolute launcher path into every event so hooks do not
+// depend on Cursor expanding it; --local-dist also points sessionStart at the
+// installed dist.
+const hooksPath = path.join(pluginDir, "hooks", "hooks-cursor.json");
+const hooks = fs.existsSync(hooksPath)
+  ? JSON.parse(fs.readFileSync(hooksPath, "utf8"))
+  : { version: 1, hooks: {} };
+const sessionStart = localDist ? cursorHookLocalDistEntry(pluginDir) : cursorHooksEntry(pluginDir);
+const mergedHooks = mergeCursorHooks(hooks, { command: sessionStart.command }, pluginDir);
+if (mergedHooks.changed.length > 0)
+  fs.writeFileSync(hooksPath, JSON.stringify(mergedHooks.config, null, 2) + "\n");
+'
+
+# DG-09: verify the just-written Cursor registration with the shared offline doctor.
+if ! bun "$ROOT/packages/workit-cli/scripts/doctor-check.ts" cursor; then
+  echo "FATAL: post-install doctor found an unhealthy Cursor registration" >&2
+  exit 1
+fi
+
+echo "Cursor plugin installed + auto-sync enabled (sessionStart)."
+echo "Share: $SHARE"
+ls "$HOME/.cursor/plugins/local/workit/skills" | grep '^wk-' || true