@workit-dev/cursor 0.0.1 → 1.0.0

package/.cursor-plugin/plugin.json

@@ -0,0 +1,38 @@
+{
+  "name": "workit",
+  "displayName": "Workit",
+  "description": "Adaptive Workit workflow with shared MCP tools and native Cursor hooks",
+  "version": "1.0.0",
+  "author": {
+    "name": "Cristhofer Pincetti"
+  },
+  "publisher": "BrainerVirus",
+  "homepage": "https://github.com/BrainerVirus/workit",
+  "repository": "https://github.com/BrainerVirus/workit",
+  "license": "MIT",
+  "logo": "assets/logo.svg",
+  "keywords": [
+    "agent",
+    "cursor",
+    "mcp",
+    "workflow",
+    "workit"
+  ],
+  "category": "Developer Tools",
+  "tags": [
+    "workflow",
+    "agent",
+    "mcp",
+    "pr",
+    "changelog",
+    "commit",
+    "handoff"
+  ],
+  "skills": "skills/",
+  "commands": "commands/",
+  "rules": [
+    "rules/workit-contract.mdc"
+  ],
+  "mcpServers": "mcp.json",
+  "hooks": "hooks/hooks-cursor.json"
+}

package/README.md

@@ -1,45 +1,58 @@
 # @workit-dev/cursor
 
-## ⚠️ IMPORTANT NOTICE ⚠️
-
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
-
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
-
-## Purpose
-
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@workit-dev/cursor`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
-
-## What is OIDC Trusted Publishing?
-
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
-
-## Setup Instructions
-
-To properly configure OIDC trusted publishing for this package:
-
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**
+[![CI](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml/badge.svg)](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/@workit-dev/cursor.svg)](https://www.npmjs.com/package/@workit-dev/cursor)
+[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/BrainerVirus/workit/blob/main/LICENSE)
+
+[Workit](https://github.com/BrainerVirus/workit) for Cursor: the shared MCP server, one native hook
+dispatcher, the `workit-contract` rule, the thirteen method skills and `/wk-*`
+commands. Requires Node.js 24+ and network access on first run.
+
+## Install
+
+```bash
+npx @workit-dev/cli init   # select Cursor
+```
+
+The wizard copies the plugin into `~/.cursor/plugins/local/workit` (a real
+directory) and registers the MCP server and hooks. Manual MCP config and host
+limits: [hosts guide](https://github.com/BrainerVirus/workit/blob/main/docs/guides/hosts.md#cursor).
+Update with `workit upgrade` (it reinstalls missing plugin files); uninstall with `workit uninstall`.
+
+## Runtime
+
+The MCP server runs through
+`npx -y --prefer-online --min-release-age=0 --package=@workit-dev/cursor@latest …`,
+so manifests carry no repository-relative `dist` paths (the age override works
+around npm/cli#9765). MCP is read-only for unattested callers; mutations run
+through the `workit` CLI.
+
+Hooks run through `node "${CURSOR_PLUGIN_ROOT}/hooks/launch.mjs" <bin>`, which
+picks the plugin's bundled `dist/` hook, else a global `workit-cursor-hook` on
+`PATH`, else `npx -y --prefer-offline` pinned to the plugin's own version. It
+never resolves `@latest` at hook time. Hooks are registered with
+`failClosed: false` and the launcher fails open: offline, a crash or a timeout
+lets the action through with a `[workit] Cursor hook unavailable` line on
+stderr, while the hook's own denials (exit 2) still block. A window with no
+folder open, or a payload without a conversation id, is allowed with a note.
+A local install (`workit init`, `install-cursor-plugin.sh`) writes the
+launcher's absolute path into every event, so only a Marketplace install
+relies on Cursor expanding `${CURSOR_PLUGIN_ROOT}`. On Windows the npx and
+global-bin fallbacks run their `.cmd` shims through `cmd.exe`.
+`workit doctor` reports the launcher mode (`local` with the runtime's version,
+`npx-pinned`, `missing` or `stale`) and the latency of one no-op hook. It
+also warns when Cursor started the Workit MCP server but no hook has run
+since: the launcher stamps `cursor-hook-last-run` and the MCP server stamps
+`cursor-session-last-start` in Workit's state directory.
+The `preToolUse` hook applies the [before-write gate](https://github.com/BrainerVirus/workit/blob/main/docs/guides/verification.md)
+to write tools while the branch task has an open product choice or needs a
+plan.
+
+## Marketplace
+
+The repository root carries `.cursor-plugin/marketplace.json` indexing this
+package. Cursor installs Marketplace plugins from git without building, so
+`skills/`, `commands/`, `rules/` and assets are committed; regenerate skills
+with `bun packages/workit-cursor/scripts/build.ts --skills-only`.
+`bun run validate:cursor-marketplace` checks the artifact against the pinned
+Cursor schemas. The plugin is submission-ready but not published there.

package/assets/logo.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#111827"/>
+  <path d="M18 33l10 10 18-20" fill="none" stroke="#34d399" stroke-width="6" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/assets/templates/workit-contract.md

@@ -0,0 +1,13 @@
+# Workit contract
+
+Workit keeps one accountable lead and one shared task state. Inspect current
+task state before acting; use only the shared operations for task, policy,
+evidence, finding, decision, worker, and state changes. Authority is
+bounded by the requested scope, current revision, caller/session provenance, and
+observed capabilities; delivery is bounded by the workspace autonomy grants
+(`workit grant show`). Never claim host enforcement or evidence that the host
+cannot provide. Preserve unresolved requirements, gaps, and uncertain workers.
+
+Focused methods are loaded only when the resolved policy requires them. A method
+must call the shared operations and must not create a second lifecycle, approval
+chain, or task-state representation.

package/commands/wk-architecture.md

@@ -0,0 +1,5 @@
+# /wk-architecture
+
+Load and apply the bundled `workit-architecture` skill. Rank cited deepening refactors from churn and ledger friction; never applied unapproved. Use for architecture.
+
+Extra context: $ARGUMENTS

package/commands/wk-bdd.md

@@ -0,0 +1,5 @@
+# /wk-bdd
+
+Load and apply the bundled `workit-bdd` skill. Turn requirements into Given/When/Then scenarios, agree the test seam, and work test-first in vertical RED/GREEN slices. Use for BDD, TDD, acceptance criteria, scenarios, Given/When/Then, write a test first.
+
+Extra context: $ARGUMENTS

package/commands/wk-continue.md

@@ -0,0 +1,5 @@
+# /wk-continue
+
+Load and apply the bundled `workit-continue` skill. Keep work on track across interruptions and sessions - sort new input, checkpoint, hand off with a resume brief, and pick up by verifying inherited claims. Use for resume, pick up, handoff, new session, interruption, change of direction.
+
+Extra context: $ARGUMENTS

package/commands/wk-debug.md

@@ -0,0 +1,5 @@
+# /wk-debug
+
+Load and apply the bundled `workit-debug` skill. Find a root cause before patching - start from a red-capable deterministic repro, rank hypotheses, bisect regressions, fix at the root with a regression test. Use for bug, broken, failing, flaky, regression, error, why does.
+
+Extra context: $ARGUMENTS

package/commands/wk-deslop.md

@@ -0,0 +1,5 @@
+# /wk-deslop
+
+Load and apply the bundled `workit-deslop` skill. Remove AI slop before a PR - dead code, comments that restate the code, filler prose - with a minimal diff and identical behavior. Use for deslop, clean up, slop, tidy before PR, remove dead code, trim the PR body.
+
+Extra context: $ARGUMENTS

package/commands/wk-fanout.md

@@ -0,0 +1,5 @@
+# /wk-fanout
+
+Load and apply the bundled `workit-fanout` skill. Run independent slices in parallel - one worker per isolated worktree with a fixed brief and file-scope manifest, a non-author verifier per slice, results in the ledger. Use for fan out, parallelize, parallel agents, split the work, delegate, swarm.
+
+Extra context: $ARGUMENTS

package/commands/wk-implement.md

@@ -0,0 +1,5 @@
+# /wk-implement
+
+Load and apply the bundled `workit-implement` skill. Build a requested change in small verified steps - follow local patterns, run real checks with workit check, prove it on the running app, hand verification to a non-author. Use for implement, build, add a feature, make the change, code it.
+
+Extra context: $ARGUMENTS

package/commands/wk-retro.md

@@ -0,0 +1,5 @@
+# /wk-retro
+
+Load and apply the bundled `workit-retro` skill. Find repeated friction in recent sessions; propose cited fixes ranked by enforcer strength, never applied. Use for retro.
+
+Extra context: $ARGUMENTS

package/commands/wk-review.md

@@ -0,0 +1,5 @@
+# /wk-review
+
+Load and apply the bundled `workit-review` skill. Independent review of a diff, branch or PR - intent fidelity and standards as separate axes, test quality, blast radius - recorded as a non-author verdict. Use for review, code review, check this PR or MR, is this safe, blast radius.
+
+Extra context: $ARGUMENTS

package/commands/wk-shape.md

@@ -0,0 +1,5 @@
+# /wk-shape
+
+Load and apply the bundled `workit-shape` skill. Shape work before building - brainstorm, grill open choices with a recommended answer, challenge weak premises, slice into PRs, propose a spec/ADR only when it pays. Use for brainstorm, plan, spec, design, options, should we, grill me.
+
+Extra context: $ARGUMENTS

package/commands/wk-ship.md

@@ -0,0 +1,5 @@
+# /wk-ship
+
+Load and apply the bundled `workit-ship` skill. Drive pushed work to its endpoint - open or stack PRs, fix red CI, answer PR threads, land verified PRs when granted. Use for ship, open a PR, babysit, CI failing, checks red, address comments, stack, merge, land.
+
+Extra context: $ARGUMENTS

package/commands/wk-test-audit.md

@@ -0,0 +1,5 @@
+# /wk-test-audit
+
+Load and apply the bundled `workit-test-audit` skill. Find tautological, low-value or noisy tests and replace them with ones that catch real breaks. Use before trusting a green suite, for agent-written tests, test audit, tautology, weak tests, prune or strengthen tests.
+
+Extra context: $ARGUMENTS

package/commands/wk-verify-app.md

@@ -0,0 +1,5 @@
+# /wk-verify-app
+
+Load and apply the bundled `workit-verify-app` skill. Generate or maintain the project's own verify-<app> skill that launches, drives and observes the real app (CLI, web, API) so agents prove features work. Use for verify the app, run it, smoke test, prove it works, set up verification.
+
+Extra context: $ARGUMENTS