fix(installer): keep the shared harness on latest (0.1.8)

.cursor-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Professional Cursor plugins with APEX workflow, SOLID principles, and expert development agents for Next.js, Laravel, Swift, Tailwind CSS, and more",
-    "version": "0.1.7"
+    "version": "0.1.8"
   },
   "plugins": [
     {
       "name": "core-guards",
       "source": ".cursor-plugin/plugins/core-guards",
       "description": "Core security guards (git, install, security) and SOLID enforcement hooks",
-      "version": "1.1.38",
+      "version": "1.1.39",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -36,7 +36,7 @@
       "name": "fuse-ai-pilot",
       "source": ".cursor-plugin/plugins/fuse-ai-pilot",
       "description": "AI Pilot workflow agents: sniper (code quality), research-expert, explore-codebase, websearch",
-      "version": "1.2.43",
+      "version": "1.2.44",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -81,7 +81,7 @@
       "name": "fuse-cartographer",
       "source": ".cursor-plugin/plugins/fuse-cartographer",
       "description": "Generates indented markdown maps of the plugin ecosystem for agent navigation",
-      "version": "1.0.13",
+      "version": "1.0.14",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -102,7 +102,7 @@
       "name": "fuse-changelog",
       "source": ".cursor-plugin/plugins/fuse-changelog",
       "description": "Claude Code update watcher: changelog tracking, breaking changes detection, community pulse via Exa, plugin compatibility analysis",
-      "version": "1.0.15",
+      "version": "1.0.16",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -145,7 +145,7 @@
       "name": "fuse-design",
       "source": ".cursor-plugin/plugins/fuse-design",
       "description": "Design Director for websites, web apps, iOS, and Android. Generates HTML/CSS directly (Gemini Design MCP, Magic/21st.dev, and shadcn MCP are optional). iOS/Android produce tokens + a device-framed mockup + a handoff spec, never SwiftUI/Compose. Design method, design system tokens, motion, UX copy, and a deterministic design-review gate. Anti-AI-Slop, WCAG 2.2.",
-      "version": "2.2.10",
+      "version": "2.2.11",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -181,7 +181,7 @@
       "name": "fuse-go",
       "source": ".cursor-plugin/plugins/fuse-go",
       "description": "Expert Go 1.26+ — idioms, concurrency, backend services, cargo-grade tooling (golangci-lint v2, govulncheck), with SOLID principles",
-      "version": "1.0.7",
+      "version": "1.0.8",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -207,7 +207,7 @@
       "name": "fuse-laravel",
       "source": ".cursor-plugin/plugins/fuse-laravel",
       "description": "Expert Laravel 13 + PHP 8.3+ with SOLID principles, first-class PHP Attributes, Laravel AI SDK, JSON:API Resources, native vector search (pgvector), Eloquent, Livewire, queues with routing, and comprehensive documentation",
-      "version": "1.2.8",
+      "version": "1.2.9",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -229,7 +229,7 @@
       "name": "fuse-lessons",
       "source": ".cursor-plugin/plugins/fuse-lessons",
       "description": "Project memory: writes compact 'never reproduce' lessons to MEMORY/LESSON.md on finish, force-reads them at session/subagent start.",
-      "version": "1.0.7",
+      "version": "1.0.8",
       "author": {
         "name": "Fusengine"
       },
@@ -247,7 +247,7 @@
       "name": "fuse-nextjs",
       "source": ".cursor-plugin/plugins/fuse-nextjs",
       "description": "Expert Next.js 16 + React 19 with App Router, Server Components, Prisma 7, and Better Auth",
-      "version": "1.1.24",
+      "version": "1.1.25",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -269,7 +269,7 @@
       "name": "fuse-php",
       "source": ".cursor-plugin/plugins/fuse-php",
       "description": "Expert modern PHP 8.5/8.4 for non-Laravel projects — libraries, standalone Symfony components, Slim, API-first apps, and CLI tools, with PER Coding Style 3.0, PHPStan, and SOLID principles",
-      "version": "1.0.7",
+      "version": "1.0.8",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -322,7 +322,7 @@
       "name": "fuse-react",
       "source": ".cursor-plugin/plugins/fuse-react",
       "description": "Expert React 19 with hooks, TanStack Router, Zustand, React Hook Form, Testing Library, shadcn/ui, and SOLID principles",
-      "version": "1.0.21",
+      "version": "1.0.22",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -346,7 +346,7 @@
       "name": "fuse-rules",
       "source": ".cursor-plugin/plugins/fuse-rules",
       "description": "Global rules for all sessions: APEX workflow, SOLID/DRY enforcement, project detection, agent delegation, frontend/git standards",
-      "version": "1.0.23",
+      "version": "1.0.24",
       "author": {
         "name": "Fusengine"
       },
@@ -359,7 +359,7 @@
       "name": "fuse-rust",
       "source": ".cursor-plugin/plugins/fuse-rust",
       "description": "Expert Rust 1.96+ (2024 edition) — ownership, error handling, async/tokio, axum backends, cargo tooling, with SOLID principles",
-      "version": "1.0.7",
+      "version": "1.0.8",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -385,7 +385,7 @@
       "name": "fuse-security",
       "source": ".cursor-plugin/plugins/fuse-security",
       "description": "Security vulnerability detection and remediation: OWASP Top 10, SAST scanning, CVE research, dependency audit, secrets detection",
-      "version": "1.0.17",
+      "version": "1.0.18",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -408,7 +408,7 @@
       "name": "fuse-seo",
       "source": ".cursor-plugin/plugins/fuse-seo",
       "description": "SEO/GEO 2026 plugin. Local-first, framework-aware, zero third-party APIs. Covers technical SEO, schema markup, E-E-A-T, AI Overviews optimization, local SEO, sitemaps, hreflang, internal linking, content briefs, semantic clustering, and search experience optimization.",
-      "version": "1.0.12",
+      "version": "1.0.13",
       "author": {
         "name": "Fusengine"
       },
@@ -438,7 +438,7 @@
       "name": "fuse-shadcn-ui",
       "source": ".cursor-plugin/plugins/fuse-shadcn-ui",
       "description": "Expert shadcn/ui with Radix UI and Base UI detection, component patterns, registries, theming, and migration",
-      "version": "1.0.18",
+      "version": "1.0.19",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -462,7 +462,7 @@
       "name": "fuse-solid",
       "source": ".cursor-plugin/plugins/fuse-solid",
       "description": "SOLID principles enforcement with automatic project detection and validation for all languages",
-      "version": "1.0.19",
+      "version": "1.0.20",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -483,7 +483,7 @@
       "name": "fuse-swift-apple-expert",
       "source": ".cursor-plugin/plugins/fuse-swift-apple-expert",
       "description": "Expert Swift 6.2 + SwiftUI for iOS 26, macOS 26, iPadOS 26, watchOS 26, visionOS 26, tvOS 26 with Liquid Glass, @Observable, actors, SwiftData inheritance",
-      "version": "1.1.20",
+      "version": "1.1.21",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -510,7 +510,7 @@
       "name": "fuse-tailwindcss",
       "source": ".cursor-plugin/plugins/fuse-tailwindcss",
       "description": "Expert Tailwind CSS v4.1 - CSS-first configuration, @theme, @utility, @variant, Oxide engine 5x faster, OKLCH colors, container queries, 15 specialized skills",
-      "version": "1.1.11",
+      "version": "1.1.12",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -542,7 +542,7 @@
       "name": "fuse-tanstack-start",
       "source": ".cursor-plugin/plugins/fuse-tanstack-start",
       "description": "Expert TanStack Start (React, RC) full-stack framework with file-based routing, createServerFn server functions, selective SSR, and Nitro deployment",
-      "version": "1.0.5",
+      "version": "1.0.6",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"
@@ -567,7 +567,7 @@
       "name": "fuse-typescript",
       "source": ".cursor-plugin/plugins/fuse-typescript",
       "description": "Expert TypeScript 6.0 for pure TS projects — CLI tools, libraries, scripts, and backends on Node 24 LTS or Bun 1.3, with SOLID principles",
-      "version": "1.0.7",
+      "version": "1.0.8",
       "author": {
         "name": "Fusengine",
         "email": "hello@fusengine.ch"

.cursor-plugin/plugin-runtime/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/core-guards/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "core-guards",
-  "version": "1.1.38",
+  "version": "1.1.39",
   "description": "Core security guards (git, install, security) and SOLID enforcement hooks",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/core-guards/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-ai-pilot/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-ai-pilot",
-  "version": "1.2.43",
+  "version": "1.2.44",
   "description": "AI Pilot workflow agents: sniper (code quality), research-expert, explore-codebase, websearch",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/fuse-ai-pilot/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-cartographer/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-cartographer",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Generates indented markdown maps of the plugin ecosystem for agent navigation",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/fuse-cartographer/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-changelog/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-changelog",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "description": "Claude Code update watcher: changelog tracking, breaking changes detection, community pulse via Exa, plugin compatibility analysis",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/fuse-changelog/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-design/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-design",
-  "version": "2.2.10",
+  "version": "2.2.11",
   "description": "Design Director for websites, web apps, iOS, and Android. Generates HTML/CSS directly (Gemini Design MCP, Magic/21st.dev, and shadcn MCP are optional). iOS/Android produce tokens + a device-framed mockup + a handoff spec, never SwiftUI/Compose. Design method, design system tokens, motion, UX copy, and a deterministic design-review gate. Anti-AI-Slop, WCAG 2.2.",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/fuse-design/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-go/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-go",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Expert Go 1.26+ — idioms, concurrency, backend services, cargo-grade tooling (golangci-lint v2, govulncheck), with SOLID principles",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/fuse-go/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-laravel/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-laravel",
-  "version": "1.2.8",
+  "version": "1.2.9",
   "description": "Expert Laravel 13 + PHP 8.3+ with SOLID principles, first-class PHP Attributes, Laravel AI SDK, JSON:API Resources, native vector search (pgvector), Eloquent, Livewire, queues with routing, and comprehensive documentation",
   "author": {
     "name": "Fusengine",

.cursor-plugin/plugins/fuse-laravel/scripts/hook.sh

@@ -7,9 +7,13 @@
 #   2. a self-heal `bun install` of that same shared directory, once
 #   3. `npx` on latest (last resort, network)
 #
-# Always tracks the LATEST published harness: the vendored manifest uses the
-# `latest` dist-tag and the npx fallback resolves it too, so a new release is
-# picked up without editing 21 wrappers.
+# Installs the LATEST published harness the first time (the manifest uses the
+# `latest` dist-tag, and so does the npx fallback), so no wrapper needs editing
+# per release. It does NOT upgrade an existing install: the fast path runs the
+# vendored bin as is, and rewriting it in place while up to 62 hooks load it
+# could crash a guard mid-run (hooks fail open). The upgrade path is the
+# installer (`install.sh` runs `bun update @fusengine/harness` on every run) or,
+# by hand: `cd ~/.cursor/.fusengine-global && bun update @fusengine/harness`.
 #
 # Resolution is relative to THIS file, never to the caller's cwd. Always exits 0
 # on its own failures: Cursor fails hooks open, and a broken guard must never

.cursor-plugin/plugins/fuse-lessons/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fuse-lessons",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Project memory: writes compact 'never reproduce' lessons to MEMORY/LESSON.md on finish, force-reads them at session/subagent start.",
   "author": {
     "name": "Fusengine"