@claudexor/harness-cursor 1.0.0 → 2.1.2

package/dist/index.js

@@ -3,10 +3,13 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync } from "node:fs
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ConformanceReport as ConformanceReportSchema, HarnessCapabilityProfile as HarnessCapabilityProfileSchema, HarnessManifest as HarnessManifestSchema, } from "@claudexor/schema";
-import { HarnessUnavailableError, needsScopedHomeKeychainBridge, providerScrubEnv, runCapture, runCliHarness as runCliHarnessDefault, } from "@claudexor/core";
+import { abortSignalFromSpec, HarnessUnavailableError, needsScopedHomeKeychainBridge, promptWithInstructions, providerScrubEnv, runCapture, runCliHarness as runCliHarnessDefault, } from "@claudexor/core";
 import { resolveSecret } from "@claudexor/secrets";
 import { CLAUDEXOR_VERSION, nowIso, redactSecrets } from "@claudexor/util";
-import { createCursorParser } from "./parse.js";
+import { createCursorParser, parseCursorModelList } from "./parse.js";
+export { parseCursorModelList } from "./parse.js";
+import { cursorProfileKeyOrRefusal, probeCursorCredentialProfile, probeCursorNativeAuth, selectCursorAuthRoute, shouldDiscloseCursorAutoApiRoute, shouldSmokeCursorApiKey, } from "./auth.js";
+export { cursorStatusAuthenticated, cursorStatusLoggedOut, selectCursorAuthRoute, shouldDiscloseCursorAutoApiRoute, } from "./auth.js";
 const BIN = process.env.CLAUDEXOR_CURSOR_BIN || "cursor-agent";
 // Long enough for one sequential reviewer panel pass; still bounded so revoked
 // keys do not remain smoke-proven for a whole daemon lifetime.
@@ -25,7 +28,7 @@ const CURSOR_CAPABILITY_PROFILE = HarnessCapabilityProfileSchema.parse({
     isolation: {
         supported_containment: ["scoped_home_keychain_bridge", "env_or_file_injection"],
     },
-    image_input: "none",
+    attachment_inputs: [],
 });
 function accessArgs(access) {
     switch (access) {
@@ -43,34 +46,20 @@ function accessArgs(access) {
             return ["--trust"];
     }
 }
-async function detectVersion() {
+async function detectVersion(abortSignal) {
     try {
-        const r = await runCapture(BIN, ["--version"], { timeoutMs: 10_000 });
+        const r = await runCapture(BIN, ["--version"], {
+            timeoutMs: 10_000,
+            abortSignal,
+            cancelSignal: "SIGTERM",
+            cancelKillDelayMs: 0,
+        });
         return r.stdout.trim() || `${BIN} (version unknown)`;
     }
     catch {
         return null;
     }
 }
-async function nativeAuthOk(env) {
-    try {
-        const r = await runCapture(BIN, ["status"], { env, timeoutMs: 10_000 });
-        return cursorStatusAuthenticated(r.code, `${r.stdout}\n${r.stderr}`);
-    }
-    catch {
-        return false;
-    }
-}
-export function cursorStatusAuthenticated(code, text) {
-    if (code !== 0)
-        return false;
-    const normalized = text.toLowerCase();
-    if (normalized.includes("not logged in") || normalized.includes("authentication required"))
-        return false;
-    return (normalized.includes("logged in") ||
-        normalized.includes("authenticated") ||
-        normalized.includes("account"));
-}
 function cursorApiKey(env) {
     if (env && Object.prototype.hasOwnProperty.call(env, "CLAUDEXOR_CURSOR_API_KEY"))
         return env["CLAUDEXOR_CURSOR_API_KEY"] || null;
@@ -81,78 +70,6 @@ function cursorApiKey(env) {
         process.env.CURSOR_API_KEY ||
         null);
 }
-export function selectCursorAuthRoute(input) {
-    const keyRouteReady = input.hasKey && input.apiKeyReady;
-    if (input.authPreference === "api_key") {
-        if (keyRouteReady)
-            return "api_key";
-        if (input.nativeAuthed)
-            return "local_session";
-        return "unavailable";
-    }
-    if (input.authPreference === "subscription") {
-        if (input.nativeAuthed)
-            return "local_session";
-        return "unavailable";
-    }
-    if (input.scopedHome && keyRouteReady)
-        return "api_key";
-    if (input.nativeAuthed)
-        return "local_session";
-    if (keyRouteReady)
-        return "api_key";
-    return "unavailable";
-}
-export function shouldDiscloseCursorAutoApiRoute(input) {
-    return input.authPreference === "auto" && input.route === "api_key" && input.nativeAuthed;
-}
-function shouldSmokeCursorApiKey(input) {
-    if (!input.hasKey)
-        return false;
-    if (input.authPreference === "subscription")
-        return false;
-    if (input.authPreference === "api_key")
-        return true;
-    return !input.nativeAuthed || input.scopedHome;
-}
-function isCursorModelId(id) {
-    if (!id)
-        return false;
-    if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(id))
-        return false;
-    for (const ch of id) {
-        if ((ch >= "a" && ch <= "z") ||
-            (ch >= "A" && ch <= "Z") ||
-            (ch >= "0" && ch <= "9") ||
-            ch === "-" ||
-            ch === "." ||
-            ch === "_" ||
-            ch === "/" ||
-            ch === ":")
-            continue;
-        return false;
-    }
-    return true;
-}
-export function parseCursorModelList(text) {
-    const out = [];
-    const seen = new Set();
-    for (const rawLine of text.replaceAll("\r", "").split("\n")) {
-        const line = rawLine.trim();
-        if (!line || line === "Available models" || line.startsWith("Tip:"))
-            continue;
-        const sep = line.indexOf(" - ");
-        if (sep <= 0)
-            continue;
-        const id = line.slice(0, sep).trim();
-        const label = line.slice(sep + 3).trim() || null;
-        if (!isCursorModelId(id) || seen.has(id))
-            continue;
-        seen.add(id);
-        out.push({ id, label, context_window: null });
-    }
-    return out;
-}
 export function cursorApiSmokeFinalText(stdout) {
     const replies = [];
     for (const rawLine of stdout.replaceAll("\r", "").split("\n")) {
@@ -291,17 +208,17 @@ export async function smokeIsolatedApiKey(key = cursorApiKey(), options = {}) {
 function cursorApiSmokeCacheKey(key) {
     return createHash("sha256").update(key).digest("hex");
 }
-async function smokeCursorApiKey(deps, key) {
+async function smokeCursorApiKey(deps, key, fresh = false) {
     const cacheKey = cursorApiSmokeCacheKey(key);
     const now = deps.nowMs();
-    const cached = deps.apiSmokeCache.get(cacheKey);
+    const cached = fresh ? undefined : deps.apiSmokeCache.get(cacheKey);
     if (cached && cached.expiresAtMs > now)
         return cached.result;
     if (cached)
         deps.apiSmokeCache.delete(cacheKey);
     const result = await deps.smokeIsolatedApiKey(key);
     const ttlMs = result.ok ? deps.apiSmokeCacheTtlMs : deps.apiSmokeFailureCacheTtlMs;
-    if (ttlMs > 0)
+    if (!fresh && ttlMs > 0)
         deps.apiSmokeCache.set(cacheKey, { result, expiresAtMs: now + ttlMs });
     return result;
 }
@@ -338,17 +255,20 @@ async function resolveCursorAuthRoute(deps, input) {
     const scopedHome = Boolean(input.env?.["HOME"]);
     if (scopedHome)
         maybeBridgeScopedHome(env);
-    const key = deps.cursorApiKey(input.env);
     const authPreference = input.authPreference ?? "auto";
-    const nativeAuthed = await deps.nativeAuthOk(env);
+    const key = authPreference === "subscription" ? null : deps.cursorApiKey(input.env);
+    const nativeProbe = authPreference === "api_key"
+        ? { authed: false, probeError: null }
+        : await deps.nativeAuthOk(env, input.abortSignal);
+    const nativeAuthed = nativeProbe.authed;
     const shouldSmokeApiKey = shouldSmokeCursorApiKey({
         hasKey: Boolean(key),
         authPreference,
         nativeAuthed,
-        scopedHome,
+        nativeProbeError: nativeProbe.probeError,
     });
     const apiSmoke = shouldSmokeApiKey && key
-        ? await smokeCursorApiKey(deps, key)
+        ? await smokeCursorApiKey(deps, key, input.fresh === true)
         : {
             ok: false,
             detail: key
@@ -362,7 +282,15 @@ async function resolveCursorAuthRoute(deps, input) {
         nativeAuthed,
         scopedHome,
     });
-    return { route, env, key, nativeAuthed, apiSmoke, scopedHome };
+    return {
+        route,
+        env,
+        key,
+        nativeAuthed,
+        nativeProbeError: nativeProbe.probeError,
+        apiSmoke,
+        scopedHome,
+    };
 }
 async function listCursorModelsFromReadyRoute(deps, spec) {
     const catalogOnly = () => {
@@ -372,11 +300,13 @@ async function listCursorModelsFromReadyRoute(deps, spec) {
             CURSOR_API_KEY: key ?? null,
         });
     };
-    if (spec?.env || spec?.authPreference) {
+    if (spec?.env || spec?.authPreference || spec?.fresh) {
         const authPreference = spec.authPreference ?? "auto";
         const resolved = await resolveCursorAuthRoute(deps, {
             env: spec.env,
             authPreference,
+            fresh: spec?.fresh,
+            abortSignal: spec?.abortSignal,
         });
         if (resolved.route === "local_session") {
             const models = await deps.listCursorModels({ ...resolved.env, CURSOR_API_KEY: null });
@@ -393,15 +323,18 @@ async function listCursorModelsFromReadyRoute(deps, spec) {
         return [];
     }
     const nativeEnv = cursorNativeEnv();
-    if (await deps.nativeAuthOk(nativeEnv)) {
+    const nativeProbe = await deps.nativeAuthOk(nativeEnv, spec?.abortSignal);
+    if (nativeProbe.authed) {
         const nativeModels = await deps.listCursorModels(nativeEnv);
         if (nativeModels.length > 0)
             return nativeModels;
     }
+    if (nativeProbe.probeError)
+        return [];
     const key = deps.cursorApiKey();
     if (!key)
         return catalogOnly();
-    const apiSmoke = await smokeCursorApiKey(deps, key);
+    const apiSmoke = await smokeCursorApiKey(deps, key, spec?.fresh === true);
     if (apiSmoke.ok) {
         const models = await deps.listCursorModels({ ...providerScrubEnv(), CURSOR_API_KEY: key });
         if (models.length > 0)
@@ -412,7 +345,7 @@ async function listCursorModelsFromReadyRoute(deps, spec) {
 export function createCursorAdapter(deps = {}) {
     const runtime = {
         detectVersion,
-        nativeAuthOk,
+        nativeAuthOk: probeCursorNativeAuth,
         cursorApiKey,
         listCursorModels,
         smokeIsolatedApiKey,
@@ -421,6 +354,7 @@ export function createCursorAdapter(deps = {}) {
         apiSmokeFailureCacheTtlMs: CURSOR_API_SMOKE_FAILURE_CACHE_TTL_MS,
         nowMs: () => Date.now(),
         runCliHarness: runCliHarnessDefault,
+        resolveProfileSecret: (ref) => resolveSecret(ref),
         ...deps,
     };
     return {
@@ -430,7 +364,8 @@ export function createCursorAdapter(deps = {}) {
             if (version === null) {
                 throw new HarnessUnavailableError("cursor-agent not found on PATH (set CLAUDEXOR_CURSOR_BIN)");
             }
-            const nativeAuthed = await runtime.nativeAuthOk(cursorNativeEnv());
+            const nativeProbe = await runtime.nativeAuthOk(cursorNativeEnv());
+            const nativeAuthed = nativeProbe.authed;
             const apiKey = runtime.cursorApiKey() !== null;
             return HarnessManifestSchema.parse({
                 id: "cursor",
@@ -458,9 +393,8 @@ export function createCursorAdapter(deps = {}) {
                     ...CURSOR_CAPABILITY_PROFILE,
                     auth: {
                         ...CURSOR_CAPABILITY_PROFILE.auth,
-                        // Static source preference mirrors the normal non-scoped route.
-                        // Scoped/envelope runs may still choose a smoke-proven API key at
-                        // runtime because that decision depends on the run environment.
+                        // Native-first is invariant across host and scoped environments;
+                        // a key becomes auto fallback only after native is unavailable.
                         preferred_source: nativeAuthed ? "native_session" : apiKey ? "api_key_env" : null,
                     },
                 },
@@ -474,7 +408,7 @@ export function createCursorAdapter(deps = {}) {
             });
         },
         async doctor(_spec) {
-            const version = await runtime.detectVersion();
+            const version = await runtime.detectVersion(_spec.abortSignal);
             if (version === null) {
                 return ConformanceReportSchema.parse({
                     harness_id: "cursor",
@@ -483,22 +417,32 @@ export function createCursorAdapter(deps = {}) {
                     reasons: ["cursor-agent not found (install Cursor CLI or set CLAUDEXOR_CURSOR_BIN)"],
                 });
             }
+            const requestedSource = _spec.authSource;
+            const probeNative = requestedSource === undefined || requestedSource === "native_session";
+            const probeApi = requestedSource === undefined || requestedSource === "api_key_env";
             const env = cursorNativeEnv(_spec.env);
             const scopedHome = Boolean(_spec.env?.["HOME"]);
-            const authPreference = _spec.authPreference ?? "auto";
-            if (scopedHome)
+            const authPreference = requestedSource === "native_session"
+                ? "subscription"
+                : requestedSource === "api_key_env"
+                    ? "api_key"
+                    : (_spec.authPreference ?? "auto");
+            if (probeNative && scopedHome)
                 maybeBridgeScopedHome(env);
-            const nativeAuthed = await runtime.nativeAuthOk(env);
-            const key = runtime.cursorApiKey(_spec.env);
+            const nativeProbe = probeNative
+                ? await runtime.nativeAuthOk(env, _spec.abortSignal)
+                : { authed: false, probeError: null };
+            const nativeAuthed = nativeProbe.authed;
+            const key = probeApi ? runtime.cursorApiKey(_spec.env) : null;
             const apiKey = key !== null;
             const shouldSmokeApiKey = shouldSmokeCursorApiKey({
                 hasKey: apiKey,
                 authPreference,
                 nativeAuthed,
-                scopedHome,
+                nativeProbeError: nativeProbe.probeError,
             });
             const apiSmoke = key && shouldSmokeApiKey
-                ? await smokeCursorApiKey(runtime, key)
+                ? await smokeCursorApiKey(runtime, key, _spec.fresh === true)
                 : {
                     ok: false,
                     detail: key
@@ -506,8 +450,8 @@ export function createCursorAdapter(deps = {}) {
                         : "no Cursor API key",
                 };
             // Readiness doctrine: a key string alone is source availability, not
-            // proven readiness. Native auth proves read-only/session reuse; an isolated
-            // API-key smoke proves envelope/write routes.
+            // proven readiness. A bridged native status probe proves the exact scoped
+            // environment; API fallback still requires its isolated smoke.
             const routeableIntents = [
                 "plan",
                 "spec",
@@ -520,24 +464,7 @@ export function createCursorAdapter(deps = {}) {
                 "explain",
                 "audit",
             ];
-            const allIntents = [
-                ...routeableIntents,
-                "orchestrate",
-            ];
-            // Write-class intents run in isolated envelopes with a scoped HOME where
-            // the native cursor session is unreachable — they REQUIRE the key
-            // fallback. Native-only auth honestly enables only the non-envelope
-            // (read-only) intents so doctor-ok can never precede a guaranteed run
-            // failure (readiness/routing contract).
-            const readOnlyIntents = [
-                "plan",
-                "spec",
-                "review",
-                "verify",
-                "synthesize",
-                "explain",
-                "audit",
-            ];
+            const allIntents = [...routeableIntents, "orchestrate"];
             const route = selectCursorAuthRoute({
                 authPreference,
                 hasKey: apiKey,
@@ -545,38 +472,101 @@ export function createCursorAdapter(deps = {}) {
                 nativeAuthed,
                 scopedHome,
             });
-            const enabled = route === "api_key" ? routeableIntents : route === "local_session" ? readOnlyIntents : [];
+            const enabled = route === "unavailable" ? [] : routeableIntents;
             const ok = route !== "unavailable";
+            const selectedAvailable = authPreference === "subscription"
+                ? nativeAuthed
+                : authPreference === "api_key"
+                    ? apiKey
+                    : nativeAuthed || apiKey;
+            const probeUnknown = authPreference !== "api_key" && nativeProbe.probeError !== null;
+            const nativeSource = nativeProbe.probeError
+                ? {
+                    source: "native_session",
+                    availability: "unknown",
+                    verification: "not_run",
+                    detail: `Cursor status probe failed: ${nativeProbe.probeError}`,
+                }
+                : nativeAuthed
+                    ? {
+                        source: "native_session",
+                        availability: "available",
+                        verification: "passed",
+                        detail: "native Cursor session passed the status probe in the exact run environment",
+                    }
+                    : {
+                        source: "native_session",
+                        availability: "unavailable",
+                        verification: "not_run",
+                        detail: "native Cursor session is not authenticated",
+                    };
+            const apiSource = {
+                source: "api_key_env",
+                availability: apiKey ? "available" : "unavailable",
+                verification: apiSmoke.ok ? "passed" : shouldSmokeApiKey ? "failed" : "not_run",
+                detail: apiSmoke.detail,
+            };
+            const authSources = requestedSource === "native_session"
+                ? [nativeSource]
+                : requestedSource === "api_key_env"
+                    ? [apiSource]
+                    : requestedSource !== undefined
+                        ? [
+                            {
+                                source: requestedSource,
+                                availability: "unavailable",
+                                verification: "not_run",
+                                detail: `Cursor does not support ${requestedSource}`,
+                            },
+                        ]
+                        : [nativeSource, apiSource];
             return ConformanceReportSchema.parse({
                 harness_id: "cursor",
-                status: ok ? "ok" : apiKey ? "degraded" : "unavailable",
+                status: ok ? "ok" : selectedAvailable || probeUnknown ? "degraded" : "unavailable",
                 checks: [
                     { id: "installed", status: "pass", detail: version },
-                    { id: "auth", status: nativeAuthed ? "pass" : "fail" },
-                    {
-                        id: "stored_key",
-                        status: apiKey ? "pass" : "fail",
-                        detail: apiKey
-                            ? "cursor secret/env available"
-                            : "no cursor key fallback (write/envelope intents disabled)",
-                    },
-                    {
-                        id: "isolated_api_smoke",
-                        status: apiSmoke.ok ? "pass" : apiKey ? "fail" : "skip",
-                        detail: apiSmoke.detail,
-                    },
+                    ...(probeNative
+                        ? [
+                            {
+                                id: "auth",
+                                status: nativeAuthed ? "pass" : "fail",
+                                detail: nativeProbe.probeError ?? nativeSource.detail,
+                            },
+                        ]
+                        : []),
+                    ...(probeApi
+                        ? [
+                            {
+                                id: "stored_key",
+                                status: apiKey ? "pass" : "fail",
+                                detail: apiKey ? "cursor secret/env available" : "no Cursor API-key fallback",
+                            },
+                            {
+                                id: "isolated_api_smoke",
+                                status: apiSmoke.ok ? "pass" : shouldSmokeApiKey ? "fail" : "skip",
+                                detail: apiSmoke.detail,
+                            },
+                        ]
+                        : []),
                 ],
+                auth_sources: authSources,
                 enabled_intents: enabled,
                 disabled_intents: allIntents.filter((i) => !enabled.includes(i)),
                 reasons: ok
-                    ? apiSmoke.ok
-                        ? []
-                        : [
-                            "native session only: isolated envelope (write) intents need a passing Cursor API-key smoke",
-                        ]
-                    : apiKey
-                        ? [`cursor key present but route unproven: ${apiSmoke.detail}`]
-                        : ["not authenticated (cursor-agent login or set CURSOR_API_KEY)"],
+                    ? []
+                    : nativeProbe.probeError && authPreference !== "api_key"
+                        ? [`Cursor native-session probe failed: ${nativeProbe.probeError}`]
+                        : authPreference === "subscription"
+                            ? ["Cursor subscription route is not ready (run `cursor-agent login`)"]
+                            : authPreference === "api_key"
+                                ? [
+                                    apiKey
+                                        ? `cursor key present but route unproven: ${apiSmoke.detail}`
+                                        : "Cursor API-key route is not configured",
+                                ]
+                                : apiKey
+                                    ? [`cursor key present but route unproven: ${apiSmoke.detail}`]
+                                    : ["not authenticated (cursor-agent login or set CURSOR_API_KEY)"],
             });
         },
         run(spec) {
@@ -588,6 +578,12 @@ export function createCursorAdapter(deps = {}) {
         async models(spec) {
             return listCursorModelsFromReadyRoute(runtime, spec);
         },
+        // INV-135 (release wave round-15 #1): a valid cursor profile must admit
+        // the route even when the default store is logged out — the orchestrator
+        // consults THIS probe to override the default auth verdict.
+        async probeCredentialProfile(profile) {
+            return probeCursorCredentialProfile(profile, runtime.resolveProfileSecret);
+        },
     };
 }
 async function* runCursor(spec, deps) {
@@ -602,17 +598,35 @@ async function* runCursor(spec, deps) {
         return;
     }
     const args = ["-p", "--output-format", "stream-json", ...accessArgs(spec.access)];
+    // W-C4 live deltas (engine-gated; the parser applies the documented taxonomy).
+    if (spec.stream_deltas)
+        args.push("--stream-partial-output");
     if (spec.model_hint)
         args.push("--model", spec.model_hint);
     // Resume the thread's native cursor chat as a follow-up turn.
     if (spec.resume_session_id)
         args.push("--resume", spec.resume_session_id);
-    args.push(spec.prompt);
-    const { route, env, key, nativeAuthed, scopedHome } = await resolveCursorAuthRoute(deps, {
+    // Cursor has no native system-prompt flag; layer instructions as a delimited
+    // prompt prefix (the engine already withheld them from synthesis/reviewers).
+    args.push(promptWithInstructions(spec));
+    // INV-135 strict profile routing: cursor's native login is a singleton, so
+    // a profile is exactly its secret-ref API key (smoked before use like the
+    // default key route); other kinds refuse typed.
+    const profile = spec.credential_profile;
+    const profileGate = profile
+        ? cursorProfileKeyOrRefusal(profile, deps.resolveProfileSecret)
+        : null;
+    if (profileGate && "refusal" in profileGate) {
+        yield { type: "error", session_id: spec.session_id, ts: nowIso(), error: profileGate.refusal };
+        yield { type: "completed", session_id: spec.session_id, ts: nowIso() };
+        return;
+    }
+    const routeDeps = profileGate ? { ...deps, cursorApiKey: () => profileGate.key } : deps;
+    const { route, env, key, nativeAuthed, scopedHome } = await resolveCursorAuthRoute(routeDeps, {
         env: spec.env,
-        authPreference: spec.auth_preference,
+        authPreference: profile ? "api_key" : spec.auth_preference,
+        abortSignal: abortSignalFromSpec(spec),
     });
-    const preferApi = spec.auth_preference === "api_key";
     if (route === "api_key" && key) {
         env.CURSOR_API_KEY = key;
         if (shouldDiscloseCursorAutoApiRoute({
@@ -635,32 +649,22 @@ async function* runCursor(spec, deps) {
     }
     else if (route === "local_session") {
         env.CURSOR_API_KEY = null;
-        if (preferApi) {
-            yield {
-                type: "message",
-                session_id: spec.session_id,
-                ts: nowIso(),
-                payload: {
-                    auth_switched: true,
-                    from_auth_mode: "api_key",
-                    to_auth_mode: "local_session",
-                    reason: "auth_unavailable",
-                },
-            };
-        }
     }
     else {
         yield {
             type: "error",
             session_id: spec.session_id,
             ts: nowIso(),
-            error: scopedHome
-                ? "scoped Cursor HOME requires either a bridged native session or a smoke-proven Cursor API key fallback"
-                : "Cursor requires either a native session or a smoke-proven Cursor API key fallback",
+            error: profile
+                ? `credential profile "${profile.profile_id}": the Cursor API-key smoke did not pass for its stored key`
+                : scopedHome
+                    ? "scoped Cursor HOME requires either a bridged native session or a smoke-proven Cursor API key fallback"
+                    : "Cursor requires either a native session or a smoke-proven Cursor API key fallback",
         };
         yield { type: "completed", session_id: spec.session_id, ts: nowIso() };
         return;
     }
+    const cursorParser = createCursorParser(route === "local_session" ? "vendor_native" : "managed_api_key", route === "local_session" ? "native_session" : "api_key_env");
     yield* deps.runCliHarness({
         bin: BIN,
         args,
@@ -668,7 +672,13 @@ async function* runCursor(spec, deps) {
         env,
         label: "cursor-agent",
         redact: redactSecrets,
-        parseEvent: createCursorParser(),
+        parseEvent: (obj, sessionId) => {
+            const out = cursorParser(obj, sessionId);
+            if (out && profile)
+                for (const ev of out)
+                    ev.credential_profile_id = profile.profile_id;
+            return out;
+        },
     });
 }
 //# sourceMappingURL=index.js.map