@cloudcli-ai/cloudcli 1.37.2 → 1.37.4

package/server/modules/providers/tests/codex-sessions.test.ts

@@ -6,7 +6,7 @@ import test from 'node:test';
 
 import { closeConnection, initializeDatabase, sessionsDb } from '@/modules/database/index.js';
 import { CodexSessionSynchronizer } from '@/modules/providers/list/codex/codex-session-synchronizer.provider.js';
-import { CodexSessionsProvider } from '@/modules/providers/list/codex/codex-sessions.provider.js';
+import { CodexSessionsProvider, parseCodexExecScript, readCodexMemoryCitations } from '@/modules/providers/list/codex/codex-sessions.provider.js';
 
 const patchHomeDir = (nextHomeDir: string) => {
   const original = os.homedir;
@@ -152,7 +152,7 @@ test('Codex synchronizer leaves indexed sessions untitled when no name is availa
   }
 });
 
-test('Codex history preserves wrapped exec tool calls and results', { concurrency: false }, async () => {
+test('Codex history translates wrapped exec scripts into the tools they ran', { concurrency: false }, async () => {
   const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-exec-history-'));
   const workspacePath = path.join(tempRoot, 'workspace');
   await mkdir(workspacePath, { recursive: true });
@@ -161,6 +161,8 @@ test('Codex history preserves wrapped exec tool calls and results', { concurrenc
   try {
     const providerSessionId = 'codex-exec-1';
     const transcriptPath = await writeCodexTranscript(tempRoot, providerSessionId, workspacePath);
+    // Every shape Codex's "code mode" emits. Only a wrapper nothing recognizes
+    // may stay labelled `exec`; the rest must name the work they performed.
     const wrappedCalls = [
       {
         callId: 'shell-command-1',
@@ -176,14 +178,22 @@ test('Codex history preserves wrapped exec tool calls and results', { concurrenc
       },
       {
         callId: 'exec-command-1',
-        input: 'await tools.exec_command({"command":"echo current"});',
+        input: 'await tools.exec_command({"cmd":"npm test","workdir":"/repo","yield_time_ms":10000});',
         expectedToolName: 'Bash',
-        expectedToolInput: JSON.stringify({ command: 'echo current' }),
+        expectedToolInput: JSON.stringify({ command: 'npm test' }),
+      },
+      {
+        callId: 'web-run-1',
+        input: 'await tools.web__run({ search_query: [{ q: "Codex" }, { q: "rollout format" }] });',
+        expectedToolName: 'WebSearch',
+        expectedToolInput: JSON.stringify({ query: 'Codex | rollout format' }),
+      },
+      {
+        callId: 'unknown-1',
+        input: 'await tools.unknown_wrapper({ value: true });',
+        expectedToolName: 'exec',
+        expectedToolInput: 'await tools.unknown_wrapper({ value: true });',
       },
-      { callId: 'apply-patch-1', input: 'await tools.apply_patch("*** Begin Patch\\n*** End Patch");' },
-      { callId: 'web-run-1', input: 'await tools.web__run({ search_query: [{ q: "Codex" }] });' },
-      { callId: 'update-plan-1', input: 'await tools.update_plan({ plan: [] });' },
-      { callId: 'unknown-1', input: 'await tools.unknown_wrapper({ value: true });' },
     ];
     const transcriptLines = [
       JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }),
@@ -209,19 +219,15 @@ test('Codex history preserves wrapped exec tool calls and results', { concurrenc
 
       const history = await new CodexSessionsProvider().fetchHistory('app-exec-1');
       const toolUses = history.messages.filter((message) => message.kind === 'tool_use');
-      const toolResults = history.messages.filter((message) => message.kind === 'tool_result');
       const toolUsesById = new Map(toolUses.map((message) => [message.toolId, message]));
-      const toolResultsById = new Map(toolResults.map((message) => [message.toolId, message]));
 
       assert.equal(toolUses.length, wrappedCalls.length);
-      assert.equal(toolResults.length, wrappedCalls.length);
       for (const call of wrappedCalls) {
         const toolUse = toolUsesById.get(call.callId);
-        assert.ok(toolUse);
-        assert.equal(toolUse.toolName, call.expectedToolName || 'exec');
-        assert.equal(toolUse.toolInput, call.expectedToolInput || call.input);
+        assert.ok(toolUse, `missing row for ${call.callId}`);
+        assert.equal(toolUse.toolName, call.expectedToolName);
+        assert.equal(toolUse.toolInput, call.expectedToolInput);
         assert.equal(toolUse.toolResult?.content, `result:${call.callId}`);
-        assert.equal(toolResultsById.get(call.callId)?.content, `result:${call.callId}`);
       }
     });
   } finally {
@@ -229,3 +235,378 @@ test('Codex history preserves wrapped exec tool calls and results', { concurrenc
     await rm(tempRoot, { recursive: true, force: true });
   }
 });
+
+test('Codex history strips the sandbox envelopes from shell output', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-exec-output-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    const providerSessionId = 'codex-output-1';
+    const transcriptPath = await writeCodexTranscript(tempRoot, providerSessionId, workspacePath);
+    await writeFile(transcriptPath, `${[
+      JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }),
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'custom_tool_call',
+          name: 'exec',
+          call_id: 'failing-1',
+          input: 'await tools.shell_command({ command: "npm test" });',
+        },
+      }),
+      // Codex nests two report headers: one for the sandbox script and one for
+      // the command it ran. Neither belongs in a chat transcript.
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'custom_tool_call_output',
+          call_id: 'failing-1',
+          output: [
+            { type: 'input_text', text: 'Script failed\nWall time 1.2 seconds\nOutput:\n' },
+            { type: 'input_text', text: 'Script error:\nExit code: 1\nWall time: 1.1 seconds\nOutput:\n1 test failed\n' },
+          ],
+        },
+      }),
+    ].join('\n')}\n`, 'utf8');
+
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-output-1', 'codex', workspacePath);
+      sessionsDb.assignProviderSessionId('app-output-1', providerSessionId);
+      await new CodexSessionSynchronizer().synchronize();
+
+      const history = await new CodexSessionsProvider().fetchHistory('app-output-1');
+      const bash = history.messages.find((message) => message.kind === 'tool_use');
+
+      assert.equal(bash?.toolName, 'Bash');
+      assert.equal(bash?.toolResult?.content, '1 test failed\n');
+      assert.equal(bash?.toolResult?.isError, true, 'a non-zero exit code must mark the row failed');
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('Codex history renders one file row per patched file, from the applied diff', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-patch-history-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    const providerSessionId = 'codex-patch-1';
+    const transcriptPath = await writeCodexTranscript(tempRoot, providerSessionId, workspacePath);
+    const patch = [
+      '*** Begin Patch',
+      '*** Update File: /repo/a.ts',
+      '@@',
+      '-const a = 1;',
+      '+const a = 2;',
+      '*** Update File: /repo/b.ts',
+      '@@',
+      '-const b = 1;',
+      '+const b = 2;',
+      '*** End Patch',
+    ].join('\n');
+
+    await writeFile(transcriptPath, `${[
+      JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }),
+      JSON.stringify({
+        type: 'response_item',
+        payload: { type: 'custom_tool_call', name: 'apply_patch', call_id: 'patch-1', input: patch },
+      }),
+      // The out-of-band report carries the real diffs, keyed by path in an
+      // order that does not follow the patch body.
+      JSON.stringify({
+        type: 'event_msg',
+        payload: {
+          type: 'patch_apply_end',
+          call_id: 'patch-1',
+          success: true,
+          changes: {
+            '/repo/b.ts': { type: 'update', unified_diff: '@@\n-const b = 1;\n+const b = 22;\n' },
+            '/repo/a.ts': { type: 'update', unified_diff: '@@\n-const a = 1;\n+const a = 22;\n' },
+          },
+        },
+      }),
+      JSON.stringify({
+        type: 'response_item',
+        payload: { type: 'custom_tool_call_output', call_id: 'patch-1', output: '{}' },
+      }),
+    ].join('\n')}\n`, 'utf8');
+
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-patch-1', 'codex', workspacePath);
+      sessionsDb.assignProviderSessionId('app-patch-1', providerSessionId);
+      await new CodexSessionSynchronizer().synchronize();
+
+      const history = await new CodexSessionsProvider().fetchHistory('app-patch-1');
+      const edits = history.messages.filter((message) => message.kind === 'tool_use');
+
+      assert.equal(edits.length, 2, 'the patch must not be rendered twice');
+      const byPath = new Map(edits.map((edit) => {
+        const input = JSON.parse(String(edit.toolInput)) as { file_path: string; new_string: string };
+        return [input.file_path, { edit, input }];
+      }));
+
+      assert.equal(byPath.get('/repo/a.ts')?.edit.toolName, 'Edit');
+      // The applied diff wins over the one reconstructed from the call input,
+      // and it must land on the row for its own file.
+      assert.equal(byPath.get('/repo/a.ts')?.input.new_string, 'const a = 22;');
+      assert.equal(byPath.get('/repo/b.ts')?.input.new_string, 'const b = 22;');
+      for (const edit of edits) {
+        assert.equal(edit.toolResult?.isError, false, 'a successful patch must resolve its row');
+      }
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('Codex history attaches a spawned agent\'s own transcript to the Task row', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-subagent-history-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    const providerSessionId = 'codex-parent-2';
+    const agentThreadId = 'codex-agent-thread-2';
+    const transcriptPath = await writeCodexTranscript(tempRoot, providerSessionId, workspacePath);
+
+    await writeFile(transcriptPath, `${[
+      JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }),
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'function_call',
+          name: 'spawn_agent',
+          call_id: 'spawn-1',
+          arguments: JSON.stringify({ task_name: 'test_agent_1' }),
+        },
+      }),
+      JSON.stringify({
+        type: 'event_msg',
+        payload: {
+          type: 'sub_agent_activity',
+          kind: 'started',
+          event_id: 'spawn-1',
+          agent_thread_id: agentThreadId,
+          agent_path: '/root/test_agent_1',
+        },
+      }),
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'agent_message',
+          author: '/root/test_agent_1',
+          content: [{ type: 'input_text', text: 'Message Type: FINAL_ANSWER\nSender: /root/test_agent_1\nPayload:\nAll done.' }],
+        },
+      }),
+    ].join('\n')}\n`, 'utf8');
+
+    // Codex writes a spawned agent's rollout next to its parent's, named after
+    // the agent thread id.
+    await writeFile(
+      path.join(path.dirname(transcriptPath), `rollout-2026-07-07T00-00-00-${agentThreadId}.jsonl`),
+      `${[
+        JSON.stringify({
+          type: 'session_meta',
+          payload: { id: agentThreadId, cwd: workspacePath, thread_source: 'subagent', agent_nickname: 'Hegel' },
+        }),
+        JSON.stringify({
+          type: 'response_item',
+          payload: {
+            type: 'custom_tool_call',
+            name: 'exec',
+            call_id: 'agent-call-1',
+            input: 'await tools.shell_command({ command: "ls" });',
+          },
+        }),
+        JSON.stringify({
+          type: 'response_item',
+          payload: { type: 'custom_tool_call_output', call_id: 'agent-call-1', output: 'Exit code: 0\nOutput:\nREADME.md\n' },
+        }),
+      ].join('\n')}\n`,
+      'utf8',
+    );
+
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-parent-2', 'codex', workspacePath);
+      sessionsDb.assignProviderSessionId('app-parent-2', providerSessionId);
+      await new CodexSessionSynchronizer().synchronize();
+
+      const history = await new CodexSessionsProvider().fetchHistory('app-parent-2');
+      const task = history.messages.find((message) => message.kind === 'tool_use' && message.toolName === 'Task');
+
+      assert.ok(task, 'a spawned agent must produce a Task row');
+      assert.equal(task.subagent?.id, agentThreadId);
+      assert.equal(task.subagent?.name, 'Hegel');
+      assert.equal(task.subagent?.status, 'completed');
+      assert.equal(task.toolResult?.content, 'All done.');
+
+      // The agent's own shell call is translated exactly like the parent's.
+      assert.equal(task.subagentTools?.length, 1);
+      assert.equal(task.subagentTools?.[0].kind, 'tool');
+      assert.equal(task.subagentTools?.[0].toolName, 'Bash');
+      assert.equal(task.subagentTools?.[0].toolResult?.content, 'README.md\n');
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('Codex memory citations are lifted out of the reply they trail', () => {
+  const reply = [
+    'Here is the answer.',
+    '',
+    '<oai-mem-citation>',
+    '<citation_entries>',
+    'MEMORY.md:137-142|note=[used verified container provisioning details]',
+    'notes/deploy.md:4-9',
+    '</citation_entries>',
+    '<rollout_ids>',
+    '019eda6d-c2f7-70c1-8b42-bf03c44a1f35',
+    '</rollout_ids>',
+    '</oai-mem-citation>',
+  ].join('\n');
+
+  const { text, memoryCitations } = readCodexMemoryCitations(reply);
+
+  assert.equal(text, 'Here is the answer.');
+  assert.deepEqual(memoryCitations, [
+    { source: 'MEMORY.md:137-142', note: 'used verified container provisioning details' },
+    { source: 'notes/deploy.md:4-9' },
+  ]);
+});
+
+test('a plan followed by a memory citation is still recognized as a plan', async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-plan-citation-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    const providerSessionId = 'codex-plan-citation-1';
+    const sessionsDir = path.join(tempRoot, '.codex', 'sessions', '2026', '07', '07');
+    await mkdir(sessionsDir, { recursive: true });
+    await writeFile(path.join(sessionsDir, `rollout-${providerSessionId}.jsonl`), `${[
+      JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }),
+      JSON.stringify({
+        type: 'response_item',
+        payload: {
+          type: 'message',
+          role: 'assistant',
+          id: 'plan-1',
+          content: [{
+            type: 'output_text',
+            text: '<proposed_plan>\n# Ship it\n</proposed_plan>\n\n<oai-mem-citation>\n<citation_entries>\nMEMORY.md:1-2|note=[prior deploy steps]\n</citation_entries>\n</oai-mem-citation>',
+          }],
+        },
+      }),
+    ].join('\n')}\n`, 'utf8');
+
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-plan-citation-1', 'codex', workspacePath);
+      sessionsDb.assignProviderSessionId('app-plan-citation-1', providerSessionId);
+      await new CodexSessionSynchronizer().synchronize();
+
+      const history = await new CodexSessionsProvider().fetchHistory('app-plan-citation-1');
+      const plan = history.messages.find((message) => message.toolName === 'ExitPlanMode');
+
+      assert.ok(plan, 'the trailing citation block must not hide the plan envelope');
+      assert.equal(JSON.parse(String(plan.toolInput)).plan, '# Ship it');
+      assert.deepEqual(plan.memoryCitations, [{ source: 'MEMORY.md:1-2', note: 'prior deploy steps' }]);
+      assert.ok(
+        !history.messages.some((message) => JSON.stringify(message).includes('oai-mem-citation')),
+        'no transcript row may still carry the raw citation markup',
+      );
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});
+
+test('an exec script that updates the plan yields the steps it set', () => {
+  const operations = parseCodexExecScript([
+    'const p = await tools.update_plan({plan:[',
+    '  {step:"Confirm the current workspace",status:"completed"},',
+    '  {step:"Check the Git working-tree status",status:"in_progress"},',
+    '  {step:"Identify the project",status:"pending"}',
+    ']});',
+    'text(p);',
+  ].join('\n'));
+
+  assert.deepEqual(operations, [{
+    kind: 'plan',
+    todos: [
+      { content: 'Confirm the current workspace', status: 'completed' },
+      { content: 'Check the Git working-tree status', status: 'in_progress' },
+      { content: 'Identify the project', status: 'pending' },
+    ],
+  }]);
+});
+
+
+test('Codex history restores user prompts from typed item_completed rows', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-typed-user-history-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    const providerSessionId = 'codex-typed-1';
+    const prompt = 'Typed prompt that must survive a refresh';
+    const transcriptPath = path.join(tempRoot, '.codex', 'sessions', '2026', '07', '07', 'rollout-' + providerSessionId + '.jsonl');
+    await mkdir(path.dirname(transcriptPath), { recursive: true });
+    const lineEnd = String.fromCharCode(10);
+    const typedLine = JSON.stringify({
+      timestamp: '2026-09-07T17:59:17.000Z',
+      type: 'event_msg',
+      payload: {
+        type: 'item_completed',
+        turn_id: 'typed-turn-1',
+        item: {
+          type: 'UserMessage',
+          id: 'item-user-1',
+          content: [
+            { type: 'text', text: prompt, text_elements: [] },
+            { type: 'local_image', path: '/tmp/prompt-picture.png', detail: null },
+          ],
+        },
+      },
+    });
+    const wireUserEcho = JSON.stringify({
+      timestamp: '2026-09-07T17:59:19.000Z',
+      type: 'response_item',
+      payload: { type: 'message', role: 'user', content: [{ type: 'input_text', text: prompt }] },
+    });
+    await writeFile(
+      transcriptPath,
+      [JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }), typedLine, wireUserEcho].join(lineEnd) + lineEnd,
+      'utf8',
+    );
+
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-typed-1', 'codex', workspacePath);
+      sessionsDb.assignProviderSessionId('app-typed-1', providerSessionId);
+      await new CodexSessionSynchronizer().synchronize();
+
+      const history = await new CodexSessionsProvider().fetchHistory('app-typed-1');
+      const users = history.messages.filter((message) => message.role === 'user');
+      const images = users[0]?.images as Array<{ path?: string; data?: string }> | undefined;
+
+      assert.equal(users.length, 1, 'the wire user echo must not duplicate the typed prompt');
+      assert.equal(users[0]?.content, prompt);
+      assert.equal(images?.[0]?.path, '/tmp/prompt-picture.png');
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});

package/server/modules/providers/tests/cursor-auth.test.ts

@@ -0,0 +1,187 @@
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { chmod, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import test, { mock } from 'node:test';
+
+import { CursorProviderAuth } from '@/modules/providers/list/cursor/cursor-auth.provider.js';
+
+const findEnvKey = (name: string) =>
+  Object.keys(process.env).find((key) => key.toLowerCase() === name.toLowerCase()) || name;
+
+// What the real CLI prints when it is logged in and the account request succeeded.
+const LOGGED_IN_OUTPUT = '✓ Logged in as cursor-user@example.com';
+
+// A stand-in for the real CLI: `--version` answers at once, while `status` drops a started
+// marker and keeps running (like the real one does while it fetches the account details from
+// Cursor's API) until the test creates the release file, then prints the configured output.
+// It records a SIGTERM so the tests can check that a timed-out check kills it.
+const FAKE_CURSOR_AGENT_SCRIPT = `
+const fs = require('node:fs');
+const path = require('node:path');
+const command = process.argv[2];
+const markerDir = process.env.CURSOR_FAKE_MARKER_DIR;
+if (command === '--version') {
+  console.log('2026.07.20-test');
+  process.exit(0);
+}
+if (command === 'status') {
+  process.on('SIGTERM', () => {
+    fs.writeFileSync(path.join(markerDir, 'status-killed'), '');
+    process.exit(143);
+  });
+  fs.writeFileSync(path.join(markerDir, 'status-started'), '');
+  // Never outlive a broken test run (its cleanup deletes the marker dir).
+  const giveUpAt = Date.now() + 30000;
+  const poll = () => {
+    if (!fs.existsSync(markerDir) || Date.now() > giveUpAt) {
+      process.exit(1);
+    }
+    if (fs.existsSync(path.join(markerDir, 'release-status'))) {
+      process.stdout.write(fs.readFileSync(path.join(markerDir, 'status-output'), 'utf8') + '\\n');
+      return;
+    }
+    setTimeout(poll, 20);
+  };
+  poll();
+}
+`;
+
+async function createFakeCursorAgent(binDir: string) {
+  await writeFile(path.join(binDir, 'cursor-agent.cjs'), FAKE_CURSOR_AGENT_SCRIPT, 'utf8');
+
+  if (process.platform === 'win32') {
+    const commandPath = path.join(binDir, 'cursor-agent.cmd');
+    await writeFile(commandPath, '@echo off\r\nnode "%~dp0cursor-agent.cjs" %*\r\n', 'utf8');
+    return;
+  }
+
+  // exec so the provider's kill() on timeout reaches the node process itself.
+  const commandPath = path.join(binDir, 'cursor-agent');
+  await writeFile(commandPath, '#!/bin/sh\nexec node "$(dirname "$0")/cursor-agent.cjs" "$@"\n', 'utf8');
+  await chmod(commandPath, 0o755);
+}
+
+// Waits in real time (the tests mock only setTimeout, not setImmediate or Date) and fails
+// instead of hanging when the fake never gets there.
+async function waitForFile(filePath: string, description: string) {
+  const giveUpAt = Date.now() + 15_000;
+  while (!existsSync(filePath)) {
+    if (Date.now() > giveUpAt) {
+      assert.fail(`timed out waiting for ${description}`);
+    }
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+type FakeCursorAgent = {
+  releaseStatus: () => Promise<void>;
+  waitForStatusStart: () => Promise<void>;
+  waitForStatusKill: () => Promise<void>;
+};
+
+const withFakeCursorAgent = async (statusOutput: string, fn: (fake: FakeCursorAgent) => Promise<void>) => {
+  const binDir = await mkdtemp(path.join(os.tmpdir(), 'cursor-auth-test-'));
+  const fake: FakeCursorAgent = {
+    releaseStatus: () => writeFile(path.join(binDir, 'release-status'), '', 'utf8'),
+    waitForStatusStart: () => waitForFile(path.join(binDir, 'status-started'), 'the fake `status` to start'),
+    waitForStatusKill: () => waitForFile(path.join(binDir, 'status-killed'), 'the fake `status` to get SIGTERM'),
+  };
+  const pathKey = findEnvKey('PATH');
+  const pathExtKey = findEnvKey('PATHEXT');
+  const previousPath = process.env[pathKey];
+  const previousPathExt = process.env[pathExtKey];
+  const previousMarkerDir = process.env.CURSOR_FAKE_MARKER_DIR;
+
+  try {
+    await createFakeCursorAgent(binDir);
+    await writeFile(path.join(binDir, 'status-output'), statusOutput, 'utf8');
+    process.env[pathKey] = `${binDir}${path.delimiter}${previousPath || ''}`;
+    process.env.CURSOR_FAKE_MARKER_DIR = binDir;
+    if (process.platform === 'win32') {
+      process.env[pathExtKey] = previousPathExt?.toUpperCase().includes('.CMD')
+        ? previousPathExt
+        : `.COM;.EXE;.BAT;.CMD${previousPathExt ? `;${previousPathExt}` : ''}`;
+    }
+
+    await fn(fake);
+  } finally {
+    // Lets a fake `status` that is still polling exit right away.
+    await fake.releaseStatus().catch(() => {});
+    process.env[pathKey] = previousPath;
+    if (previousPathExt === undefined) {
+      delete process.env[pathExtKey];
+    } else {
+      process.env[pathExtKey] = previousPathExt;
+    }
+    if (previousMarkerDir === undefined) {
+      delete process.env.CURSOR_FAKE_MARKER_DIR;
+    } else {
+      process.env.CURSOR_FAKE_MARKER_DIR = previousMarkerDir;
+    }
+    await rm(binDir, { recursive: true, force: true });
+  }
+};
+
+test('getStatus waits for a logged-in `cursor-agent status` that takes longer than 5 s (#551)', async () => {
+  await withFakeCursorAgent(LOGGED_IN_OUTPUT, async (fake) => {
+    // getStatus() arms its timeout before it spawns `status`, so it must see the mocked setTimeout.
+    mock.timers.enable({ apis: ['setTimeout'] });
+    try {
+      const pending = new CursorProviderAuth().getStatus();
+      // Move the clock only once `status` runs, i.e. once the timeout is armed.
+      await fake.waitForStatusStart();
+
+      // CLI startup alone took 3-6 s on a busy host; the account request adds a network round trip.
+      mock.timers.tick(10_000);
+      await fake.releaseStatus();
+
+      const status = await pending;
+      assert.equal(status.error, undefined);
+      assert.equal(status.authenticated, true);
+      assert.equal(status.email, 'cursor-user@example.com');
+      assert.equal(status.method, 'cli');
+    } finally {
+      mock.timers.reset();
+    }
+  });
+});
+
+test('getStatus still gives up on, and kills, a `cursor-agent status` that never answers', async () => {
+  await withFakeCursorAgent(LOGGED_IN_OUTPUT, async (fake) => {
+    mock.timers.enable({ apis: ['setTimeout'] });
+    try {
+      const pending = new CursorProviderAuth().getStatus();
+      await fake.waitForStatusStart();
+
+      mock.timers.tick(60_000);
+
+      const status = await pending;
+      assert.equal(status.installed, true);
+      assert.equal(status.authenticated, false);
+      assert.equal(status.error, 'Command timeout');
+      // On Windows kill() ends the .cmd shim's cmd.exe, which does not signal node behind it.
+      if (process.platform !== 'win32') {
+        await fake.waitForStatusKill();
+      }
+    } finally {
+      mock.timers.reset();
+    }
+  });
+});
+
+test('getStatus reports no email when `cursor-agent status` could not fetch the account', async () => {
+  // What the real CLI prints when its account request fails: the stored login is still valid.
+  const output = '✓ Login successful!\nLogged in (unable to fetch user details)';
+  await withFakeCursorAgent(output, async (fake) => {
+    await fake.releaseStatus();
+
+    const status = await new CursorProviderAuth().getStatus();
+    assert.equal(status.error, undefined);
+    assert.equal(status.authenticated, true);
+    // The old 'Logged in' placeholder made the Settings card read "Logged in as Logged in".
+    assert.equal(status.email, null);
+    assert.equal(status.method, 'cli');
+  });
+});