@cloudcli-ai/cloudcli 1.37.3 → 1.37.4

package/server/modules/providers/tests/claude-settings-permissions.test.ts

@@ -0,0 +1,271 @@
+import assert from 'node:assert/strict';
+import { once } from 'node:events';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import type { AddressInfo } from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import express from 'express';
+
+import providerRouter from '@/modules/providers/provider.routes.js';
+import { claudeSettingsPermissionsService } from '@/modules/providers/services/claude-settings-permissions.service.js';
+
+// Issue #109: the Claude CLI applies the permission rules in its own settings
+// files on top of the lists CloudCLI passes it, but the Settings panel never
+// showed them. These tests pin the read-only reader behind that view.
+
+type Source = Awaited<ReturnType<typeof claudeSettingsPermissionsService.listRuleSources>>[number];
+
+const withHome = async (run: (homeDir: string) => Promise<void>) => {
+  const homeDir = await mkdtemp(path.join(os.tmpdir(), 'claude-settings-permissions-'));
+  // os.homedir() reads HOME on POSIX and USERPROFILE on Windows.
+  const overridden = { HOME: homeDir, USERPROFILE: homeDir, CLAUDE_CONFIG_DIR: undefined };
+  const original = Object.fromEntries(Object.keys(overridden).map((key) => [key, process.env[key]]));
+  const setEnv = (values: Record<string, string | undefined>) => {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  };
+  setEnv(overridden);
+  try {
+    await run(homeDir);
+  } finally {
+    setEnv(original);
+    await rm(homeDir, { recursive: true, force: true });
+  }
+};
+
+const writeSettings = async (filePath: string, content: unknown) => {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(
+    filePath,
+    typeof content === 'string' || Buffer.isBuffer(content) ? content : JSON.stringify(content),
+  );
+};
+
+const bySource = (sources: Source[], scope: Source['scope']): Source => {
+  const source = sources.find((entry) => entry.scope === scope);
+  assert.ok(source, `expected a ${scope} source`);
+  return source;
+};
+
+test('lists the allow, deny and ask rules of ~/.claude/settings.json and the managed file', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    const managedFile = path.join(homeDir, 'managed', 'managed-settings.json');
+    await writeSettings(userFile, {
+      env: { ANTHROPIC_API_KEY: 'sk-secret' },
+      permissions: {
+        allow: ['Bash(npm run test:*)', 'Read', 'Read', '  ', 42],
+        deny: ['Bash(rm:*)'],
+        ask: ['WebFetch'],
+        defaultMode: 'acceptEdits',
+      },
+    });
+    await writeSettings(managedFile, { permissions: { deny: ['WebSearch'] } });
+
+    const sources = await claudeSettingsPermissionsService.listRuleSources(managedFile);
+
+    assert.deepEqual(bySource(sources, 'user'), {
+      scope: 'user',
+      path: userFile,
+      status: 'ok',
+      // Duplicates, blanks and non-strings are dropped; order is kept.
+      allow: ['Bash(npm run test:*)', 'Read'],
+      deny: ['Bash(rm:*)'],
+      ask: ['WebFetch'],
+    });
+    assert.deepEqual(bySource(sources, 'managed'), {
+      scope: 'managed',
+      path: managedFile,
+      status: 'ok',
+      allow: [],
+      deny: ['WebSearch'],
+      ask: [],
+    });
+    // Nothing but the rule lists leaves the server (the env block holds secrets).
+    assert.doesNotMatch(JSON.stringify(sources), /sk-secret|acceptEdits/);
+  });
+});
+
+test('reports missing files as empty instead of failing', async () => {
+  await withHome(async (homeDir) => {
+    const sources = await claudeSettingsPermissionsService.listRuleSources(
+      path.join(homeDir, 'nowhere', 'managed-settings.json'),
+    );
+
+    for (const source of sources) {
+      assert.equal(source.status, 'missing');
+      assert.deepEqual([source.allow, source.deny, source.ask], [[], [], []]);
+    }
+  });
+});
+
+test('reports invalid JSON, non-object JSON and unreadable paths as invalid without throwing', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    const managedFile = path.join(homeDir, 'managed', 'managed-settings.json');
+    await writeSettings(userFile, '{ "permissions": { "allow": ["Read"], }');
+    await writeSettings(managedFile, '["Read"]');
+
+    let sources = await claudeSettingsPermissionsService.listRuleSources(managedFile);
+    assert.equal(bySource(sources, 'user').status, 'invalid');
+    assert.deepEqual(bySource(sources, 'user').allow, []);
+    assert.equal(bySource(sources, 'managed').status, 'invalid');
+
+    // A directory where the file should be cannot be read either.
+    await rm(userFile);
+    await mkdir(userFile);
+    sources = await claudeSettingsPermissionsService.listRuleSources(managedFile);
+    assert.equal(bySource(sources, 'user').status, 'invalid');
+  });
+});
+
+test('reports a file under a path that is not a directory as missing', async () => {
+  await withHome(async (homeDir) => {
+    // ~/.claude is a plain file, so ~/.claude/settings.json cannot exist (ENOTDIR).
+    await writeFile(path.join(homeDir, '.claude'), 'not a directory');
+
+    const sources = await claudeSettingsPermissionsService.listRuleSources(path.join(homeDir, 'none.json'));
+
+    assert.equal(bySource(sources, 'user').status, 'missing');
+  });
+});
+
+test('reads files saved with a byte order mark, as the CLI does', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    const managedFile = path.join(homeDir, 'managed', 'managed-settings.json');
+    const settings = JSON.stringify({ permissions: { allow: ['Bash(git status)'], deny: ['Bash(rm:*)'] } });
+    // UTF-8 with BOM (older Notepad) and UTF-16LE with BOM (Windows PowerShell 5.1 Out-File).
+    await writeSettings(userFile, Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), Buffer.from(settings, 'utf8')]));
+    await writeSettings(managedFile, Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(settings, 'utf16le')]));
+
+    const sources = await claudeSettingsPermissionsService.listRuleSources(managedFile);
+
+    for (const scope of ['user', 'managed'] as const) {
+      const source = bySource(sources, scope);
+      assert.equal(source.status, 'ok', `${scope} file`);
+      assert.deepEqual(source.allow, ['Bash(git status)']);
+      assert.deepEqual(source.deny, ['Bash(rm:*)']);
+    }
+  });
+});
+
+test('treats an empty or whitespace-only file as valid with no rules, as the CLI does', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    const managedFile = path.join(homeDir, 'managed', 'managed-settings.json');
+    await writeSettings(userFile, '');
+    await writeSettings(managedFile, ' \n\t\r\n');
+
+    const sources = await claudeSettingsPermissionsService.listRuleSources(managedFile);
+
+    for (const source of sources) {
+      assert.equal(source.status, 'ok', `${source.scope} file`);
+      assert.deepEqual([source.allow, source.deny, source.ask], [[], [], []]);
+    }
+  });
+});
+
+test('reports a file over the CLI 2 MB limit as invalid, since the CLI skips it', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    await writeSettings(userFile, { permissions: { allow: ['Read'] }, padding: 'x'.repeat(2 * 1024 * 1024) });
+
+    const sources = await claudeSettingsPermissionsService.listRuleSources(path.join(homeDir, 'none.json'));
+
+    assert.equal(bySource(sources, 'user').status, 'invalid');
+    assert.deepEqual(bySource(sources, 'user').allow, []);
+  });
+});
+
+test('a settings file without a permissions block is valid and adds no rules', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    await writeSettings(userFile, { model: 'opus' });
+
+    let sources = await claudeSettingsPermissionsService.listRuleSources(path.join(homeDir, 'none.json'));
+    assert.equal(bySource(sources, 'user').status, 'ok');
+    assert.deepEqual(bySource(sources, 'user').allow, []);
+
+    // A rule list that is not an array adds no rules either.
+    await writeSettings(userFile, { permissions: { allow: 'Read' } });
+    sources = await claudeSettingsPermissionsService.listRuleSources(path.join(homeDir, 'none.json'));
+    assert.equal(bySource(sources, 'user').status, 'ok');
+    assert.deepEqual(bySource(sources, 'user').allow, []);
+  });
+});
+
+test('reads the managed file from the fixed path the CLI uses on each OS', async () => {
+  const expected = {
+    darwin: '/Library/Application Support/ClaudeCode/managed-settings.json',
+    win32: 'C:\\Program Files\\ClaudeCode\\managed-settings.json',
+    linux: '/etc/claude-code/managed-settings.json',
+  };
+  const originalPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+  assert.ok(originalPlatform);
+  await withHome(async () => {
+    try {
+      for (const [platform, managedPath] of Object.entries(expected)) {
+        Object.defineProperty(process, 'platform', { ...originalPlatform, value: platform });
+        const sources = await claudeSettingsPermissionsService.listRuleSources();
+        assert.equal(bySource(sources, 'managed').path, managedPath, platform);
+      }
+    } finally {
+      Object.defineProperty(process, 'platform', originalPlatform);
+    }
+  });
+});
+
+test('follows CLAUDE_CONFIG_DIR like the CLI does', async () => {
+  await withHome(async (homeDir) => {
+    const configDir = path.join(homeDir, 'custom-claude');
+    await writeSettings(path.join(configDir, 'settings.json'), { permissions: { allow: ['Edit'] } });
+    process.env.CLAUDE_CONFIG_DIR = configDir;
+
+    const sources = await claudeSettingsPermissionsService.listRuleSources(path.join(homeDir, 'none.json'));
+
+    assert.equal(bySource(sources, 'user').path, path.join(configDir, 'settings.json'));
+    assert.deepEqual(bySource(sources, 'user').allow, ['Edit']);
+
+    // A relative value would resolve against the server's cwd, not the CLI's
+    // project folder, so the reader keeps the default location instead.
+    process.env.CLAUDE_CONFIG_DIR = 'custom-claude';
+    const fallback = await claudeSettingsPermissionsService.listRuleSources(path.join(homeDir, 'none.json'));
+    assert.equal(bySource(fallback, 'user').path, path.join(homeDir, '.claude', 'settings.json'));
+  });
+});
+
+test('GET /api/providers/claude/settings-permissions serves the sources and never writes the files', async () => {
+  await withHome(async (homeDir) => {
+    const userFile = path.join(homeDir, '.claude', 'settings.json');
+    const original = JSON.stringify({ permissions: { allow: ['Bash(git status)'] } });
+    await writeSettings(userFile, original);
+
+    const app = express().use('/api/providers', providerRouter);
+    const server = app.listen(0, '127.0.0.1');
+    await once(server, 'listening');
+    try {
+      const { port } = server.address() as AddressInfo;
+      const response = await fetch(`http://127.0.0.1:${port}/api/providers/claude/settings-permissions`);
+      const payload = await response.json() as { success: boolean; data: { sources: Source[] } };
+
+      assert.equal(response.status, 200);
+      assert.equal(payload.success, true);
+      const user = bySource(payload.data.sources, 'user');
+      assert.equal(user.path, userFile);
+      assert.deepEqual(user.allow, ['Bash(git status)']);
+      assert.equal(await readFile(userFile, 'utf8'), original);
+    } finally {
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+      });
+    }
+  });
+});

package/server/modules/providers/tests/codex-models.test.ts

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import test from 'node:test';
+
+import { CODEX_PREDEFINED_MODELS } from '@/modules/providers/list/codex/codex-models.provider.js';
+
+const require = createRequire(import.meta.url);
+
+const findCodexModel = (value: string) =>
+  CODEX_PREDEFINED_MODELS.OPTIONS.find((option) => option.value === value);
+
+test('lists GPT-6 Sol and GPT-6 Luna with the effort levels the Codex CLI accepts', () => {
+  const sol = findCodexModel('gpt-6-sol');
+  assert.equal(sol?.label, 'GPT-6 Sol');
+  assert.equal(sol?.effort?.default, 'medium');
+  assert.deepEqual(
+    sol?.effort?.values.map((effort) => effort.value),
+    ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'],
+  );
+
+  const luna = findCodexModel('gpt-6-luna');
+  assert.equal(luna?.label, 'GPT-6 Luna');
+  assert.equal(luna?.effort?.default, 'medium');
+  assert.deepEqual(
+    luna?.effort?.values.map((effort) => effort.value),
+    ['low', 'medium', 'high', 'xhigh', 'max'],
+  );
+});
+
+test('bundles a Codex CLI new enough to know the GPT-6 Sol and Luna models', () => {
+  // Codex only ships metadata for gpt-6-sol / gpt-6-luna from 0.155.0 on. An
+  // older CLI still sends the request, but on fallback metadata: it warns
+  // "Model metadata ... not found" and quietly drops `ultra` to `medium`.
+  const { version } = require('@openai/codex/package.json') as { version: string };
+  const [major, minor] = version.split('.').map(Number);
+  assert.ok(major > 0 || minor >= 155, `bundled @openai/codex ${version} predates 0.155.0`);
+});

package/server/modules/providers/tests/codex-runtime.test.ts

@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import path from 'node:path';
 import test from 'node:test';
 
 import { Codex } from '@openai/codex-sdk';
@@ -56,3 +57,38 @@ for (const resumed of [false, true]) {
     });
   }
 }
+
+for (const command of ['', '  \n\t']) {
+  test(`Codex supplies a prompt for an image-only turn (${JSON.stringify(command)})`, async (t) => {
+    let capturedPrompt: unknown;
+    const imagePath = path.join(process.cwd(), 'public', 'favicon.png');
+    const thread = {
+      id: 'native-thread',
+      async runStreamed(prompt: unknown) {
+        capturedPrompt = prompt;
+        return { events: (async function* () {
+          yield { type: 'thread.started', thread_id: 'native-thread' };
+        })() };
+      },
+    } as unknown as Thread;
+
+    t.mock.method(Codex.prototype, 'startThread', () => thread);
+    const context: ProviderRuntimeContext = {
+      resolveProviderSessionId: () => null,
+      resolveResumeModel: async () => 'test-model',
+      getProviderModels: async () => ({ OPTIONS: [], DEFAULT: 'test-model' }),
+      normalizeMessage: () => [],
+      isProviderInstalled: async () => true,
+    };
+
+    await codexRuntime.run(command, {
+      cwd: process.cwd(),
+      images: [{ path: imagePath, mimeType: 'image/png' }],
+    }, { isWebSocketWriter: true, send: () => {} }, context);
+
+    assert.deepEqual(capturedPrompt, [
+      { type: 'text', text: 'Please analyze the attached image(s).' },
+      { type: 'local_image', path: imagePath },
+    ]);
+  });
+}

package/server/modules/providers/tests/codex-sessions.test.ts

@@ -551,3 +551,62 @@ test('an exec script that updates the plan yields the steps it set', () => {
     ],
   }]);
 });
+
+
+test('Codex history restores user prompts from typed item_completed rows', { concurrency: false }, async () => {
+  const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'codex-typed-user-history-'));
+  const workspacePath = path.join(tempRoot, 'workspace');
+  await mkdir(workspacePath, { recursive: true });
+  const restoreHomeDir = patchHomeDir(tempRoot);
+
+  try {
+    const providerSessionId = 'codex-typed-1';
+    const prompt = 'Typed prompt that must survive a refresh';
+    const transcriptPath = path.join(tempRoot, '.codex', 'sessions', '2026', '07', '07', 'rollout-' + providerSessionId + '.jsonl');
+    await mkdir(path.dirname(transcriptPath), { recursive: true });
+    const lineEnd = String.fromCharCode(10);
+    const typedLine = JSON.stringify({
+      timestamp: '2026-09-07T17:59:17.000Z',
+      type: 'event_msg',
+      payload: {
+        type: 'item_completed',
+        turn_id: 'typed-turn-1',
+        item: {
+          type: 'UserMessage',
+          id: 'item-user-1',
+          content: [
+            { type: 'text', text: prompt, text_elements: [] },
+            { type: 'local_image', path: '/tmp/prompt-picture.png', detail: null },
+          ],
+        },
+      },
+    });
+    const wireUserEcho = JSON.stringify({
+      timestamp: '2026-09-07T17:59:19.000Z',
+      type: 'response_item',
+      payload: { type: 'message', role: 'user', content: [{ type: 'input_text', text: prompt }] },
+    });
+    await writeFile(
+      transcriptPath,
+      [JSON.stringify({ type: 'session_meta', payload: { id: providerSessionId, cwd: workspacePath } }), typedLine, wireUserEcho].join(lineEnd) + lineEnd,
+      'utf8',
+    );
+
+    await withIsolatedDatabase(async () => {
+      sessionsDb.createAppSession('app-typed-1', 'codex', workspacePath);
+      sessionsDb.assignProviderSessionId('app-typed-1', providerSessionId);
+      await new CodexSessionSynchronizer().synchronize();
+
+      const history = await new CodexSessionsProvider().fetchHistory('app-typed-1');
+      const users = history.messages.filter((message) => message.role === 'user');
+      const images = users[0]?.images as Array<{ path?: string; data?: string }> | undefined;
+
+      assert.equal(users.length, 1, 'the wire user echo must not duplicate the typed prompt');
+      assert.equal(users[0]?.content, prompt);
+      assert.equal(images?.[0]?.path, '/tmp/prompt-picture.png');
+    });
+  } finally {
+    restoreHomeDir();
+    await rm(tempRoot, { recursive: true, force: true });
+  }
+});

package/server/modules/providers/tests/cursor-auth.test.ts

@@ -0,0 +1,187 @@
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { chmod, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import test, { mock } from 'node:test';
+
+import { CursorProviderAuth } from '@/modules/providers/list/cursor/cursor-auth.provider.js';
+
+const findEnvKey = (name: string) =>
+  Object.keys(process.env).find((key) => key.toLowerCase() === name.toLowerCase()) || name;
+
+// What the real CLI prints when it is logged in and the account request succeeded.
+const LOGGED_IN_OUTPUT = '✓ Logged in as cursor-user@example.com';
+
+// A stand-in for the real CLI: `--version` answers at once, while `status` drops a started
+// marker and keeps running (like the real one does while it fetches the account details from
+// Cursor's API) until the test creates the release file, then prints the configured output.
+// It records a SIGTERM so the tests can check that a timed-out check kills it.
+const FAKE_CURSOR_AGENT_SCRIPT = `
+const fs = require('node:fs');
+const path = require('node:path');
+const command = process.argv[2];
+const markerDir = process.env.CURSOR_FAKE_MARKER_DIR;
+if (command === '--version') {
+  console.log('2026.07.20-test');
+  process.exit(0);
+}
+if (command === 'status') {
+  process.on('SIGTERM', () => {
+    fs.writeFileSync(path.join(markerDir, 'status-killed'), '');
+    process.exit(143);
+  });
+  fs.writeFileSync(path.join(markerDir, 'status-started'), '');
+  // Never outlive a broken test run (its cleanup deletes the marker dir).
+  const giveUpAt = Date.now() + 30000;
+  const poll = () => {
+    if (!fs.existsSync(markerDir) || Date.now() > giveUpAt) {
+      process.exit(1);
+    }
+    if (fs.existsSync(path.join(markerDir, 'release-status'))) {
+      process.stdout.write(fs.readFileSync(path.join(markerDir, 'status-output'), 'utf8') + '\\n');
+      return;
+    }
+    setTimeout(poll, 20);
+  };
+  poll();
+}
+`;
+
+async function createFakeCursorAgent(binDir: string) {
+  await writeFile(path.join(binDir, 'cursor-agent.cjs'), FAKE_CURSOR_AGENT_SCRIPT, 'utf8');
+
+  if (process.platform === 'win32') {
+    const commandPath = path.join(binDir, 'cursor-agent.cmd');
+    await writeFile(commandPath, '@echo off\r\nnode "%~dp0cursor-agent.cjs" %*\r\n', 'utf8');
+    return;
+  }
+
+  // exec so the provider's kill() on timeout reaches the node process itself.
+  const commandPath = path.join(binDir, 'cursor-agent');
+  await writeFile(commandPath, '#!/bin/sh\nexec node "$(dirname "$0")/cursor-agent.cjs" "$@"\n', 'utf8');
+  await chmod(commandPath, 0o755);
+}
+
+// Waits in real time (the tests mock only setTimeout, not setImmediate or Date) and fails
+// instead of hanging when the fake never gets there.
+async function waitForFile(filePath: string, description: string) {
+  const giveUpAt = Date.now() + 15_000;
+  while (!existsSync(filePath)) {
+    if (Date.now() > giveUpAt) {
+      assert.fail(`timed out waiting for ${description}`);
+    }
+    await new Promise<void>((resolve) => setImmediate(resolve));
+  }
+}
+
+type FakeCursorAgent = {
+  releaseStatus: () => Promise<void>;
+  waitForStatusStart: () => Promise<void>;
+  waitForStatusKill: () => Promise<void>;
+};
+
+const withFakeCursorAgent = async (statusOutput: string, fn: (fake: FakeCursorAgent) => Promise<void>) => {
+  const binDir = await mkdtemp(path.join(os.tmpdir(), 'cursor-auth-test-'));
+  const fake: FakeCursorAgent = {
+    releaseStatus: () => writeFile(path.join(binDir, 'release-status'), '', 'utf8'),
+    waitForStatusStart: () => waitForFile(path.join(binDir, 'status-started'), 'the fake `status` to start'),
+    waitForStatusKill: () => waitForFile(path.join(binDir, 'status-killed'), 'the fake `status` to get SIGTERM'),
+  };
+  const pathKey = findEnvKey('PATH');
+  const pathExtKey = findEnvKey('PATHEXT');
+  const previousPath = process.env[pathKey];
+  const previousPathExt = process.env[pathExtKey];
+  const previousMarkerDir = process.env.CURSOR_FAKE_MARKER_DIR;
+
+  try {
+    await createFakeCursorAgent(binDir);
+    await writeFile(path.join(binDir, 'status-output'), statusOutput, 'utf8');
+    process.env[pathKey] = `${binDir}${path.delimiter}${previousPath || ''}`;
+    process.env.CURSOR_FAKE_MARKER_DIR = binDir;
+    if (process.platform === 'win32') {
+      process.env[pathExtKey] = previousPathExt?.toUpperCase().includes('.CMD')
+        ? previousPathExt
+        : `.COM;.EXE;.BAT;.CMD${previousPathExt ? `;${previousPathExt}` : ''}`;
+    }
+
+    await fn(fake);
+  } finally {
+    // Lets a fake `status` that is still polling exit right away.
+    await fake.releaseStatus().catch(() => {});
+    process.env[pathKey] = previousPath;
+    if (previousPathExt === undefined) {
+      delete process.env[pathExtKey];
+    } else {
+      process.env[pathExtKey] = previousPathExt;
+    }
+    if (previousMarkerDir === undefined) {
+      delete process.env.CURSOR_FAKE_MARKER_DIR;
+    } else {
+      process.env.CURSOR_FAKE_MARKER_DIR = previousMarkerDir;
+    }
+    await rm(binDir, { recursive: true, force: true });
+  }
+};
+
+test('getStatus waits for a logged-in `cursor-agent status` that takes longer than 5 s (#551)', async () => {
+  await withFakeCursorAgent(LOGGED_IN_OUTPUT, async (fake) => {
+    // getStatus() arms its timeout before it spawns `status`, so it must see the mocked setTimeout.
+    mock.timers.enable({ apis: ['setTimeout'] });
+    try {
+      const pending = new CursorProviderAuth().getStatus();
+      // Move the clock only once `status` runs, i.e. once the timeout is armed.
+      await fake.waitForStatusStart();
+
+      // CLI startup alone took 3-6 s on a busy host; the account request adds a network round trip.
+      mock.timers.tick(10_000);
+      await fake.releaseStatus();
+
+      const status = await pending;
+      assert.equal(status.error, undefined);
+      assert.equal(status.authenticated, true);
+      assert.equal(status.email, 'cursor-user@example.com');
+      assert.equal(status.method, 'cli');
+    } finally {
+      mock.timers.reset();
+    }
+  });
+});
+
+test('getStatus still gives up on, and kills, a `cursor-agent status` that never answers', async () => {
+  await withFakeCursorAgent(LOGGED_IN_OUTPUT, async (fake) => {
+    mock.timers.enable({ apis: ['setTimeout'] });
+    try {
+      const pending = new CursorProviderAuth().getStatus();
+      await fake.waitForStatusStart();
+
+      mock.timers.tick(60_000);
+
+      const status = await pending;
+      assert.equal(status.installed, true);
+      assert.equal(status.authenticated, false);
+      assert.equal(status.error, 'Command timeout');
+      // On Windows kill() ends the .cmd shim's cmd.exe, which does not signal node behind it.
+      if (process.platform !== 'win32') {
+        await fake.waitForStatusKill();
+      }
+    } finally {
+      mock.timers.reset();
+    }
+  });
+});
+
+test('getStatus reports no email when `cursor-agent status` could not fetch the account', async () => {
+  // What the real CLI prints when its account request fails: the stored login is still valid.
+  const output = '✓ Login successful!\nLogged in (unable to fetch user details)';
+  await withFakeCursorAgent(output, async (fake) => {
+    await fake.releaseStatus();
+
+    const status = await new CursorProviderAuth().getStatus();
+    assert.equal(status.error, undefined);
+    assert.equal(status.authenticated, true);
+    // The old 'Logged in' placeholder made the Settings card read "Logged in as Logged in".
+    assert.equal(status.email, null);
+    assert.equal(status.method, 'cli');
+  });
+});