@hearsay-tools/squawk 0.0.0-stage → 0.17.0-dev.5685

package/scripts/probe-cursor-print.mjs

@@ -0,0 +1,699 @@
+#!/usr/bin/env node
+import { productEnv } from './product-env.mjs';
+// Opt-in vendor probe. It saves only a small allowlisted summary, never a transcript.
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { parseArgs } from 'node:util';
+import { deflateSync } from 'node:zlib';
+
+const { values } = parseArgs({ options: {
+  model: { type: 'string' },
+  'output-dir': { type: 'string' },
+  case: { type: 'string' },
+} });
+if (!values.model || !values['output-dir'] || !['native-question', 'delegation', 'mcp', 'plugins', 'resume-missing', 'fields', 'plugin-lifecycle', 'errors'].includes(values.case)) {
+  process.stderr.write('Usage: probe-cursor-print.mjs --model <discovered-id> --output-dir <path> --case native-question|delegation|mcp|plugins|resume-missing|fields|plugin-lifecycle|errors\n');
+  process.exit(1);
+}
+
+const bin = productEnv('CURSOR_BIN') || 'agent';
+const scratch = mkdtempSync(join(tmpdir(), 'cez-cursor-print-probe-'));
+const checkout = join(scratch, 'checkout');
+const outputDir = resolve(values['output-dir']);
+
+function git(args) {
+  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 15_000 });
+  if (result.status !== 0) throw new Error(`git ${args[0]} failed`);
+  return result.stdout.trim();
+}
+
+// Keep the probed build installed while it is probed (hearsay-tools/cezarion#1257). A build
+// that rejects the hidden option exits 1 with commander's unknown-option line before any work,
+// so the probe reruns that call without it and leaves it out from then on.
+let disableAutoUpdate = true;
+async function runAgent(args, cwd, timeoutMs, env = process.env) {
+  const run = await runAgentOnce(disableAutoUpdate ? ['--disable-auto-update', ...args] : args, cwd, timeoutMs, env);
+  if (!disableAutoUpdate || run.code !== 1 || !run.stderr.includes("unknown option '--disable-auto-update'")) return run;
+  disableAutoUpdate = false;
+  return runAgentOnce(args, cwd, timeoutMs, env);
+}
+
+function runAgentOnce(args, cwd, timeoutMs, env) {
+  return new Promise((resolveRun, rejectRun) => {
+    const child = spawn(bin, args, { cwd, env, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    let truncated = false;
+    let timedOut = false;
+    const append = (current, chunk) => {
+      if (current.length + chunk.length > 1_048_576) { truncated = true; return current; }
+      return current + chunk;
+    };
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', chunk => { stdout = append(stdout, chunk); });
+    child.stderr.on('data', chunk => { stderr = append(stderr, chunk); });
+    const signalGroup = signal => {
+      try { process.kill(process.platform === 'win32' ? child.pid : -child.pid, signal); } catch { /* already gone */ }
+    };
+    const groupAlive = () => {
+      try { process.kill(process.platform === 'win32' ? child.pid : -child.pid, 0); return true; } catch { return false; }
+    };
+    const timer = setTimeout(() => { timedOut = true; signalGroup('SIGTERM'); }, timeoutMs);
+    const escalation = setTimeout(() => signalGroup('SIGKILL'), timeoutMs + 2_000);
+    child.on('error', error => { clearTimeout(timer); clearTimeout(escalation); rejectRun(error); });
+    child.on('close', async code => {
+      clearTimeout(timer);
+      clearTimeout(escalation);
+      signalGroup('SIGTERM');
+      await new Promise(done => setTimeout(done, 500));
+      if (groupAlive()) signalGroup('SIGKILL');
+      await new Promise(done => setTimeout(done, 100));
+      resolveRun({ code, stdout, stderr, truncated, timedOut, processGroupGone: !groupAlive() });
+    });
+  });
+}
+
+function framesOf(stdout) {
+  return stdout.split('\n').flatMap(line => {
+    try { return [JSON.parse(line)]; } catch { return []; }
+  });
+}
+
+function toolKindsOf(frames) {
+  return [...new Set(frames.flatMap(frame => frame.type === 'tool_call'
+    ? Object.keys(frame.tool_call ?? {}).filter(key => key.endsWith('ToolCall')) : []))].sort();
+}
+
+function resultOf(frames) {
+  return frames.findLast(frame => frame.type === 'result');
+}
+
+function askQuestionQueryOf(frames) {
+  const request = frames.find(frame => frame.type === 'interaction_query' && frame.subtype === 'request' && frame.query_type === 'askQuestionInteractionQuery');
+  const response = frames.find(frame => frame.type === 'interaction_query' && frame.subtype === 'response' && frame.query_type === 'askQuestionInteractionQuery');
+  const rejection = response?.response?.askQuestionInteractionResponse?.result?.rejected?.reason;
+  return { request, response, rejection };
+}
+
+function askQuestionKindOf(response, rejection) {
+  return {
+    responseKind: rejection ? 'rejected' : response ? 'other' : 'none',
+    rejectionKind: typeof rejection === 'string' && rejection.includes('skipped') ? 'skipped' : rejection ? 'other' : 'none',
+  };
+}
+
+function askQuestionSessionOf(request, response) {
+  return {
+    sameSession: Boolean(request && response && request.session_id === response.session_id),
+    responseDelayMs: request && response ? response.timestamp_ms - request.timestamp_ms : null,
+  };
+}
+
+function nativeQuestionOutcome(run, request, response, rejection) {
+  return run.code === 0 && !run.timedOut && !run.truncated && request && response && request.session_id === response.session_id && rejection?.includes('skipped')
+    ? 'blocked' : request && response ? 'unqualified' : 'inconclusive';
+}
+
+async function probeNativeQuestion(version) {
+  const run = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, '--allowed-tools', 'ask_question_tool_call',
+    'Use the native AskQuestion tool now. Ask me to choose Alpha or Beta. Do not answer it yourself and do not use any other tool.',
+  ], checkout, 45_000);
+
+  const frames = framesOf(run.stdout);
+  const { request, response, rejection } = askQuestionQueryOf(frames);
+  return {
+    schema: 1,
+    case: 'native-question',
+    cliVersion: version,
+    model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--allowed-tools ask_question_tool_call'],
+    exitCode: run.code,
+    timedOut: run.timedOut,
+    outputTruncated: run.truncated,
+    nativeQuestionRequested: Boolean(request),
+    nativeQuestionAnswered: Boolean(response),
+    ...askQuestionKindOf(response, rejection),
+    ...askQuestionSessionOf(request, response),
+    outcome: nativeQuestionOutcome(run, request, response, rejection),
+  };
+}
+
+const nativeDelegationEntries = [
+  'task_tool_call', 'create_agent_tool_call', 'adopt_tool_call',
+  'send_to_agent_tool_call', 'send_message_tool_call',
+  'get_agent_status_tool_call', 'stop_agent_tool_call',
+  'read_agent_transcript_tool_call', 'start_grind_execution_tool_call',
+  'start_grind_planning_tool_call',
+];
+
+async function discoverSafeAllowedTools() {
+  // Cursor validates this public proto-oneof list before inference. The name
+  // is deliberately invalid; no model or native worker can run in this step.
+  const catalogRun = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, '--allowed-tools', 'definitelyNotATool', 'Reply OK.',
+  ], checkout, 15_000);
+  const names = catalogRun.stderr.match(/Expected one of: ([a-z_, ]+)/)?.[1]
+    ?.split(',').map(value => value.trim()).filter(Boolean) ?? [];
+  const safeAllowedTools = names.filter(name => !nativeDelegationEntries.includes(name));
+  return { catalogRun, names, safeAllowedTools };
+}
+
+function writeCanary(name) {
+  const canary = randomBytes(16).toString('hex');
+  writeFileSync(join(checkout, name), `${canary}\n`, { mode: 0o600 });
+  return canary;
+}
+
+const delegationPrompt = name => `Use the native Read tool to read ${name}, then reply with its exact contents. Do not use any other tool.`;
+
+async function delegationReadTurn(args) {
+  return runAgent(['-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, ...args], checkout, 45_000);
+}
+
+function delegationTurnFacts(frames, canary) {
+  return { tools: toolKindsOf(frames), sawCanary: String(resultOf(frames)?.result ?? '').includes(canary) };
+}
+
+function sameDelegationSession(firstId, secondFrames, thirdFrames) {
+  return Boolean(firstId && firstId === resultOf(secondFrames)?.session_id
+    && firstId === resultOf(thirdFrames)?.session_id);
+}
+
+function delegationCatalogVerified(catalogRun, names, noDelegationEntriesInAllowlist) {
+  return catalogRun.code === 1 && !catalogRun.timedOut
+    && names.includes('task_tool_call') && names.includes('create_agent_tool_call')
+    && nativeDelegationEntries.every(name => names.includes(name)) && noDelegationEntriesInAllowlist;
+}
+
+function delegationTurnVerified(run, facts, toolExpected) {
+  return run?.code === 0 && !run.timedOut && !run.truncated
+    && facts.tools.includes('readToolCall') === toolExpected && facts.sawCanary === toolExpected;
+}
+
+function delegationOutcome(catalogRun, names, noDelegationEntriesInAllowlist, first, firstFacts, second, secondFacts, third, thirdFacts, sameSession) {
+  return delegationCatalogVerified(catalogRun, names, noDelegationEntriesInAllowlist)
+    && delegationTurnVerified(first, firstFacts, true)
+    && delegationTurnVerified(second, secondFacts, false)
+    && delegationTurnVerified(third, thirdFacts, true)
+    && sameSession ? 'pass' : 'blocked';
+}
+
+async function probeDelegation(version) {
+  const { catalogRun, names, safeAllowedTools } = await discoverSafeAllowedTools();
+
+  const firstCanary = writeCanary('probe-first.txt');
+  const first = await delegationReadTurn(['--allowed-tools', 'read_tool_call', delegationPrompt('probe-first.txt')]);
+  const firstFrames = framesOf(first.stdout);
+  const firstId = resultOf(firstFrames)?.session_id;
+
+  const secondCanary = writeCanary('probe-second.txt');
+  const second = firstId ? await delegationReadTurn(['--resume', firstId,
+    '--allowed-tools', 'read_todos_tool_call', delegationPrompt('probe-second.txt')]) : undefined;
+  const secondFrames = second ? framesOf(second.stdout) : [];
+
+  const thirdCanary = writeCanary('probe-third.txt');
+  const third = firstId && second ? await delegationReadTurn(['--resume', firstId,
+    '--allowed-tools', safeAllowedTools.join(','), delegationPrompt('probe-third.txt')]) : undefined;
+  const thirdFrames = third ? framesOf(third.stdout) : [];
+
+  const firstFacts = delegationTurnFacts(firstFrames, firstCanary);
+  const secondFacts = delegationTurnFacts(secondFrames, secondCanary);
+  const thirdFacts = delegationTurnFacts(thirdFrames, thirdCanary);
+  const sameSession = sameDelegationSession(firstId, secondFrames, thirdFrames);
+  const noDelegationEntriesInAllowlist = nativeDelegationEntries.every(name => !safeAllowedTools.includes(name));
+  return {
+    schema: 1,
+    case: 'delegation',
+    cliVersion: version,
+    model: values.model,
+    testedMechanism: '--allowed-tools',
+    catalogValidatedBeforeInference: catalogRun.code === 1 && names.includes('task_tool_call'),
+    nativeDelegationEntries,
+    safeAllowedTools,
+    freshReadToolCalled: firstFacts.tools.includes('readToolCall'),
+    freshReadSucceeded: firstFacts.sawCanary,
+    resumedReadToolCalled: secondFacts.tools.includes('readToolCall'),
+    resumedReadSucceeded: secondFacts.sawCanary,
+    fullAllowlistReadToolCalled: thirdFacts.tools.includes('readToolCall'),
+    fullAllowlistReadSucceeded: thirdFacts.sawCanary,
+    noDelegationEntriesInAllowlist,
+    sameNativeSession: sameSession,
+    directTaskCallAttempted: false,
+    outcome: delegationOutcome(catalogRun, names, noDelegationEntriesInAllowlist, first, firstFacts, second, secondFacts, third, thirdFacts, sameSession),
+  };
+}
+
+function mcpCatalogSafe(catalogRun, names, safeAllowedTools) {
+  return catalogRun.code === 1 && names.includes('mcp_tool_call')
+    && nativeDelegationEntries.every(name => names.includes(name) && !safeAllowedTools.includes(name));
+}
+
+function mcpOutcome(catalogSafe, first, second) {
+  return catalogSafe && first.ok && second?.ok && first.id === second.id
+    && !first.stderrMentionsApproval && !second.stderrMentionsApproval ? 'pass' : 'blocked';
+}
+
+async function probeMcp(version) {
+  const { catalogRun, names, safeAllowedTools } = await discoverSafeAllowedTools();
+  const pluginDir = join(checkout, 'cez-probe-plugin');
+  mkdirSync(pluginDir);
+  writeFileSync(join(pluginDir, 'plugin.json'), JSON.stringify({ name: 'cez-probe-plugin', version: '0.0.1', description: 'Inert local qualification plugin' }));
+  writeFileSync(join(pluginDir, 'mcp.json'), JSON.stringify({ mcpServers: { 'cez-probe': {
+    type: 'stdio', command: 'node', args: [join(pluginDir, 'server.mjs')],
+    env: { CEZ_PROBE_CANARY: '${CEZ_PROBE_CANARY}' },
+  } } }));
+  writeFileSync(join(pluginDir, 'server.mjs'), `
+import { createHash } from 'node:crypto';
+import { writeFileSync } from 'node:fs';
+writeFileSync(new URL('./started', import.meta.url), '1');
+let buffer = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {
+  buffer += chunk;
+  while (buffer.includes('\\n')) {
+    const end = buffer.indexOf('\\n');
+    const line = buffer.slice(0, end);
+    buffer = buffer.slice(end + 1);
+    let request;
+    try { request = JSON.parse(line); } catch { continue; }
+    if (request.id === undefined) continue;
+    let result = {};
+    if (request.method === 'initialize') result = {
+      protocolVersion: request.params?.protocolVersion || '2024-11-05',
+      capabilities: { tools: {} }, serverInfo: { name: 'cez-probe', version: '0.0.1' },
+    };
+    if (request.method === 'tools/list') result = { tools: [{
+      name: 'check_env', description: 'Return a hash of an inherited synthetic environment value',
+      inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    }] };
+    if (request.method === 'tools/call') {
+      writeFileSync(new URL('./called', import.meta.url), '1');
+      result = { content: [{ type: 'text', text: 'env-hash:' + createHash('sha256').update(process.env.CEZ_PROBE_CANARY || '').digest('hex') }], isError: false };
+    }
+    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: request.id, result }) + '\\n');
+  }
+});
+`);
+
+  const runTurn = async (id) => {
+    const canary = randomBytes(16).toString('hex');
+    const expectedHash = createHash('sha256').update(canary).digest('hex');
+    rmSync(join(pluginDir, 'called'), { force: true });
+    const run = await runAgent([
+      '-p', '--force', '--trust', '--output-format', 'stream-json', '--model', values.model,
+      ...(id ? ['--resume', id] : []), '--allowed-tools', safeAllowedTools.join(','),
+      '--plugin-dir', pluginDir,
+      id ? 'The synthetic environment value changed since the last turn. Call cez-probe check_env again now; the previous hash is stale. Report only the new hash. Do not use another tool.'
+        : 'Call the cez-probe MCP check_env tool once and report its hash. Do not use any other tool.',
+    ], checkout, 45_000, { ...process.env, CEZ_PROBE_CANARY: canary });
+    const frames = framesOf(run.stdout);
+    return {
+      id: resultOf(frames)?.session_id,
+      ok: run.code === 0 && !run.timedOut && !run.truncated && existsSync(join(pluginDir, 'called'))
+        && run.stdout.includes(expectedHash) && toolKindsOf(frames).includes('mcpToolCall'),
+      mcpToolCalled: toolKindsOf(frames).includes('mcpToolCall'),
+      serverCalled: existsSync(join(pluginDir, 'called')),
+      environmentHashSeen: run.stdout.includes(expectedHash),
+      stderrMentionsApproval: /approv/i.test(run.stderr),
+    };
+  };
+  const first = await runTurn();
+  const second = first.id ? await runTurn(first.id) : undefined;
+  const catalogSafe = mcpCatalogSafe(catalogRun, names, safeAllowedTools);
+  return {
+    schema: 1, case: 'mcp', cliVersion: version, model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--allowed-tools <non-agent catalog>', '--plugin-dir <disposable local plugin>', '--resume <exact native id>'],
+    environmentBinding: 'MCP env placeholder expanded from per-process environment',
+    globalCursorConfigWritten: false, blanketMcpApprovalUsed: false,
+    catalogSafe, freshToolCalled: first.mcpToolCalled, freshServerCalled: first.serverCalled,
+    freshEnvironmentHashSeen: first.environmentHashSeen,
+    resumedToolCalled: second?.mcpToolCalled ?? false, resumedServerCalled: second?.serverCalled ?? false,
+    resumedEnvironmentHashSeen: second?.environmentHashSeen ?? false,
+    sameNativeSession: Boolean(first.id && first.id === second?.id),
+    stderrMentionsApproval: first.stderrMentionsApproval || Boolean(second?.stderrMentionsApproval),
+    outcome: mcpOutcome(catalogSafe, first, second),
+  };
+}
+
+async function probePlugins(version) {
+  // This project-local disable is a negative control. It never changes a
+  // user's Cursor installation, marketplace state or Claude settings.
+  const claudeSettings = join(checkout, '.claude');
+  mkdirSync(claudeSettings, { recursive: true });
+  writeFileSync(join(claudeSettings, 'settings.json'), JSON.stringify({ enabledPlugins: {
+    'superpowers@apptension-dev': false,
+    'superpowers@claude-plugins-official': false,
+    'superpowers@apptension-toolkit-dev': false,
+  } }));
+  const pluginDir = join(checkout, 'cez-inert-plugin');
+  mkdirSync(pluginDir);
+  writeFileSync(join(pluginDir, 'plugin.json'), JSON.stringify({ name: 'cez-inert-plugin', version: '0.0.1', description: 'Inert qualification plugin' }));
+  const { catalogRun, names, safeAllowedTools } = await discoverSafeAllowedTools();
+  const run = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json', '--model', values.model,
+    '--allowed-tools', safeAllowedTools.join(','), '--plugin-dir', pluginDir,
+    'From your loaded skills, read the Superpowers brainstorming SKILL.md and report its first heading. Do not search the filesystem for a disabled skill.',
+  ], checkout, 45_000);
+  const frames = framesOf(run.stdout);
+  const reads = frames.filter(frame => frame.type === 'tool_call' && frame.tool_call?.readToolCall)
+    .map(frame => JSON.stringify(frame.tool_call.readToolCall));
+  const marketplaceSkillRead = reads.some(read => /\.cursor\/plugins\/cache\/.*superpowers.*SKILL\.md/i.test(read));
+  const claudeSkillRead = reads.some(read => /\.claude\/plugins\/.*superpowers.*SKILL\.md/i.test(read));
+  return {
+    schema: 1, case: 'plugins', cliVersion: version, model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--allowed-tools <non-agent catalog>', '--plugin-dir <disposable inert plugin>'],
+    projectSettings: '.claude/settings.json enabledPlugins=false for known Superpowers IDs in disposable worktree',
+    globalConfigurationWritten: false,
+    catalogValidatedBeforeInference: catalogRun.code === 1 && names.includes('read_tool_call'),
+    readToolFrames: reads.length, marketplaceSkillRead, claudeSkillRead,
+    outcome: run.code === 0 && !run.timedOut && !run.truncated && marketplaceSkillRead
+      ? 'blocked' : 'inconclusive',
+  };
+}
+
+async function probeResumeMissing(version) {
+  const nonexistentId = randomUUID();
+  const run = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json', '--model', values.model,
+    '--resume', nonexistentId, '--allowed-tools', 'read_todos_tool_call',
+    'What exact phrase did I ask you to remember in the previous turn of this chat? If this chat has no previous turn, answer NO_PRIOR_TURN.',
+  ], checkout, 45_000);
+  const frames = framesOf(run.stdout);
+  const result = resultOf(frames);
+  const successWithRequestedId = run.code === 0 && result?.subtype === 'success'
+    && result.session_id === nonexistentId;
+  const noPriorTurn = String(result?.result ?? '').includes('NO_PRIOR_TURN');
+  return {
+    schema: 1, case: 'resume-missing', cliVersion: version, model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--resume <random never-seen UUID>', '--allowed-tools read_todos_tool_call'],
+    exitCode: run.code, timedOut: run.timedOut, outputTruncated: run.truncated,
+    successWithRequestedId, noPriorTurn,
+    missingSessionError: /not found|missing|resume|session/i.test(run.stderr),
+    outcome: !run.timedOut && !run.truncated && successWithRequestedId && noPriorTurn
+      ? 'blocked' : run.code !== 0 && !result ? 'pass' : 'inconclusive',
+  };
+}
+
+function writeStripedPng(path) {
+  // A small randomized red/blue control, generated locally and never retained.
+  const colors = Math.random() < 0.5
+    ? [[255, 0, 0], [0, 0, 255]] : [[0, 0, 255], [255, 0, 0]];
+  const width = 40;
+  const height = 20;
+  const raw = Buffer.concat(Array.from({ length: height }, () => Buffer.from([
+    0, ...Array.from({ length: width }, (_, x) => colors[x < width / 2 ? 0 : 1]).flat(),
+  ])));
+  const crc = bytes => {
+    let value = 0xffffffff;
+    for (const byte of bytes) {
+      value ^= byte;
+      for (let bit = 0; bit < 8; bit++) value = (value >>> 1) ^ (value & 1 ? 0xedb88320 : 0);
+    }
+    return (value ^ 0xffffffff) >>> 0;
+  };
+  const chunk = (type, data) => {
+    const label = Buffer.from(type);
+    const size = Buffer.alloc(4);
+    size.writeUInt32BE(data.length);
+    const checksum = Buffer.alloc(4);
+    checksum.writeUInt32BE(crc(Buffer.concat([label, data])));
+    return Buffer.concat([size, label, data, checksum]);
+  };
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(width, 0);
+  header.writeUInt32BE(height, 4);
+  header[8] = 8;
+  header[9] = 2;
+  writeFileSync(path, Buffer.concat([
+    Buffer.from('89504e470d0a1a0a', 'hex'), chunk('IHDR', header),
+    chunk('IDAT', deflateSync(raw)), chunk('IEND', Buffer.alloc(0)),
+  ]));
+  return colors[0][0] === 255 ? 'RED_BLUE' : 'BLUE_RED';
+}
+
+async function fieldsModelChecks() {
+  const modelListing = await runAgent(['--list-models'], checkout, 15_000);
+  const modelLines = modelListing.stdout.split('\n');
+  const advertisedModel = modelListing.code === 0 && modelLines.some(line => line.startsWith(`${values.model} - `));
+  const lowEffortModel = values.model.replace(/-medium$/, '-low');
+  const lowEffortAdvertised = lowEffortModel !== values.model && modelLines.some(line => line.startsWith(`${lowEffortModel} - `));
+  const lowEffort = lowEffortAdvertised ? await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', lowEffortModel, '--allowed-tools', 'read_todos_tool_call', 'Reply OK.',
+  ], checkout, 45_000) : undefined;
+  const invalid = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', 'cez-nonexistent-model-pin', 'Reply OK.',
+  ], checkout, 15_000);
+  const invalidRejectedBeforeInference = invalid.code !== 0
+    && !framesOf(invalid.stdout).some(frame => frame.type === 'assistant' || frame.type === 'result');
+  return { advertisedModel, lowEffortAdvertised, lowEffort, invalidRejectedBeforeInference };
+}
+
+function effortVariantAdmitted(lowEffort) {
+  return lowEffort?.code === 0 && resultOf(framesOf(lowEffort.stdout))?.subtype === 'success';
+}
+
+async function fieldsExtraRootTurns() {
+  const extraRoot = join(scratch, 'extra-root');
+  mkdirSync(extraRoot);
+  const canary = randomBytes(12).toString('hex');
+  writeFileSync(join(extraRoot, 'root-canary.txt'), canary, { mode: 0o600 });
+  const image = join(checkout, 'stripes.png');
+  const colorOrder = writeStripedPng(image);
+  const args = [
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, '--allowed-tools', 'read_tool_call',
+    '--add-dir', extraRoot, '--image', image,
+  ];
+  const first = await runAgent([...args,
+    `Read ${join(extraRoot, 'root-canary.txt')} with the native Read tool. Then describe the image's colors from left to right as RED_BLUE or BLUE_RED. Reply with the file contents and that code only.`,
+  ], checkout, 45_000);
+  const firstFrames = framesOf(first.stdout);
+  const firstId = resultOf(firstFrames)?.session_id;
+  const second = firstId ? await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json', '--model', values.model,
+    '--resume', firstId, '--allowed-tools', 'read_todos_tool_call',
+    'What was the image color-order code from the previous turn? Reply with just that code.',
+  ], checkout, 45_000) : undefined;
+  const secondResult = second ? resultOf(framesOf(second.stdout)) : undefined;
+  return { canary, colorOrder, first, firstFrames, firstId, second, secondResult };
+}
+
+function fieldsReadOf(firstFrames) {
+  const rootRead = firstFrames.some(frame => frame.type === 'tool_call' && frame.tool_call?.readToolCall);
+  const readCall = firstFrames.find(frame => frame.type === 'tool_call' && frame.subtype === 'completed'
+    && frame.tool_call?.readToolCall)?.tool_call.readToolCall;
+  const text = String(resultOf(firstFrames)?.result ?? '');
+  return { rootRead, readCall, text };
+}
+
+function readCallKeys(readCall) {
+  return {
+    readArgKeys: readCall?.args && typeof readCall.args === 'object' ? Object.keys(readCall.args).sort() : [],
+    readResultKeys: readCall?.result && typeof readCall.result === 'object' ? Object.keys(readCall.result).sort() : [],
+  };
+}
+
+function fieldsFreshVerified(invalidRejectedBeforeInference, first, rootRead, text, canary, colorOrder) {
+  return invalidRejectedBeforeInference && first.code === 0 && rootRead
+    && text.includes(canary) && text.includes(colorOrder);
+}
+
+function fieldsResumedVerified(firstId, second, secondResult, colorOrder) {
+  return second?.code === 0 && secondResult?.session_id === firstId
+    && String(secondResult?.result ?? '').trim() === colorOrder;
+}
+
+function fieldsOutcome(checks, first, second, rootRead, text, canary, colorOrder, firstId, secondResult) {
+  return checks.advertisedModel && checks.lowEffortAdvertised && effortVariantAdmitted(checks.lowEffort)
+    && fieldsFreshVerified(checks.invalidRejectedBeforeInference, first, rootRead, text, canary, colorOrder)
+    && fieldsResumedVerified(firstId, second, secondResult, colorOrder) ? 'pass' : 'blocked';
+}
+
+async function probeFields(version) {
+  const checks = await fieldsModelChecks();
+  const turns = await fieldsExtraRootTurns();
+  const { rootRead, readCall, text } = fieldsReadOf(turns.firstFrames);
+  return {
+    schema: 1, case: 'fields', cliVersion: version, model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--model <advertised ID>', '--allowed-tools read_tool_call', '--add-dir <disposable root>', '--image <disposable PNG>', '--resume <exact native ID>'],
+    advertisedModel: checks.advertisedModel, invalidRejectedBeforeInference: checks.invalidRejectedBeforeInference,
+    advertisedEffortVariant: checks.lowEffortAdvertised,
+    advertisedEffortVariantAdmitted: effortVariantAdmitted(checks.lowEffort),
+    extraRootToolRead: rootRead, extraRootCanarySeen: text.includes(turns.canary),
+    ...readCallKeys(readCall),
+    imageOrderSeen: text.includes(turns.colorOrder),
+    sameNativeSession: Boolean(turns.firstId && turns.secondResult?.session_id === turns.firstId),
+    currentInstructionFollowedOnResume: String(turns.secondResult?.result ?? '').trim() === turns.colorOrder,
+    freshExitCode: turns.first.code, resumedExitCode: turns.second?.code ?? null,
+    timedOut: turns.first.timedOut || Boolean(turns.second?.timedOut),
+    outputTruncated: turns.first.truncated || Boolean(turns.second?.truncated),
+    outcome: fieldsOutcome(checks, turns.first, turns.second, rootRead, text, turns.canary, turns.colorOrder, turns.firstId, turns.secondResult),
+  };
+}
+
+async function probeErrors(version) {
+  const invalidKey = `cez-invalid-${randomBytes(16).toString('hex')}`;
+  const auth = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, '--allowed-tools', 'read_todos_tool_call', 'Reply OK.',
+  ], checkout, 20_000, { ...process.env, CURSOR_API_KEY: invalidKey });
+  const authFrames = framesOf(auth.stdout);
+  const authFailedWithoutSuccess = auth.code !== 0
+    && !authFrames.some(frame => frame.type === 'result' && frame.subtype === 'success');
+  const timeout = await runAgent([
+    '-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, '--allowed-tools', 'read_todos_tool_call', 'Reply OK.',
+  ], checkout, 10);
+  return {
+    schema: 1, case: 'errors', cliVersion: version, model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--allowed-tools read_todos_tool_call', 'invalid synthetic CURSOR_API_KEY in process env', '10 ms timeout in disposable worktree'],
+    invalidKeyNotEchoed: !auth.stdout.includes(invalidKey) && !auth.stderr.includes(invalidKey),
+    invalidKeyRejected: authFailedWithoutSuccess,
+    noFallbackToLoggedInAccount: authFailedWithoutSuccess,
+    authProcessGroupGone: auth.processGroupGone,
+    timeoutTriggered: timeout.timedOut,
+    timeoutProcessGroupGone: timeout.processGroupGone,
+    outcome: authFailedWithoutSuccess && !auth.stdout.includes(invalidKey)
+      && !auth.stderr.includes(invalidKey) && auth.processGroupGone
+      && timeout.timedOut && timeout.processGroupGone ? 'pass' : 'blocked',
+  };
+}
+
+function writeLifecyclePlugin(pluginDir) {
+  const manifestDir = join(pluginDir, '.cursor-plugin');
+  const hooksDir = join(pluginDir, 'hooks');
+  const skillDir = join(pluginDir, 'skills', 'print-qualification');
+  mkdirSync(manifestDir, { recursive: true });
+  mkdirSync(hooksDir);
+  mkdirSync(skillDir, { recursive: true });
+  const heading = `# Print qualification ${randomBytes(6).toString('hex')}`;
+  const hookPhrase = randomBytes(12).toString('hex');
+  writeFileSync(join(skillDir, 'SKILL.md'), `${heading}\nA local test skill.\n`);
+  writeFileSync(join(manifestDir, 'plugin.json'), JSON.stringify({
+    name: 'cez-print-qualification', version: '0.0.1',
+    description: 'Disposable local plugin for fork 590 qualification',
+    skills: './skills/', hooks: './hooks/hooks.json',
+  }));
+  const hookOutput = join(hooksDir, 'started');
+  writeFileSync(join(hooksDir, 'start.mjs'), `import { appendFileSync } from 'node:fs';\nappendFileSync(${JSON.stringify(hookOutput)}, '1\\n');\nprocess.stdout.write(JSON.stringify({ additional_context: ${JSON.stringify(`Remember this hook phrase for later: ${hookPhrase}`)} }));\n`);
+  writeFileSync(join(hooksDir, 'hooks.json'), JSON.stringify({
+    version: 1, hooks: { sessionStart: [{ command: `node ${join(hooksDir, 'start.mjs')}` }] },
+  }));
+  return { heading, hookPhrase, hookOutput };
+}
+
+function lifecycleHookCount(hookOutput) {
+  return existsSync(hookOutput) ? readFileSync(hookOutput, 'utf8').split('\n').filter(Boolean).length : 0;
+}
+
+function lifecycleReadOf(frames, isTargetRead) {
+  return frames.some(frame => frame.type === 'tool_call'
+    && frame.tool_call?.readToolCall && isTargetRead(JSON.stringify(frame.tool_call.readToolCall)));
+}
+
+function lifecycleResultIncludes(frames, needle) {
+  return String(resultOf(frames)?.result ?? '').includes(needle);
+}
+
+function lifecycleRunsVerified(catalogRun, first, second, absent) {
+  return catalogRun.code === 1 && first.code === 0 && second?.code === 0 && absent.code === 0;
+}
+
+function lifecycleOutcome(runsVerified, evidence) {
+  return runsVerified && evidence.localSkillRead && evidence.localHeadingSeen
+    && evidence.marketplaceSkillRead && evidence.firstIdEqualsSecondId && evidence.freshHookRan
+    && evidence.hookContextRecalledOnResume && !evidence.absentLocalRead
+    && evidence.absentModelReportedMissing ? 'pass' : 'blocked';
+}
+
+async function probePluginLifecycle(version) {
+  const { catalogRun, names, safeAllowedTools } = await discoverSafeAllowedTools();
+  const pluginDir = join(checkout, 'cez-print-qualification-plugin');
+  const { heading, hookPhrase, hookOutput } = writeLifecyclePlugin(pluginDir);
+  const base = ['-p', '--force', '--trust', '--output-format', 'stream-json',
+    '--model', values.model, '--allowed-tools', safeAllowedTools.join(',')];
+  const first = await runAgent([...base, '--plugin-dir', pluginDir,
+    'Use your loaded print-qualification skill. Read its SKILL.md with the native Read tool and report the first heading exactly.',
+  ], checkout, 45_000);
+  const firstFrames = framesOf(first.stdout);
+  const firstId = resultOf(firstFrames)?.session_id;
+  const firstHookCount = lifecycleHookCount(hookOutput);
+  const localSkillRead = lifecycleReadOf(firstFrames, text => text.includes('print-qualification/SKILL.md'));
+  const second = firstId ? await runAgent([...base, '--resume', firstId, '--plugin-dir', pluginDir,
+    'From your enabled marketplace plugins, read the Superpowers brainstorming SKILL.md with the native Read tool. Then report its first heading and the hook phrase injected at the start of this session.',
+  ], checkout, 45_000) : undefined;
+  const secondFrames = second ? framesOf(second.stdout) : [];
+  const secondId = resultOf(secondFrames)?.session_id;
+  const secondHookCount = lifecycleHookCount(hookOutput);
+  const marketplaceSkillRead = lifecycleReadOf(secondFrames,
+    text => /\.cursor\/plugins\/cache\/.*superpowers.*SKILL\.md/i.test(text));
+  rmSync(pluginDir, { recursive: true, force: true });
+  const absent = await runAgent([...base,
+    'If a loaded skill named print-qualification is available, read its SKILL.md. Otherwise reply ABSENT. Do not search the filesystem.',
+  ], checkout, 45_000);
+  const absentFrames = framesOf(absent.stdout);
+  const absentLocalRead = lifecycleReadOf(absentFrames, text => text.includes('print-qualification/SKILL.md'));
+  const evidence = {
+    localSkillRead,
+    localHeadingSeen: lifecycleResultIncludes(firstFrames, heading),
+    marketplaceSkillRead,
+    firstIdEqualsSecondId: firstId === secondId,
+    freshHookRan: firstHookCount > 0,
+    hookContextRecalledOnResume: lifecycleResultIncludes(secondFrames, hookPhrase),
+    absentLocalRead,
+    absentModelReportedMissing: lifecycleResultIncludes(absentFrames, 'ABSENT'),
+  };
+  return {
+    schema: 1, case: 'plugin-lifecycle', cliVersion: version, model: values.model,
+    invocation: ['-p', '--force', '--trust', '--output-format stream-json', '--allowed-tools <non-agent catalog>', '--plugin-dir <disposable local plugin>', '--resume <exact native ID>'],
+    catalogValidatedBeforeInference: catalogRun.code === 1 && names.includes('read_tool_call'),
+    localSkillRead, localHeadingSeen: evidence.localHeadingSeen,
+    marketplaceSkillRead, sameNativeSession: Boolean(firstId && secondId === firstId),
+    freshHookRan: evidence.freshHookRan, resumedHookRan: secondHookCount > firstHookCount,
+    hookContextRecalledOnResume: evidence.hookContextRecalledOnResume,
+    absentLocalSkillRead: absentLocalRead,
+    absentModelReportedMissing: evidence.absentModelReportedMissing,
+    globalConfigurationWritten: false,
+    outcome: lifecycleOutcome(lifecycleRunsVerified(catalogRun, first, second, absent), evidence),
+  };
+}
+
+let added = false;
+let cleaned = true;
+try {
+  const version = await runAgent(['--version'], process.cwd(), 10_000);
+  if (version.code !== 0 || version.timedOut) throw new Error('Cursor version check failed');
+  git(['worktree', 'add', '--quiet', '--detach', checkout, 'HEAD']);
+  added = true;
+
+  const probes = { 'native-question': probeNativeQuestion, delegation: probeDelegation, mcp: probeMcp, plugins: probePlugins, 'resume-missing': probeResumeMissing, fields: probeFields, 'plugin-lifecycle': probePluginLifecycle, errors: probeErrors };
+  const summary = await probes[values.case](version.stdout.trim());
+  mkdirSync(outputDir, { recursive: true });
+  const output = join(outputDir, `print-${values.case}.json`);
+  writeFileSync(output, `${JSON.stringify(summary, null, 2)}\n`, { mode: 0o600 });
+  process.stdout.write(`${output}\n`);
+  process.exitCode = summary.outcome === 'pass' ? 0 : summary.outcome === 'blocked' ? 2 : 1;
+} catch (error) {
+  process.stderr.write(`Probe failed: ${error instanceof Error ? error.message : 'unknown error'}\n`);
+  process.exitCode = 1;
+} finally {
+  if (added) {
+    const removed = spawnSync('git', ['worktree', 'remove', '--force', checkout], { encoding: 'utf8', timeout: 15_000 });
+    if (removed.status !== 0) {
+      process.stderr.write(`Probe cleanup failed; inspect ${checkout}\n`);
+      process.exitCode = 1;
+      cleaned = false;
+    }
+  }
+  if (cleaned) rmSync(scratch, { recursive: true, force: true });
+}