@stigmer/runner 3.0.1

package/src/activities/execute-cursor/__tests__/approval-gate.test.ts

@@ -0,0 +1,188 @@
+/**
+ * Unit tests for the Cursor-harness HITL approval gate logic.
+ *
+ * Covers the pure policy/grant/prompt builders that drive the preToolUse hook:
+ * - built-in tool gating (mutating gated, read-only + unknown allowed)
+ * - salient-arg extraction (grant matching key)
+ * - grant building from adjudicated approvals
+ * - approval-state file content (gated list, MCP policies, grant tokens)
+ * - the human-meaningful reinvocation prompt
+ *
+ * These are deterministic and need no Cursor API key.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { PendingApprovalSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+import {
+  builtInRequiresApproval,
+  getBuiltInApprovalMessage,
+  getBuiltInGatedList,
+  extractArgKey,
+} from "../approval-policy.js";
+import type { MergedToolPolicy } from "../approval-policy.js";
+import {
+  buildApprovalGrants,
+  buildApprovalState,
+  grantToken,
+} from "../approval-state.js";
+import { buildReinvocationPrompt } from "../prompt-builder.js";
+
+function pending(overrides: Partial<PendingApproval>): PendingApproval {
+  return create(PendingApprovalSchema, {
+    toolCallId: "call-1",
+    toolName: "Write",
+    message: "",
+    argsPreview: "",
+    mcpServerSlug: "",
+    ...overrides,
+  });
+}
+
+describe("builtInRequiresApproval", () => {
+  it("gates mutating/destructive built-in tools", () => {
+    for (const t of ["Write", "StrReplace", "EditNotebook", "Shell", "Delete"]) {
+      expect(builtInRequiresApproval(t)).toBe(true);
+    }
+  });
+
+  it("allows read-only built-in tools", () => {
+    for (const t of ["Read", "Grep", "Glob", "SemanticSearch", "WebFetch", "ReadLints"]) {
+      expect(builtInRequiresApproval(t)).toBe(false);
+    }
+  });
+
+  it("fails open for unknown tools (parity with native, avoids denying auto-approved MCP)", () => {
+    expect(builtInRequiresApproval("SomeFutureTool")).toBe(false);
+    expect(builtInRequiresApproval("search_services")).toBe(false);
+  });
+
+  it("exposes the gated set", () => {
+    expect(getBuiltInGatedList()).toEqual(
+      expect.arrayContaining(["Write", "StrReplace", "EditNotebook", "Shell", "Delete"]),
+    );
+  });
+});
+
+describe("getBuiltInApprovalMessage", () => {
+  it("returns a template for gated tools and undefined otherwise", () => {
+    expect(getBuiltInApprovalMessage("Write")).toContain("{{args.path}}");
+    expect(getBuiltInApprovalMessage("Shell")).toContain("{{args.command}}");
+    expect(getBuiltInApprovalMessage("Read")).toBeUndefined();
+  });
+});
+
+describe("extractArgKey", () => {
+  it("extracts the salient field by priority (path > command > target_notebook)", () => {
+    expect(extractArgKey({ path: "a.txt" })).toBe("a.txt");
+    expect(extractArgKey({ command: "ls -la" })).toBe("ls -la");
+    expect(extractArgKey({ target_notebook: "nb.ipynb" })).toBe("nb.ipynb");
+    expect(extractArgKey({ path: "a.txt", command: "ls" })).toBe("a.txt");
+  });
+
+  it("returns empty string when no salient field is present", () => {
+    expect(extractArgKey({})).toBe("");
+    expect(extractArgKey(undefined)).toBe("");
+    expect(extractArgKey({ other: 1 })).toBe("");
+  });
+});
+
+describe("grantToken", () => {
+  it("is byte-identical to base64(toolName \\n argKey)", () => {
+    expect(grantToken("Write", "gated.txt")).toBe(
+      Buffer.from("Write\ngated.txt", "utf-8").toString("base64"),
+    );
+    expect(grantToken("search_services", "")).toBe(
+      Buffer.from("search_services\n", "utf-8").toString("base64"),
+    );
+  });
+});
+
+describe("buildApprovalGrants", () => {
+  it("creates an arg-keyed grant for an approved built-in tool", () => {
+    const grants = buildApprovalGrants(
+      [pending({ toolCallId: "c1", toolName: "Write", argsPreview: JSON.stringify({ path: "gated.txt" }) })],
+      new Map([["c1", ApprovalAction.APPROVE]]),
+    );
+    expect(grants).toEqual([{ toolName: "Write", mcpServerSlug: "", argKey: "gated.txt" }]);
+  });
+
+  it("creates a name-only grant for an approved MCP tool", () => {
+    const grants = buildApprovalGrants(
+      [pending({ toolCallId: "c1", toolName: "apply_x", mcpServerSlug: "planton", argsPreview: JSON.stringify({ path: "ignored" }) })],
+      new Map([["c1", ApprovalAction.APPROVE]]),
+    );
+    expect(grants).toEqual([{ toolName: "apply_x", mcpServerSlug: "planton", argKey: "" }]);
+  });
+
+  it("ignores skipped and rejected approvals", () => {
+    const grants = buildApprovalGrants(
+      [
+        pending({ toolCallId: "c1", toolName: "Write", argsPreview: JSON.stringify({ path: "a" }) }),
+        pending({ toolCallId: "c2", toolName: "Shell", argsPreview: JSON.stringify({ command: "rm" }) }),
+      ],
+      new Map([
+        ["c1", ApprovalAction.SKIP],
+        ["c2", ApprovalAction.REJECT],
+      ]),
+    );
+    expect(grants).toEqual([]);
+  });
+});
+
+describe("buildApprovalState", () => {
+  const mcpPolicies = new Map<string, MergedToolPolicy>([
+    ["planton/apply_x", { toolName: "apply_x", mcpServerSlug: "planton", requiresApproval: true, approvalMessage: "Apply X" }],
+  ]);
+
+  it("carries the gated list, MCP policies, and grant tokens", () => {
+    const grants = [{ toolName: "Write", mcpServerSlug: "", argKey: "gated.txt" }];
+    const state = buildApprovalState(mcpPolicies, false, grants);
+
+    expect(state.autoApproveAll).toBe(false);
+    expect(state.builtInGatedList).toEqual(expect.arrayContaining(["Write", "Shell"]));
+    expect(state.mcpToolPolicies.apply_x).toEqual({ requiresApproval: true, message: "Apply X" });
+    expect(state.approvedGrantTokens).toEqual([grantToken("Write", "gated.txt")]);
+  });
+
+  it("defaults grants to empty when none provided", () => {
+    const state = buildApprovalState(mcpPolicies, true);
+    expect(state.autoApproveAll).toBe(true);
+    expect(state.approvedGrants).toEqual([]);
+    expect(state.approvedGrantTokens).toEqual([]);
+  });
+});
+
+describe("buildReinvocationPrompt", () => {
+  it("describes approved and skipped actions in human terms, not opaque ids", () => {
+    const prompt = buildReinvocationPrompt(
+      [
+        pending({ toolCallId: "c1", toolName: "Write", message: "Write file: gated.txt" }),
+        pending({ toolCallId: "c2", toolName: "Shell", message: "Run command: rm -rf build" }),
+      ],
+      new Map([
+        ["c1", ApprovalAction.APPROVE],
+        ["c2", ApprovalAction.SKIP],
+      ]),
+    );
+
+    expect(prompt).toContain("APPROVED");
+    expect(prompt).toContain("Write file: gated.txt");
+    expect(prompt).toContain("SKIPPED");
+    expect(prompt).toContain("Run command: rm -rf build");
+    // No opaque tool-call ids leak into the prompt.
+    expect(prompt).not.toContain("c1");
+    expect(prompt).not.toContain("c2");
+  });
+
+  it("falls back to tool name + args preview when no message is set", () => {
+    const prompt = buildReinvocationPrompt(
+      [pending({ toolCallId: "c1", toolName: "apply_x", mcpServerSlug: "planton", message: "", argsPreview: '{"k":"v"}' })],
+      new Map([["c1", ApprovalAction.APPROVE]]),
+    );
+    expect(prompt).toContain("planton/apply_x");
+  });
+});

package/src/activities/execute-cursor/__tests__/build-prompt.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Unit tests for buildPrompt's prompt-selection logic.
+ *
+ * Conversation continuity is carried entirely by the Cursor SDK's native agent
+ * state (no separate continuation store), so buildPrompt depends only on
+ * resolution.reason and HITL state. It is a pure string builder — it never
+ * touches the live SDK agent — so these tests need no Cursor API key.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { PendingApprovalSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+
+import { buildPrompt } from "../index.js";
+import type { BuildPromptInput } from "../index.js";
+import type { AgentResolution, AgentResolutionReason } from "../session-lifecycle.js";
+
+const USER_MESSAGE = "What was the secret token I told you?";
+
+function resolution(
+  mode: "local" | "cloud",
+  reason: AgentResolutionReason,
+): AgentResolution {
+  return {
+    // buildPrompt never touches the agent handle; a stub keeps the type happy.
+    agent: {} as AgentResolution["agent"],
+    agentId: "agent-test",
+    isNew: reason !== "resumed_successfully",
+    resumed: reason === "resumed_successfully",
+    mode,
+    reason,
+  };
+}
+
+function input(overrides: Partial<BuildPromptInput>): BuildPromptInput {
+  return {
+    resolution: resolution("local", "resumed_successfully"),
+    approvalDecisions: undefined,
+    instructions: "You are a test agent.",
+    userMessage: USER_MESSAGE,
+    skills: [],
+    subAgents: [],
+    workspaceDirs: ["/tmp/ws"],
+    workspaceFileRefs: [],
+    attachmentPaths: [],
+    pendingApprovals: [],
+    ...overrides,
+  };
+}
+
+describe("buildPrompt", () => {
+  it("sends the raw user message when a local agent resumed successfully (native context carries it)", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "resumed_successfully") }),
+    );
+    expect(prompt).toBe(USER_MESSAGE);
+  });
+
+  it("sends the raw user message when a cloud agent resumed successfully", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("cloud", "resumed_successfully") }),
+    );
+    expect(prompt).toBe(USER_MESSAGE);
+  });
+
+  it("uses the enhanced first-execution prompt on the first turn", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_first_execution") }),
+    );
+    expect(prompt).not.toBe(USER_MESSAGE);
+    expect(prompt).toContain("<agent_instructions>");
+    expect(prompt).toContain(USER_MESSAGE);
+  });
+
+  it("uses the enhanced prompt (no prior context) for a fresh agent after a resume failure", () => {
+    // With SessionMemory removed, a fresh agent created after a resume failure
+    // has no prior conversation to inherit — it starts a new turn with full
+    // instructions plus the user message.
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_after_resume_failure") }),
+    );
+    expect(prompt).not.toBe(USER_MESSAGE);
+    expect(prompt).toContain("<agent_instructions>");
+    expect(prompt).toContain(USER_MESSAGE);
+  });
+
+  it("uses the reinvocation prompt for a HITL reinvocation (human-meaningful, no opaque ids)", () => {
+    const approvalDecisions = new Map<string, ApprovalAction>([
+      ["tool-call-1", ApprovalAction.APPROVE],
+    ]);
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        approvalDecisions,
+        pendingApprovals: [
+          create(PendingApprovalSchema, {
+            toolCallId: "tool-call-1",
+            toolName: "Write",
+            message: "Write file: gated.txt",
+          }),
+        ],
+      }),
+    );
+    expect(prompt).not.toBe(USER_MESSAGE);
+    expect(prompt).toContain("APPROVED");
+    expect(prompt).toContain("Write file: gated.txt");
+    // The opaque tool-call id must not leak into the prompt.
+    expect(prompt).not.toContain("tool-call-1");
+  });
+});

package/src/activities/execute-cursor/__tests__/cursor-baseurl-routing.test.ts

@@ -0,0 +1,86 @@
+/**
+ * Test that the SDK works correctly when CURSOR_BACKEND_URL is unset.
+ *
+ * In proxy mode, only CURSOR_API_BASE_URL is set (for Connect RPC).
+ * CURSOR_BACKEND_URL is left unset so the SDK uses its built-in defaults:
+ *   - CloudApiClient → api.cursor.com (REST: /v1/models, CRUD)
+ *   - Token exchange → api2.cursor.sh (/auth/exchange_user_api_key)
+ *
+ * This test verifies:
+ *   1. Model validation (GET /v1/models) works with real API key when
+ *      CURSOR_BACKEND_URL is unset (routes to api.cursor.com by default)
+ *   2. Agent execution works end-to-end (token exchange + Connect RPC)
+ *
+ * NOTE: CURSOR_API_BASE_URL routing cannot be tested from vitest because
+ * the native SDK binary reads it at process startup, not at import time.
+ * That routing is validated by the production code in main.ts which sets
+ * the env var BEFORE any SDK import.
+ */
+
+import { describe, it, expect, beforeAll } from "vitest";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const CURSOR_API_KEY = process.env.CURSOR_API_KEY ?? "";
+
+// Live smoke test: requires a real Cursor API key. Skipped when none is set
+// (e.g. local `make check` / CI without provider credentials).
+const describeWithCursorKey = CURSOR_API_KEY ? describe : describe.skip;
+
+describeWithCursorKey("SDK routing with CURSOR_BACKEND_URL unset", () => {
+  beforeAll(() => {
+    // Ensure CURSOR_BACKEND_URL is unset — the SDK should use its built-in
+    // defaults for REST calls (model validation → api.cursor.com, token
+    // exchange → api2.cursor.sh).
+    delete process.env.CURSOR_BACKEND_URL;
+  });
+
+  it("Agent.create() with explicit model succeeds (model validation via default api.cursor.com)", async () => {
+    const stateRoot = join(tmpdir(), `cursor-routing-test-${Date.now()}`);
+    mkdirSync(stateRoot, { recursive: true });
+
+    const { Agent } = await import("@cursor/sdk");
+
+    const agent = await Agent.create({
+      apiKey: CURSOR_API_KEY,
+      model: { id: "claude-sonnet-4" },
+      local: { cwd: stateRoot },
+      platform: {
+        workspaceRef: `routing-test-${Date.now()}`,
+        stateRoot,
+      },
+    });
+
+    expect(agent).toBeDefined();
+    expect(agent.agentId).toBeTruthy();
+    console.log(`Agent created with model validation: agentId=${agent.agentId}`);
+  }, 30_000);
+
+  it("agent.send() succeeds (token exchange + Connect RPC round-trip)", async () => {
+    const stateRoot = join(tmpdir(), `cursor-routing-send-${Date.now()}`);
+    mkdirSync(stateRoot, { recursive: true });
+
+    const { Agent } = await import("@cursor/sdk");
+
+    const agent = await Agent.create({
+      apiKey: CURSOR_API_KEY,
+      model: { id: "claude-sonnet-4" },
+      local: { cwd: stateRoot },
+      platform: {
+        workspaceRef: `routing-send-test-${Date.now()}`,
+        stateRoot,
+      },
+    });
+
+    const run = await agent.send("Reply with exactly: routing-test-ok");
+    const result = await run.wait();
+
+    expect(result).toBeDefined();
+    expect(["completed", "finished"]).toContain(result.status);
+    console.log(
+      `Full round-trip succeeded: runId=${result.id}, status=${result.status}, ` +
+      `durationMs=${result.durationMs}`,
+    );
+  }, 120_000);
+});

package/src/activities/execute-cursor/__tests__/cursor-fetch-interceptor-bypass.test.ts

@@ -0,0 +1,64 @@
+/**
+ * Test that reproduces the desktop runner's EXACT execution path.
+ *
+ * Simulates proxy mode: fetch interceptor installed, apiKey="proxy-managed",
+ * to verify whether the proxy rewriting actually intercepts @cursor/sdk calls.
+ *
+ * Expected result: THIS TEST WILL FAIL because @cursor/sdk uses connect-node
+ * (Node.js native HTTP), not globalThis.fetch. The fetch interceptor never fires.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const CURSOR_API_KEY = process.env.CURSOR_API_KEY ?? "";
+
+// Live smoke test: requires a real Cursor API key. Skipped when none is set
+// (e.g. local `make check` / CI without provider credentials).
+const describeWithCursorKey = CURSOR_API_KEY ? describe : describe.skip;
+
+describeWithCursorKey("Fetch Interceptor vs Connect-Node Transport", () => {
+  let interceptCalled = false;
+  const originalFetch = globalThis.fetch;
+
+  beforeAll(() => {
+    interceptCalled = false;
+    globalThis.fetch = (async (input: any, init?: any) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (url.includes("cursor.sh") || url.includes("cursor.com")) {
+        interceptCalled = true;
+        console.log(`[INTERCEPTOR HIT] ${url}`);
+      }
+      return originalFetch(input, init);
+    }) as typeof fetch;
+  });
+
+  afterAll(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it("Agent.create() does NOT go through globalThis.fetch (proving interceptor is useless)", async () => {
+    const { Agent } = await import("@cursor/sdk");
+
+    const stateRoot = join(tmpdir(), `cursor-intercept-test-${Date.now()}`);
+    mkdirSync(stateRoot, { recursive: true });
+
+    const agent = await Agent.create({
+      apiKey: CURSOR_API_KEY,
+      local: { cwd: stateRoot },
+      platform: {
+        workspaceRef: `intercept-test-${Date.now()}`,
+        stateRoot,
+      },
+    });
+
+    expect(agent.agentId).toBeTruthy();
+    console.log(`Agent created: ${agent.agentId}, interceptCalled=${interceptCalled}`);
+
+    // This assertion proves the fetch interceptor pattern is broken:
+    // connect-node uses Node.js http module, NOT globalThis.fetch
+    expect(interceptCalled).toBe(false);
+  }, 30_000);
+});

package/src/activities/execute-cursor/__tests__/cursor-mode.test.ts

@@ -0,0 +1,95 @@
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+import {
+  WorkspaceEntrySchema,
+  WorkspaceSourceSchema,
+  GitRepoSourceSchema,
+  LocalPathSourceSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
+import type { WorkspaceEntry } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
+import { determineCursorMode, isCloudMode } from "../cursor-mode.js";
+
+/**
+ * Cloud Cursor agents are disabled platform-wide: Cursor cloud clones repos
+ * via its own GitHub App connection and cannot use the git credentials Stigmer
+ * collects, so git-backed cloud sessions fail for user repos. determineCursorMode
+ * must therefore always return LOCAL, regardless of workspace shape or flag.
+ *
+ * These tests lock that contract so the cloud path cannot be silently
+ * re-armed by an environment flag or a git-only workspace.
+ */
+
+function gitRepoEntry(url: string, branch = "main"): WorkspaceEntry {
+  return create(WorkspaceEntrySchema, {
+    name: "repo",
+    source: create(WorkspaceSourceSchema, {
+      source: {
+        case: "gitRepo",
+        value: create(GitRepoSourceSchema, { url, branch }),
+      },
+    }),
+  });
+}
+
+function localPathEntry(path: string): WorkspaceEntry {
+  return create(WorkspaceEntrySchema, {
+    name: "local",
+    source: create(WorkspaceSourceSchema, {
+      source: {
+        case: "localPath",
+        value: create(LocalPathSourceSchema, { path }),
+      },
+    }),
+  });
+}
+
+describe("determineCursorMode", () => {
+  it("returns LOCAL when no workspace entries (flag off)", () => {
+    expect(determineCursorMode([], false)).toBe(CursorMode.LOCAL);
+  });
+
+  it("returns LOCAL when no workspace entries (flag on)", () => {
+    expect(determineCursorMode([], true)).toBe(CursorMode.LOCAL);
+  });
+
+  it("returns LOCAL for an all-git-repo workspace even with the cloud flag enabled", () => {
+    const entries = [gitRepoEntry("https://github.com/stigmer/stigmer")];
+    expect(determineCursorMode(entries, true)).toBe(CursorMode.LOCAL);
+  });
+
+  it("returns LOCAL for multiple git-repo entries with the cloud flag enabled", () => {
+    const entries = [
+      gitRepoEntry("https://github.com/stigmer/stigmer"),
+      gitRepoEntry("https://github.com/stigmer/stigmer-cloud"),
+    ];
+    expect(determineCursorMode(entries, true)).toBe(CursorMode.LOCAL);
+  });
+
+  it("returns LOCAL for a local-path workspace", () => {
+    const entries = [localPathEntry("/tmp/project")];
+    expect(determineCursorMode(entries, true)).toBe(CursorMode.LOCAL);
+  });
+
+  it("returns LOCAL for a mixed git + local workspace with the flag enabled", () => {
+    const entries = [
+      gitRepoEntry("https://github.com/stigmer/stigmer"),
+      localPathEntry("/tmp/project"),
+    ];
+    expect(determineCursorMode(entries, true)).toBe(CursorMode.LOCAL);
+  });
+});
+
+describe("isCloudMode", () => {
+  it("is true only for CLOUD", () => {
+    expect(isCloudMode(CursorMode.CLOUD)).toBe(true);
+  });
+
+  it("is false for LOCAL", () => {
+    expect(isCloudMode(CursorMode.LOCAL)).toBe(false);
+  });
+
+  it("treats UNSPECIFIED as not cloud", () => {
+    expect(isCloudMode(CursorMode.UNSPECIFIED)).toBe(false);
+  });
+});

package/src/activities/execute-cursor/__tests__/cursor-sdk-auth-smoke.test.ts

@@ -0,0 +1,90 @@
+/**
+ * Minimal smoke test to verify Cursor SDK authentication works with a real API key.
+ *
+ * Tests three things in isolation:
+ * 1. Agent.create() succeeds (proves the API key is valid)
+ * 2. agent.send() produces a response (proves the agent can execute)
+ * 3. The connect-node transport works end-to-end
+ *
+ * Run with: CURSOR_API_KEY=<key> npx tsx --test this-file.ts
+ * Or via the test script: npm run test:cursor-auth
+ */
+
+import { describe, it, expect } from "vitest";
+import { Agent } from "@cursor/sdk";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const CURSOR_API_KEY = process.env.CURSOR_API_KEY ?? "";
+
+// Live smoke test: requires a real Cursor API key. Skipped when none is set
+// (e.g. local `make check` / CI without provider credentials).
+const describeWithCursorKey = CURSOR_API_KEY ? describe : describe.skip;
+
+describeWithCursorKey("Cursor SDK Authentication Smoke Test", () => {
+
+  it("Agent.create() succeeds with a valid API key", async () => {
+    const stateRoot = join(tmpdir(), `cursor-auth-test-${Date.now()}`);
+    mkdirSync(stateRoot, { recursive: true });
+
+    const agent = await Agent.create({
+      apiKey: CURSOR_API_KEY,
+      model: { id: "claude-sonnet-4" },
+      local: { cwd: stateRoot },
+      platform: {
+        workspaceRef: `auth-test-${Date.now()}`,
+        stateRoot,
+      },
+    });
+
+    expect(agent).toBeDefined();
+    expect(agent.agentId).toBeTruthy();
+    console.log(`Agent created successfully: agentId=${agent.agentId}`);
+  }, 30_000);
+
+  it("agent.send() produces a response (full auth round-trip)", async () => {
+    const stateRoot = join(tmpdir(), `cursor-send-test-${Date.now()}`);
+    mkdirSync(stateRoot, { recursive: true });
+
+    const agent = await Agent.create({
+      apiKey: CURSOR_API_KEY,
+      model: { id: "claude-sonnet-4" },
+      local: { cwd: stateRoot },
+      platform: {
+        workspaceRef: `send-test-${Date.now()}`,
+        stateRoot,
+      },
+    });
+
+    expect(agent.agentId).toBeTruthy();
+
+    const run = await agent.send("Reply with exactly: auth-test-ok");
+
+    const result = await run.wait();
+    expect(result).toBeDefined();
+    expect(["completed", "finished"]).toContain(result.status);
+    console.log(
+      `Agent.send() completed: runId=${result.id}, status=${result.status}, ` +
+      `durationMs=${result.durationMs}`,
+    );
+  }, 120_000);
+
+  it("Agent.create() with default model (no explicit model)", async () => {
+    const stateRoot = join(tmpdir(), `cursor-default-model-test-${Date.now()}`);
+    mkdirSync(stateRoot, { recursive: true });
+
+    const agent = await Agent.create({
+      apiKey: CURSOR_API_KEY,
+      local: { cwd: stateRoot },
+      platform: {
+        workspaceRef: `default-model-test-${Date.now()}`,
+        stateRoot,
+      },
+    });
+
+    expect(agent).toBeDefined();
+    expect(agent.agentId).toBeTruthy();
+    console.log(`Agent created with default model: agentId=${agent.agentId}`);
+  }, 30_000);
+});