@tech-leads-club/harness-toolkit 0.2.1

package/src/providers/claude/claude.transcript.ts

@@ -0,0 +1,62 @@
+import { readTail } from "../../platform/fs-jsonl.ts";
+
+export type TranscriptUsage = {
+  inputTokens: number;
+  outputTokens: number;
+  cacheReadTokens: number;
+  cacheWriteTokens: number;
+};
+
+const DEFAULT_TAIL_LINES = 200;
+
+function asNumber(value: unknown): number {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+function usageOf(record: unknown): Record<string, unknown> | undefined {
+  const message = asRecord(asRecord(record)?.message);
+  return asRecord(message?.usage);
+}
+
+/** Best-effort — the transcript is written asynchronously and may lag, so any read failure degrades to null. */
+export function readClaudeUsage(
+  transcriptPath: string | undefined,
+  tailLines: number = DEFAULT_TAIL_LINES,
+): TranscriptUsage | null {
+  if (!transcriptPath) {
+    return null;
+  }
+
+  let records: unknown[];
+  try {
+    records = readTail<unknown>(transcriptPath, tailLines);
+  } catch {
+    return null;
+  }
+
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let cacheReadTokens = 0;
+  let cacheWriteTokens = 0;
+  let found = false;
+
+  for (const record of records) {
+    const usage = usageOf(record);
+    if (!usage) {
+      continue;
+    }
+    found = true;
+    inputTokens += asNumber(usage.input_tokens);
+    outputTokens += asNumber(usage.output_tokens);
+    cacheReadTokens += asNumber(usage.cache_read_input_tokens);
+    cacheWriteTokens += asNumber(usage.cache_creation_input_tokens);
+  }
+
+  return found ? { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens } : null;
+}

package/src/providers/claude/claude.wiring.ts

@@ -0,0 +1,245 @@
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import type { ProviderWiring, RuntimePaths, WiringEntry } from "../../contracts/index.ts";
+import { claudeConfigDir } from "../../platform/paths.ts";
+
+type EntrySpec = {
+  hookEvent: string;
+  handler: string;
+  timeoutSeconds: number;
+  failClosed?: boolean;
+  loopLimit?: number;
+};
+
+// why: PreToolUse and PostToolUse are each a single dispatcher entry — the fan-out lives in claude.inbound.ts,
+// so Claude never registers a hook per tool the way Cursor registers one per dedicated event.
+const ENTRY_SPECS: readonly EntrySpec[] = [
+  { hookEvent: "SessionStart", handler: "session-start", timeoutSeconds: 10 },
+  { hookEvent: "SessionEnd", handler: "session-end", timeoutSeconds: 10 },
+  { hookEvent: "UserPromptSubmit", handler: "prompt-submit", timeoutSeconds: 5 },
+  { hookEvent: "PreToolUse", handler: "tool-before", timeoutSeconds: 10, failClosed: true },
+  { hookEvent: "PostToolUse", handler: "tool-after", timeoutSeconds: 10 },
+  { hookEvent: "PostToolUseFailure", handler: "tool-failure", timeoutSeconds: 5 },
+  { hookEvent: "SubagentStart", handler: "subagent-start", timeoutSeconds: 5, failClosed: true },
+  { hookEvent: "SubagentStop", handler: "subagent-stop", timeoutSeconds: 5 },
+  { hookEvent: "Stop", handler: "stop", timeoutSeconds: 120, loopLimit: 5 },
+  { hookEvent: "PreCompact", handler: "compact-before", timeoutSeconds: 5 },
+  { hookEvent: "MessageDisplay", handler: "response-after", timeoutSeconds: 5 },
+];
+
+export function claudeSettingsPath(): string {
+  return join(claudeConfigDir(), "settings.json");
+}
+
+// why: exec form only, on every platform — it bypasses shell tokenization, so there is no quoting variant to get wrong.
+export function claudeWiring(runtime: RuntimePaths): ProviderWiring {
+  const entries: WiringEntry[] = ENTRY_SPECS.map((spec) => ({
+    hookEvent: spec.hookEvent,
+    handler: spec.handler,
+    command: "node",
+    args: [runtime.launcherPath, spec.handler],
+    timeoutSeconds: spec.timeoutSeconds,
+    ...(spec.failClosed !== undefined ? { failClosed: spec.failClosed } : {}),
+    ...(spec.loopLimit !== undefined ? { loopLimit: spec.loopLimit } : {}),
+  }));
+
+  return {
+    target: claudeSettingsPath(),
+    strategy: "merge",
+    entries,
+  };
+}
+
+export type ClaudeSettingsHookEntry = { type: "command"; command: string; args: string[] };
+export type ClaudeSettingsHookGroup = { hooks: ClaudeSettingsHookEntry[] };
+export type ClaudeSettingsHooks = Record<string, ClaudeSettingsHookGroup[]>;
+
+export type MergeSuccess = { ok: true; settingsText: string; changed: boolean };
+export type MergeFailure = { ok: false; error: string; block: string };
+export type MergeResult = MergeSuccess | MergeFailure;
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function isHooksRecord(value: unknown): value is ClaudeSettingsHooks {
+  return isPlainRecord(value);
+}
+
+function deepEqual(a: unknown, b: unknown): boolean {
+  if (a === b) {
+    return true;
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+      return false;
+    }
+    return a.every((item, index) => deepEqual(item, b[index]));
+  }
+  if (isPlainRecord(a) && isPlainRecord(b)) {
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length) {
+      return false;
+    }
+    return aKeys.every((key) => bKeys.includes(key) && deepEqual(a[key], b[key]));
+  }
+  return false;
+}
+
+function desiredHooksFor(entries: readonly WiringEntry[]): ClaudeSettingsHooks {
+  const hooks: ClaudeSettingsHooks = {};
+  for (const entry of entries) {
+    const group: ClaudeSettingsHookGroup = {
+      hooks: [{ type: "command", command: entry.command, args: entry.args }],
+    };
+    hooks[entry.hookEvent] = [...(hooks[entry.hookEvent] ?? []), group];
+  }
+  return hooks;
+}
+
+const LAUNCHER_MARKER = "tlc-exec.mjs";
+
+export function isHarnessGroup(group: unknown): boolean {
+  return JSON.stringify(group ?? null).includes(LAUNCHER_MARKER);
+}
+
+export function canonicalLauncherPath(path: string, resolve: (p: string) => string = realpathSync): string {
+  try {
+    return resolve(path);
+  } catch {
+    return path;
+  }
+}
+
+// hazard: an installation reached through a symlink writes one path into settings.json and resolves another
+// at runtime, so a structural comparison reports the wiring as broken every time. Comparing the launcher by
+// the file it actually points at is what makes "wired" mean wired, and stops every update from rewriting
+// a settings.json that was already correct.
+export function canonicalizeGroups(groups: unknown, resolve?: (p: string) => string): unknown {
+  return JSON.parse(
+    JSON.stringify(groups ?? null, (_key, value) =>
+      typeof value === "string" && value.includes(LAUNCHER_MARKER)
+        ? canonicalLauncherPath(value, resolve)
+        : value,
+    ),
+  );
+}
+
+export function mergeClaudeSettings(
+  existingText: string | null,
+  entries: readonly WiringEntry[],
+): MergeResult {
+  const desired = desiredHooksFor(entries);
+
+  let settings: Record<string, unknown> = {};
+  if (existingText !== null && existingText.trim() !== "") {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(existingText);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return { ok: false, error: message, block: JSON.stringify({ hooks: desired }, null, 2) };
+    }
+    if (!isPlainRecord(parsed)) {
+      return {
+        ok: false,
+        error: "settings.json root is not a JSON object",
+        block: JSON.stringify({ hooks: desired }, null, 2),
+      };
+    }
+    settings = parsed;
+  }
+
+  const currentHooks = isHooksRecord(settings.hooks) ? settings.hooks : {};
+  const mergedHooks: ClaudeSettingsHooks = { ...currentHooks };
+  let changed = false;
+
+  for (const [hookEvent, groups] of Object.entries(desired)) {
+    const existingGroups = mergedHooks[hookEvent] ?? [];
+    // hazard: appending only what is missing leaves a stale copy behind when the launcher path
+    // changes, and every hook then fires twice. Ours are replaced wholesale; foreign ones stay.
+    const foreign = existingGroups.filter((group) => !isHarnessGroup(group));
+    const nextGroups = [...foreign, ...groups];
+    if (!deepEqual(canonicalizeGroups(existingGroups), canonicalizeGroups(nextGroups))) {
+      changed = true;
+    }
+    mergedHooks[hookEvent] = nextGroups;
+  }
+
+  const mergedSettings = { ...settings, hooks: mergedHooks };
+  return { ok: true, settingsText: JSON.stringify(mergedSettings, null, 2), changed };
+}
+
+/**
+ * The exact inverse of `mergeClaudeSettings`: every group `isHarnessGroup` matches leaves, everything else stays
+ * where it was.
+ *
+ * hazard: this file is the operator's, not ours. It carries `permissions`, `sandbox`, `env` and `statusLine`
+ * alongside our eleven hook groups, so deleting it — or rewriting it from a template — destroys work the
+ * installer never wrote. Only groups are dropped, and only ours ([/decisions/ad-066.md](/decisions/ad-066.md)).
+ */
+export function unmergeClaudeSettings(existingText: string | null): MergeResult {
+  if (existingText === null || existingText.trim() === "") {
+    return { ok: true, settingsText: "", changed: false };
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(existingText);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, error: message, block: "" };
+  }
+  if (!isPlainRecord(parsed)) {
+    return { ok: false, error: "settings.json root is not a JSON object", block: "" };
+  }
+
+  const currentHooks = isHooksRecord(parsed.hooks) ? parsed.hooks : {};
+  const remainingHooks: ClaudeSettingsHooks = {};
+  let changed = false;
+
+  for (const [hookEvent, groups] of Object.entries(currentHooks)) {
+    const foreign = groups.filter((group) => !isHarnessGroup(group));
+    if (foreign.length !== groups.length) {
+      changed = true;
+    }
+    // invariant: an event whose only groups were ours loses its key. Leaving `"Stop": []` behind is residue that
+    // reads as configuration, and it is exactly what makes a second run report work still to do.
+    if (foreign.length > 0) {
+      remainingHooks[hookEvent] = foreign;
+    }
+  }
+
+  // why: rebuilt key by key rather than spread-and-override, so `hooks` keeps its position. An operator diffing
+  // their own settings.json after this should see the hook groups leave and nothing else move.
+  const next: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (key !== "hooks") {
+      next[key] = value;
+    } else if (Object.keys(remainingHooks).length > 0) {
+      next.hooks = remainingHooks;
+    }
+  }
+  return { ok: true, settingsText: JSON.stringify(next, null, 2), changed };
+}
+
+export function removeClaudeWiring(settingsPath: string): MergeResult {
+  if (!existsSync(settingsPath)) {
+    return { ok: true, settingsText: "", changed: false };
+  }
+  const result = unmergeClaudeSettings(readFileSync(settingsPath, "utf8"));
+  if (result.ok && result.changed) {
+    writeFileSync(settingsPath, result.settingsText, "utf8");
+  }
+  return result;
+}
+
+export function applyClaudeWiring(settingsPath: string, entries: readonly WiringEntry[]): MergeResult {
+  const existingText = existsSync(settingsPath) ? readFileSync(settingsPath, "utf8") : null;
+  const result = mergeClaudeSettings(existingText, entries);
+  if (result.ok && result.changed) {
+    mkdirSync(dirname(settingsPath), { recursive: true });
+    writeFileSync(settingsPath, result.settingsText, "utf8");
+  }
+  return result;
+}

package/src/providers/claude/index.ts

@@ -0,0 +1,17 @@
+import type { ProviderPort } from "../provider.port.ts";
+import { claudeCapabilities } from "./claude.capabilities.ts";
+import { detectClaude } from "./claude.detect.ts";
+import { claudeToEvent } from "./claude.inbound.ts";
+import { claudeRender } from "./claude.outbound.ts";
+import { claudePolicyDefaults } from "./claude.policy-defaults.ts";
+import { claudeWiring } from "./claude.wiring.ts";
+
+export const claudeProvider: ProviderPort = {
+  name: "claude",
+  detect: detectClaude,
+  capabilities: claudeCapabilities,
+  policyDefaults: claudePolicyDefaults,
+  toEvent: claudeToEvent,
+  render: claudeRender,
+  wiring: claudeWiring,
+};

package/src/providers/cursor/cursor.capabilities.ts

@@ -0,0 +1,28 @@
+import type { ProviderCapabilities } from "../../contracts/index.ts";
+
+export function cursorCapabilities(): ProviderCapabilities {
+  return {
+    enforcesHooks: true,
+    askSupportedOn: ["shell.before", "mcp.before"],
+    sessionEnv: true,
+    nativeLoopCounter: true,
+    dedicatedShellEvent: true,
+    toolInputRewrite: true,
+    toolOutputRewrite: true,
+    contextAtToolBefore: false,
+    contextAtToolAfter: true,
+    // why: the `stop` output schema carries `followup_message` and nothing else, so a context decision raised there
+    // has no field to travel in. `followup_message` is not the fallback — it auto-submits.
+    contextAtStop: false,
+    // hazard: the field exists and is documented, and the hook log says "Merged 1 valid response(s)". It is still
+    // dropped: Cursor staff called it "a bug on our side… a timing issue between when the hook runs and when the
+    // composer handle is created" (forum thread 158452, 2026-04-20), and it was reported again against 3.14.7 on
+    // 2026-08-02 with no changelog entry fixing it. `env` on the same payload arrives, because that is a different
+    // code path ([/decisions/ad-050.md](/decisions/ad-050.md)).
+    sessionStartContextReliable: false,
+    toolOutputAtAfter: true,
+    usageInPayload: true,
+    effortSignal: false,
+    thoughtEvent: true,
+  };
+}

package/src/providers/cursor/cursor.detect.ts

@@ -0,0 +1,14 @@
+// why: Cursor payloads use camelCase hook_event_name + workspace_roots; Claude payloads don't.
+const CAMEL_CASE_EVENT_NAME = /^[a-z][a-zA-Z0-9]*$/;
+
+export function detectCursor(raw: unknown): boolean {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return false;
+  }
+  const value = raw as Record<string, unknown>;
+  const eventName = value.hook_event_name;
+  if (typeof eventName !== "string" || !CAMEL_CASE_EVENT_NAME.test(eventName)) {
+    return false;
+  }
+  return Array.isArray(value.workspace_roots);
+}

package/src/providers/cursor/cursor.inbound.ts

@@ -0,0 +1,203 @@
+import type { HarnessEvent, HarnessEventKind } from "../../contracts/index.ts";
+import { sanitizeSegment } from "../../platform/sanitize.ts";
+
+const EVENT_KIND_BY_HOOK: Record<string, HarnessEventKind> = {
+  sessionStart: "session.start",
+  sessionEnd: "session.end",
+  beforeSubmitPrompt: "prompt.submit",
+  preToolUse: "tool.before",
+  postToolUse: "tool.after",
+  postToolUseFailure: "tool.failure",
+  beforeShellExecution: "shell.before",
+  afterShellExecution: "shell.after",
+  beforeMCPExecution: "mcp.before",
+  afterMCPExecution: "mcp.after",
+  beforeReadFile: "read.before",
+  afterFileEdit: "edit.after",
+  subagentStart: "subagent.start",
+  subagentStop: "subagent.stop",
+  stop: "stop",
+  preCompact: "compact.before",
+  afterAgentResponse: "response.after",
+  afterAgentThought: "thought.after",
+};
+
+function asString(value: unknown): string | undefined {
+  return typeof value === "string" ? value : undefined;
+}
+
+function asNumber(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+function asStatus(value: unknown): "completed" | "aborted" | "error" | undefined {
+  return value === "completed" || value === "aborted" || value === "error" ? value : undefined;
+}
+
+function sessionKeyFor(raw: Record<string, unknown>): string {
+  const seed = asString(raw.conversation_id) || asString(raw.session_id) || "default";
+  return `cursor-${sanitizeSegment(seed)}`;
+}
+
+function projectDirFor(raw: Record<string, unknown>): string {
+  const envDir = process.env.CURSOR_PROJECT_DIR;
+  if (envDir) {
+    return envDir;
+  }
+  const roots = raw.workspace_roots;
+  if (Array.isArray(roots)) {
+    const first = asString(roots[0]);
+    if (first) {
+      return first;
+    }
+  }
+  return process.cwd();
+}
+
+/** Never throws on a malformed payload — returns null instead. */
+export function cursorToEvent(raw: Record<string, unknown>): HarnessEvent | null {
+  const hookEventName = asString(raw.hook_event_name);
+  const eventKind = hookEventName ? EVENT_KIND_BY_HOOK[hookEventName] : undefined;
+  if (!eventKind) {
+    return null;
+  }
+
+  const event: HarnessEvent = {
+    provider: "cursor",
+    event: eventKind,
+    sessionKey: sessionKeyFor(raw),
+    projectDir: projectDirFor(raw),
+    raw,
+  };
+
+  const model = asString(raw.model);
+  if (model) {
+    event.model = model;
+  }
+  const contextUsagePercent = asNumber(raw.context_usage_percent);
+  if (contextUsagePercent !== undefined) {
+    event.contextUsagePercent = contextUsagePercent;
+  }
+
+  switch (eventKind) {
+    case "prompt.submit": {
+      const text = asString(raw.prompt);
+      if (text !== undefined) {
+        event.text = text;
+      }
+      break;
+    }
+    case "response.after": {
+      const text = asString(raw.text);
+      if (text !== undefined) {
+        event.text = text;
+      }
+      break;
+    }
+    case "thought.after": {
+      const text = asString(raw.thought) ?? asString(raw.text);
+      if (text !== undefined) {
+        event.text = text;
+      }
+      break;
+    }
+    case "tool.before":
+    case "tool.after":
+    case "tool.failure": {
+      const toolName = asString(raw.tool_name);
+      if (toolName) {
+        event.toolName = toolName;
+      }
+      const toolInput = asRecord(raw.tool_input);
+      if (toolInput) {
+        event.toolInput = toolInput;
+      }
+      const subagentType = asString(raw.subagent_type);
+      if (subagentType) {
+        event.subagentType = subagentType;
+      }
+      const toolSpawnModel = toolInput ? asString(toolInput.model) : undefined;
+      if (toolSpawnModel) {
+        event.spawnModel = toolSpawnModel;
+      }
+      const toolSpawnType = toolInput ? asString(toolInput.subagent_type) : undefined;
+      if (toolSpawnType) {
+        event.spawnSubagentType = toolSpawnType;
+      }
+      break;
+    }
+    case "shell.before":
+    case "shell.after": {
+      const command = asString(raw.command);
+      if (command !== undefined) {
+        event.command = command;
+      }
+      const output = asString(raw.output);
+      if (output !== undefined) {
+        event.toolOutput = output;
+      }
+      break;
+    }
+    case "mcp.before":
+    case "mcp.after": {
+      const resultJson = asString(raw.result_json);
+      if (resultJson !== undefined) {
+        event.toolOutput = resultJson;
+      }
+      const toolName = asString(raw.tool_name);
+      if (toolName) {
+        event.toolName = toolName;
+      }
+      const toolInput = asRecord(raw.tool_input);
+      if (toolInput) {
+        event.toolInput = toolInput;
+      }
+      const command = asString(raw.command);
+      if (command !== undefined) {
+        event.command = command;
+      }
+      break;
+    }
+    case "read.before":
+    case "edit.after": {
+      const filePath = asString(raw.file_path);
+      if (filePath !== undefined) {
+        event.filePath = filePath;
+      }
+      break;
+    }
+    case "subagent.start":
+    case "subagent.stop": {
+      const spawnSubagentType = asString(raw.subagent_type);
+      if (spawnSubagentType) {
+        event.spawnSubagentType = spawnSubagentType;
+      }
+      const spawnModel = asString(raw.subagent_model);
+      if (spawnModel) {
+        event.spawnModel = spawnModel;
+      }
+      break;
+    }
+    case "stop": {
+      const status = asStatus(raw.status);
+      if (status) {
+        event.status = status;
+      }
+      const loopCount = asNumber(raw.loop_count);
+      if (loopCount !== undefined) {
+        event.loopCount = loopCount;
+      }
+      break;
+    }
+    default:
+      break;
+  }
+
+  return event;
+}

package/src/providers/cursor/cursor.lessons-view.ts

@@ -0,0 +1,30 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { projectConfigPath } from "../../platform/paths.ts";
+
+// why: mirrors core/lesson/lesson.garden.ts's lessonsMarkdownPath — providers cannot import core, so the join is duplicated.
+export function cursorLessonsSourcePath(root: string): string {
+  return join(dirname(projectConfigPath(root)), "lessons.md");
+}
+
+export function cursorLessonsViewPath(root: string): string {
+  return join(root, ".cursor", "rules", "harness-lessons.mdc");
+}
+
+export function renderCursorLessonsView(root: string): string | null {
+  const sourcePath = cursorLessonsSourcePath(root);
+  if (!existsSync(sourcePath)) {
+    return null;
+  }
+  const body = readFileSync(sourcePath, "utf8");
+  const path = cursorLessonsViewPath(root);
+  mkdirSync(dirname(path), { recursive: true });
+  const content = `---
+description: Harness-learned lessons (auto-synced from gate failures)
+alwaysApply: true
+---
+
+${body}`;
+  writeFileSync(path, content, "utf8");
+  return path;
+}

package/src/providers/cursor/cursor.outbound.ts

@@ -0,0 +1,43 @@
+import type { Decision, HarnessEvent, Rendered } from "../../contracts/index.ts";
+
+// why: key order (permission, user_message, agent_message) matches the captured golden byte-for-byte.
+function renderDenyOrAsk(
+  permission: "deny" | "ask",
+  decision: { reason: string; userNote?: string },
+): string {
+  const body: Record<string, unknown> = { permission };
+  if (decision.userNote !== undefined) {
+    body.user_message = decision.userNote;
+  }
+  body.agent_message = decision.reason;
+  return JSON.stringify(body);
+}
+
+export function cursorRender(decision: Decision, _event: HarnessEvent): Rendered {
+  switch (decision.kind) {
+    case "abstain":
+      return { stdout: "{}", exitCode: 0 };
+    case "allow":
+      return { stdout: JSON.stringify({ permission: "allow" }), exitCode: 0 };
+    case "deny":
+      return { stdout: renderDenyOrAsk("deny", decision), exitCode: 0 };
+    case "ask":
+      return { stdout: renderDenyOrAsk("ask", decision), exitCode: 0 };
+    case "context": {
+      const body: Record<string, unknown> = {};
+      if (decision.env !== undefined) {
+        body.env = decision.env;
+      }
+      body.additional_context = decision.text;
+      return { stdout: JSON.stringify(body), exitCode: 0 };
+    }
+    case "continue":
+      return { stdout: JSON.stringify({ followup_message: decision.text }), exitCode: 0 };
+    case "rewriteInput":
+      return { stdout: JSON.stringify({ updated_input: decision.input }), exitCode: 0 };
+    default: {
+      const exhaustive: never = decision;
+      throw new Error(`unreachable decision kind: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}

package/src/providers/cursor/cursor.policy-defaults.ts

@@ -0,0 +1,9 @@
+import type { ProviderPolicyDefaults } from "../../contracts/index.ts";
+
+export function cursorPolicyDefaults(): ProviderPolicyDefaults {
+  return {
+    blockedPatterns: ["-fast(?:$|[^a-z0-9])", "/fast(?:$|[^a-z0-9])", "composer-2\\.5-fast"],
+    minEffort: null,
+    untrustedTools: ["Fetch", "WebSearch"],
+  };
+}