@wacando/agent 0.0.0-stage → 2.0.0-rc.1

package/docs/evidence/issue-2/check.txt

@@ -0,0 +1,376 @@
+
+> wacando-plugins@1.0.0 check
+> npm run build && npm run check:generated && npm test
+
+
+> wacando-plugins@1.0.0 build
+> node scripts/build.mjs
+
+Built self-contained codex plugin: wacando@1.0.0
+Built self-contained cursor plugin: wacando-cursor@1.0.0
+Built self-contained claude plugin: wacando-claude@1.0.0
+
+> wacando-plugins@1.0.0 check:generated
+> node scripts/check-generated.mjs
+
+Verified exact runtime: wacando
+Verified exact runtime: wacando-cursor
+Verified exact runtime: wacando-claude
+
+> wacando-plugins@1.0.0 test
+> node --test tests/*.test.mjs
+
+TAP version 13
+# Subtest: clean package builds remove deleted sources and preserve the old runtime on preparation failure
+ok 1 - clean package builds remove deleted sources and preserve the old runtime on preparation failure
+  ---
+  duration_ms: 1051.087639
+  type: 'test'
+  ...
+# Subtest: cursor checker requires an affirmative parsed payload even when the wrapper says success
+ok 2 - cursor checker requires an affirmative parsed payload even when the wrapper says success
+  ---
+  duration_ms: 2.664519
+  type: 'test'
+  ...
+# Subtest: cursor checker distinguishes clear revocation from a crash, lock error or false connection
+ok 3 - cursor checker distinguishes clear revocation from a crash, lock error or false connection
+  ---
+  duration_ms: 1.38043
+  type: 'test'
+  ...
+# Subtest: codex checker requires an affirmative parsed payload even when the wrapper says success
+ok 4 - codex checker requires an affirmative parsed payload even when the wrapper says success
+  ---
+  duration_ms: 0.489554
+  type: 'test'
+  ...
+# Subtest: codex checker distinguishes clear revocation from a crash, lock error or false connection
+ok 5 - codex checker distinguishes clear revocation from a crash, lock error or false connection
+  ---
+  duration_ms: 0.411003
+  type: 'test'
+  ...
+# Subtest: checker requires verified:true for installation readiness
+ok 6 - checker requires verified:true for installation readiness
+  ---
+  duration_ms: 0.405553
+  type: 'test'
+  ...
+# Subtest: malformed viewer request targets return 400 without losing MCP events
+ok 7 - malformed viewer request targets return 400 without losing MCP events
+  ---
+  duration_ms: 82.943859
+  type: 'test'
+  ...
+# Subtest: MCP shutdown on EOF closes SSE and unfinished HTTP headers
+ok 8 - MCP shutdown on EOF closes SSE and unfinished HTTP headers
+  ---
+  duration_ms: 315.184055
+  type: 'test'
+  ...
+# Subtest: MCP shutdown on SIGTERM closes SSE and unfinished HTTP headers
+ok 9 - MCP shutdown on SIGTERM closes SSE and unfinished HTTP headers
+  ---
+  duration_ms: 305.673835
+  type: 'test'
+  ...
+# Subtest: HTTP and SSE snapshots use bounded pages and preserve large Unicode events
+ok 10 - HTTP and SSE snapshots use bounded pages and preserve large Unicode events
+  ---
+  duration_ms: 61.905405
+  type: 'test'
+  ...
+# Subtest: SSE client and queue limits isolate slow readers
+ok 11 - SSE client and queue limits isolate slow readers
+  ---
+  duration_ms: 12.125679
+  type: 'test'
+  ...
+# Subtest: legacy negotiation requires valid initialization and the initialized notification
+ok 12 - legacy negotiation requires valid initialization and the initialized notification
+  ---
+  duration_ms: 62.283697
+  type: 'test'
+  ...
+# Subtest: JSON-RPC rejects invalid IDs and parameters without answering responses or notifications
+ok 13 - JSON-RPC rejects invalid IDs and parameters without answering responses or notifications
+  ---
+  duration_ms: 54.601141
+  type: 'test'
+  ...
+# Subtest: tools enforce schemas, preserve Unicode limits, and never claim observed visibility
+ok 14 - tools enforce schemas, preserve Unicode limits, and never claim observed visibility
+  ---
+  duration_ms: 66.77478
+  type: 'test'
+  ...
+# Subtest: event pages obey encoded byte limits and traverse without losing filtered records
+ok 15 - event pages obey encoded byte limits and traverse without losing filtered records
+  ---
+  duration_ms: 11.553055
+  type: 'test'
+  ...
+# Subtest: retention is bounded by bytes as well as event count and reports eviction
+ok 16 - retention is bounded by bytes as well as event count and reports eviction
+  ---
+  duration_ms: 1.935104
+  type: 'test'
+  ...
+# Subtest: stdio framing handles split UTF-8, CRLF and escaped newlines with strict byte bounds
+ok 17 - stdio framing handles split UTF-8, CRLF and escaped newlines with strict byte bounds
+  ---
+  duration_ms: 2.863391
+  type: 'test'
+  ...
+# Subtest: an oversized unfinished frame closes the MCP process promptly
+ok 18 - an oversized unfinished frame closes the MCP process promptly
+  ---
+  duration_ms: 54.294119
+  type: 'test'
+  ...
+# Subtest: SIGTERM exits within a deadline even when the host stops reading stdout
+ok 19 - SIGTERM exits within a deadline even when the host stops reading stdout
+  ---
+  duration_ms: 1107.18707
+  type: 'test'
+  ...
+# Subtest: stdio writes wait for readers and reject stalled or oversized output
+ok 20 - stdio writes wait for readers and reject stalled or oversized output
+  ---
+  duration_ms: 1004.277874
+  type: 'test'
+  ...
+# Subtest: rate limiting admits bursts, rejects excess calls and refills over time
+ok 21 - rate limiting admits bursts, rejects excess calls and refills over time
+  ---
+  duration_ms: 0.322933
+  type: 'test'
+  ...
+# Subtest: MCP tool floods receive actionable rate-limit errors
+ok 22 - MCP tool floods receive actionable rate-limit errors
+  ---
+  duration_ms: 63.699898
+  type: 'test'
+  ...
+# Subtest: live dev API: codex installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
+ok 23 - live dev API: codex installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation # SKIP
+  ---
+  duration_ms: 0.656305
+  type: 'test'
+  ...
+# Subtest: live dev API: cursor installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
+ok 24 - live dev API: cursor installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation # SKIP
+  ---
+  duration_ms: 0.101111
+  type: 'test'
+  ...
+# Subtest: live dev API: claude installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation
+ok 25 - live dev API: claude installed runtime verifies, enrolls, publishes OMEMO, restarts and stops on revocation # SKIP
+  ---
+  duration_ms: 0.090091
+  type: 'test'
+  ...
+# cursor: delayed shutdown released session lock; OMEMO snapshot unchanged
+# Subtest: cursor shutdown waits for session cleanup and releases its own lock without changing keys
+ok 26 - cursor shutdown waits for session cleanup and releases its own lock without changing keys
+  ---
+  duration_ms: 2282.813723
+  type: 'test'
+  ...
+# codex: delayed shutdown released session lock; OMEMO snapshot unchanged
+# Subtest: codex shutdown waits for session cleanup and releases its own lock without changing keys
+ok 27 - codex shutdown waits for session cleanup and releases its own lock without changing keys
+  ---
+  duration_ms: 1598.667168
+  type: 'test'
+  ...
+# Subtest: MCP shutdown finishes saving an in-flight verification response before exiting
+ok 28 - MCP shutdown finishes saving an in-flight verification response before exiting
+  ---
+  duration_ms: 1332.841137
+  type: 'test'
+  ...
+# Subtest: enrollment saves durable credential before XMPP, publishes before callback, and resumes without redemption
+ok 29 - enrollment saves durable credential before XMPP, publishes before callback, and resumes without redemption
+  ---
+  duration_ms: 1043.328531
+  type: 'test'
+  ...
+# Subtest: origins, host identities and installations cannot be substituted
+ok 30 - origins, host identities and installations cannot be substituted
+  ---
+  duration_ms: 208.854253
+  type: 'test'
+  ...
+# Subtest: expiration, replay, wrong installation and revocation return safe actions
+ok 31 - expiration, replay, wrong installation and revocation return safe actions
+  ---
+  duration_ms: 42.991905
+  type: 'test'
+  ...
+# Subtest: background heartbeats preserve the stream and retry outages with bounded backoff and safe diagnostics
+ok 32 - background heartbeats preserve the stream and retry outages with bounded backoff and safe diagnostics
+  ---
+  duration_ms: 114.009357
+  type: 'test'
+  ...
+# Subtest: failed initial connection recovers in background without another redemption and close cancels retries
+ok 33 - failed initial connection recovers in background without another redemption and close cancels retries
+  ---
+  duration_ms: 18.615887
+  type: 'test'
+  ...
+# Subtest: failed XMPP ping closes only the broken stream and obtains a fresh grant on automatic retry
+ok 34 - failed XMPP ping closes only the broken stream and obtains a fresh grant on automatic retry
+  ---
+  duration_ms: 19.640814
+  type: 'test'
+  ...
+# Subtest: shutdown waits for a background grant request and prevents a new session after closing
+ok 35 - shutdown waits for a background grant request and prevents a new session after closing
+  ---
+  duration_ms: 96.954952
+  type: 'test'
+  ...
+# Subtest: failed OMEMO registration preserves credential, suppresses connected callback, and resumes
+ok 36 - failed OMEMO registration preserves credential, suppresses connected callback, and resumes
+  ---
+  duration_ms: 32.641529
+  type: 'test'
+  ...
+# Subtest: lost redemption and failed persistence never claim success
+ok 37 - lost redemption and failed persistence never claim success
+  ---
+  duration_ms: 15.961747
+  type: 'test'
+  ...
+# Subtest: unsafe permissions, symlinks and concurrent writes fail closed
+ok 38 - unsafe permissions, symlinks and concurrent writes fail closed
+  ---
+  duration_ms: 2.011264
+  type: 'test'
+  ...
+# Subtest: HTTP policy rejects non-loopback cleartext, URL credentials and redirects
+ok 39 - HTTP policy rejects non-loopback cleartext, URL credentials and redirects
+  ---
+  duration_ms: 15.899446
+  type: 'test'
+  ...
+# Subtest: existing Wacando OMEMO identity survives reload; corrupt state is never regenerated
+ok 40 - existing Wacando OMEMO identity survives reload; corrupt state is never regenerated
+  ---
+  duration_ms: 403.376792
+  type: 'test'
+  ...
+# Subtest: installed MCP tools verify via HTTP and never expose response credentials
+ok 41 - installed MCP tools verify via HTTP and never expose response credentials
+  ---
+  duration_ms: 88.259078
+  type: 'test'
+  ...
+# Subtest: cursor packaged MCP rejects a locally revoked identity without crashing or reporting connection
+ok 42 - cursor packaged MCP rejects a locally revoked identity without crashing or reporting connection
+  ---
+  duration_ms: 71.019902
+  type: 'test'
+  ...
+# Subtest: codex packaged MCP rejects a locally revoked identity without crashing or reporting connection
+ok 43 - codex packaged MCP rejects a locally revoked identity without crashing or reporting connection
+  ---
+  duration_ms: 73.068047
+  type: 'test'
+  ...
+# Subtest: release version matches all manifests
+ok 44 - release version matches all manifests
+  ---
+  duration_ms: 6.070935
+  type: 'test'
+  ...
+# Subtest: local npm tarball contains standalone hosts and installer preserves existing installations
+ok 45 - local npm tarball contains standalone hosts and installer preserves existing installations
+  ---
+  duration_ms: 1231.05584
+  type: 'test'
+  ...
+# Subtest: codex package runs relocated without the repository and records its own provider
+ok 46 - codex package runs relocated without the repository and records its own provider
+  ---
+  duration_ms: 180.434215
+  type: 'test'
+  ...
+# Subtest: cursor package runs relocated without the repository and records its own provider
+ok 47 - cursor package runs relocated without the repository and records its own provider
+  ---
+  duration_ms: 261.805562
+  type: 'test'
+  ...
+# Subtest: claude package runs relocated without the repository and records its own provider
+ok 48 - claude package runs relocated without the repository and records its own provider
+  ---
+  duration_ms: 190.058795
+  type: 'test'
+  ...
+# Subtest: Claude, Cursor and Codex MCP processes have independent stores and ports
+ok 49 - Claude, Cursor and Codex MCP processes have independent stores and ports
+  ---
+  duration_ms: 70.82851
+  type: 'test'
+  ...
+# Subtest: Cursor installer copies a real package and refuses to overwrite an existing install
+ok 50 - Cursor installer copies a real package and refuses to overwrite an existing install
+  ---
+  duration_ms: 301.01033
+  type: 'test'
+  ...
+# Subtest: store validates messages, orders events and bounds retention
+ok 51 - store validates messages, orders events and bounds retention
+  ---
+  duration_ms: 1.795423
+  type: 'test'
+  ...
+# Subtest: loopback viewer serves assets and blocks cross-origin writes and traversal
+ok 52 - loopback viewer serves assets and blocks cross-origin writes and traversal
+  ---
+  duration_ms: 31.956835
+  type: 'test'
+  ...
+# Subtest: SSE delivers snapshot and live message, reconnect recovers snapshot
+ok 53 - SSE delivers snapshot and live message, reconnect recovers snapshot
+  ---
+  duration_ms: 258.948192
+  type: 'test'
+  ...
+# Subtest: MCP starts HTTP, records events and shuts down on stdin EOF
+ok 54 - MCP starts HTTP, records events and shuts down on stdin EOF
+  ---
+  duration_ms: 58.386089
+  type: 'test'
+  ...
+# Subtest: late history pages cannot duplicate live events, resurrect evictions or replace a new connection
+ok 55 - late history pages cannot duplicate live events, resurrect evictions or replace a new connection
+  ---
+  duration_ms: 1.604591
+  type: 'test'
+  ...
+# Subtest: history loading pins the snapshot sequence, follows cursors and respects cancellation
+ok 56 - history loading pins the snapshot sequence, follows cursors and respects cancellation
+  ---
+  duration_ms: 1.007087
+  type: 'test'
+  ...
+# Subtest: rate-limited history loading resumes from the same page instead of restarting the stream
+ok 57 - rate-limited history loading resumes from the same page instead of restarting the stream
+  ---
+  duration_ms: 1001.664905
+  type: 'test'
+  ...
+1..57
+# tests 57
+# suites 0
+# pass 54
+# fail 0
+# cancelled 0
+# skipped 3
+# todo 0
+# duration_ms 5282.140907

package/docs/evidence/issue-2/codex-exec-help.json

@@ -0,0 +1,11 @@
+{
+  "command": [
+    "timeout",
+    "20s",
+    "codex",
+    "exec",
+    "--help"
+  ],
+  "exit_code": 0,
+  "combined_output": "WARNING: proceeding, even though we could not create PATH aliases: Read-only file system (os error 30)\nRun Codex non-interactively\n\nUsage: codex exec [OPTIONS] [PROMPT]\n       codex exec [OPTIONS] <COMMAND> [ARGS]\n\nCommands:\n  resume  Resume a previous session by id or pick the most recent with --last\n  fork    Fork a previous session by id into a new session\n  review  Run a code review against the current repository\n  help    Print this message or the help of the given subcommand(s)\n\nArguments:\n  [PROMPT]\n          Initial instructions for the agent. If not provided as an argument (or if `-` is used),\n          instructions are read from stdin. If stdin is piped and a prompt is also provided, stdin\n          is appended as a `<stdin>` block\n\nOptions:\n  -c, --config <key=value>\n          Override a configuration value that would otherwise be loaded from `~/.codex/config.toml`.\n          Use a dotted path (`foo.bar.baz`) to override nested values. The `value` portion is parsed\n          as TOML. If it fails to parse as TOML, the raw string is used as a literal.\n          \n          Examples: - `-c model=\"o3\"` - `-c 'sandbox_permissions=[\"disk-full-read-access\"]'` - `-c\n          shell_environment_policy.inherit=all`\n\n      --enable <FEATURE>\n          Enable a feature (repeatable). Equivalent to `-c features.<name>=true`\n\n      --disable <FEATURE>\n          Disable a feature (repeatable). Equivalent to `-c features.<name>=false`\n\n      --strict-config\n          Error out when config.toml contains fields that are not recognized by this version of\n          Codex\n\n  -i, --image <FILE>...\n          Optional image(s) to attach to the initial prompt\n\n  -m, --model <MODEL>\n          Model the agent should use\n\n      --oss\n          Use open-source provider\n\n      --local-provider <OSS_PROVIDER>\n          Specify which local provider to use (lmstudio or ollama). If not specified with --oss,\n          will use config default or show selection\n\n  -p, --profile <CONFIG_PROFILE_V2>\n          Layer $CODEX_HOME/<name>.config.toml on top of the base user config\n\n  -s, --sandbox <SANDBOX_MODE>\n          Select the sandbox policy to use when executing model-generated shell commands\n          \n          [possible values: read-only, workspace-write, danger-full-access]\n\n      --approve-for-me\n          Route approval requests through automatic review using the workspace-write sandbox\n\n      --dangerously-bypass-approvals-and-sandbox\n          Skip all confirmation prompts and execute commands without sandboxing. EXTREMELY\n          DANGEROUS. Intended solely for running in environments that are externally sandboxed\n\n      --dangerously-bypass-hook-trust\n          Run enabled hooks without requiring persisted hook trust for this invocation. DANGEROUS.\n          Intended only for automation that already vets hook sources\n\n  -C, --cd <DIR>\n          Tell the agent to use the specified directory as its working root\n\n      --worktree\n          Run the session in a new managed Git worktree\n\n      --add-dir <DIR>\n          Additional directories that should be writable alongside the primary workspace\n\n      --thread-source <SOURCE>\n          Source classification for newly created or forked threads\n\n      --cyber-access-program <PROGRAM>\n          Request an experimental Cyber access program for this turn (OpenAI provider only). Omit to\n          use server defaults. Not supported with review; fork requires a prompt\n          \n          [possible values: standard, daybreak_blue, daybreak_red]\n\n      --skip-git-repo-check\n          Allow running Codex outside a Git repository\n\n      --ephemeral\n          Run without persisting session files to disk\n\n      --ignore-user-config\n          Do not load `$CODEX_HOME/config.toml`; auth still uses `CODEX_HOME`\n\n      --ignore-rules\n          Do not load user or project execpolicy `.rules` files\n\n      --output-schema <FILE>\n          Path to a JSON Schema file describing the model's final response shape\n\n      --color <COLOR>\n          Specifies color settings for use in the output\n          \n          [default: auto]\n          [possible values: always, never, auto]\n\n      --json\n          Print events to stdout as JSONL\n\n  -o, --output-last-message <FILE>\n          Specifies file where the last message from the agent should be written\n\n  -h, --help\n          Print help (see a summary with '-h')\n\n  -V, --version\n          Print version\n"
+}

package/docs/evidence/issue-2/codex-help.json

@@ -0,0 +1,10 @@
+{
+  "command": [
+    "timeout",
+    "20s",
+    "codex",
+    "--help"
+  ],
+  "exit_code": 0,
+  "combined_output": "WARNING: proceeding, even though we could not create PATH aliases: Read-only file system (os error 30)\nCodex CLI\n\nIf no subcommand is specified, options will be forwarded to the interactive CLI.\n\nUsage: codex [OPTIONS] [PROMPT]\n       codex [OPTIONS] <COMMAND> [ARGS]\n\nCommands:\n  agents            Browse all agent sessions on the shared local app-server daemon\n  exec              Run Codex non-interactively [aliases: e]\n  review            Run a code review non-interactively\n  login             Manage login\n  logout            Remove stored authentication credentials\n  mcp               Manage external MCP servers for Codex\n  plugin            Manage Codex plugins\n  app-server        [experimental] Run the app server or related tooling\n  remote-control    [experimental] Manage the app-server daemon with remote control enabled\n  completion        Generate shell completion scripts\n  update            Update Codex to the latest version\n  doctor            Diagnose local Codex installation, config, auth, and runtime health\n  sandbox           Run commands within a Codex-provided sandbox\n  debug             Debugging tools\n  apply             Apply the latest diff produced by Codex agent as a `git apply` to your local\n                    working tree [aliases: a]\n  resume            Resume a previous interactive session (picker by default; use --last to continue\n                    the most recent)\n  queue             Queue a message for an existing session\n  archive           Archive a saved session by id or session name\n  delete            Permanently delete a saved session by id or session name\n  migrate-rollouts  Inspect or migrate legacy local sessions to paginated thread history\n  unarchive         Unarchive a saved session by id or session name\n  fork              Fork a previous interactive session (picker by default; use --last to fork the\n                    most recent)\n  cloud             [EXPERIMENTAL] Browse tasks from Codex Cloud and apply changes locally\n  exec-server       [EXPERIMENTAL] Run the standalone exec-server service\n  features          Inspect feature flags\n  help              Print this message or the help of the given subcommand(s)\n\nArguments:\n  [PROMPT]\n          Optional user prompt to start the session\n\nOptions:\n  -c, --config <key=value>\n          Override a configuration value that would otherwise be loaded from `~/.codex/config.toml`.\n          Use a dotted path (`foo.bar.baz`) to override nested values. The `value` portion is parsed\n          as TOML. If it fails to parse as TOML, the raw string is used as a literal.\n          \n          Examples: - `-c model=\"o3\"` - `-c 'sandbox_permissions=[\"disk-full-read-access\"]'` - `-c\n          shell_environment_policy.inherit=all`\n\n      --enable <FEATURE>\n          Enable a feature (repeatable). Equivalent to `-c features.<name>=true`\n\n      --disable <FEATURE>\n          Disable a feature (repeatable). Equivalent to `-c features.<name>=false`\n\n      --remote <ADDR>\n          Connect the TUI to a remote app server endpoint.\n          \n          Accepted forms: `ws://host:port`, `wss://host:port`, `unix://`, or `unix://PATH`.\n\n      --remote-auth-token-env <ENV_VAR>\n          Name of the environment variable containing the bearer token to send to a remote app\n          server websocket\n\n      --strict-config\n          Error out when config.toml contains fields that are not recognized by this version of\n          Codex\n\n  -i, --image <FILE>...\n          Optional image(s) to attach to the initial prompt\n\n  -m, --model <MODEL>\n          Model the agent should use\n\n      --oss\n          Use open-source provider\n\n      --local-provider <OSS_PROVIDER>\n          Specify which local provider to use (lmstudio or ollama). If not specified with --oss,\n          will use config default or show selection\n\n  -p, --profile <CONFIG_PROFILE_V2>\n          Layer $CODEX_HOME/<name>.config.toml on top of the base user config\n\n  -s, --sandbox <SANDBOX_MODE>\n          Select the sandbox policy to use when executing model-generated shell commands\n          \n          [possible values: read-only, workspace-write, danger-full-access]\n\n      --approve-for-me\n          Route approval requests through automatic review using the workspace-write sandbox\n\n      --dangerously-bypass-approvals-and-sandbox\n          Skip all confirmation prompts and execute commands without sandboxing. EXTREMELY\n          DANGEROUS. Intended solely for running in environments that are externally sandboxed\n\n      --dangerously-bypass-hook-trust\n          Run enabled hooks without requiring persisted hook trust for this invocation. DANGEROUS.\n          Intended only for automation that already vets hook sources\n\n  -C, --cd <DIR>\n          Tell the agent to use the specified directory as its working root\n\n      --worktree\n          Run the session in a new managed Git worktree\n\n      --add-dir <DIR>\n          Additional directories that should be writable alongside the primary workspace\n\n  -a, --ask-for-approval <APPROVAL_POLICY>\n          Configure when the model requires human approval before executing a command\n\n          Possible values:\n          - on-request: The model decides when to ask the user for approval\n          - never:      Never ask for user approval Execution failures are immediately returned to\n            the model\n\n      --search\n          Enable live web search. When enabled, the native Responses `web_search` tool is available\n          to the model (no per\u2011call approval)\n\n      --no-alt-screen\n          Disable alternate screen mode\n          \n          Runs the TUI in inline mode, preserving terminal scrollback history.\n\n      --no-daemon\n          Run without the shared background server, even if it is already running\n\n  -h, --help\n          Print help (see a summary with '-h')\n\n  -V, --version\n          Print version\n"
+}

package/docs/evidence/issue-2/cursor-help.json

@@ -0,0 +1,10 @@
+{
+  "command": [
+    "timeout",
+    "20s",
+    "cursor-agent",
+    "--help"
+  ],
+  "exit_code": 0,
+  "combined_output": "Usage: agent [options] [command] [prompt...]\n\nStart the Cursor Agent\n\nArguments:\n  prompt                       Initial prompt for the agent\n\nOptions:\n  -v, --version                Output the version number\n  --api-key <key>              API key for authentication (can also use\n                               CURSOR_API_KEY env var)\n  -H, --header <header>        Add custom header to agent requests (format:\n                               'Name: Value', can be used multiple times)\n  -e, --endpoint <url>         Target API endpoint URL (can also use\n                               CURSOR_API_ENDPOINT env var) (default:\n                               \"https://api2.cursor.sh\", env:\n                               CURSOR_API_ENDPOINT)\n  -p, --print                  Print responses to console (for scripts or\n                               non-interactive use). Has access to all tools,\n                               including write and shell. (default: false)\n  --output-format <format>     Output format (only works with --print): text |\n                               json | stream-json (default: \"text\")\n  --stream-partial-output      Stream partial output as individual text deltas\n                               (only works with --print and stream-json format)\n                               (default: false)\n  --mode <mode>                Start in the given execution mode. plan:\n                               read-only/planning (analyze, propose plans, no\n                               edits). ask: Q&A style for explanations and\n                               questions (read-only). (choices: \"plan\", \"ask\")\n  --plan                       Start in plan mode (shorthand for --mode=plan).\n                               (default: false)\n  --resume [chatId]            Select a session to resume (default: false)\n  --continue                   Continue previous session (default: false)\n  --model <model>              Model to use (e.g., gpt-5, sonnet-4-thinking).\n                               Parameterized models accept quoted bracket\n                               overrides, e.g.\n                               'claude-opus-4-8[context=1m,effort=high,fast=false]'\n  --list-models                List available models and exit (default: false)\n  -f, --force                  Force allow commands unless explicitly denied\n                               (default: false)\n  --yolo                       Alias for --force (Run Everything) (default:\n                               false)\n  --auto-review                Use Auto-review (Smart Auto): a server classifier\n                               auto-runs safe tool calls and prompts for the\n                               rest (default: false)\n  --sandbox <mode>             Explicitly enable or disable sandbox mode\n                               (overrides config) (choices: \"enabled\",\n                               \"disabled\")\n  --approve-mcps               Automatically approve all MCP servers (default:\n                               false)\n  --trust                      Trust the current workspace without prompting\n                               (default: false)\n  --workspace <path-or-name>   Workspace directory or saved workspace name to\n                               use (defaults to current working directory)\n  --add-dir <path>             Add an additional workspace root directory (can\n                               be specified multiple times)\n  --plugin-dir <path>          Load a local plugin directory (can be specified\n                               multiple times)\n  -w, --worktree [name]        Start in an isolated git worktree at\n                               ~/.cursor/worktrees/<reponame>/<name>. If\n                               omitted, a name is generated.\n  --worktree-base <branch>     Branch or ref to base the new worktree on\n                               (default: current HEAD)\n  --skip-worktree-setup        Skip running worktree setup scripts from\n                               .cursor/worktrees.json (default: false)\n  -h, --help                   Display help for command\n\nCommands:\n  persist                      Start or manage a session that survives terminal\n                               disconnects\n  install-shell-integration    Install shell integration to ~/.zshrc\n  uninstall-shell-integration  Remove shell integration from ~/.zshrc\n  login                        Authenticate with Cursor. Set NO_OPEN_BROWSER to\n                               disable browser opening.\n  logout                       Sign out and clear stored authentication\n  mcp                          Manage MCP servers\n  plugin                       Manage plugins and plugin marketplaces\n  worker [options]             Run a self-hosted Cloud Agent worker that\n                               connects to Cursor and executes agent tool calls\n                               on this machine. Without --pool it is a personal\n                               My Machines worker (no Enterprise plan needed);\n                               with --pool it joins a team Self-Hosted Pool\n                               (Enterprise plan + service account API key).\n  status|whoami [options]      View authentication status\n  models                       List available models for this account\n  team                         View or switch the active team for this account\n  bedrock                      Configure AWS Bedrock usage for CLI\n  about [options]              Display version, system, and account information\n  update                       Update Cursor Agent to the latest version\n  create-chat                  Create a new empty chat and return its ID\n  generate-rule|rule           Generate a new Cursor rule with interactive\n                               prompts\n  agent [prompt...]            Start the Cursor Agent\n  ls                           Resume a chat session\n  resume                       Resume the latest chat session\n  help [command]               Display help for command\n"
+}