agentic-workflow-manager 9.14.0 → 9.15.0

package/dist/src/commands/context-budget/budget.js

@@ -7,10 +7,14 @@ exports.CONFIG_FILE = exports.DEFAULT_FILES = void 0;
 exports.estimateTokens = estimateTokens;
 exports.measure = measure;
 exports.readConfig = readConfig;
+exports.readCursorHookByteCaps = readCursorHookByteCaps;
+exports.evaluateCursorHookBudgets = evaluateCursorHookBudgets;
 exports.writeConfig = writeConfig;
 exports.checkBudget = checkBudget;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const paths_1 = require("../../core/paths");
+const cursor_budgets_1 = require("../../core/cursor-budgets");
 /**
  * The feedforward context budget.
  *
@@ -69,15 +73,53 @@ function readConfig(cwd) {
         const raw = JSON.parse(fs_1.default.readFileSync(path_1.default.join(cwd, exports.CONFIG_FILE), 'utf-8'));
         if (typeof raw.maxBytes !== 'number' || !Number.isFinite(raw.maxBytes))
             return null;
-        return {
+        const config = {
             files: Array.isArray(raw.files) && raw.files.length ? raw.files : exports.DEFAULT_FILES,
             maxBytes: raw.maxBytes,
         };
+        if (typeof raw[cursor_budgets_1.CURSOR_SESSION_START_PIN] === 'number' && Number.isFinite(raw[cursor_budgets_1.CURSOR_SESSION_START_PIN])) {
+            config[cursor_budgets_1.CURSOR_SESSION_START_PIN] = raw[cursor_budgets_1.CURSOR_SESSION_START_PIN];
+        }
+        if (typeof raw[cursor_budgets_1.CURSOR_REANCHOR_PIN] === 'number' && Number.isFinite(raw[cursor_budgets_1.CURSOR_REANCHOR_PIN])) {
+            config[cursor_budgets_1.CURSOR_REANCHOR_PIN] = raw[cursor_budgets_1.CURSOR_REANCHOR_PIN];
+        }
+        return config;
     }
     catch {
         return null;
     }
 }
+/** Read MAX_*_BYTES assignments from an installed Cursor session-start script. */
+function readCursorHookByteCaps(scriptPath) {
+    if (!fs_1.default.existsSync(scriptPath))
+        return { session: null, reanchor: null };
+    const text = fs_1.default.readFileSync(scriptPath, 'utf8');
+    const session = /MAX_SESSION_BYTES\s*=\s*(\d+)\s*\*\s*(\d+)/.exec(text);
+    const reanchor = /MAX_REANCHOR_BYTES\s*=\s*(\d+)\s*\*\s*(\d+)/.exec(text);
+    return {
+        session: session ? Number(session[1]) * Number(session[2]) : null,
+        reanchor: reanchor ? Number(reanchor[1]) * Number(reanchor[2]) : null,
+    };
+}
+function evaluateCursorHookBudgets(config) {
+    const scriptPath = path_1.default.join((0, paths_1.awmHome)(), 'hooks/cursor/session-start');
+    if (!fs_1.default.existsSync(scriptPath)) {
+        return undefined; // unmeasurable / absent — do not fail
+    }
+    const pinSession = config?.[cursor_budgets_1.CURSOR_SESSION_START_PIN] ?? cursor_budgets_1.CURSOR_SESSION_START_MAX_BYTES;
+    const pinReanchor = config?.[cursor_budgets_1.CURSOR_REANCHOR_PIN] ?? cursor_budgets_1.CURSOR_REANCHOR_MAX_BYTES;
+    const observed = readCursorHookByteCaps(scriptPath);
+    const sessionOk = observed.session === null || observed.session <= pinSession;
+    const reanchorOk = observed.reanchor === null || observed.reanchor <= pinReanchor;
+    const constantsOk = cursor_budgets_1.CURSOR_SESSION_START_MAX_BYTES <= pinSession && cursor_budgets_1.CURSOR_REANCHOR_MAX_BYTES <= pinReanchor;
+    return {
+        status: sessionOk && reanchorOk && constantsOk ? 'within' : 'over',
+        sessionStartMaxBytes: pinSession,
+        reanchorMaxBytes: pinReanchor,
+        observedSessionStartMaxBytes: observed.session,
+        observedReanchorMaxBytes: observed.reanchor,
+    };
+}
 function writeConfig(cwd, config) {
     fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
     const body = {
@@ -97,6 +139,7 @@ function writeConfig(cwd, config) {
  */
 function checkBudget(cwd) {
     const config = readConfig(cwd);
+    const cursorHooks = evaluateCursorHookBudgets(config);
     if (!config) {
         const { total, breakdown } = measure(cwd, exports.DEFAULT_FILES);
         // Fijar sobre CERO archivos es una trampa, no una linea base.
@@ -110,16 +153,19 @@ function checkBudget(cwd) {
         //
         // Se reporta y NO se escribe config: el proximo run, ya con contexto, fija bien.
         if (breakdown.length === 0) {
-            return { status: 'unmeasurable', totalBytes: 0, maxBytes: 0, breakdown };
+            return { status: 'unmeasurable', totalBytes: 0, maxBytes: 0, breakdown, ...(cursorHooks ? { cursorHooks } : {}) };
         }
         writeConfig(cwd, { files: exports.DEFAULT_FILES, maxBytes: total });
-        return { status: 'pinned', totalBytes: total, maxBytes: total, breakdown };
+        return { status: 'pinned', totalBytes: total, maxBytes: total, breakdown, ...(cursorHooks ? { cursorHooks } : {}) };
     }
     const { total, breakdown } = measure(cwd, config.files);
+    const fileStatus = total > config.maxBytes ? 'over' : 'within';
+    const status = fileStatus === 'over' || cursorHooks?.status === 'over' ? 'over' : fileStatus;
     return {
-        status: total > config.maxBytes ? 'over' : 'within',
+        status,
         totalBytes: total,
         maxBytes: config.maxBytes,
         breakdown,
+        ...(cursorHooks ? { cursorHooks } : {}),
     };
 }

package/dist/src/commands/doctor.js

@@ -76,6 +76,7 @@ const CHECK_LABELS = {
     'agents.native': 'native agents',
     'workflows.global': 'global workflows',
     'context.global': 'global context',
+    'context.overlap': 'Claude/Cursor delivery overlap',
     'hook.trust': 'hook SessionStart',
     'guidance.project': 'project guidance',
     'constitution.delivery': 'constitution delivery',
@@ -100,7 +101,7 @@ function attachRoutingSetupGuidance(report, guidance) {
     return { ...report, providers };
 }
 const OK_STATES = ['supported', 'healthy', 'shared', 'delivered'];
-const PENDING_STATES = ['pending', 'pending-trust'];
+const PENDING_STATES = ['pending', 'pending-trust', 'pending-first-run'];
 const WARN_STATES = ['stale'];
 function providerGlyph(state) {
     if (OK_STATES.includes(state))
@@ -116,6 +117,8 @@ function providerCheckDetail(check) {
         return picocolors_1.default.dim(` (${check.target})`);
     if (check.state === 'pending-trust')
         return picocolors_1.default.dim(' (pending trust)');
+    if (check.state === 'pending-first-run')
+        return picocolors_1.default.dim(' (pending first run)');
     if (check.detail)
         return picocolors_1.default.dim(` (${check.detail})`);
     return '';

package/dist/src/commands/hooks/cursor.js

@@ -0,0 +1,359 @@
+"use strict";
+// cli/src/commands/hooks/cursor.ts
+//
+// Cursor hook adapter: merges AWM entries into ~/.cursor/hooks.json (version: 1)
+// for sessionStart / preCompact / postToolUse, syncs the three Plan A scripts into
+// <AWM_HOME>/hooks/cursor/, and materializes using-awm.md beside them.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURSOR_HOOK_EVENTS = exports.CURSOR_HOOKS_REGISTRY_FLOOR = void 0;
+exports.shouldDisableDeferredReanchor = shouldDisableDeferredReanchor;
+exports.assertCursorRegistryFloor = assertCursorRegistryFloor;
+exports.resolveInstalledBaselineVersion = resolveInstalledBaselineVersion;
+exports.awmCursorEntry = awmCursorEntry;
+exports.isDeadAwmCursorEntry = isDeadAwmCursorEntry;
+exports.isStaleAwmCursorEntry = isStaleAwmCursorEntry;
+exports.installCursorHook = installCursorHook;
+exports.computeCursorHookStatus = computeCursorHookStatus;
+exports.uninstallCursorHook = uninstallCursorHook;
+exports.resyncCursorHookFiles = resyncCursorHookFiles;
+exports.cursorResyncSourcesExist = cursorResyncSourcesExist;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const providers_1 = require("../../providers");
+const shared_1 = require("./shared");
+const atomic_file_1 = require("../../core/atomic-file");
+const provider_1 = require("../../core/context/provider");
+const orchestrators_1 = require("../../core/orchestrators");
+const registries_1 = require("../../core/registries");
+const versioning_1 = require("../../core/versioning");
+exports.CURSOR_HOOKS_REGISTRY_FLOOR = '4.9.0';
+exports.CURSOR_HOOK_EVENTS = ['sessionStart', 'preCompact', 'postToolUse'];
+const SCRIPT_BY_EVENT = {
+    sessionStart: { source: 'hooks/cursor-session-start', dest: 'session-start' },
+    preCompact: { source: 'hooks/cursor-pre-compact', dest: 'pre-compact' },
+    postToolUse: { source: 'hooks/cursor-post-tool-use', dest: 'post-tool-use' },
+};
+/** R16.2 — disable deferred re-anchor when delivery is unverified or p95 exceeds 50ms. */
+function shouldDisableDeferredReanchor(metrics) {
+    return metrics.deliveryVerified === false || metrics.p95Ms > 50;
+}
+function assertCursorRegistryFloor(version) {
+    if (version === null) {
+        throw new Error(`Cursor hooks require baseline registry >= ${exports.CURSOR_HOOKS_REGISTRY_FLOOR}; installed version is unverifiable. Run 'awm update -y'.`);
+    }
+    try {
+        if ((0, versioning_1.compareSemver)(version, exports.CURSOR_HOOKS_REGISTRY_FLOOR) < 0) {
+            throw new Error(`Cursor hooks require baseline registry >= ${exports.CURSOR_HOOKS_REGISTRY_FLOOR}; installed is ${version}. Run 'awm update -y'.`);
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('Cursor hooks require'))
+            throw error;
+        throw new Error(`Cursor hooks require baseline registry >= ${exports.CURSOR_HOOKS_REGISTRY_FLOOR}; installed version is unverifiable. Run 'awm update -y'.`);
+    }
+}
+function syncDescribeExactTag(repoDir) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['describe', '--tags', '--exact-match', 'HEAD'], {
+            cwd: repoDir,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 2_000,
+            maxBuffer: 64 * 1024,
+            windowsHide: true,
+        }).trim();
+        const match = /^v(\d+\.\d+\.\d+)$/.exec(out);
+        return match ? match[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve installed baseline version (pin wins; else exact tag on checkout). */
+function resolveInstalledBaselineVersion() {
+    const { pin } = (0, versioning_1.machineVersionOpts)('baseline');
+    if (pin)
+        return (0, versioning_1.normalizePin)(pin);
+    let root;
+    try {
+        root = (0, registries_1.listRegistries)().find((registry) => registry.name === 'baseline')?.contentRoot;
+    }
+    catch {
+        return null;
+    }
+    if (!root || !fs_1.default.existsSync(root))
+        return null;
+    return syncDescribeExactTag(root);
+}
+function cursorConfig() {
+    const config = (0, providers_1.getHookConfig)('cursor');
+    if (!config || config.type !== 'cursor-hooks-json') {
+        throw new Error('Cursor hook configuration is unavailable');
+    }
+    return config;
+}
+function writeMaterializedSkill(skillDest, registryRoot) {
+    const skillSource = path_1.default.join(registryRoot, 'skills/using-awm/SKILL.md');
+    if (!fs_1.default.existsSync(skillSource)) {
+        throw new Error(`using-awm skill not found at ${skillSource}. Run 'awm update' first.`);
+    }
+    const ctx = (0, provider_1.buildContext)({
+        registryRoot,
+        profileExtensions: [],
+        declaredOrchestrators: (0, orchestrators_1.collectAndWarn)(),
+    });
+    fs_1.default.mkdirSync(path_1.default.dirname(skillDest), { recursive: true });
+    const tmpPath = path_1.default.join(path_1.default.dirname(skillDest), `.using-awm.md.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    fs_1.default.writeFileSync(tmpPath, ctx.markdown, 'utf-8');
+    fs_1.default.renameSync(tmpPath, skillDest);
+}
+function awmCursorEntry(scriptsDir, event) {
+    return { command: path_1.default.join(scriptsDir, SCRIPT_BY_EVENT[event].dest) };
+}
+function isAwmCursorEntry(entry, scriptsDir, event) {
+    const command = entry?.command;
+    return typeof command === 'string' && command === path_1.default.join(scriptsDir, SCRIPT_BY_EVENT[event].dest);
+}
+/** Dead AWM entry: our script basename, not under current scriptsDir, path missing. */
+function isDeadAwmCursorEntry(entry, currentScriptsDir) {
+    const command = entry?.command;
+    if (typeof command !== 'string' || command.length === 0)
+        return false;
+    const basename = path_1.default.basename(command);
+    if (!Object.values(SCRIPT_BY_EVENT).some((script) => script.dest === basename))
+        return false;
+    if (path_1.default.dirname(command) === currentScriptsDir)
+        return false;
+    return !fs_1.default.existsSync(command);
+}
+/**
+ * Stale Cursor AWM entries (legacy shapes). Today Cursor only ever wrote the
+ * flat `{ command }` form, so there is no legacy matcher/wrapper to retire —
+ * live parallel AWM_HOME installs are preserved (same rule as Codex).
+ */
+function isStaleAwmCursorEntry(_entry, _currentScriptsDir) {
+    return false;
+}
+function activeEvents(disableDeferred) {
+    return disableDeferred ? ['sessionStart'] : [...exports.CURSOR_HOOK_EVENTS];
+}
+function readCursorHooksDocument(settingsPath) {
+    const current = (0, shared_1.readStrictJson)(settingsPath);
+    if (Object.keys(current).length === 0) {
+        return { version: 1, hooks: {} };
+    }
+    if (current.version !== undefined && current.version !== 1) {
+        throw new Error(`${settingsPath} has unsupported hooks.json version ${String(current.version)} (expected 1).`);
+    }
+    return current;
+}
+function eventArray(hooks, event, settingsPath) {
+    if (!(event in hooks) || hooks[event] === undefined)
+        return [];
+    if (!Array.isArray(hooks[event])) {
+        throw new Error(`${settingsPath} hooks.${event} must be an array.`);
+    }
+    return hooks[event];
+}
+function installCursorHook(options) {
+    const config = cursorConfig();
+    const baselineVersion = options.baselineRegistryVersion !== undefined
+        ? options.baselineRegistryVersion
+        : resolveInstalledBaselineVersion();
+    assertCursorRegistryFloor(baselineVersion ?? null);
+    for (const event of exports.CURSOR_HOOK_EVENTS) {
+        const source = path_1.default.join(options.registryRoot, SCRIPT_BY_EVENT[event].source);
+        if (!fs_1.default.existsSync(source)) {
+            throw new Error(`Cursor hook source missing: ${source}. Run 'awm update' first.`);
+        }
+    }
+    const disableDeferred = options.disableDeferredReanchor === true;
+    const events = activeEvents(disableDeferred);
+    const current = readCursorHooksDocument(config.settingsPath);
+    const hooks = current.hooks && typeof current.hooks === 'object' && !Array.isArray(current.hooks)
+        ? { ...current.hooks }
+        : {};
+    let pruned = false;
+    let needsWrite = false;
+    const nextHooks = { ...hooks };
+    for (const event of exports.CURSOR_HOOK_EVENTS) {
+        const raw = eventArray(hooks, event, config.settingsPath);
+        const kept = raw.filter((entry) => !isDeadAwmCursorEntry(entry, config.scriptsDir)
+            && !isStaleAwmCursorEntry(entry, config.scriptsDir));
+        if (kept.length !== raw.length)
+            pruned = true;
+        if (!events.includes(event)) {
+            // Deferred disabled: drop our AWM entries for deferred events, keep foreign ones.
+            const withoutOurs = kept.filter((entry) => !isAwmCursorEntry(entry, config.scriptsDir, event));
+            if (withoutOurs.length !== raw.length)
+                needsWrite = true;
+            if (withoutOurs.length === 0)
+                delete nextHooks[event];
+            else
+                nextHooks[event] = withoutOurs;
+            continue;
+        }
+        const matches = kept.filter((entry) => isAwmCursorEntry(entry, config.scriptsDir, event));
+        if (matches.length > 1) {
+            throw new Error(`multiple AWM ${event} entries in Cursor hooks.json`);
+        }
+        const newEntry = awmCursorEntry(config.scriptsDir, event);
+        if (matches.length === 1 && JSON.stringify(matches[0]) === JSON.stringify(newEntry)) {
+            nextHooks[event] = kept;
+            continue;
+        }
+        needsWrite = true;
+        nextHooks[event] = matches.length === 1
+            ? kept.map((entry) => (isAwmCursorEntry(entry, config.scriptsDir, event) ? newEntry : entry))
+            : [...kept, newEntry];
+    }
+    if (!pruned && !needsWrite) {
+        return {
+            status: 'already-up-to-date',
+            scriptsDir: config.scriptsDir,
+            settingsPath: config.settingsPath,
+            backupPath: null,
+        };
+    }
+    const merged = { ...current, version: 1, hooks: nextHooks };
+    const backupPath = (0, shared_1.backupManagedFile)(config.settingsPath);
+    fs_1.default.mkdirSync(config.scriptsDir, { recursive: true });
+    for (const event of events) {
+        const meta = SCRIPT_BY_EVENT[event];
+        (0, shared_1.syncExecutable)(path_1.default.join(options.registryRoot, meta.source), path_1.default.join(config.scriptsDir, meta.dest), options.installMethod);
+    }
+    // When deferred is disabled, leave previously synced deferred scripts alone (harmless).
+    writeMaterializedSkill(path_1.default.join(config.scriptsDir, 'using-awm.md'), options.registryRoot);
+    fs_1.default.mkdirSync(path_1.default.dirname(config.settingsPath), { recursive: true });
+    (0, atomic_file_1.writeFileAtomic)(config.settingsPath, JSON.stringify(merged, null, 2) + '\n');
+    return {
+        status: 'installed',
+        scriptsDir: config.scriptsDir,
+        settingsPath: config.settingsPath,
+        backupPath,
+    };
+}
+function hashFile(file) {
+    return crypto_1.default.createHash('sha256').update(fs_1.default.readFileSync(file)).digest('hex');
+}
+function computeCursorTrust(scriptCheck, scriptPath, heartbeatPath) {
+    if (!scriptCheck.ok)
+        return undefined;
+    if (!fs_1.default.existsSync(heartbeatPath))
+        return 'pending-first-run';
+    let heartbeat;
+    try {
+        heartbeat = JSON.parse(fs_1.default.readFileSync(heartbeatPath, 'utf-8'));
+    }
+    catch {
+        return 'stale';
+    }
+    return heartbeat?.hash === hashFile(scriptPath) ? 'healthy' : 'stale';
+}
+function checkCursorSettingsEntry(settingsPath, scriptsDir, disableDeferred = false) {
+    if (!fs_1.default.existsSync(settingsPath)) {
+        return { ok: false, detail: `hooks.json not found: ${settingsPath}` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(fs_1.default.readFileSync(settingsPath, 'utf-8'));
+    }
+    catch {
+        return { ok: false, detail: 'hooks.json is not valid JSON' };
+    }
+    if (parsed.version !== 1) {
+        return { ok: false, detail: 'hooks.json version is not 1' };
+    }
+    const events = activeEvents(disableDeferred);
+    for (const event of events) {
+        const entries = parsed.hooks?.[event];
+        if (!Array.isArray(entries) || !entries.some((entry) => isAwmCursorEntry(entry, scriptsDir, event))) {
+            return { ok: false, detail: `no AWM ${event} entry in ${settingsPath}` };
+        }
+    }
+    return { ok: true, detail: settingsPath };
+}
+function computeCursorHookStatus(agent) {
+    const config = (0, providers_1.getHookConfig)(agent);
+    if (!config || config.type !== 'cursor-hooks-json') {
+        throw new Error('Cursor hook configuration is unavailable');
+    }
+    const scriptPath = path_1.default.join(config.scriptsDir, 'session-start');
+    const heartbeatPath = path_1.default.join(config.scriptsDir, 'heartbeat.json');
+    const sessionStartScript = (0, shared_1.checkExecutable)(scriptPath);
+    const bootstrapSkill = (0, shared_1.checkFile)(path_1.default.join(config.scriptsDir, 'using-awm.md'));
+    const settingsEntry = checkCursorSettingsEntry(config.settingsPath, config.scriptsDir);
+    const allOk = sessionStartScript.ok && settingsEntry.ok && bootstrapSkill.ok;
+    const settingsOnlyMissing = !settingsEntry.ok && sessionStartScript.ok;
+    const trust = settingsEntry.ok
+        ? computeCursorTrust(sessionStartScript, scriptPath, heartbeatPath)
+        : undefined;
+    let overall;
+    if (!allOk)
+        overall = settingsOnlyMissing && bootstrapSkill.ok ? 'NOT_INSTALLED' : 'DEGRADED';
+    else if (trust === 'stale')
+        overall = 'DEGRADED';
+    else if (trust === 'pending-first-run')
+        overall = 'PENDING_TRUST';
+    else
+        overall = 'HEALTHY';
+    return {
+        overall,
+        trust,
+        checks: { sessionStartScript, settingsEntry, bootstrapSkill },
+    };
+}
+function uninstallCursorHook(agent) {
+    const config = (0, providers_1.getHookConfig)(agent);
+    if (!config || config.type !== 'cursor-hooks-json') {
+        throw new Error('Cursor hook configuration is unavailable');
+    }
+    if (!fs_1.default.existsSync(config.settingsPath)) {
+        return { status: 'not-installed', backupPath: null };
+    }
+    const current = (0, shared_1.readStrictJson)(config.settingsPath);
+    const hooks = current.hooks && typeof current.hooks === 'object' && !Array.isArray(current.hooks)
+        ? { ...current.hooks }
+        : {};
+    let removed = false;
+    const nextHooks = { ...hooks };
+    for (const event of exports.CURSOR_HOOK_EVENTS) {
+        if (!Array.isArray(hooks[event]))
+            continue;
+        const entries = hooks[event];
+        const filtered = entries.filter((entry) => !isAwmCursorEntry(entry, config.scriptsDir, event));
+        if (filtered.length !== entries.length)
+            removed = true;
+        if (filtered.length === 0)
+            delete nextHooks[event];
+        else
+            nextHooks[event] = filtered;
+    }
+    if (!removed)
+        return { status: 'not-installed', backupPath: null };
+    const backupPath = (0, shared_1.backupManagedFile)(config.settingsPath);
+    const nextConfig = { ...current, hooks: nextHooks };
+    if (Object.keys(nextHooks).length === 0)
+        delete nextConfig.hooks;
+    (0, atomic_file_1.writeFileAtomic)(config.settingsPath, JSON.stringify(nextConfig, null, 2) + '\n');
+    return { status: 'uninstalled', backupPath };
+}
+function resyncCursorHookFiles(config, registryRoot, method) {
+    for (const event of exports.CURSOR_HOOK_EVENTS) {
+        const meta = SCRIPT_BY_EVENT[event];
+        const source = path_1.default.join(registryRoot, meta.source);
+        if (!fs_1.default.existsSync(source)) {
+            throw new Error(`Cursor hook source missing: ${source}. Run 'awm update' first.`);
+        }
+        (0, shared_1.syncExecutable)(source, path_1.default.join(config.scriptsDir, meta.dest), method);
+    }
+    writeMaterializedSkill(path_1.default.join(config.scriptsDir, 'using-awm.md'), registryRoot);
+}
+function cursorResyncSourcesExist(registryRoot) {
+    return exports.CURSOR_HOOK_EVENTS.every((event) => fs_1.default.existsSync(path_1.default.join(registryRoot, SCRIPT_BY_EVENT[event].source)));
+}

package/dist/src/commands/hooks/install.js

@@ -4,6 +4,7 @@ exports.installHook = installHook;
 const providers_1 = require("../../providers");
 const claude_1 = require("./claude");
 const codex_1 = require("./codex");
+const cursor_1 = require("./cursor");
 function installHook(options) {
     const config = (0, providers_1.getHookConfig)(options.agent);
     if (!config) {
@@ -14,6 +15,8 @@ function installHook(options) {
             return (0, claude_1.installClaudeHook)(options);
         case 'codex-hooks-json':
             return (0, codex_1.installCodexHook)(options);
+        case 'cursor-hooks-json':
+            return (0, cursor_1.installCursorHook)(options);
         /* istanbul ignore next -- HookConfig['type'] is exhaustively handled above */
         default: {
             const exhaustive = config.type;

package/dist/src/commands/hooks/resync.js

@@ -10,6 +10,7 @@ const providers_1 = require("../../providers");
 const status_1 = require("./status");
 const claude_1 = require("./claude");
 const codex_1 = require("./codex");
+const cursor_1 = require("./cursor");
 function detectInstallMethod(scriptsDir) {
     try {
         return fs_1.default.lstatSync(path_1.default.join(scriptsDir, 'session-start')).isSymbolicLink() ? 'symlink' : 'copy';
@@ -49,6 +50,15 @@ function resyncInstalledHooks(registryRoot, targets = [...providers_1.AGENT_TARG
                 results.push({ agent, action: 'resynced' });
                 break;
             }
+            case 'cursor-hooks-json': {
+                if (!(0, cursor_1.cursorResyncSourcesExist)(registryRoot)) {
+                    results.push({ agent, action: 'registry-missing' });
+                    continue;
+                }
+                (0, cursor_1.resyncCursorHookFiles)(config, registryRoot, method);
+                results.push({ agent, action: 'resynced' });
+                break;
+            }
             /* istanbul ignore next -- HookConfig['type'] is exhaustively handled above */
             default: {
                 const exhaustive = config.type;

package/dist/src/commands/hooks/status.js

@@ -4,6 +4,7 @@ exports.computeHookStatus = computeHookStatus;
 const providers_1 = require("../../providers");
 const claude_1 = require("./claude");
 const codex_1 = require("./codex");
+const cursor_1 = require("./cursor");
 function computeHookStatus(agent) {
     const config = (0, providers_1.getHookConfig)(agent);
     if (!config) {
@@ -14,6 +15,8 @@ function computeHookStatus(agent) {
             return (0, claude_1.computeClaudeHookStatus)(agent);
         case 'codex-hooks-json':
             return (0, codex_1.computeCodexHookStatus)(agent);
+        case 'cursor-hooks-json':
+            return (0, cursor_1.computeCursorHookStatus)(agent);
         /* istanbul ignore next -- HookConfig['type'] is exhaustively handled above */
         default: {
             const exhaustive = config.type;

package/dist/src/commands/hooks/uninstall.js

@@ -4,6 +4,7 @@ exports.uninstallHook = uninstallHook;
 const providers_1 = require("../../providers");
 const claude_1 = require("./claude");
 const codex_1 = require("./codex");
+const cursor_1 = require("./cursor");
 function uninstallHook(options) {
     const config = (0, providers_1.getHookConfig)(options.agent);
     if (!config) {
@@ -14,6 +15,8 @@ function uninstallHook(options) {
             return (0, claude_1.uninstallClaudeHook)(options.agent);
         case 'codex-hooks-json':
             return (0, codex_1.uninstallCodexHook)(options.agent);
+        case 'cursor-hooks-json':
+            return (0, cursor_1.uninstallCursorHook)(options.agent);
         /* istanbul ignore next -- HookConfig['type'] is exhaustively handled above */
         default: {
             const exhaustive = config.type;

package/dist/src/commands/update.js

@@ -32,6 +32,7 @@ const reconciliation_1 = require("../core/reconciliation");
 const bundles_1 = require("../core/bundles");
 const install_transaction_1 = require("../core/install-transaction");
 const resync_1 = require("../commands/hooks/resync");
+const migrate_cursor_mdc_1 = require("../core/init/migrate-cursor-mdc");
 const defaultDeps = {
     syncRegistries: registries_1.syncRegistries,
     verifyMinCliVersions: registries_1.verifyMinCliVersions,
@@ -165,6 +166,9 @@ async function runUpdateCore(options = {}, deps = {}) {
     if (artifactResult.installed.length > 0) {
         console.log(picocolors_1.default.green(`  ✓ Reconciled artifacts: ${artifactResult.installed.join(', ')}`));
     }
+    if (selectedAgents.includes('cursor')) {
+        (0, migrate_cursor_mdc_1.migrateCursorMdcSkills)({});
+    }
     const hooksRoot = (0, registries_1.capabilityRoot)('hooks');
     if (hooksRoot) {
         try {

package/dist/src/core/admission/index.js

@@ -166,7 +166,7 @@ function sanitizeAdmissionReport(report) {
         invalidAdmission();
     if (value.cliCurrentness !== undefined && !CLI_CURRENTNESS.has(value.cliCurrentness))
         invalidAdmission();
-    if (value.sensorEvidence !== undefined && value.sensorEvidence !== 'generation-bound')
+    if (value.sensorEvidence !== undefined && value.sensorEvidence !== 'generation-bound' && value.sensorEvidence !== 'r8-registry-opt-out')
         invalidAdmission();
     if (value.planDigest !== undefined && (typeof value.planDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.planDigest)))
         invalidAdmission();
@@ -225,12 +225,18 @@ async function admitPlan(input) {
         if (input.compatibilityDiagnostics?.length)
             return blocked(input, input.compatibilityDiagnostics, { planDigest: plan.planDigest, provider, executionMode: mode, currentness: 'unverifiable', cliCurrentness });
     }
+    let sensorsReported = 'not-required';
+    let sensorEvidence = {};
     if (input.verifySensors) {
         if (!input.sensors)
             return blocked(input, [diagnostic('ADMISSION_SENSORS_REQUIRED', 'Sensor evidence was required but not supplied.')], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness });
         const sensors = sensorVerdict(input.sensors);
-        if (sensors !== 'pass')
+        const registryOptOut = sensors === 'not-certified' && input.sensorClosurePolicy === 'r8-registry-opt-out' && input.sensors.mode === 'opt-out';
+        if (sensors !== 'pass' && !registryOptOut)
             return blocked(input, [diagnostic('ADMISSION_SENSORS_BLOCKED', `Sensor verdict is ${sensors}.`)], { planDigest: plan.planDigest, provider, executionMode: mode, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors });
+        sensorsReported = sensors;
+        if (registryOptOut)
+            sensorEvidence = { sensorEvidence: 'r8-registry-opt-out' };
     }
     if (mode === 'desatendido') {
         // The durable controller (journal + awm watch + jobs) is opt-in, as it
@@ -241,7 +247,7 @@ async function admitPlan(input) {
         const observed = journalStatus(input, plan);
         const journal = observed === 'missing' && plan.schema === 'compact-slices/v1' ? 'not-required' : observed;
         if (journal !== 'current' && journal !== 'not-required')
-            return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors: input.verifySensors ? 'pass' : 'not-required' });
+            return blocked(input, [diagnostic('ADMISSION_JOURNAL_BINDING_REQUIRED', 'Unattended execution requires a healthy schema-2 journal binding for this exact plan; run watch --init --plan.')], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors: sensorsReported, ...sensorEvidence });
         const capabilities = unattendedCapabilities(provider, input.controllerAutonomy);
         const resolution = { outcome: capabilities.unattendedController === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
         if (resolution.outcome === 'blocked') {
@@ -252,17 +258,17 @@ async function admitPlan(input) {
             const reason = exports.PROVIDER_EXECUTION_CAPABILITIES[provider].unattendedController !== 'supported'
                 ? diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified unattended execution capability.`)
                 : diagnostic('ADMISSION_CONTROLLER_AUTONOMY_REQUIRED', `Unattended dispatch on ${provider} requires an explicit controller autonomy posture; without it the controller blocks on its first tool call.`);
-            return blocked(input, [reason], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors: input.verifySensors ? 'pass' : 'not-required', capabilityResolution: resolution });
+            return blocked(input, [reason], { planDigest: plan.planDigest, provider, executionMode: mode, journal, currentness: input.requireCurrent ? 'current' : 'not-checked', cliCurrentness, sensors: sensorsReported, ...sensorEvidence, capabilityResolution: resolution });
         }
         const routing = plan.schema === 'compact-slices/v2' ? input.routing ?? await input.routingReader?.() : input.routing;
-        return completeAdmission({ ...input, routing, routingReader: undefined }, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution, cliCurrentness);
+        return { ...completeAdmission({ ...input, routing, routingReader: undefined }, plan, provider, mode, journal, input.requireCurrent ? 'current' : 'not-checked', sensorsReported, resolution, cliCurrentness), ...sensorEvidence };
     }
     const capabilities = exports.PROVIDER_EXECUTION_CAPABILITIES[provider];
     const resolution = { outcome: capabilities.interactiveExecution === 'supported' ? 'native' : 'blocked', provider, capabilities, evidenceVersion: 'r1-v1', diagnostics: [] };
     if (resolution.outcome === 'blocked')
         return blocked(input, [diagnostic('ADMISSION_CAPABILITY_UNVERIFIED', `Provider ${provider} has no verified interactive execution capability.`)], { planDigest: plan.planDigest, provider, executionMode: mode, capabilityResolution: resolution });
     const routing = plan.schema === 'compact-slices/v2' ? input.routing ?? await input.routingReader?.() : input.routing;
-    return completeAdmission({ ...input, routing, routingReader: undefined }, plan, provider, mode, 'not-required', input.requireCurrent ? 'current' : 'not-checked', input.verifySensors ? 'pass' : 'not-required', resolution, cliCurrentness);
+    return { ...completeAdmission({ ...input, routing, routingReader: undefined }, plan, provider, mode, 'not-required', input.requireCurrent ? 'current' : 'not-checked', sensorsReported, resolution, cliCurrentness), ...sensorEvidence };
 }
 function completeAdmission(input, plan, provider, executionMode, journal, currentness, sensors, capabilityResolution, cliCurrentness = 'not-checked') {
     if (plan.schema === 'compact-slices/v1')