dsh-cursor-dev 0.12.3 → 0.12.4

package/README.md

@@ -55,7 +55,7 @@ flowchart LR
 3. 按 DSH 提示完成加载；涉及后台代码更新时重启 DSH，然后刷新页面。在 Cursor 面板中选择模型并保存。
 4. 明确告诉父模型使用 `cursor_code`，或者用下面的斜杠命令派发第一个任务。
 
-**版本说明（0.12.3）：** 本版显式声明支持 DSH `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1` 和 `0.2.1-rc.2`，开发依赖 `@deepseek-ai/dsh` 精确固定为 `0.2.1-rc.2`，保留 `>=0.2.1 <0.3.0` 的稳定版本支持。保留额度耗尽保护：调用 `cursor_code` 或通过原生子智能体派发之前先检查 Cursor 用量，总、Auto、API 三个额度都到上限时直接拒绝并说明原因，不再把任务派出去后中途失败；用量接口暂时取不到时不拦截调用。`cursor_subagent` 也会生成可点击的对话子会话，面板里点运行中或已完成的行都能查看过程，不再报「没有可恢复的会话」。面板保留额度四张卡片置顶、代理输入框在模型选择上方、模型目录与来源说明折叠收起的布局。插件市场已收录本插件，卡片版本随目录探测更新；npm 包名为 `dsh-cursor-dev`，实际已发布版本以 npm 的 `latest` 标签为准。要跟进后续改动请用 Git 来源；`.tgz` 是某一刻的固定快照。详见[安装来源与版本](docs/INSTALL.md#2-选择安装来源)。
+**版本说明（0.12.4）：** 本版把两个原本要手改配置才能调的开关搬进了面板的模型卡片。`maxChildDepth` 默认值从 `1` 改为 `2`——Cursor 是叶节点（CLI 里没有 DSH 工具，不可能再往下派），`2` 就是实际上限，旧的默认值只是把「子智能体派 Cursor」这件事拒掉了；该值改为每次调用现读，面板「子代理深度」的选择优先于配置，下一次调用生效、不用重载插件，越界的值（如手改成 `9`）当作「没设」回落到配置而不是被截断。新增「Cursor 署名」开关：Cursor 会给子智能体做的 commit 追加 `Co-authored-by: Cursor` 并在它开的 PR 上署名，而这个开关没有 CLI 参数也没有环境变量，只存在于 Cursor 自己的 `cli-config.json`，所以插件替你写那个文件——只改 `attribution` 两项、其余键原样保留、临时文件加改名、解析不了的文件绝不覆盖，默认关闭；保存后立即写入并在每次启动 CLI 前再确认一次（CLI 只在进程启动时读一次配置）。面板布局调整为模型选择器与保存按钮置顶、代理输入框移到它所解释的状态行下方，并删掉「来源与出口」折叠、并入「模型目录、搜索与来源」。保留额度耗尽保护：调用 `cursor_code` 或通过原生子智能体派发之前先检查 Cursor 用量，总、Auto、API 三个额度都到上限时直接拒绝并说明原因，不再把任务派出去后中途失败；用量接口暂时取不到时不拦截调用。`cursor_subagent` 也会生成可点击的对话子会话，面板里点运行中或已完成的行都能查看过程，不再报「没有可恢复的会话」。DSH 兼容性不变，仍显式声明支持 `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2` 以及 `>=0.2.1 <0.3.0` 的稳定版本，开发依赖固定为 `0.2.1-rc.2`。插件市场已收录本插件，卡片版本随目录探测更新；npm 包名为 `dsh-cursor-dev`，实际已发布版本以 npm 的 `latest` 标签为准。要跟进后续改动请用 Git 来源；`.tgz` 是某一刻的固定快照。详见[安装来源与版本](docs/INSTALL.md#2-选择安装来源)。
 
 运行要求：DSH `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2` 或 `>=0.2.1 <0.3.0` 的稳定版本（已在 `0.2.1-rc.2` 上验证）；Node.js `^22.19.0 || >=24.0.0`；已登录且可访问服务的 Cursor CLI。原生子智能体功能需要 DSH 的 `subagents`、`agents` 服务，后台任务还需要对应任务服务，建议使用当前 DSH 桌面版。CLI 安装方法见 [Cursor 官方文档](https://cursor.com/docs/cli)。
 
@@ -163,7 +163,7 @@ flowchart LR
 | `toolName` | `cursor_code` | 编码工具的注册名 |
 | `usageUi` | `true` | 是否挂载状态、额度和面板 HTTP 路由 |
 | `usageBaseUrl` | `https://api2.cursor.sh` | Cursor 额度 API 地址 |
-| `maxChildDepth` | `1` | Cursor 子会话允许达到的深度上限，调用方深度必须小于该值 |
+| `maxChildDepth` | `2` | Cursor 子会话允许达到的深度上限，调用方深度必须小于该值（面板「子代理深度」可覆盖） |
 
 插件自动探测 CLI 的 PATH 和已知安装目录。探测失败时，可在插件配置里设置 `command` 指向可启动的二进制、安装根目录、`agent.cmd`，或 `"node.exe" "index.js"`；非空时只使用该路径，不再回退到自动探测。安装排错以[指南](docs/INSTALL.md#6-常见问题)为准。
 
@@ -183,10 +183,30 @@ flowchart LR
 
 模型卡片下方还有可搜索的模型浏览器：点一行设为面板模型，右边的开关决定它是否出现在上方下拉框里。关掉的模型只是藏起来（写入 `disabledModels`），点「保存」后生效，随时可以再打开——这样在完整目录有上百个模型时也能只留下写业务常用的几条。
 
-`maxChildDepth` 限制的是**谁能启动 Cursor 子会话**：深度为 `0` 的顶层智能体是正常调用方，深度 `1` 的子智能体再调用就会被拒绝（默认上限 `1`，即只允许父智能体创建子智能体）。拒绝发生在创建任何进程或子会话之前，`cursor_code` 立即返回 `sessionKey: "depth-refused"`，`cursor_subagent` 抛出同类错误，错误信息里带有当前深度和上限。宿主本身对 `subagent` / `subagent_fork` 的深度限制（面板「子智能体 → 运行限制 → 最大递归深度」）仍然生效；`cursor` provider 声明 `depthLimit: false`，无法接收数值型 `maxDepth`，所以这道限制由本插件自己执行。把 `maxChildDepth` 设为 `0` 可以完全禁止子会话，设为 `2` 或更大则允许更深一层。镜像历史（面板里的记录）不受此限制，仍可正常打开查看。
+`maxChildDepth` 限制的是**谁能启动 Cursor 子会话**：深度为 `0` 的顶层智能体是正常调用方，深度 `1` 的子智能体再调用就会被拒绝。默认值是 `2`，即允许父智能体和子智能体都创建 Cursor 子会话——Cursor 是个叶节点（CLI 里没有 DSH 工具，它不可能再往下派），所以 `2` 就是实际上限，再大的值和 `2` 完全等价。这个值可以在面板的「子代理深度」里改，面板的选择优先于配置；改完下一次调用生效，不需要重载插件。拒绝发生在创建任何进程或子会话之前，`cursor_code` 立即返回 `sessionKey: "depth-refused"`，`cursor_subagent` 抛出同类错误，错误信息里带有当前深度和上限。宿主本身对 `subagent` / `subagent_fork` 的深度限制（面板「子智能体 → 运行限制 → 最大递归深度」）仍然生效；`cursor` provider 声明 `depthLimit: false`，无法接收数值型 `maxDepth`，所以这道限制由本插件自己执行。把 `maxChildDepth` 设为 `0` 可以完全禁止子会话，设为 `2` 或更大则允许更深一层。镜像历史（面板里的记录）不受此限制，仍可正常打开查看。
 
 插件设置与会话映射优先写入环境变量 `DSH_CURSOR_DEV_DATA` 指定的目录；否则使用 `%LOCALAPPDATA%/dsh-cursor-dev`；没有该环境变量时使用 DSH 提供的 `baseDir` 下的 `.data`（再无 `baseDir` 时回退到进程当前目录）。Cursor 登录和原始会话由 Cursor 自己保存。面板写操作包含同源检查，HTTP 可访问范围由 DSH 的监听配置决定。
 
+### Cursor 署名
+
+Cursor 默认会在子智能体做的提交上追加 `Co-authored-by: Cursor`，在它开的 PR 上署名。这些提交发生在别人的仓库里，而仓库的读者并没有同意这件事，所以面板里默认**关掉**：模型卡片底部的「Cursor 署名」选择「不加 Cursor 署名」，插件在下一次启动 CLI 前把 Cursor 自己的配置文件改成不署名。
+
+这个开关没有 CLI 参数，也没有环境变量，只存在于 Cursor 的 `cli-config.json`：
+
+```json
+{ "attribution": { "attributeCommitsToAgent": false, "attributePRsToAgent": false } }
+```
+
+文件位置按 Cursor 自己的顺序解析：`CURSOR_CONFIG_DIR` → `XDG_CONFIG_HOME/cursor` → `~/.cursor`。插件只改 `attribution` 这两项，权限、模型、登录信息等其他键原样保留，写入走临时文件 + 改名；解析不了的文件不会被覆盖（那是 Cursor 自己的报错，不该由插件掩盖）。面板的三个选项：
+
+| 选项 | 行为 |
+| --- | --- |
+| 不加 Cursor 署名（默认） | 把两项都写成 `false` |
+| 保留 Cursor 署名 | 把两项都写成 `true` |
+| 跟随 Cursor 自己的配置 | 插件不碰这个文件，你用自己的 Cursor 设置 |
+
+保存后立即写入，并在每次启动 CLI 前再确认一次——因为 CLI 只在进程启动时读一次配置，已经在跑的会话要等新会话才生效。选择器下面那行「Cursor 当前：…」显示的是配置文件的实际状态，不是你的选择：用了「跟随」或者写入失败时，两者会不一样。团队管理员在服务端禁用署名（`attributionControls`）时，本地怎么写都不会恢复署名。
+
 ### 开发与验证
 
 ```sh
@@ -220,7 +240,7 @@ See the [installation guide](docs/INSTALL.md) for detailed setup and troubleshoo
 3. Restart DSH when backend changes require it, then refresh the page. Open the Cursor panel under `/plugins/dsh-cursor-dev/`, select a model and save it. The history list keeps one row per run forever, so it sits in a height-capped scroll box and folds away when you click its heading (the choice is remembered); a row's **Delete** link clears that run's index record, journal and mirrored child — the same chain `resetSession` uses — and arms on the first click so the irreversible second click is deliberate.
 4. Ask the parent to use `cursor_code`, or send `/cursor-subagent` followed by a complete task. The command dispatches directly and hands a completion or failure summary back to the original parent.
 
-Version `0.12.3` explicitly declares support for DSH `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1` and `0.2.1-rc.2`, and pins the `@deepseek-ai/dsh` development dependency to exactly `0.2.1-rc.2`. Existing support for stable versions `>=0.2.1 <0.3.0` remains. Quota exhaustion protection is retained: before `cursor_code` or a native subagent call starts, the plugin reads Cursor usage and refuses the call, explaining why, when the total, Auto and API buckets are all at their limit, instead of dispatching a run that later fails mid-way. A usage lookup that cannot be completed never blocks a call. `cursor_subagent` also creates a clickable transcript child, so rows for running and finished runs open in the panel instead of reporting that no durable conversation exists. The panel keeps the four quota cards first, the proxy input above the model picker, and the model catalogue and source/egress notes folded. The dsh-market catalog already lists this plugin and updates its displayed version on subsequent probes. The public npm package is `dsh-cursor-dev`; its `latest` tag identifies the published version. Use the Git source to follow later changes; a `.tgz` is a fixed snapshot.
+Version `0.12.4` moves two settings that used to need a hand-edited profile, or a hand-edited file belonging to another program, into the model card. `maxChildDepth` now defaults to `2` instead of `1`: a Cursor run is a leaf — the CLI has no DSH tools, so it can never delegate further, which makes `2` the real ceiling and the old default refused the delegation people actually try. The cap is read per call, the panel's **Subagent depth** picker wins over the config, it applies on the next call without a reload, and an out-of-range value (a hand-edited `9`) is treated as unset rather than clamped. A new **Cursor credit** switch exists because Cursor appends `Co-authored-by: Cursor` to the commits its agent makes and credits itself on the pull requests it opens, and that switch has no flag and no environment variable — it lives only in Cursor's own `cli-config.json`, so the plugin writes that file: exactly the two `attribution` keys, every other key preserved, through a temporary file and a rename, and a file it cannot parse is never replaced. It is off by default, applied on save and re-checked before every spawn, because the CLI reads its settings once at startup. The panel now leads the model card with the model picker and its save button, puts the proxy box under the status line it is about, and folds the former "sources" note into the catalogue fold. Quota exhaustion protection is retained: before `cursor_code` or a native subagent call starts, the plugin reads Cursor usage and refuses the call, explaining why, when the total, Auto and API buckets are all at their limit, instead of dispatching a run that later fails mid-way. A usage lookup that cannot be completed never blocks a call. `cursor_subagent` also creates a clickable transcript child, so rows for running and finished runs open in the panel instead of reporting that no durable conversation exists. DSH compatibility is unchanged: support is declared for `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1`, `0.2.1-rc.2` and stable versions `>=0.2.1 <0.3.0`, with the `@deepseek-ai/dsh` development dependency pinned to exactly `0.2.1-rc.2`. The dsh-market catalog already lists this plugin and updates its displayed version on subsequent probes. The public npm package is `dsh-cursor-dev`; its `latest` tag identifies the published version. Use the Git source to follow later changes; a `.tgz` is a fixed snapshot.
 
 Requirements: DSH `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1`, `0.2.1-rc.2` or a stable version `>=0.2.1 <0.3.0` (verified against `0.2.1-rc.2`); Node.js `^22.19.0 || >=24.0.0`; an authenticated Cursor CLI account with service access. Native dispatch additionally needs DSH's `subagents` and `agents` services, and background runs need the host's job services. A current DSH desktop installation is recommended.
 
@@ -243,7 +263,7 @@ Cursor executes externally. From DSH 0.2.1 on, the host writes a single non-inte
 
 The parent remains responsible for reviewing the actual changes and verification evidence. File reports have scan limits and are not a substitute for final workspace checks. Cursor model availability and usage depend on the Cursor account; the parent model uses its separate DSH provider configuration.
 
-`maxChildDepth` (default `1`) caps who may start a Cursor child session. A top-level agent at depth `0` is the intended caller; a subagent at depth `1` that calls `cursor_code` or `cursor_subagent` is refused before any process, child session, or reset is created — `cursor_code` returns `sessionKey: "depth-refused"` and the error names both the current depth and the cap. This exists because the `cursor` provider declares `depthLimit: false` and cannot accept a numeric `maxDepth` from the host's `tool-subagent`, so the plugin enforces the limit itself. Set it to `0` to forbid Cursor children entirely, or higher to allow deeper nesting. The host's own delegation limit for `subagent` / `subagent_fork` (panel → Subagents → Run limits → maximum recursion depth) still applies independently. Opening a mirrored child conversation in the panel is a read-only record and is not affected.
+`maxChildDepth` (default `2`) caps who may start a Cursor child session. A top-level agent at depth `0` is the intended caller; a subagent at depth `1` that calls `cursor_code` or `cursor_subagent` is refused before any process, child session, or reset is created — `cursor_code` returns `sessionKey: "depth-refused"` and the error names both the current depth and the cap. This exists because the `cursor` provider declares `depthLimit: false` and cannot accept a numeric `maxDepth` from the host's `tool-subagent`, so the plugin enforces the limit itself. Set it to `0` to forbid Cursor children entirely, or `1` to keep delegation to the top-level agent only. The default of `2` lets a subagent start one too, because a Cursor run is a leaf — the CLI has no DSH tools, so it can never delegate further and every value above `2` behaves exactly like `2`. The settings panel's **Subagent depth** picker writes the same value and wins over this config; a change applies on the next call without reloading the plugin. The host's own delegation limit for `subagent` / `subagent_fork` (panel → Subagents → Run limits → maximum recursion depth) still applies independently. Opening a mirrored child conversation in the panel is a read-only record and is not affected.
 
 ### Proxy
 
@@ -259,6 +279,26 @@ Why it exists: the Cursor CLI reads `HTTPS_PROXY` / `HTTP_PROXY` / `https_proxy`
 
 Leaving the box empty already fixes it, so no configuration is normally needed: the plugin resolves the route, writes `HTTPS_PROXY`/`HTTP_PROXY` (and the lowercase spellings) into every child process it starts, and shows the result as **子进程出口** at the end of the *available models* line. Saving takes effect on the next spawn rather than the next restart, and a value that cannot be parsed is reported on that same line instead of being silently ignored.
 
+### Cursor attribution
+
+Cursor appends `Co-authored-by: Cursor` to the commits its agent makes, and credits itself on the pull requests it opens. Those commits land in repositories whose readers never agreed to that, so the panel turns it **off** by default: the **Cursor credit** picker at the bottom of the model card keeps the CLI's own settings file saying "no attribution", and the plugin applies that before the next CLI process starts.
+
+There is no flag and no environment variable for this — the only switch is Cursor's `cli-config.json`:
+
+```json
+{ "attribution": { "attributeCommitsToAgent": false, "attributePRsToAgent": false } }
+```
+
+The file lives where Cursor looks for it: `CURSOR_CONFIG_DIR`, else `XDG_CONFIG_HOME/cursor`, else `~/.cursor`. The plugin writes only those two keys — permissions, models, and auth information are preserved byte for byte — through a temporary file and a rename, and a file it cannot parse is left alone rather than replaced (that is Cursor's error to report). The three choices:
+
+| Choice | Effect |
+| --- | --- |
+| No Cursor credit (default) | writes both flags as `false` |
+| Credit Cursor | writes both flags as `true` |
+| Leave Cursor own setting alone | the plugin never touches the file |
+
+Saving applies immediately, and every spawn re-checks the file, because the CLI reads its configuration once at startup — a session already running keeps the old value until a new session starts. The `Cursor now:` line under the picker reports the state of the file, not your choice: with "leave alone" or after a failed write, the two differ. When a team administrator disables attribution server-side (`attributionControls`), no local setting turns it back on.
+
 ## License
 
 [MIT](LICENSE)

package/docs/INSTALL.md

@@ -38,7 +38,7 @@ agent status --format json
 
 ## 2. 选择安装来源
 
-**当前源码版本：** `0.12.3`，显式声明支持 DSH `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1` 和 `0.2.1-rc.2`，开发依赖 `@deepseek-ai/dsh` 精确固定为 `0.2.1-rc.2`，保留 `>=0.2.1 <0.3.0` 的稳定版本支持。同时保留额度耗尽保护（三个额度都到上限时提前拒绝，用量取不到时不拦截）、可点击的子会话轨迹，以及额度置顶、代理输入框在模型选择上方的面板布局。npm 包名为 `dsh-cursor-dev`，实际已发布版本以 npm 的 `latest` 标签为准。插件市场已收录本插件，卡片版本随目录探测更新。
+**当前源码版本：** `0.12.4`，把两个原本要手改配置才能调的开关搬进了面板：`maxChildDepth` 默认值改为 `2`（Cursor 是叶节点，`2` 即实际上限），改为每次调用现读、面板「子代理深度」优先于配置；新增「Cursor 署名」开关，插件按你的选择写 Cursor 自己的 `cli-config.json`（只改 `attribution` 两项、其余键原样保留、解析不了的文件不覆盖），默认关闭。面板布局调整为模型选择器置顶、代理输入框在它所解释的状态行下方，「来源与出口」并入「模型目录、搜索与来源」。同时保留额度耗尽保护（三个额度都到上限时提前拒绝，用量取不到时不拦截）、可点击的子会话轨迹。DSH 兼容性不变，仍显式声明支持 `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2` 以及 `>=0.2.1 <0.3.0` 的稳定版本。npm 包名为 `dsh-cursor-dev`，实际已发布版本以 npm 的 `latest` 标签为准。插件市场已收录本插件，卡片版本随目录探测更新。
 
 | 你要安装的内容 | 安装来源 |
 | --- | --- |
@@ -46,7 +46,7 @@ agent status --format json
 | npm 公共源上的已发布版本 | `dsh-cursor-dev`（`0.11.0` 起可用，按包内 `files` 白名单安装，版本以 npm 的 `latest` 标签为准） |
 | 公开仓库的当前版本（推荐） | `git+https://github.com/Dclef/dsh-cursor-dev.git` |
 | 你本地的源码目录 | 该目录的绝对路径，例如 `D:/plugins/dsh-cursor-dev` |
-| 维护者提供的源码快照或发布包 | `.tgz` 文件的绝对路径，例如 `D:/Downloads/dsh-cursor-dev-0.12.3.tgz` |
+| 维护者提供的源码快照或发布包 | `.tgz` 文件的绝对路径，例如 `D:/Downloads/dsh-cursor-dev-0.12.4.tgz` |
 
 表中本地路径是示例，需要换成实际位置。npm 来源取 registry 上发布的最新版本；Git 来源会取得仓库默认分支的最新提交；`.tgz` 是某一刻的固定快照——要跟进后续改动就用 Git 来源。
 
@@ -88,7 +88,7 @@ dsh plugin add "/home/you/plugins/dsh-cursor-dev"
 安装收到的包：
 
 ```powershell
-dsh plugin add "D:/Downloads/dsh-cursor-dev-0.12.3.tgz"
+dsh plugin add "D:/Downloads/dsh-cursor-dev-0.12.4.tgz"
 ```
 
 终端没有 `dsh` 命令时，使用桌面插件管理即可。不要把在任意项目目录执行 `npm install` 当成已经在 DSH 当前 profile 中启用插件。

package/lib/attribution.js

@@ -0,0 +1,169 @@
+/**
+ * Cursor's commit attribution, and the only switch that turns it off.
+ *
+ * When the agent runs `git commit`, the CLI appends a `Co-authored-by: Cursor`
+ * trailer, and it credits Cursor on pull requests it opens. There is no flag and
+ * no environment variable for this — `agent --help` has nothing, and the plugin
+ * never gets a per-run channel for it — so the setting lives in the CLI's own
+ * `cli-config.json` under `attribution`:
+ *
+ * ```json
+ * { "attribution": { "attributeCommitsToAgent": true, "attributePRsToAgent": true } }
+ * ```
+ *
+ * Team admins can force this off server-side (`attributionControls`), which the
+ * CLI checks separately; nothing a user writes locally can turn it back on.
+ *
+ * This module reads and writes that file. Two rules keep it safe to call from a
+ * plugin that does not own it: everything except `attribution` is preserved
+ * byte for byte, and a file we cannot parse is never overwritten — a broken
+ * config is the CLI's problem to report, not ours to replace.
+ *
+ * @module dsh-cursor-dev/attribution
+ */
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+/** The file the CLI keeps its settings in, inside its config directory. */
+const FILE = 'cli-config.json';
+
+/** The two things Cursor can attribute. */
+const KEYS = ['attributeCommitsToAgent', 'attributePRsToAgent'];
+
+/**
+ * Where the CLI looks for its config directory.
+ *
+ * Mirrors the CLI's own resolution order — `CURSOR_CONFIG_DIR`, then
+ * `XDG_CONFIG_HOME/cursor`, then `~/.cursor` — because writing anywhere else
+ * would silently do nothing.
+ *
+ * @param env - environment to read.
+ */
+export function cursorConfigDir(env = process.env) {
+    const explicit = env.CURSOR_CONFIG_DIR;
+    if (typeof explicit === 'string' && explicit.trim() !== '')
+        return explicit.trim();
+    const xdg = env.XDG_CONFIG_HOME;
+    if (typeof xdg === 'string' && xdg.trim() !== '')
+        return join(xdg.trim(), 'cursor');
+    return join(homedir(), '.cursor');
+}
+
+/**
+ * Absolute path of the CLI settings file.
+ *
+ * @param env - environment to read.
+ */
+export function attributionPath(env = process.env) {
+    return join(cursorConfigDir(env), FILE);
+}
+
+/**
+ * The attribution block as it currently stands on disk.
+ *
+ * A missing file reports the CLI's own defaults (`true` twice) because that is
+ * what a run would do; `present: false` says we read nothing.
+ *
+ * @param env - environment to read.
+ */
+export function readAttribution(env = process.env) {
+    const path = attributionPath(env);
+    let raw;
+    try {
+        if (!existsSync(path))
+            return { path, present: false, attribution: defaults() };
+        raw = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        return { path, present: true, attribution: defaults(), error: messageOf(error) };
+    }
+    return { path, present: true, attribution: pick(raw), error: undefined };
+}
+
+/**
+ * Coerce a panel choice into the two flags, or `undefined` for "leave alone".
+ *
+ * `keep` is a real choice: an operator who manages Cursor themselves must be
+ * able to stop the plugin from rewriting their file on every spawn.
+ *
+ * @param choice - `off`, `on`, or `keep`.
+ */
+export function desiredAttribution(choice) {
+    if (choice === 'off') return { attributeCommitsToAgent: false, attributePRsToAgent: false };
+    if (choice === 'on') return { attributeCommitsToAgent: true, attributePRsToAgent: true };
+    return undefined;
+}
+
+/**
+ * Make the CLI settings file say what the panel asked for.
+ *
+ * Writes only when a flag actually differs, so a machine that is already
+ * configured is never touched. The write goes through a temporary file and a
+ * rename: the CLI reads this file at startup, and half a JSON document would
+ * take the child down with it.
+ *
+ * @param choice - `off`, `on`, or `keep`.
+ * @param options - `env` override and a `logger` for the one failure worth reporting.
+ */
+export function applyAttribution(choice, options = {}) {
+    const env = options.env ?? process.env;
+    const desired = desiredAttribution(choice);
+    if (desired === undefined)
+        return { ...readAttribution(env), changed: false };
+    const path = attributionPath(env);
+    let raw;
+    try {
+        raw = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : { version: 1 };
+    }
+    catch (error) {
+        const failure = messageOf(error);
+        return { path, present: true, attribution: defaults(), changed: false, error: failure };
+    }
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        return { path, present: true, attribution: defaults(), changed: false, error: 'the CLI settings file is not an object' };
+    }
+    const current = pick(raw);
+    const changed = KEYS.some(key => current[key] !== desired[key]);
+    if (!changed)
+        return { path, present: true, attribution: current, changed: false };
+    // Keep every other key — permissions, model, auth — exactly as it was, and
+    // merge into the attribution block rather than replacing it: a key we do
+    // not know about is still the CLI's to read.
+    const block = raw.attribution !== null && typeof raw.attribution === 'object' && !Array.isArray(raw.attribution)
+        ? raw.attribution
+        : {};
+    raw.attribution = { ...block, ...desired };
+    try {
+        const temporary = `${path}.dsh-cursor-dev.tmp`;
+        writeFileSync(temporary, `${JSON.stringify(raw, null, 2)}\n`, 'utf8');
+        renameSync(temporary, path);
+    }
+    catch (error) {
+        const failure = messageOf(error);
+        return { path, present: true, attribution: current, changed: false, error: failure };
+    }
+    return { path, present: true, attribution: { ...current, ...desired }, changed: true };
+}
+
+/** The CLI's own defaults, used when it has no opinion yet. */
+function defaults() {
+    return { attributeCommitsToAgent: true, attributePRsToAgent: true };
+}
+
+/** Read just the two flags out of a parsed settings document. */
+function pick(raw) {
+    const block = raw !== null && typeof raw === 'object' ? raw.attribution : undefined;
+    const source = block !== null && typeof block === 'object' ? block : {};
+    const picked = { ...defaults() };
+    for (const key of KEYS) {
+        if (typeof source[key] === 'boolean')
+            picked[key] = source[key];
+    }
+    return picked;
+}
+
+/** Render an unknown thrown value as text. */
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/lib/index.js

@@ -18,6 +18,7 @@
 import z from '@deepseek-ai/schemastery';
 import { resolveAgent } from './resolve-agent.js';
 import { CLI_SETUP, authStatus, describeAgent } from './cli.js';
+import { applyAttribution } from './attribution.js';
 import { SessionPool } from './session-pool.js';
 import { RunJournal } from './journal.js';
 import { ConversationIndex } from './conversations.js';
@@ -27,7 +28,7 @@ import { createMirrorHub } from './mirror.js';
 import { createRouteFence } from './fence.js';
 import { UsageClient, registerUsageRoutes } from './usage.js';
 import { CursorQuotaGuard } from './quota-guard.js';
-import { effectiveModel, readSettings, registerSettingsRoutes, resolveModelSelection } from './settings.js';
+import { effectiveMaxChildDepth, effectiveModel, readSettings, registerSettingsRoutes, resolveModelSelection } from './settings.js';
 import { createNativeCursorBridge } from './native-provider.js';
 import { describeProxy, proxySettingIsDirect, resolveChildProxy, withProxyEnvironment } from './proxy.js';
 
@@ -65,12 +66,18 @@ export const Config = z.object({
     /** Disable the usage routes entirely (the coding tool is unaffected). */
     usageUi: z.boolean().default(true),
     /**
-     * Recursion budget for Cursor children. `1` (the platform default for
-     * delegation tools) allows only a top-level agent to start a Cursor run;
-     * `0` refuses Cursor children entirely; a higher number allows a subagent to
-     * start one too. Raise it deliberately — every level multiplies cost.
+     * Recursion budget for Cursor children: `0` refuses them entirely, `1`
+     * allows only a top-level agent to start one, `2` lets a subagent start one
+     * too.
+     *
+     * `2` is the default here, against the platform convention of `1`, because
+     * the levels above it do not exist: a Cursor run is a leaf — the CLI has no
+     * DSH tools, so it can never delegate further. That makes this setting
+     * effectively a switch, and the value that matches how people actually use
+     * the tool is the one where a teammate can drive it. The panel writes to
+     * the same idea (`data/settings.json` wins over this default).
      */
-    maxChildDepth: z.natural().default(1),
+    maxChildDepth: z.natural().default(2),
 });
 
 /**
@@ -166,9 +173,48 @@ export function apply(ctx, config) {
         resolution = resolveProxy();
         return resolution;
     };
-    const childEnvironment = () => resolution.then(() => childEnv);
+    // Cursor credits itself in the commits and pull requests the child makes,
+    // and the only switch is a key in Cursor's own config file — so this plugin
+    // keeps that file in the state the panel asks for. Best effort by design: a
+    // read-only Cursor install must not stop a run, and the change is logged
+    // once instead of on every spawn.
+    let attributionComplaint = '';
+    const syncAttribution = () => {
+        try {
+            const choice = readSettings(dataDir).attribution;
+            const applied = applyAttribution(choice, { env: process.env });
+            if (applied.error !== undefined) {
+                if (applied.error !== attributionComplaint) {
+                    attributionComplaint = applied.error;
+                    logger?.warn?.(`dsh-cursor-dev: could not update Cursor attribution in ${applied.path}: ${applied.error}`);
+                }
+                return applied;
+            }
+            if (applied.changed)
+                logger?.info?.(`dsh-cursor-dev: Cursor commit attribution ${choice === 'on' ? 'on' : 'off'} in ${applied.path}`);
+            attributionComplaint = '';
+            return applied;
+        }
+        catch (error) {
+            logger?.warn?.(`dsh-cursor-dev: could not update Cursor attribution: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+    };
+    const childEnvironment = () => resolution.then(() => {
+        // The child reads its settings file once, at startup, and there is no
+        // per-run channel for commit attribution. So the file has to be right
+        // *before* the process exists — and this hook is the last moment before
+        // that happens, on every path that spawns the CLI.
+        syncAttribution();
+        return childEnv;
+    });
     const routeNow = () => (settled ? proxyRoute : '');
     void refreshProxy().then(route => logger?.info?.(`dsh-cursor-dev: Cursor CLI egress via ${route}`));
+    // Applied at load as well as before every spawn: an operator who installs
+    // this plugin should not have to wait for a run to stop being credited. With
+    // no CLI resolved there is no settings file worth writing.
+    if (resolved !== undefined)
+        syncAttribution();
 
     // Child conversations: every Cursor run also becomes a real DSH child
     // session, so the parent's header can list it and clicking it opens the
@@ -177,7 +223,11 @@ export function apply(ctx, config) {
     // fiber answers `undefined` while the agent loop is still activating.
     const usage = new UsageClient({ baseUrl: config.usageBaseUrl });
     const quotaGuard = new CursorQuotaGuard(usage);
-    const mirrors = createMirrorHub({ logger, maxChildDepth: config.maxChildDepth });
+    // The depth cap the panel can change without a reload. Read per call from
+    // the same file the model comes from: a cached number would keep enforcing
+    // the cap that was in force when the plugin loaded.
+    const maxChildDepthNow = () => effectiveMaxChildDepth(readSettings(dataDir), config.maxChildDepth);
+    const mirrors = createMirrorHub({ logger, maxChildDepth: maxChildDepthNow });
     const pool = resolved === undefined
         ? new UnavailablePool()
         : new SessionPool({
@@ -200,7 +250,7 @@ export function apply(ctx, config) {
         mirrors,
         quotaGuard,
         maxScanFiles: config.maxScanFiles,
-        maxChildDepth: config.maxChildDepth,
+        maxChildDepth: maxChildDepthNow,
         unavailable,
         // The panel writes the model the user picked; a tool call that names no
         // model follows that choice, so switching models does not need a profile
@@ -211,7 +261,7 @@ export function apply(ctx, config) {
         resolveDefaultMode: () => readSettings(dataDir).mode,
     });
 
-    const native = createNativeCursorBridge({ execute: rawTool.execute, mirrors, quotaGuard, maxChildDepth: config.maxChildDepth });
+    const native = createNativeCursorBridge({ execute: rawTool.execute, mirrors, quotaGuard, maxChildDepth: maxChildDepthNow });
     const tool = { ...rawTool, execute: (args, exec) => native.execute(args, exec) };
     const disposeTool = ctx.tools.register({ ...tool, name: config.toolName });
 
@@ -318,6 +368,13 @@ function mountHttpSurfaces(ctx, config, deps) {
                     index: deps.index,
                     dataDir: deps.dataDir,
                     configModel: config.model,
+                    // The depth picker lives on this dashboard, and its value is
+                    // the stored choice over this config default.
+                    maxChildDepth: config.maxChildDepth,
+                    // The dashboard reports what Cursor's config file says about
+                    // attribution, and that file is looked up from the same
+                    // environment the child will be spawned with.
+                    env: deps.env,
                     fence,
                     // The dashboard offers a jump into the mirrored child
                     // conversation, so it has to know both whether this host has
@@ -338,6 +395,9 @@ function mountHttpSurfaces(ctx, config, deps) {
                 cwd: deps.cwd,
                 dataDir: deps.dataDir,
                 configModel: config.model,
+                // The panel shows the cap in force: the stored choice when there
+                // is one, otherwise what the profile hands this plugin.
+                maxChildDepth: config.maxChildDepth,
                 logger: deps.logger,
                 fence,
                 // The panel's model list must be the ids `set_config_option`

package/lib/mirror.js

@@ -1016,8 +1016,12 @@ export function createMirrorHub(options = {}) {
     // The recursion budget this hub enforces on every child it opens. `undefined`
     // keeps the previous behaviour (no cap); a number refuses a parent that is
     // already at that depth, which is how "only a top-level agent delegates"
-    // (1) or "nobody delegates" (0) is configured.
-    const maxChildDepth = options.maxChildDepth;
+    // (1) or "nobody delegates" (0) is configured. A function is resolved per
+    // call, so the settings panel can lift the cap without a reload — otherwise
+    // the tool would allow a run that the mirror then refuses to record.
+    const maxChildDepthNow = () => (typeof options.maxChildDepth === 'function'
+        ? options.maxChildDepth()
+        : options.maxChildDepth);
     const entries = new Map();
     let agents;
     let reportedMissing = false;
@@ -1122,7 +1126,7 @@ export function createMirrorHub(options = {}) {
                         parent: options.parent,
                         childSessionId: remembered,
                         model: options.model,
-                        maxChildDepth,
+                        maxChildDepth: maxChildDepthNow(),
                         logger,
                     });
                     if (resumed !== undefined) {
@@ -1146,7 +1150,7 @@ export function createMirrorHub(options = {}) {
                     model: options.model,
                     descriptor: options.descriptor,
                     announce: options.announce,
-                    maxChildDepth,
+                    maxChildDepth: maxChildDepthNow(),
                     logger,
                 });
                 if (opened === undefined) {

package/lib/native-provider.js

@@ -60,7 +60,8 @@ export function createCursorProvider({ execute, mirrors, quotaGuard, maxChildDep
             // The recursion budget is the plugin's own now that the host leaves it
             // to the provider (`maxDepth: provider-managed`); refuse before any
             // process, child row, or lifecycle event exists.
-            if (typeof maxChildDepth === 'number') resolveChildDepth(originalParent, maxChildDepth);
+            const depthCap = typeof maxChildDepth === 'function' ? maxChildDepth() : maxChildDepth;
+            if (typeof depthCap === 'number') resolveChildDepth(originalParent, depthCap);
             // Keep the service's external lifecycle id separate from the local
             // transcript child. The mirror is opened explicitly by the panel
             // and does not publish another catalog row.

package/lib/settings.js

@@ -23,6 +23,7 @@
  */
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { applyAttribution, readAttribution } from './attribution.js';
 import { runOnce } from './cli.js';
 import { normalizeModelId } from './models.js';
 
@@ -44,6 +45,15 @@ const MODEL_SOURCES = new Set(['acp', 'cli']);
 /** Modes a Cursor session can run in (`agent` is the default). */
 const MODES = new Set(['agent', 'plan', 'ask']);
 
+/**
+ * What the panel may say about Cursor's commit attribution.
+ *
+ * `keep` exists so that an operator who sets attribution in Cursor itself can
+ * stop this plugin from rewriting that file — the flag lives in Cursor's config,
+ * not ours, and a plugin that always wrote it would fight the owner.
+ */
+const ATTRIBUTIONS = new Set(['off', 'on', 'keep']);
+
 /** Absolute path of the settings file. */
 export function settingsPath(dataDir) {
     return join(dataDir, FILE);
@@ -58,6 +68,16 @@ export function emptySettings() {
         mode: '',
         language: '',
         proxy: 'none',
+        // How deep in the delegation chain a Cursor child may still be started.
+        // `''` means "not chosen here, use the plugin config" — the panel writes
+        // a number, a hand-edited file can leave it out entirely.
+        maxChildDepth: '',
+        // Whether commits the child makes carry a `Co-authored-by: Cursor`
+        // trailer. The switch itself lives in Cursor's own config file, which
+        // this plugin writes on the operator's behalf — see `attribution.js`.
+        // `off` is the default because these runs are unattended and nobody
+        // reading the repository later agreed to have Cursor credited in it.
+        attribution: 'off',
         // Models the operator switched off in the picker. A DENY list, not an
         // allow list, so a catalogue that gains entries keeps showing them: an
         // empty list means "everything the CLI knows about" and a fresh install
@@ -89,6 +109,8 @@ export function normalizeSettings(raw) {
         mode: MODES.has(value.mode) ? value.mode : '',
         language: LANGUAGES.has(value.language) ? value.language : '',
         proxy: proxySetting(value.proxy),
+        maxChildDepth: depthSetting(value.maxChildDepth),
+        attribution: ATTRIBUTIONS.has(value.attribution) ? value.attribution : 'off',
         disabledModels: modelIdList(value.disabledModels),
         updatedAt: numberOrUndefined(value.updatedAt) ?? 0,
         modelsFetchedAt: numberOrUndefined(value.modelsFetchedAt) ?? 0,
@@ -192,6 +214,25 @@ function modelChoice(value) {
     return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
 }
 
+/**
+ * Resolve the depth cap in force for the next call.
+ *
+ * The panel choice wins over the config default, the same way the panel model
+ * wins over `config.model`: an operator who clicked something expects the click
+ * to be what runs. A settings value that is absent hands control back to the
+ * config, so a fresh install runs on whatever the profile says.
+ *
+ * @param settings - result of `readSettings`.
+ * @param configDepth - `maxChildDepth` from the plugin config.
+ */
+export function effectiveMaxChildDepth(settings, configDepth) {
+    const chosen = depthSetting(settings?.maxChildDepth);
+    if (chosen !== '') return chosen;
+    return typeof configDepth === 'number' && Number.isSafeInteger(configDepth) && configDepth >= 0
+        ? configDepth
+        : MAX_DEPTH_CHOICE;
+}
+
 /**
  * Parse `agent --list-models`.
  *
@@ -393,6 +434,8 @@ export function registerSettingsRoutes(ctx, deps) {
                 mode: settings.mode,
                 language: settings.language,
                 proxy: settings.proxy,
+                maxChildDepth: settings.maxChildDepth,
+                attribution: settings.attribution,
                 disabledModels: settings.disabledModels,
                 updatedAt: settings.updatedAt,
             },
@@ -406,6 +449,15 @@ export function registerSettingsRoutes(ctx, deps) {
             },
             effectiveModel: effectiveModel(settings, deps.configModel),
             configModel: deps.configModel ?? '',
+            // The number the next call will enforce, so the picker shows the cap
+            // in force rather than the value this file happens to hold.
+            effectiveMaxChildDepth: effectiveMaxChildDepth(settings, deps.maxChildDepth),
+            configMaxChildDepth: deps.maxChildDepth ?? '',
+            // What Cursor's own config file says right now. The panel needs this
+            // to tell "asked for off" apart from "off is actually in effect":
+            // the flag lives in a file this plugin does not own, and a failed
+            // write has to be visible instead of looking like success.
+            attribution: { choice: settings.attribution, ...readAttribution(deps.env) },
             agent: deps.resolved === undefined ? null : { command: deps.resolved.command, source: deps.resolved.source },
             models: { ...models, source: models.source ?? 'none' },
         };
@@ -449,10 +501,30 @@ export function registerSettingsRoutes(ctx, deps) {
                 patch.mode = body.mode;
             if (typeof body?.proxy === 'string')
                 patch.proxy = body.proxy;
+            // A depth outside 0..2 is refused by normalizeSettings, which stores
+            // `''` and hands control back to the config — a number the panel
+            // never offers must not become a cap this plugin enforces.
+            if (body?.maxChildDepth !== undefined)
+                patch.maxChildDepth = body.maxChildDepth;
+            // Refuse a word the panel never offers instead of storing it: the
+            // normalizer would fall back to `off`, which would silently disable
+            // Cursor attribution because of a typo.
+            if (typeof body?.attribution === 'string' && ATTRIBUTIONS.has(body.attribution))
+                patch.attribution = body.attribution;
             if (Array.isArray(body?.disabledModels))
                 patch.disabledModels = body.disabledModels;
-            if (Object.keys(patch).length > 0)
-                writeSettings(deps.dataDir, patch);
+            if (Object.keys(patch).length > 0) {
+                const saved = writeSettings(deps.dataDir, patch);
+                // The attribution switch is not stored here — it lives in
+                // Cursor's own config file — so saving has to write it now.
+                // Otherwise the answer below would report a choice that is not
+                // yet true and would only take effect on some later spawn.
+                if (patch.attribution !== undefined) {
+                    const applied = applyAttribution(saved.attribution, { env: deps.env });
+                    if (applied.error !== undefined)
+                        ctx.logger?.warn?.(`dsh-cursor-dev: could not update Cursor attribution in ${applied.path}: ${applied.error}`);
+                }
+            }
             // Re-resolve before answering: the payload reports the route a child
             // would take, and it has to describe the proxy that was just saved,
             // not the one that was in force a moment ago.
@@ -610,6 +682,24 @@ function modelIdList(value) {
     return [...seen];
 }
 
+/** Deepest delegation depth the panel offers. */
+const MAX_DEPTH_CHOICE = 2;
+
+/**
+ * Coerce the `maxChildDepth` setting.
+ *
+ * `''` means "the panel never wrote this, follow the plugin config", which is
+ * why a missing value must not collapse to 0 — 0 is a real choice that refuses
+ * every Cursor run. Anything outside 0..2 is treated as not set rather than
+ * clamped: a hand-edited 9 is a typo, and silently turning it into 2 would make
+ * the panel claim a cap the operator never picked.
+ */
+function depthSetting(value) {
+    const parsed = numberOrUndefined(value);
+    if (parsed === undefined) return '';
+    return Number.isSafeInteger(parsed) && parsed >= 0 && parsed <= MAX_DEPTH_CHOICE ? parsed : '';
+}
+
 /** Coerce a finite number, else undefined. */
 function numberOrUndefined(value) {
     if (typeof value === 'number')

package/lib/tool.js

@@ -93,9 +93,11 @@ export function cursorCodeTool(deps) {
     const { pool, journal, index, logger, unavailable, mirrors, quotaGuard } = deps;
     // The recursion budget this tool enforces: the child it starts is a real
     // DSH child session, so a subagent calling this tool would create a
-    // GRANDCHILD. `1` is the platform's own default (only a top-level agent
-    // delegates) and `0` forbids Cursor children entirely.
-    const maxChildDepth = deps.maxChildDepth;
+    // GRANDCHILD. Resolved per call, because the settings panel can change it
+    // without a reload — a cached number would keep enforcing the old cap.
+    const maxChildDepthNow = () => (typeof deps.maxChildDepth === 'function'
+        ? deps.maxChildDepth()
+        : deps.maxChildDepth);
 
     return {
         name: 'cursor_code',
@@ -274,6 +276,7 @@ export function cursorCodeTool(deps) {
             // The depth cap is checked BEFORE anything is created or spawned, so
             // a refused call costs nothing: no child session, no CLI process, no
             // Cursor conversation left half-started.
+            const maxChildDepth = maxChildDepthNow();
             if (typeof maxChildDepth === 'number') {
                 try {
                     resolveChildDepth(exec.agent, maxChildDepth);

package/lib/usage.js

@@ -16,7 +16,8 @@ import { execFile } from 'node:child_process';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { proxyAwareFetch, readSystemProxy, describeProxy } from './proxy.js';
-import { readSettings } from './settings.js';
+import { readAttribution } from './attribution.js';
+import { effectiveMaxChildDepth, readSettings } from './settings.js';
 import { conversationKeyOf } from './session-pool.js';
 
 /** Cursor's API host (mirrors `cli-config.json` → serverConfigCache.backendUrl). */
@@ -470,6 +471,43 @@ export class UsageClient {
     }
 }
 
+/**
+ * The depth cap the next call would enforce, for the dashboard's first paint.
+ *
+ * The panel would otherwise have to guess between the stored choice and the
+ * config default and would paint the wrong one for a moment. A settings file
+ * that cannot be read falls back to the config value, exactly like `readSettings`.
+ *
+ * @param deps - route dependencies; `dataDir` and the config `maxChildDepth`.
+ */
+function effectiveDepthFor(deps) {
+    try {
+        return effectiveMaxChildDepth(readSettings(deps.dataDir), deps.maxChildDepth);
+    }
+    catch {
+        return typeof deps.maxChildDepth === 'number' ? deps.maxChildDepth : 2;
+    }
+}
+
+/**
+ * The attribution state the dashboard paints first.
+ *
+ * Two facts, not one: the choice stored in this plugin's settings, and what
+ * Cursor's own config file says right now. A panel that showed only the choice
+ * would claim a state the CLI might not be in.
+ *
+ * @param deps - route dependencies; `dataDir` and the child environment.
+ */
+function attributionFor(deps) {
+    try {
+        const choice = readSettings(deps.dataDir).attribution;
+        return { choice, ...readAttribution(deps.env) };
+    }
+    catch {
+        return { choice: 'off', path: '', present: false, attribution: undefined };
+    }
+}
+
 /**
  * Register the usage surfaces on the host web server.
  *
@@ -815,6 +853,13 @@ export function registerUsageRoutes(ctx, deps) {
                 journal,
                 dataDir,
                 configModel: deps.configModel,
+                // First paint only: the settings payload corrects this on load.
+                // Seeding it here keeps the picker from briefly showing a cap the
+                // operator never chose.
+                effectiveMaxChildDepth: effectiveDepthFor(deps),
+                // What Cursor's own config file says right now, so the first
+                // paint can report the effect instead of the stored choice.
+                attribution: attributionFor(deps),
                 // Whether this host can open a mirrored child conversation at
                 // all. When it cannot, a key click must keep opening the step
                 // timeline instead of offering a jump nobody is listening for.
@@ -947,6 +992,7 @@ function dashboardHtml(state) {
             mode: settings.mode,
             language: settings.language,
             proxy: settings.proxy,
+            attribution: settings.attribution,
             disabledModels: settings.disabledModels,
         },
         // The route a child process would take right now. Without it the panel
@@ -963,6 +1009,10 @@ function dashboardHtml(state) {
             source: settings.modelsSource ?? '',
         },
         configModel: state.configModel ?? '',
+        effectiveMaxChildDepth: state.effectiveMaxChildDepth ?? 2,
+        // The stored choice plus what Cursor's own file says, so the first paint
+        // can report the effect instead of repeating the choice back.
+        attribution: state.attribution ?? { choice: settings.attribution, path: '', present: false },
         // When the host has an agent loop, a row's key opens the mirrored child
         // conversation in the app itself. When it does not, the key keeps
         // opening the step timeline, which is then the only record of a run.
@@ -1101,6 +1151,9 @@ function dashboardHtml(state) {
      a wrong proxy is the usual reason the model list looks short. */
   .env { margin-top: 12px; padding-bottom: 10px; border-bottom: 1px solid var(--line); }
   .env .controls { margin: 0; }
+  /* Each env row is one setting, and a row that follows an explanation needs to
+     look like a new setting rather than the tail of the previous one. */
+  .env .controls + .controls, .env .muted + .controls { margin-top: 10px; }
   .env input[type="text"] { font-size: 12px; padding: 4px 8px; }
   .env label { font-size: 12px; }
   button.ghost { color: var(--muted); }
@@ -1234,8 +1287,20 @@ function dashboardHtml(state) {
 
 <section class="row card" id="modelcard" aria-labelledby="model-title">
   <h2 id="model-title" data-t="model">子智能体模型</h2>
+  <!-- The choice comes first: it is the one thing this card exists for. -->
+  <div class="controls">
+    <select id="model" aria-labelledby="model-title"></select>
+    <button type="button" id="model-save" class="primary" data-t="save">保存</button>
+  </div>
   <div class="muted" data-t="modelHint"></div>
-  <!-- The child CLI does not read the Windows registry, so a machine whose proxy
+  <label class="lock">
+    <input type="checkbox" id="model-lock">
+    <span data-t="modelLock">锁定面板模型（忽略单次调用的 model 参数）</span>
+  </label>
+  <div class="status" id="model-status" role="status" aria-live="polite"></div>
+  <!-- Everything below is how the child gets launched, not what it will say:
+       the egress route and how deep in the delegate chain it may be started.
+       The child CLI does not read the Windows registry, so a machine whose proxy
        lives only in Internet Settings gets a child that lists a fraction of the
        models. Empty means "ask the machine", which is what makes the full
        catalogue appear with nobody configuring anything. -->
@@ -1244,22 +1309,24 @@ function dashboardHtml(state) {
       <label class="muted" for="proxy" data-t="proxyLabel">代理</label>
       <input type="text" id="proxy" autocomplete="off" spellcheck="false">
     </div>
+    <div class="controls">
+      <label class="muted" for="depth" data-t="depthLabel">子代理深度</label>
+      <select id="depth" aria-describedby="depth-hint"></select>
+    </div>
+    <div class="muted" id="depth-hint" data-t="depthHint"></div>
+    <div class="controls">
+      <label class="muted" for="attribution" data-t="attributionLabel">Cursor 署名</label>
+      <select id="attribution" aria-describedby="attribution-hint"></select>
+    </div>
+    <div class="muted" id="attribution-hint" data-t="attributionHint"></div>
+    <div class="muted" id="attribution-status"></div>
   </div>
-  <div class="controls">
-    <select id="model" aria-labelledby="model-title"></select>
-    <button type="button" id="model-save" class="primary" data-t="save">保存</button>
-  </div>
-  <label class="lock">
-    <input type="checkbox" id="model-lock">
-    <span data-t="modelLock">锁定面板模型（忽略单次调用的 model 参数）</span>
-  </label>
-  <div class="status" id="model-status" role="status" aria-live="polite"></div>
   <!-- The catalogue the CLI reports is too long for a dropdown, so it gets a
        browser: search, filter, and a switch per model. Switching a model off
        only hides it from the picker — it is never deleted, so switching it
        back on restores the same entry. -->
   <details class="fold" id="model-browser">
-    <summary data-t="modelBrowse">模型目录、搜索与筛选</summary>
+    <summary data-t="modelBrowse">模型目录、搜索与来源</summary>
     <div class="controls">
       <button type="button" id="model-reload" class="ghost" data-t="reloadModels">重新读取模型列表</button>
     </div>
@@ -1274,9 +1341,9 @@ function dashboardHtml(state) {
       </div>
     </div>
     <div class="muted" data-t="modelNote" style="margin-top:6px"></div>
-  </details>
-  <details class="fold" id="model-advanced">
-    <summary data-t="modelAdvanced">来源与出口</summary>
+    <!-- The catalogue and where it came from are one question — "is the list in
+         front of me the real list?" — so the diagnostics sit in the same fold
+         instead of a second one nobody opens. -->
     <div class="muted" id="model-state"></div>
   </details>
 </section>
@@ -1331,11 +1398,24 @@ function dashboardHtml(state) {
       levelBad: '接近上限',
       officialNote: '官方说明',
       model: '子智能体模型',
-      modelBrowse: '模型目录、搜索与筛选',
-      modelAdvanced: '来源与出口',
+      modelBrowse: '模型目录、搜索与来源',
       appliesNext: '下次调用生效',
       unsavedShort: '有改动未保存',
-      seeAdvanced: '模型列表或代理有异常，见「来源与出口」',
+      seeAdvanced: '模型列表或代理有异常，见「模型目录、搜索与来源」',
+      depthLabel: '子代理深度',
+      depthHint: '决定「子代理里的代理」能不能再开一次 Cursor。Cursor 自己不会再往下派，所以 2 就是上限。',
+      depthNone: '0 · 禁止（cursor_code 一律拒绝）',
+      depthTop: '1 · 仅顶层代理可用',
+      depthAll: '2 · 顶层与子代理都可用（默认）',
+      depthInEffect: '当前生效：',
+      attributionLabel: 'Cursor 署名',
+      attributionHint: 'Cursor 会在子智能体提交的 commit 和 PR 上署名。开关在 Cursor 自己的 cli-config.json 里，改这里等于替你改那个文件，其余设置不动。新会话生效。',
+      attributionOff: '不加 Cursor 署名（默认）',
+      attributionOn: '保留 Cursor 署名',
+      attributionKeep: '跟随 Cursor 自己的配置（本插件不写文件）',
+      attributionNowOff: 'Cursor 当前：不加署名',
+      attributionNowOn: 'Cursor 当前：会署名',
+      attributionFailed: '写入 Cursor 配置失败：',
       modelHint: '默认跟随这里的模型；勾选锁定后，智能体传入的 model 参数也不会覆盖你的选择。',
       modelLock: '锁定面板模型（忽略单次调用的 model 参数）',
       modelLocked: '已锁定模型',
@@ -1458,11 +1538,24 @@ function dashboardHtml(state) {
       levelBad: 'near the limit',
       officialNote: 'Official note',
       model: 'Child-agent model',
-      modelBrowse: 'Model catalogue, search and filters',
-      modelAdvanced: 'Source and egress',
+      modelBrowse: 'Model catalogue, search and sources',
       appliesNext: 'applies on the next call',
       unsavedShort: 'unsaved changes',
-      seeAdvanced: 'model list or proxy problem — see Source and egress',
+      seeAdvanced: 'model list or proxy problem — see Catalogue, search and sources',
+      depthLabel: 'Subagent depth',
+      depthHint: 'Whether a subagent may start a Cursor run of its own. Cursor never delegates further, so 2 is the ceiling.',
+      depthNone: '0 · never (cursor_code always refuses)',
+      depthTop: '1 · top-level agent only',
+      depthAll: '2 · top-level and subagents (default)',
+      depthInEffect: 'in effect: ',
+      attributionLabel: 'Cursor credit',
+      attributionHint: 'Cursor credits itself on the commits and pull requests its child makes. The switch lives in Cursor own cli-config.json, so changing it here edits that file and nothing else in it. New sessions only.',
+      attributionOff: 'No Cursor credit (default)',
+      attributionOn: 'Credit Cursor',
+      attributionKeep: 'Leave Cursor own setting alone (this plugin writes nothing)',
+      attributionNowOff: 'Cursor now: no credit',
+      attributionNowOn: 'Cursor now: credits itself',
+      attributionFailed: 'Could not write Cursor config: ',
       modelHint: 'Calls follow this default unless they specify a model. Lock it to prevent the agent from overriding your choice.',
       modelLock: 'Lock the panel model (ignore per-call model arguments)',
       modelLocked: 'model locked',
@@ -1582,6 +1675,21 @@ function dashboardHtml(state) {
   var modelsSource = (boot.models && boot.models.source) || '';
   var quotaGate = boot.quotaGuard || { blocked: false };
   var configModel = boot.configModel || '';
+  // What the plugin will actually enforce on the next call: the panel value if
+  // one was saved, otherwise the config default. The server computes it, so the
+  // panel never has to guess which of the two wins.
+  var effectiveDepth = typeof boot.effectiveMaxChildDepth === 'number'
+    ? boot.effectiveMaxChildDepth : 2;
+  // The depth picker's choices: the value the tool compares against, then the
+  // dictionary key for its label. Ordered shallowest first.
+  var DEPTH_CHOICES = [['0', 'depthNone'], ['1', 'depthTop'], ['2', 'depthAll']];
+  // Whether the child credits Cursor in the commits it makes. The switch is not
+  // ours — it is a key in Cursor own config file — so the panel tracks both the
+  // choice and what that file says right now.
+  var attributionChoice = boot.attribution && boot.attribution.choice
+    ? boot.attribution.choice : 'off';
+  var attributionState = boot.attribution || null;
+  var ATTRIBUTION_CHOICES = [['off', 'attributionOff'], ['on', 'attributionOn'], ['keep', 'attributionKeep']];
   var setupState = null;
   var LANG = pickLang();
 
@@ -1824,6 +1932,54 @@ function dashboardHtml(state) {
         proxyBox.value = configuredProxy;
       }
     }
+    var depthBox = $('depth');
+    if (depthBox && depthBox.options) {
+      if (depthBox.options.length === 0) {
+        DEPTH_CHOICES.forEach(function (pair) {
+          var option = document.createElement('option');
+          option.value = pair[0];
+          depthBox.appendChild(option);
+        });
+      }
+      // Relabelled every paint, so a language switch renames them in place
+      // without the <option> elements carrying their own data-t.
+      for (var di = 0; di < depthBox.options.length; di += 1) {
+        if (DEPTH_CHOICES[di]) depthBox.options[di].textContent = t(DEPTH_CHOICES[di][1]);
+      }
+      // Same rule as the proxy box: a value the operator just picked survives
+      // the poll that arrives before they press 保存.
+      if (depthBox !== document.activeElement) depthBox.value = String(effectiveDepth);
+    }
+    var attributionBox = $('attribution');
+    if (attributionBox && attributionBox.options) {
+      if (attributionBox.options.length === 0) {
+        ATTRIBUTION_CHOICES.forEach(function (pair) {
+          var option = document.createElement('option');
+          option.value = pair[0];
+          attributionBox.appendChild(option);
+        });
+      }
+      for (var ai = 0; ai < attributionBox.options.length; ai += 1) {
+        if (ATTRIBUTION_CHOICES[ai]) attributionBox.options[ai].textContent = t(ATTRIBUTION_CHOICES[ai][1]);
+      }
+      if (attributionBox !== document.activeElement) attributionBox.value = String(attributionChoice);
+    }
+    // The choice is ours to store; whether it took effect is Cursor's answer, so
+    // the line under the picker reports the file rather than repeating the pick.
+    var attributionNote = $('attribution-status');
+    if (attributionNote) {
+      var state = attributionState;
+      if (state && state.error) {
+        attributionNote.textContent = t('attributionFailed') + state.error;
+      }
+      else if (state && state.attribution) {
+        attributionNote.textContent = state.attribution.attributeCommitsToAgent === false
+          ? t('attributionNowOff') : t('attributionNowOn');
+      }
+      else {
+        attributionNote.textContent = '';
+      }
+    }
     var query = modelFilter.trim().toLowerCase();
     var fallback = document.createElement('option');
     fallback.value = '';
@@ -2537,6 +2693,12 @@ function dashboardHtml(state) {
     if (typeof data.proxy.route === 'string') proxyRoute = data.proxy.route;
     if (typeof data.proxy.error === 'string') proxyError = data.proxy.error;
   }
+  function applyAttribution(data) {
+    if (!data || !data.attribution) return;
+    var block = data.attribution;
+    if (typeof block.choice === 'string' && block.choice !== '') attributionChoice = block.choice;
+    attributionState = block;
+  }
   function loadSettings(force) {
     return fetch(boot.settingsEndpoint + (force ? '?refreshModels=1' : ''), { headers: { accept: 'application/json' } })
       .then(function (r) { return r.json(); })
@@ -2552,6 +2714,8 @@ function dashboardHtml(state) {
           modelsError = data.models.ok === false ? String(data.models.error || '') : '';
         }
         if (typeof data.configModel === 'string') configModel = data.configModel;
+        if (typeof data.effectiveMaxChildDepth === 'number') effectiveDepth = data.effectiveMaxChildDepth;
+        applyAttribution(data);
         applyProxy(data);
         renderModel();
         return data;
@@ -2577,6 +2741,9 @@ function dashboardHtml(state) {
           if (typeof data.models.source === 'string' && data.models.source !== '') modelsSource = data.models.source;
           modelsError = data.models.ok === false ? String(data.models.error || '') : '';
         }
+        // The answer already carries what Cursor file says after the write, so
+        // the line under the picker reports the result rather than the intent.
+        applyAttribution(data);
         applyProxy(data);
         renderModel();
         return data;
@@ -2689,12 +2856,23 @@ function dashboardHtml(state) {
     var proxyBox = $('proxy');
     var nextProxy = proxyBox ? proxyBox.value.trim() : '';
     var proxyChanged = nextProxy !== (settings.proxy == null ? '' : String(settings.proxy));
+    var depthBox = $('depth');
+    // An absent picker leaves the stored value alone: a page without it (an
+    // older panel, a test stub) must not overwrite the cap with NaN.
+    var nextDepth = depthBox && depthBox.options ? Number(depthBox.value) : undefined;
+    if (!Number.isFinite(nextDepth)) nextDepth = undefined;
+    var attributionBox = $('attribution');
+    // Same rule as the depth picker: no element, no change.
+    var nextAttribution = attributionBox && attributionBox.options ? String(attributionBox.value) : undefined;
+    if (!nextAttribution) nextAttribution = undefined;
     text($('model-state'), '…');
     text($('model-status'), '…');
     post({
       model: value,
       modelPolicy: $('model-lock').checked ? 'panel' : 'per-call',
       proxy: nextProxy,
+      maxChildDepth: nextDepth,
+      attribution: nextAttribution,
       disabledModels: disabledModels()
     }).then(function (data) {
       if (!data || !data.settings) return;

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-cursor-dev",
   "displayName": "Cursor 子智能体",
   "description": "把 Cursor CLI 当作子编码智能体来写业务代码：cursor_code 与 cursor_subagent 都提供可从面板点开的实时子对话，原生任务保留宿主的 External 运行记录；可按任务选模型、会话在 DSH 重启后仍能续聊、返回逐步工具时间线与真实文件 diff，并自带额度/模型/会话面板。",
-  "version": "0.12.3",
+  "version": "0.12.4",
   "license": "MIT",
   "type": "module",
   "main": "lib/index.js",