hilos-agent 0.5.1 → 0.6.0

package/README.md

@@ -42,7 +42,8 @@ Running from elsewhere, or want to map several repos explicitly? Use a config:
   "url": "https://hilos.sh/api/mcp",
   "token": "mgo_…",
   "repos": { "your-org/your-repo": "/Users/you/code/your-repo" },
-  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text", "agy -p", any command
+  "codingCmd": "claude -p --permission-mode acceptEdits",  // safe default; see Permissions / autonomy. or "codex exec", "cursor-agent -p --output-format text --trust", "agy -p", any command
+  "codingModel": "",  // model preset tier ("opus" | "sonnet" | "haiku") resolved at run time against the CLI's own model list (Cursor only today); "" = the tool's default
   "chatCmd": "",  // FAST command for chat replies + the plan-ack. Empty = derived from codingCmd's tool (codex daemons chat with codex, etc.); set to override
   "defaultBranch": "main",
   "gate": false,               // default: open a PR directly. true = approve-before-push

package/bin/hilos-agent.mjs

@@ -31,6 +31,7 @@ function parseArgs(argv) {
     else if (a === "--url") flags.url = argv[++i];
     else if (a === "--token") flags.token = argv[++i];
     else if (a === "--coding-cmd") flags.codingCmd = argv[++i];
+    else if (a === "--coding-model") flags.codingModel = argv[++i];
     else if (a === "--chat-cmd") flags.chatCmd = argv[++i];
     else if (a === "--once") flags.once = true;
     else if (a === "--backfill") flags.backfill = true;
@@ -56,8 +57,11 @@ Options:
   --channel <id>     watch only one channel (per-channel override)
   --config <path>    use a specific config file
   --coding-cmd <cmd> the coding agent to run — claude -p, codex exec,
-                     cursor-agent -p, agy -p, hermes, or any command that
-                     takes a prompt as its last arg (default: "claude -p")
+                     cursor-agent -p --trust, agy -p, hermes, or any command
+                     that takes a prompt as its last arg (default: "claude -p")
+  --coding-model <tier>  model preset tier (opus | sonnet | haiku) resolved at
+                     run time against the CLI's own model list — never a baked
+                     id (Cursor only today; default: the tool's own model)
   --chat-cmd <cmd>   fast command for chat replies + the plan-ack (default:
                      derived from the coding command, so a Codex or Cursor
                      daemon chats with its own tool)
@@ -98,6 +102,7 @@ async function main() {
     // non-Claude connect command doesn't write the Claude default over it.
     const starter = { ...(joinPayload || {}) };
     if (flags.codingCmd) starter.codingCmd = flags.codingCmd;
+    if (flags.codingModel) starter.codingModel = flags.codingModel;
     const path = writeStarterConfig(joinPayload ? GLOBAL_CONFIG : flags.config, starter);
     console.log(`Wrote ${path}.`);
     console.log(joinPayload ? "Token + endpoint set from your link." : "Fill in token + repos, then run `hilos-agent`.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hilos-agent",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Run your own coding agent (Claude Code / Codex / Cursor) as an autonomous teammate in a hilos channel. Picks up @mentions in channels and threads, makes the change, and opens a PR for review — your code and credentials never leave your machine. (Approve-before-push is available via gate:true.)",
   "type": "module",
   "bin": {

package/src/agent-events.mjs

@@ -1,9 +1,10 @@
 // Normalized vendor stream parser (0272). The KEYSTONE of the "Agents feel
 // alive" epic: coding CLIs each narrate their work in a different, unstable
 // wire format (Claude Code emits `--output-format stream-json` NDJSON, Codex
-// emits `--json` item events, Cursor emits unstructured text). This module turns
-// any of them into ONE small, typed `AgentEvent` stream the UI can render as a
-// live "what the agent is doing right now" card.
+// emits `--json` item events, Cursor emits its own `--output-format
+// stream-json` NDJSON — 0573). This module turns any of them into ONE small,
+// typed `AgentEvent` stream the UI can render as a live "what the agent is
+// doing right now" card.
 //
 // Design rules that make this safe to point at an untrusted, evolving CLI:
 //   - PURE + dependency-free (node builtins only) so it stands alone and is
@@ -207,12 +208,77 @@ function parseCodexLine(line) {
   }
 }
 
+/**
+ * Parse ONE Cursor `--output-format stream-json` NDJSON line → AgentEvent[].
+ * Shapes captured LIVE against cursor-agent 2026.07.23 (ticket 0572's audit):
+ * a `system`/`init` envelope with `session_id` (the `--resume` id — 0573),
+ * `assistant` turns whose message.content carries text blocks (tool calls
+ * arrive as separate events, unlike Claude's inline tool_use), `tool_call`
+ * started/completed envelopes keyed by kind (`editToolCall`/`readToolCall`/
+ * `shellToolCall`, each with an `args` object), and a terminal `result` with
+ * `is_error` + the full text in `result`. `thinking` deltas, the `user` echo,
+ * and `tool_call` completions are deliberately not steps.
+ */
+function parseCursorLine(line) {
+  const obj = tryParse(line);
+  if (!obj) return [];
+  if (obj.type === "system" && typeof obj.session_id === "string") {
+    return [{ t: "session", sessionId: sanitizeText(obj.session_id) }];
+  }
+  if (obj.type === "result") {
+    const ok = obj.is_error !== true && obj.subtype !== "error";
+    const summary = typeof obj.result === "string" ? sanitizeText(obj.result) : undefined;
+    return [summary ? { t: "result", ok, summary } : { t: "result", ok }];
+  }
+  // Only `started` — the `completed` twin repeats the same call and would
+  // double every step.
+  if (obj.type === "tool_call" && obj.subtype === "started") {
+    const ev = cursorToolEvent(obj.tool_call);
+    return ev ? [ev] : [];
+  }
+  if (obj.type === "assistant" && obj.message && Array.isArray(obj.message.content)) {
+    const out = [];
+    for (const block of obj.message.content) {
+      if (block && block.type === "text" && typeof block.text === "string") {
+        const text = sanitizeText(block.text.replace(/\s+/g, " ").trim());
+        if (text) out.push({ t: "note", text });
+      }
+    }
+    return out;
+  }
+  return [];
+}
+
+/** One Cursor tool_call envelope → an AgentEvent, or null. The envelope holds a
+ *  single `<kind>ToolCall` key; grep/ls/etc. carry less "alive" signal and are
+ *  skipped, mirroring toolKind()'s v1 restraint — an unknown kind never crashes. */
+function cursorToolEvent(toolCall) {
+  if (!toolCall || typeof toolCall !== "object") return null;
+  for (const [key, val] of Object.entries(toolCall)) {
+    if (!key.endsWith("ToolCall") || !val || typeof val !== "object") continue;
+    const args = val.args && typeof val.args === "object" ? val.args : {};
+    if (key === "shellToolCall" || key === "terminalToolCall") {
+      const cmd = typeof args.command === "string" ? args.command.replace(/\s+/g, " ").trim() : "";
+      return { t: "run", cmd: sanitizeText(cmd) };
+    }
+    if (key === "editToolCall" || key === "writeToolCall") {
+      return { t: "edit", path: typeof args.path === "string" ? sanitizeText(args.path) : "" };
+    }
+    if (key === "readToolCall") {
+      return { t: "read", path: typeof args.path === "string" ? sanitizeText(args.path) : "" };
+    }
+    return null;
+  }
+  return null;
+}
+
 /** claude / claude_code / claude-code all mean the Claude parser. */
 function normalizeVendor(vendor) {
   const v = String(vendor || "").toLowerCase();
   if (v === "claude" || v === "claude_code" || v === "claude-code") return "claude";
   if (v === "codex") return "codex";
-  return "cursor"; // cursor + ANY unknown vendor → lastLine fallback
+  if (v === "cursor") return "cursor"; // structured stream-json since 0573
+  return "text"; // ANY unknown vendor → lastLine text-tail fallback
 }
 
 // --- Streaming parsers -----------------------------------------------------
@@ -249,12 +315,13 @@ function makeLineBufferedParser(parseLine) {
 }
 
 /**
- * Fallback for Cursor and any vendor with no structured stream. There's nothing
- * to parse, so we only remember the last non-empty line seen — matching exactly
- * what the daemon does today (handler.mjs onData) so we NEVER regress below it —
- * and emit at most one sparse note on flush.
+ * Fallback for any vendor with no structured stream (cursor graduated to a
+ * real parser in 0573). There's nothing to parse, so we only remember the last
+ * non-empty line seen — matching exactly what the daemon does today
+ * (handler.mjs onData) so we NEVER regress below it — and emit at most one
+ * sparse note on flush.
  */
-function makeCursorParser() {
+function makeTextTailParser() {
   let lastLine = "";
   return {
     /** @returns {AgentEvent[]} */
@@ -285,7 +352,8 @@ export function makeStreamParser(vendor) {
   const v = normalizeVendor(vendor);
   if (v === "claude") return makeLineBufferedParser(parseClaudeLine);
   if (v === "codex") return makeLineBufferedParser(parseCodexLine);
-  return makeCursorParser();
+  if (v === "cursor") return makeLineBufferedParser(parseCursorLine);
+  return makeTextTailParser();
 }
 
 // --- Human step labels (what the LiveRunCard shows) ------------------------

package/src/cli.mjs

@@ -159,7 +159,7 @@ const MAX_CAPTURE_BYTES = 50 * 1024 * 1024;
  *
  * @param {RunCliOptions} opts
  */
-export function runCli(opts) {
+function runCliOnce(opts) {
   const {
     cmd,
     args = [],
@@ -289,3 +289,27 @@ export function runCli(opts) {
     child.on("close", (code) => finish(code, null));
   });
 }
+
+// Compat retry (0572): Cursor CLIs older than Jan 2026 predate the workspace-
+// trust gate and reject the `--trust` flag we now bake into cursor commands
+// (`error: unknown option '--trust'`). Those CLIs don't NEED the flag (no gate
+// existed), so on that exact failure runCli retries ONCE with it stripped. The
+// failed attempt writes only the commander error to stderr — stdout stays
+// empty — so progress streaming (onData) never sees the false start. Lives
+// inside runCli (not a wrapper) so every call site, present and future, gets it.
+const UNKNOWN_TRUST_RE = /unknown option '--trust'/;
+
+/** @param {RunCliOptions} opts */
+export async function runCli(opts) {
+  const first = await runCliOnce(opts);
+  const args = Array.isArray(opts?.args) ? opts.args : [];
+  if (
+    first.status !== 0 &&
+    !first.aborted &&
+    args.includes("--trust") &&
+    UNKNOWN_TRUST_RE.test(first.stderr || "")
+  ) {
+    return runCliOnce({ ...opts, args: args.filter((a) => a !== "--trust") });
+  }
+  return first;
+}

package/src/config.mjs

@@ -66,6 +66,11 @@ const DEFAULTS = {
   // mode with codingEnvAllow: ["MY_VAR", …].
   codingEnv: "inherit",
   codingEnvAllow: [],
+  // Model preset TIER for the coding run ("" / "default" = the tool's own
+  // default). "opus" | "sonnet" | "haiku" resolve at RUN time against the
+  // CLI's own model list — never a baked id that could 404 on another account
+  // (0504; cursor only today, see model-resolve.mjs).
+  codingModel: "",
   // Chat replies + the code-task plan-ack use a FAST one-shot command so a casual
   // reply (or "I see it, here's my plan") comes back in seconds, not minutes.
   // Bounded by chatTimeoutMs with a template fallback so it can never dead-air.
@@ -112,6 +117,7 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
     token: process.env.HILOS_TOKEN,
     channelId: process.env.HILOS_CHANNEL,
     codingCmd: process.env.CODING_CMD,
+    codingModel: process.env.HILOS_CODING_MODEL,
     chatCmd: process.env.HILOS_CHAT_CMD,
     heartbeatMs: process.env.HILOS_HEARTBEAT_MS ? Number(process.env.HILOS_HEARTBEAT_MS) : undefined,
     progressMs: process.env.HILOS_PROGRESS_MS ? Number(process.env.HILOS_PROGRESS_MS) : undefined,
@@ -135,8 +141,12 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
   // Local-folder map, merged like `repos` (an object, not a scalar overlay).
   merged.folders = { ...DEFAULTS.folders, ...(file.folders || {}) };
   merged.deploy = { ...DEFAULTS.deploy, ...(file.deploy || {}) };
-  // Remember where the file lives so reloadConfig can re-read it live.
+  // Remember where the file lives so reloadConfig can re-read it live, and
+  // what it said AT LAUNCH so reload only applies fields the user actually
+  // edited afterwards (0576) — a pre-existing file value must not claw back
+  // an explicit launch flag (--coding-cmd / --coding-model) on the first poll.
   merged.configPath = findConfigPath(flags.config) || null;
+  merged.fileSnapshot = file;
   return merged;
 }
 
@@ -145,6 +155,7 @@ export function resolveConfig({ flags = {}, join: joinPayload } = {}) {
 // edited file can NEVER drop the daemon's connection.
 const LIVE_FIELDS = [
   "codingCmd",
+  "codingModel",
   "chatCmd",
   "codingEnv",
   "codingEnvAllow",
@@ -182,8 +193,17 @@ export function reloadConfig(prev) {
   const path = prev.configPath;
   const file = (path && readJson(path)) || {};
   const next = { ...prev };
-  for (const k of LIVE_FIELDS) if (file[k] !== undefined) next[k] = file[k];
+  // Apply only fields that CHANGED since the launch snapshot (or the last
+  // reload): an EDIT to hilos-agent.json wins live, as documented, but a value
+  // that merely pre-existed at launch can't override the flags the user just
+  // pasted (`--coding-cmd`/`--coding-model` on a machine with an older config
+  // silently flipped back on the first poll — 0576 review finding).
+  const snap = prev.fileSnapshot || {};
+  const changed = (k) => JSON.stringify(file[k]) !== JSON.stringify(snap[k]);
+  for (const k of LIVE_FIELDS) if (file[k] !== undefined && changed(k)) next[k] = file[k];
+  next.fileSnapshot = file;
   if (process.env.CODING_CMD) next.codingCmd = process.env.CODING_CMD;
+  if (process.env.HILOS_CODING_MODEL) next.codingModel = process.env.HILOS_CODING_MODEL;
   if (process.env.HILOS_CHAT_CMD) next.chatCmd = process.env.HILOS_CHAT_CMD;
   if (process.env.HILOS_HEARTBEAT_MS) next.heartbeatMs = Number(process.env.HILOS_HEARTBEAT_MS);
   if (process.env.HILOS_PROGRESS_MS) next.progressMs = Number(process.env.HILOS_PROGRESS_MS);
@@ -208,6 +228,7 @@ export function writeStarterConfig(path, partial = {}) {
     channelId: partial.channelId || "",
     repos: partial.repos || { "owner/name": "/absolute/path/to/checkout" },
     codingCmd: partial.codingCmd || DEFAULTS.codingCmd,
+    ...(partial.codingModel ? { codingModel: partial.codingModel } : {}),
     defaultBranch: DEFAULTS.defaultBranch,
     // false = open a PR directly (bias to action); true = approve-before-push.
     gate: false,

package/src/handler.mjs

@@ -31,6 +31,7 @@ import { makeStreamParser } from "./agent-events.mjs";
 import { detectVendor, codeStreamArgs, createProgressEmitter, fastChatCmd } from "./progress-emitter.mjs";
 import { resolveFollowupMode, classifyFollowupCue, normalizeSignal } from "./followup.mjs";
 import { buildResumeArgs, readStateEntry, writeState, HILOS_DIR } from "./resume.mjs";
+import { createModelArgsResolver } from "./model-resolve.mjs";
 import {
   buildReviewPrompt,
   parseReviewOutput,
@@ -75,6 +76,10 @@ function prNumberFromUrl(url) {
 // human re-triggering the review is the escape hatch past the cap.
 const reviewRounds = new Map();
 
+// Tier → account-verified `--model` args for the code run (0504). Memoized per
+// (binary, tier) for the process; a failed lookup emits [] and retries later.
+const modelArgsFor = createModelArgsResolver({ run: (opts) => runCli(opts) });
+
 
 // Sentinel the router model emits (only when a thread already owns a run) to
 // classify a follow-up: change | new-scope | ambiguous. Parsed out of the router
@@ -1272,10 +1277,12 @@ async function handleFolderTask({ message, channelId, tool, me, caps, cfg, deps,
       };
     }
     let run;
+    // Model preset (0504): same run-time resolution as the repo path.
+    const modelArgs = await modelArgsFor(cfg, vendor);
     try {
       run = await deps.runCli({
         cmd: parts[0],
-        args: [...parts.slice(1), ...streamArgs, memoryPreamble(workspaceMemory) + promptText],
+        args: [...parts.slice(1), ...modelArgs, ...streamArgs, memoryPreamble(workspaceMemory) + promptText],
         cwd: folderPath,
         timeoutMs: cfg.runTimeoutMs,
         label: "coding",
@@ -2078,9 +2085,9 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
   // (get_active_run) with no local match means the session likely lives on another
   // machine/instance — a bad `--resume` id makes claude error → empty diff → a failed
   // run, so we DON'T resume and degrade to today's branch+feedback (never worse).
-  // Only claude_code has a proven resume flag; codex/cursor/unknown → [] anyway.
+  // claude_code + cursor have proven resume flags (0282/0573); codex/unknown → [].
   let resumeSessionId = null;
-  if (effectiveMode === "iterate" && vendor === "claude_code") {
+  if (effectiveMode === "iterate" && (vendor === "claude_code" || vendor === "cursor")) {
     const local = (() => {
       try {
         return readStateEntry(HILOS_DIR, threadRoot);
@@ -2209,9 +2216,13 @@ export async function handleTask({ message, channelId, tool, me, caps = {} }, cf
     // fallback) suppresses it. buildResumeArgs is [] unless vendor+session make
     // resume safe, so a non-resume run is byte-identical to the pre-0282 ARGV.
     const resumeArgs = resume ? buildResumeArgs(vendor, resumeSessionId) : [];
+    // Model preset (0504): resolved at run time against the CLI's own model
+    // list (cursor only today) — [] when unset/unresolvable, so the tool's
+    // default stands. Inserted before resume/stream flags, after the base.
+    const modelArgs = await modelArgsFor(cfg, vendor);
     const codeArgs = streamOn
-      ? [...parts.slice(1), ...resumeArgs, ...streamArgs]
-      : [...parts.slice(1), ...resumeArgs];
+      ? [...parts.slice(1), ...modelArgs, ...resumeArgs, ...streamArgs]
+      : [...parts.slice(1), ...modelArgs, ...resumeArgs];
     let run;
     try {
       run = await runCli({

package/src/model-resolve.mjs

@@ -0,0 +1,99 @@
+// Runtime model-preset resolution (0504). The connect UI offers capability
+// TIERS (Most capable / Balanced / Fastest), but Cursor's model ids are
+// account- and plan-specific and churn weekly — a baked id that works for one
+// user 404s for another, which is why VENDOR_CLI.cursor.model stayed empty for
+// months. So the tier resolves HERE, at run time, against the account's OWN
+// `cursor-agent --list-models` output: we only ever emit an id the CLI itself
+// just listed, and when nothing matches we emit no flag at all (the tool's
+// default — `auto` routing — stands). Never a guessed id, never a wrong flag.
+//
+// Design rules (mirror the .mjs siblings): the parse/resolve transforms are
+// PURE + node-builtins-only; the resolver takes an injected `run` (runCli) so
+// tests drive it with no CLI; a resolution failure NEVER breaks a run ([]).
+//
+// codex stays out: its CLI has no verified model-list command (0504 notes).
+
+/** Strip ANSI SGR color codes (`--list-models` output is colorized). */
+export function stripAnsi(s) {
+  // eslint-disable-next-line no-control-regex
+  return String(s || "").replace(/\x1b\[[0-9;]*m/g, "");
+}
+
+/**
+ * Parse `cursor-agent --list-models` stdout → model ids, in list order.
+ * Wire shape captured live on 2026.07.23: a header line, then one
+ * `<id> - <Label>` line per model, colorized. Anything that doesn't match the
+ * `id - label` shape (headers, blanks) is skipped — a format drift degrades to
+ * [] and the preset silently falls back to the tool default.
+ * @param {string} stdout
+ * @returns {string[]}
+ */
+export function parseCursorModels(stdout) {
+  const ids = [];
+  for (const raw of String(stdout || "").split("\n")) {
+    const m = stripAnsi(raw).trim().match(/^(\S+)\s+-\s+\S/);
+    if (m) ids.push(m[1]);
+  }
+  return ids;
+}
+
+// Ranked preferences per tier, scanned in order — the first pattern with any
+// match wins, then the FIRST id in the account's list-order that matches it.
+// opus = the strongest reasoning family; sonnet ("Balanced") = Cursor's own
+// composer flagship (its default agent model) before a Claude sonnet;
+// haiku ("Fastest") = the -fast variants, composer first. `auto` never
+// matches (tier "default" emits no flag long before this table is consulted).
+const TIER_PREFS = {
+  opus: [/^claude-opus[\w.-]*thinking(?!.*fast)/, /^claude-opus(?!.*fast)/, /opus(?!.*fast)/],
+  sonnet: [/^composer(?!.*fast)/, /^claude-sonnet(?!.*fast)/, /sonnet(?!.*fast)/],
+  haiku: [/^composer.*fast/, /-fast$/],
+};
+
+/**
+ * Pick the account's model id for a tier, or null when nothing fits.
+ * @param {'opus'|'sonnet'|'haiku'|string} tier
+ * @param {string[]} ids
+ * @returns {string|null}
+ */
+export function resolveCursorModel(tier, ids) {
+  const prefs = TIER_PREFS[tier];
+  if (!prefs || !Array.isArray(ids)) return null;
+  for (const re of prefs) {
+    const hit = ids.find((id) => typeof id === "string" && re.test(id));
+    if (hit) return hit;
+  }
+  return null;
+}
+
+/**
+ * Build a memoized `modelArgsFor(cfg, vendor)` → `["--model", id]` or [].
+ * Emits [] (tool default) when: the vendor isn't cursor, no/default tier is
+ * configured, the user already pinned `--model` by hand in codingCmd, the
+ * list command fails, or nothing matches. Successful lookups are cached per
+ * (binary, tier) for the process lifetime; failures are NOT cached so a
+ * transient hiccup (offline, auth) retries on the next run.
+ *
+ * @param {{ run: (opts: object) => Promise<{status: number|null, stdout: string}> }} o
+ */
+export function createModelArgsResolver({ run } = {}) {
+  const cache = new Map();
+  return async function modelArgsFor(cfg, vendor) {
+    try {
+      const tier = String(cfg?.codingModel || "").trim();
+      if (vendor !== "cursor" || !tier || tier === "default") return [];
+      const cmd = String(cfg?.codingCmd || "");
+      if (/(^|\s)--model(\s|=)/.test(cmd + " ")) return []; // hand-pinned wins
+      const bin = cmd.trim().split(/\s+/)[0] || "cursor-agent";
+      const key = `${bin} ${tier}`;
+      if (cache.has(key)) return cache.get(key);
+      const r = await run({ cmd: bin, args: ["--list-models"], timeoutMs: 30000, heartbeatMs: 0 });
+      if (!r || r.status !== 0) return [];
+      const id = resolveCursorModel(tier, parseCursorModels(r.stdout));
+      const args = id ? ["--model", id] : [];
+      cache.set(key, args);
+      return args;
+    } catch {
+      return []; // resolution must never break a run
+    }
+  };
+}

package/src/progress-emitter.mjs

@@ -32,7 +32,9 @@ export function detectVendor(codingCmd) {
   const base = (first.split(/[/\\]/).pop() || "").toLowerCase();
   if (base === "claude" || base === "claude-code" || base === "claude_code") return "claude_code";
   if (base === "codex") return "codex";
-  if (base === "cursor" || base === "cursor-agent") return "cursor";
+  // `agent` is Cursor's canonical binary name since Jan 2026 (the installer
+  // symlinks both; `cursor-agent` remains an alias) — 0572.
+  if (base === "cursor" || base === "cursor-agent" || base === "agent") return "cursor";
   if (base === "agy" || base === "antigravity") return "antigravity";
   if (base === "hermes") return "hermes";
   return "unknown";
@@ -45,16 +47,18 @@ export function detectVendor(codingCmd) {
  * verified non-interactive print mode; the daemon appends the prompt as the last
  * arg. codex carries --skip-git-repo-check because chat (and the read-only
  * review sandbox) can run outside a git checkout. cursor carries
- * --output-format text because its -p default is stream-json, which would post
- * raw JSONL into the channel. Returns "" for unknown (caller falls back to
- * codingCmd).
+ * --output-format text (explicit, so a CLI default change can never post raw
+ * JSONL into the channel) and --trust (its Jan-2026 workspace-trust gate fails
+ * headless runs at spawn in untrusted directories — 0572; pre-2026 CLIs reject
+ * the flag and runCli retries without it). Returns "" for unknown (caller
+ * falls back to codingCmd).
  * @param {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'} vendor
  * @returns {string}
  */
 export function fastChatCmd(vendor) {
   if (vendor === "claude_code") return "claude -p --model claude-haiku-4-5";
   if (vendor === "codex") return "codex exec --skip-git-repo-check";
-  if (vendor === "cursor") return "cursor-agent -p --output-format text";
+  if (vendor === "cursor") return "cursor-agent -p --output-format text --trust";
   if (vendor === "antigravity") return "agy -p";
   if (vendor === "hermes") return "hermes -z";
   return "";
@@ -62,15 +66,19 @@ export function fastChatCmd(vendor) {
 
 /**
  * Extra args to make the code run EMIT a structured stream, appended to the code
- * run's argv (NOT the display string) and ONLY for the code run. Only claude_code
- * has a proven flag (`--output-format stream-json --verbose`, per lib/agent-cli.ts
- * + scripts/verify-sandbox-mcp.mjs). codex/cursor return [] — their stream flags
+ * run's argv (NOT the display string) and ONLY for the code run. claude_code:
+ * `--output-format stream-json --verbose` (per lib/agent-cli.ts +
+ * scripts/verify-sandbox-mcp.mjs). cursor (0573): `--output-format stream-json`
+ * — appended AFTER the base's `--output-format text`, and live-verified on
+ * cursor-agent 2026.07.23 that the LAST occurrence wins, so the code run
+ * streams NDJSON while chat keeps text. codex returns [] — its stream flags
  * are deferred to 0278 rather than guessed (an unproven flag could break the run).
  * @param {'claude_code'|'codex'|'cursor'|'antigravity'|'hermes'|'unknown'} vendor
  * @returns {string[]}
  */
 export function codeStreamArgs(vendor) {
   if (vendor === "claude_code") return ["--output-format", "stream-json", "--verbose"];
+  if (vendor === "cursor") return ["--output-format", "stream-json"];
   return [];
 }
 

package/src/resume.mjs

@@ -35,18 +35,21 @@ export const STATE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 /**
  * The `--resume` flags for a coding vendor, or [] when resume isn't safe/known.
  *
- * ONLY claude_code has a proven, confirmed resume flag (`--resume <id>`, compatible
- * with `--output-format stream-json`). codex/cursor have UNCONFIRMED resume flags,
- * so we emit NOTHING rather than guess — a wrong flag could break the run; they
- * degrade to today's branch+feedback iterate (deferred to 0278/later). A falsy or
- * non-string sessionId also returns [] (nothing to resume).
+ * claude_code: `--resume <id>`, proven and compatible with
+ * `--output-format stream-json`. cursor (0573): `--resume <chatId>` —
+ * live-verified against cursor-agent 2026.07.23 that a resumed `-p` run
+ * answers from the prior session's context; the id is the `session_id` its
+ * stream-json init/result events carry. codex has an UNCONFIRMED resume flag,
+ * so we emit NOTHING rather than guess — a wrong flag could break the run; it
+ * degrades to today's branch+feedback iterate. A falsy or non-string sessionId
+ * also returns [] (nothing to resume).
  *
  * @param {'claude_code'|'codex'|'cursor'|'hermes'|'unknown'} vendor
  * @param {string|null|undefined} sessionId
  * @returns {string[]}
  */
 export function buildResumeArgs(vendor, sessionId) {
-  if (vendor !== "claude_code") return [];
+  if (vendor !== "claude_code" && vendor !== "cursor") return [];
   if (typeof sessionId !== "string" || !sessionId.trim()) return [];
   return ["--resume", sessionId];
 }