orquesta-agent 0.2.235 → 0.2.239

package/README.md

@@ -86,6 +86,51 @@ This checks:
 - Claude authentication (API key or web subscription)
 - Git installation
 
+## IDE Hooks — mirror Claude Code and Cursor sessions
+
+Everything above is *dispatch*: Orquesta sends work down to the agent. Hooks are
+the opposite direction — you keep working in your own IDE and Orquesta mirrors
+what happened. No daemon runs, and nothing is ever executed back into your editor.
+
+```bash
+# Wire both tools (default)
+orquesta-agent init --token oat_xxxxx
+
+# Or pick one
+orquesta-agent init --token oat_xxxxx --client cursor
+orquesta-agent init --token oat_xxxxx --client claude
+```
+
+`init` writes `.orquesta.json` (project binding — it is added to `.gitignore`
+because it holds the raw token) plus `.claude/settings.json` and/or
+`.cursor/hooks.json`. Hooks you already had are preserved, and re-running `init`
+upgrades Orquesta's entries rather than stacking duplicates.
+
+| Moment | Claude Code | Cursor | Recorded as |
+|---|---|---|---|
+| Prompt sent | `UserPromptSubmit` | `beforeSubmitPrompt` | The prompt |
+| Tool ran | `PostToolUse` | `postToolUse`, `afterShellExecution`, `afterFileEdit` | Tool call + result |
+| Answer written | — | `afterAgentResponse` | The assistant's reply |
+| Session done | `Stop` | `stop` | Marks the prompt complete |
+
+Cursor surfaces shell runs and file edits as their own events on top of
+`postToolUse`, so all three are wired and the handler de-dupes by content — an
+action reported twice is still logged once.
+
+Two behaviours differ per tool, both deliberate:
+
+- **stdout.** Claude Code reads `UserPromptSubmit` stdout as extra model context,
+  so the hook injects a short Orquesta block there. Cursor parses hook stdout as a
+  JSON permission decision, so on that path the hook writes **nothing**.
+- **Failure is always silent.** Every hook exits 0. An unreachable Orquesta, a
+  revoked token, a malformed payload or a directory with no `.orquesta.json` all
+  leave your session untouched.
+
+The tool is detected from the payload, so `--client` is only needed to override
+the guess. Mirrored prompts arrive with `source: terminal` and a `cli_type` of
+`claude-code` or `cursor-cli`, and are excluded from agent dispatch so a hooked
+session is never re-executed.
+
 ## Architecture
 
 ```

package/dist/cli-auth-detect.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Reading a coding CLI's own words to decide whether it is logged out.
+ *
+ * Its own module, with no imports, for one reason: executor.ts pulls in node-pty
+ * and the whole execution stack, so nothing there can be unit-tested. The
+ * classifier is the part that can actually be wrong, so it lives where a test
+ * can reach it.
+ *
+ * The contract is deliberately one-sided — it answers "did this CLI SAY it is
+ * logged out", not "is it logged in". Everything else (an older build with no
+ * status subcommand, a timeout, an unfamiliar phrasing) is treated as unknown by
+ * the caller and reported as authenticated: a false "not logged in" badge on a
+ * working machine sends the user chasing a problem that isn't there, while the
+ * badge we had before this existed was simply always green.
+ */
+export declare function isLoggedOutMessage(output: string | null | undefined): boolean;
+//# sourceMappingURL=cli-auth-detect.d.ts.map

package/dist/cli-auth-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth-detect.d.ts","sourceRoot":"","sources":["../src/cli-auth-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAaH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG7E"}

package/dist/cli-auth-detect.js

@@ -0,0 +1,31 @@
+/**
+ * Reading a coding CLI's own words to decide whether it is logged out.
+ *
+ * Its own module, with no imports, for one reason: executor.ts pulls in node-pty
+ * and the whole execution stack, so nothing there can be unit-tested. The
+ * classifier is the part that can actually be wrong, so it lives where a test
+ * can reach it.
+ *
+ * The contract is deliberately one-sided — it answers "did this CLI SAY it is
+ * logged out", not "is it logged in". Everything else (an older build with no
+ * status subcommand, a timeout, an unfamiliar phrasing) is treated as unknown by
+ * the caller and reported as authenticated: a false "not logged in" badge on a
+ * working machine sends the user chasing a problem that isn't there, while the
+ * badge we had before this existed was simply always green.
+ */
+const LOGGED_OUT_PATTERNS = [
+    // "Not logged in", "not authenticated", "You are not logged in."
+    /not\s+(logged\s*in|authenticated|signed\s*in)/i,
+    // "Logged out", "Signed out"
+    /(logged|signed)\s*out/i,
+    // "No active session", "no credentials found"
+    /no\s+(active\s+)?(session|credentials)/i,
+    // The instruction every one of them prints when unauthenticated.
+    /run\s+`?(cursor-agent|claude|kimi)\s+login/i,
+];
+export function isLoggedOutMessage(output) {
+    if (!output)
+        return false;
+    return LOGGED_OUT_PATTERNS.some(pattern => pattern.test(output));
+}
+//# sourceMappingURL=cli-auth-detect.js.map

package/dist/cli-auth-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth-detect.js","sourceRoot":"","sources":["../src/cli-auth-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,mBAAmB,GAAG;IAC1B,iEAAiE;IACjE,gDAAgD;IAChD,6BAA6B;IAC7B,wBAAwB;IACxB,8CAA8C;IAC9C,yCAAyC;IACzC,iEAAiE;IACjE,6CAA6C;CAC9C,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAiC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;AAClE,CAAC"}

package/dist/executor.d.ts

@@ -66,7 +66,7 @@ export declare function getEffectiveRuntimeConfig(): {
     sandboxMode: SandboxMode;
     sandboxStatus: 'active' | 'unavailable' | 'off';
 };
-export type CliPreference = 'auto' | 'orquesta' | 'claude' | 'kimi';
+export type CliPreference = 'auto' | 'orquesta' | 'claude' | 'kimi' | 'cursor';
 export declare function setCliPreference(preference: CliPreference): void;
 export declare function setCliEndpoint(endpoint: string): void;
 export declare function getCliEndpoint(): string;
@@ -77,8 +77,16 @@ export declare function resolveClaudeBinary(): string | null;
 export declare function isClaudeCliAvailable(): boolean;
 export declare function resolveKimiBinary(): string | null;
 export declare function isKimiCliAvailable(): boolean;
+export declare function resolveCursorBinary(): string | null;
+export declare function isCursorCliAvailable(): boolean;
+export declare function checkCursorAuth(): {
+    available: boolean;
+    authenticated: boolean;
+    method: string | null;
+};
+export type CliName = 'orquesta' | 'claude' | 'kimi' | 'cursor';
 export declare function selectCli(): {
-    cli: 'orquesta' | 'claude' | 'kimi' | null;
+    cli: CliName | null;
     reason: string;
 };
 export declare function checkClaudeAuth(): {
@@ -237,7 +245,7 @@ export interface SessionInfo {
     subAgentName: string | null;
     workingDirectory: string;
     uptime: number;
-    cliType?: 'claude' | 'orquesta' | 'kimi';
+    cliType?: 'claude' | 'orquesta' | 'kimi' | 'cursor';
 }
 /**
  * List every active interactive session — the dashboard renders these so each
@@ -254,7 +262,7 @@ export declare function getSessionStatus(): {
     sessionId: string | null;
     workingDirectory: string | null;
     uptime: number | null;
-    cliType?: 'claude' | 'orquesta' | 'kimi';
+    cliType?: 'claude' | 'orquesta' | 'kimi' | 'cursor';
     sessions: SessionInfo[];
 };
 /**

package/dist/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAkItD,OAAO,EAAgG,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AA+O7I,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAOhF;AAGD,wBAAgB,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE/D;AAGD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,YAAY,CAAA;AAOlD,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAID,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAMtE;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAIlE;AA+DD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,WAAW,CAAC,EAAE,UAAU,EAAE,CAAA;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;CAClC;AAWD,MAAM,WAAW,UAAU;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAGD,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAgBtD;AAGD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAG5D;AAWD;uDACuD;AACvD,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAQ3G;AACD,wBAAgB,gBAAgB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAA;CAAE,CAEzG;AAGD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,GAAE,MAAM,EAAO,EAAE,IAAI,GAAE,WAAwB,GAAG,IAAI,CAUlH;AA4CD,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,QAAQ,GAAG,aAAa,GAAG,KAAK,CAGnE;AAED;6DAC6D;AAC7D,wBAAgB,yBAAyB,IAAI;IAAE,aAAa,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAC;IAAC,aAAa,EAAE,QAAQ,GAAG,aAAa,GAAG,KAAK,CAAA;CAAE,CAiB9N;AAoID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAA;AAInE,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI,CAGhE;AAKD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAKrD;AACD,wBAAgB,cAAc,IAAI,MAAM,CAA6B;AAMrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAKxD;AACD,wBAAgB,iBAAiB,IAAI,OAAO,CAAgC;AAY5E,wBAAgB,sBAAsB,IAAI,OAAO,CA0DhD;AAcD,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAmCnD;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAQ9C;AAOD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAkBjD;AAID,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAaD,wBAAgB,SAAS,IAAI;IAAE,GAAG,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAsC1F;AAGD,wBAAgB,eAAe,IAAI;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAkDvG;AAgBD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtG;AAED,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBxF;AA+lBD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAA2B;AA4I7E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa9D;AAMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBhE;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAw/BpE;AA0CD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAQtG;AAED,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAwC1C;AAED,wBAAgB,SAAS,IAAI,IAAI,CAOhC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAMD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,CAAA;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,eAAe,EAAE,UAAU,GAAG,WAAW,CAAA;IACzC,aAAa,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;CAC1B;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyLtE;AASD;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiBzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiB1D;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAenE;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAMD,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8GxF;AA6PD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAEtD;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAuCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,SAAK,GACT,gBAAgB,EAAE,CAuBpB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmajF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,OAAO,CA+CnH;AA2ED;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAgDrD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWpF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAMvE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAGlD;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAA;CACzC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,EAAE,CAe9C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;CAAE,CAe3M;AAsBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAoBzD"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../src/executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAkItD,OAAO,EAAgG,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAgP7I,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAOhF;AAGD,wBAAgB,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE/D;AAGD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,YAAY,CAAA;AAOlD,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAID,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAMtE;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAIlE;AA+DD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,WAAW,CAAC,EAAE,UAAU,EAAE,CAAA;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;CAClC;AAWD,MAAM,WAAW,UAAU;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAGD,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAgBtD;AAGD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAG5D;AAWD;uDACuD;AACvD,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAQ3G;AACD,wBAAgB,gBAAgB,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAA;CAAE,CAEzG;AAGD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,GAAE,MAAM,EAAO,EAAE,IAAI,GAAE,WAAwB,GAAG,IAAI,CAUlH;AA4CD,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,QAAQ,GAAG,aAAa,GAAG,KAAK,CAGnE;AAED;6DAC6D;AAC7D,wBAAgB,yBAAyB,IAAI;IAAE,aAAa,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAC;IAAC,aAAa,EAAE,QAAQ,GAAG,aAAa,GAAG,KAAK,CAAA;CAAE,CAiB9N;AAoID,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;AAI9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI,CAGhE;AAKD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAKrD;AACD,wBAAgB,cAAc,IAAI,MAAM,CAA6B;AAMrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAKxD;AACD,wBAAgB,iBAAiB,IAAI,OAAO,CAAgC;AAY5E,wBAAgB,sBAAsB,IAAI,OAAO,CA0DhD;AAcD,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAmCnD;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAQ9C;AAOD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAkBjD;AAID,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAWD,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAiBnD;AAKD,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAiBD,wBAAgB,eAAe,IAAI;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAgCvG;AAYD,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;AAgB/D,wBAAgB,SAAS,IAAI;IAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoCnE;AAGD,wBAAgB,eAAe,IAAI;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAkDvG;AAgBD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtG;AAED,wBAAsB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBxF;AAmnBD,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAA2B;AA4I7E;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa9D;AAMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBhE;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2hCpE;AA0CD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAQtG;AAED,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAwC1C;AAED,wBAAgB,SAAS,IAAI,IAAI,CAOhC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAMD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,cAAc,CAAA;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,eAAe,EAAE,UAAU,GAAG,WAAW,CAAA;IACzC,aAAa,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;CAC1B;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAyLtE;AASD;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiBzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiB1D;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAenE;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAMD,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8GxF;AA6PD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAEtD;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAuCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,SAAK,GACT,gBAAgB,EAAE,CAuBpB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAobjF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAQ,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,OAAO,CA+CnH;AA2ED;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAgDrD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWpF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAMvE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAGlD;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;CACpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,EAAE,CAe9C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;CAAE,CAetN;AAsBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAoBzD"}

package/dist/executor.js

@@ -122,6 +122,7 @@ import * as logger from './logger.js';
 // interactive-session spawn — node-pty can't launch the `.cmd` shim).
 const nodeRequire = createRequire(import.meta.url);
 import { isSandboxAvailable, buildBwrapArgs, shQuote, ensureStrictProjectDirs, encodeClaudeProjectDir } from './sandbox.js';
+import { isLoggedOutMessage } from './cli-auth-detect.js';
 import { parseCoordSpec, runCoordination } from './coordination.js';
 import { parseSudosudoInstallSpec, runSudosudoInstall } from './sudosudo.js';
 import { sendOutput, sendComplete, sendError, sendSupervisionRequest, sendExecutionResumed, updatePromptStatus, persistOutputLogs, clearOutputBuffer, sendRequirement, persistRequirement, sendQAInstructions, persistQAInstructions, sendPlanItemsGenerated, sendSessionOutput, sendSessionStarted, sendSessionEnded, sendSessionError, sendSessionLog, reportAgentError } from './supabase.js';
@@ -874,6 +875,101 @@ export function resolveKimiBinary() {
 export function isKimiCliAvailable() {
     return resolveKimiBinary() !== null;
 }
+// Resolve Cursor's headless CLI (`cursor-agent`). Its installer
+// (`curl https://cursor.com/install -fsS | bash`) drops the binary in
+// ~/.local/bin and only PRINTS a reminder to add that to PATH — so on a machine
+// where the user never edited their shell profile, a bare `cursor-agent` lookup
+// fails while the CLI is in fact installed. Same trap as kimi.
+// Order: CURSOR_AGENT_PATH → on PATH → ~/.local/bin/cursor-agent.
+// On Windows the PowerShell installer does put it on PATH, so the PATH probe is
+// the working path there.
+let cursorBinaryCache = null;
+export function resolveCursorBinary() {
+    const now = Date.now();
+    if (cursorBinaryCache && now - cursorBinaryCache.at < CLI_DETECTION_TTL_MS)
+        return cursorBinaryCache.path;
+    let resolved = null;
+    const envPath = process.env.CURSOR_AGENT_PATH;
+    if (envPath) {
+        try {
+            fs.accessSync(envPath, fs.constants.X_OK);
+            resolved = envPath;
+        }
+        catch { /* bad override */ }
+    }
+    if (!resolved) {
+        try {
+            execSync('cursor-agent --version', { stdio: 'pipe', timeout: 15000 });
+            resolved = 'cursor-agent';
+        }
+        catch { /* not on PATH */ }
+    }
+    if (!resolved) {
+        const candidate = path.join(os.homedir(), '.local', 'bin', 'cursor-agent');
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            resolved = candidate;
+        }
+        catch { /* not installed there */ }
+    }
+    cursorBinaryCache = { path: resolved, at: now };
+    return resolved;
+}
+// Cursor CLI (the `cursor-agent` binary). Authenticated separately with
+// `cursor-agent login` against the user's own Cursor subscription — Orquesta
+// never sees that credential.
+export function isCursorCliAvailable() {
+    return resolveCursorBinary() !== null;
+}
+// Is cursor-agent actually LOGGED IN, not just installed?
+//
+// Installed-but-logged-out is a real state and used to be invisible: the agent
+// reported `authenticated: available`, so the dashboard showed a green tick, the
+// user pinned Cursor, and every prompt failed at execution with cursor's own
+// auth error. `cursor-agent status` is the documented way to ask.
+//
+// Deliberately conservative: it reports NOT authenticated only when cursor says
+// so in words. Any other outcome (an older build with no `status` subcommand, a
+// timeout, an unparseable answer) reports authenticated with a null method —
+// crying wolf on a working machine is worse than the tick we had before, and
+// nothing about EXECUTION depends on this flag; selectCli() still keys purely on
+// the binary existing.
+let cursorAuthCache = null;
+export function checkCursorAuth() {
+    const now = Date.now();
+    if (cursorAuthCache && now - cursorAuthCache.at < CLI_DETECTION_TTL_MS)
+        return cursorAuthCache.result;
+    const cache = (result) => {
+        cursorAuthCache = { result, at: now };
+        return result;
+    };
+    const binary = resolveCursorBinary();
+    if (!binary)
+        return cache({ available: false, authenticated: false, method: null });
+    // An API key in the environment authenticates cursor-agent on its own, and is
+    // what CI machines use — no point spawning a process to confirm it.
+    if (process.env.CURSOR_API_KEY)
+        return cache({ available: true, authenticated: true, method: 'api_key' });
+    try {
+        const out = execSync(`"${binary}" status`, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 15000,
+            encoding: 'utf-8',
+        });
+        if (isLoggedOutMessage(out))
+            return cache({ available: true, authenticated: false, method: null });
+        return cache({ available: true, authenticated: true, method: 'subscription' });
+    }
+    catch (error) {
+        // Non-zero exit covers both "logged out" and "this build has no `status`",
+        // so the OUTPUT decides, not the exit code.
+        const err = error;
+        const combined = `${err.stdout ?? ''}${err.stderr ?? ''}`;
+        if (isLoggedOutMessage(combined))
+            return cache({ available: true, authenticated: false, method: null });
+        return cache({ available: true, authenticated: true, method: null });
+    }
+}
 // Dedupe the fallback warning: selectCli() runs on every heartbeat (the agent
 // reports activeCli), so logging unconditionally spammed thousands of identical
 // WARN lines. Only log when the message actually changes.
@@ -884,53 +980,48 @@ function warnCliOnce(msg) {
     lastCliWarn = msg;
     logger.warn(msg);
 }
+// Preference order when nothing is pinned, and the order a fallback walks when
+// the pinned CLI turns out not to be installed. Table-driven rather than a nest
+// of pairwise ifs: every CLI added here otherwise costs another N branches, and
+// the pair that got missed is exactly how a preference silently no-ops.
+const CLI_AUTO_ORDER = ['orquesta', 'claude', 'kimi', 'cursor'];
+const CLI_AUTO_REASON = {
+    orquesta: 'Auto: orquesta available (local LLM)',
+    claude: 'Auto: claude available (Anthropic API)',
+    kimi: 'Auto: kimi available',
+    cursor: 'Auto: cursor-agent available',
+};
 // Select which CLI to use based on availability and preference
 export function selectCli() {
-    const hasOrquesta = isOrquestaCliAvailable();
-    const hasClaude = isClaudeCliAvailable();
-    const hasKimi = isKimiCliAvailable();
-    // If none available, return null
-    if (!hasOrquesta && !hasClaude && !hasKimi) {
-        return { cli: null, reason: 'No CLI found (orquesta, claude, kimi)' };
+    const available = {
+        orquesta: isOrquestaCliAvailable(),
+        claude: isClaudeCliAvailable(),
+        kimi: isKimiCliAvailable(),
+        cursor: isCursorCliAvailable(),
+    };
+    if (!CLI_AUTO_ORDER.some(cli => available[cli])) {
+        return { cli: null, reason: `No CLI found (${CLI_AUTO_ORDER.join(', ')})` };
     }
+    const preferred = globalCliPreference;
     // Explicit preference, available → use it.
-    if (globalCliPreference === 'orquesta' && hasOrquesta)
-        return { cli: 'orquesta', reason: 'User preference: orquesta' };
-    if (globalCliPreference === 'claude' && hasClaude)
-        return { cli: 'claude', reason: 'User preference: claude' };
-    if (globalCliPreference === 'kimi' && hasKimi)
-        return { cli: 'kimi', reason: 'User preference: kimi' };
-    // Explicit preference, NOT available → warn once + fall back (orquesta → claude → kimi).
-    if (globalCliPreference === 'kimi' && !hasKimi) {
-        warnCliOnce('Kimi CLI preferred but not available, falling back');
-        if (hasOrquesta)
-            return { cli: 'orquesta', reason: 'Fallback: kimi not available' };
-        if (hasClaude)
-            return { cli: 'claude', reason: 'Fallback: kimi not available' };
-    }
-    if (globalCliPreference === 'orquesta' && !hasOrquesta) {
-        warnCliOnce('Orquesta CLI preferred but not available, falling back');
-        if (hasClaude)
-            return { cli: 'claude', reason: 'Fallback: orquesta not available' };
-        if (hasKimi)
-            return { cli: 'kimi', reason: 'Fallback: orquesta not available' };
-    }
-    if (globalCliPreference === 'claude' && !hasClaude) {
-        warnCliOnce('Claude CLI preferred but not available, falling back');
-        if (hasOrquesta)
-            return { cli: 'orquesta', reason: 'Fallback: claude not available' };
-        if (hasKimi)
-            return { cli: 'kimi', reason: 'Fallback: claude not available' };
-    }
-    // Auto mode: prefer orquesta → claude → kimi.
-    if (hasOrquesta) {
+    if (preferred !== 'auto' && available[preferred]) {
+        lastCliWarn = null;
+        return { cli: preferred, reason: `User preference: ${preferred}` };
+    }
+    // Explicit preference, NOT available → warn once, then fall through to the
+    // auto order skipping the one that isn't there.
+    if (preferred !== 'auto') {
+        warnCliOnce(`${preferred} CLI preferred but not available, falling back`);
+        const fallback = CLI_AUTO_ORDER.find(cli => cli !== preferred && available[cli]);
+        if (fallback)
+            return { cli: fallback, reason: `Fallback: ${preferred} not available` };
+        return { cli: null, reason: 'No CLI found' };
+    }
+    const auto = CLI_AUTO_ORDER.find(cli => available[cli]);
+    if (auto) {
         lastCliWarn = null;
-        return { cli: 'orquesta', reason: 'Auto: orquesta available (local LLM)' };
+        return { cli: auto, reason: CLI_AUTO_REASON[auto] };
     }
-    if (hasClaude)
-        return { cli: 'claude', reason: 'Auto: claude available (Anthropic API)' };
-    if (hasKimi)
-        return { cli: 'kimi', reason: 'Auto: kimi available' };
     return { cli: null, reason: 'No CLI found' };
 }
 // Check if Claude CLI is authenticated
@@ -1507,6 +1598,20 @@ function detectQAInstructions(text, commandId) {
     const buf = (qaBufferMap.get(commandId) || '') + text;
     qaBufferMap.set(commandId, buf.length > 20000 ? buf.slice(-15000) : buf);
     const currentBuf = qaBufferMap.get(commandId);
+    /*
+     * Last-resort unescape for a block that reached us still JSON-encoded (a CLI
+     * whose output format we do not parse, or a tool that echoes a JSON payload).
+     * Only when the whole capture is a single line carrying literal \n escapes —
+     * a genuine multi-line QA block is left exactly as written, so a step that
+     * legitimately mentions \n in a regex or a code span is not rewritten.
+     */
+    const unescapeIfEncoded = (value) => !value.includes('\n') && /\\n/.test(value)
+        ? value
+            .replace(/\\r\\n|\\n/g, '\n')
+            .replace(/\\t/g, '\t')
+            .replace(/\\"/g, '"')
+            .replace(/\\\\/g, '\\')
+        : value;
     // Look for QA Instructions header (## or ###)
     const qaMatch = currentBuf.match(/##\s*QA\s+Instructions\s*([\s\S]*?)(?=\n##[^#]|$)/i);
     if (!qaMatch || qaDetectedMap.get(commandId))
@@ -1515,7 +1620,7 @@ function detectQAInstructions(text, commandId) {
     // to end-of-buffer and swallows whatever the CLI prints next (observed: the
     // whole appended system prompt — Orquesta Capabilities, browser tools —
     // persisted as "QA instructions" in the DB). Real QA blocks are short.
-    const qaContent = qaMatch[1].length > 4000 ? qaMatch[1].slice(0, 4000) : qaMatch[1];
+    const qaContent = unescapeIfEncoded(qaMatch[1].length > 4000 ? qaMatch[1].slice(0, 4000) : qaMatch[1]);
     // Ignore the TEMPLATE echo: if the CLI echoes the QA-instructions prompt
     // template itself ("[Brief description of the feature/change]" etc.), the
     // placeholders are still in brackets — that's not a real QA report.
@@ -1525,7 +1630,11 @@ function detectQAInstructions(text, commandId) {
     // Matches: **Feature**: or **Feature:** or ### Feature or **Summary**: etc
     // Note: Claude sometimes puts colon inside bold (**Feature:**) or outside (**Feature**:)
     const featureMatch = qaContent.match(/(?:\*\*(?:Feature|Description|Summary)(?::\*\*|\*\*:)|###?\s*(?:Feature|Description|Summary):?\s*\n?)\s*(.+?)(?:\n|$)/i);
-    const feature = featureMatch ? featureMatch[1].trim() : 'Feature verification';
+    // Clamp it: the feature is a card heading in the dashboard, so whatever the
+    // regex captures has to stay heading-sized even if the output was shaped in
+    // some way these patterns did not anticipate. QA-70.
+    const rawFeature = featureMatch ? featureMatch[1].trim() : 'Feature verification';
+    const feature = rawFeature.length > 160 ? rawFeature.slice(0, 157).trimEnd() + '…' : rawFeature;
     // Extract steps to test (accept multiple formats)
     // Matches: "**Steps to Test**:", "**Steps to verify:**", "### Test Steps", "### Steps", etc
     const stepsMatch = qaContent.match(/(?:\*\*(?:Steps\s+to\s+(?:Test|[Vv]erify)|Verification\s+Steps|Testing\s+Steps|Test\s+Steps|Steps)(?::\*\*|\*\*:)|###?\s*(?:Steps\s+to\s+(?:Test|[Vv]erify)|Verification\s+Steps|Testing\s+Steps|Test\s+Steps|Steps):?\s*\n?)\s*([\s\S]*?)(?=\*\*Expected|###?\s*Expected|###?\s*Rollback|\*\*Test\s+URL|\*\*Production\s+URL|$)/i);
@@ -1989,9 +2098,11 @@ ${userRequestBody}`;
         // (cliCommand stays the TYPE for flag decisions.)
         const cliBinary = cliCommand === 'kimi'
             ? (resolveKimiBinary() || 'kimi')
-            : cliCommand === 'claude'
-                ? (resolveClaudeBinary() || 'claude')
-                : (cliCommand || 'claude');
+            : cliCommand === 'cursor'
+                ? (resolveCursorBinary() || 'cursor-agent')
+                : cliCommand === 'claude'
+                    ? (resolveClaudeBinary() || 'claude')
+                    : (cliCommand || 'claude');
         const cwd = workingDirectory || process.cwd();
         // Which branch this prompt runs on — captured up front so it's persisted even
         // if the run fails, and broadcast live below once sendSpecialEvent exists.
@@ -2010,7 +2121,9 @@ ${userRequestBody}`;
         // can never regress to a worse state than before.
         let promptContent = fullContent;
         let sysPromptFilePath = null;
-        if (cliCommand !== 'kimi') {
+        // kimi and cursor-agent have no --append-system-prompt-file, so their static
+        // context stays inline in the prompt.
+        if (cliCommand !== 'kimi' && cliCommand !== 'cursor') {
             try {
                 const promptDir = process.platform === 'win32'
                     ? os.tmpdir()
@@ -2037,15 +2150,28 @@ ${userRequestBody}`;
         // Orquesta CLI doesn't need special format flags - it outputs directly
         const baseFlags = cliCommand === 'orquesta'
             ? '--verbose' // Orquesta: simple verbose output
-            : cliCommand === 'kimi'
-                ? '--output-format text' // Kimi: plain text. NOTE: -p (one-shot) CANNOT be
-                // combined with -y ("Cannot combine --prompt with
-                // --yolo"), so dispatched kimi prompts respond as
-                // chat (no autonomous tool use). Interactive kimi
-                // sessions DO get -y (see ptyArgs below).
-                : '--verbose --output-format stream-json'; // Claude: stream-json format
-        // Kimi has no --dangerously-skip-permissions, and -p forbids -y.
-        const permFlags = cliCommand === 'kimi' ? '' : (mode === 'auto' ? '--dangerously-skip-permissions' : '');
+            : cliCommand === 'cursor'
+                ? '--output-format text' // Cursor: plain text. Its stream-json events are a
+                // different shape from Claude's, and parseStreamJson
+                // below only understands Claude's and orquesta-cli's,
+                // so asking for it would give us an unparseable
+                // stream instead of an answer.
+                : cliCommand === 'kimi'
+                    ? '--output-format text' // Kimi: plain text. NOTE: -p (one-shot) CANNOT be
+                    // combined with -y ("Cannot combine --prompt with
+                    // --yolo"), so dispatched kimi prompts respond as
+                    // chat (no autonomous tool use). Interactive kimi
+                    // sessions DO get -y (see ptyArgs below).
+                    : '--verbose --output-format stream-json'; // Claude: stream-json format
+        // Kimi has no --dangerously-skip-permissions, and -p forbids -y. Cursor spells
+        // the same thing --force (alias --yolo).
+        const permFlags = cliCommand === 'kimi'
+            ? ''
+            : mode !== 'auto'
+                ? ''
+                : cliCommand === 'cursor'
+                    ? '--force'
+                    : '--dangerously-skip-permissions';
         // Per-project endpoint override (orquesta CLI only). Single-quoted for the
         // shell-wrapped (Linux) path; pushed as a separate arg on Win/macOS below.
         const useEndpoint = cliCommand === 'orquesta' && !!globalCliEndpoint;
@@ -2534,8 +2660,17 @@ ${userRequestBody}`;
                         logger.warn(`Failed to persist requirement: ${err}`);
                     });
                 }
-                // Detect QA instructions
-                const qaInstructions = detectQAInstructions(text, commandId);
+                // Detect QA instructions.
+                //
+                // On the PARSED output, not the raw chunk. With --output-format
+                // stream-json every assistant message arrives as one JSON line, so the
+                // newlines inside it are the two characters \n and the markdown
+                // structure the patterns below look for does not exist yet: the
+                // "**Feature**:" capture, terminated by a newline, ran to the end of the
+                // line and stored the entire escaped message as the feature name — the
+                // wall of text QA saw in the panel. `parsed` is the same text the user
+                // reads in the output pane, with real line breaks. QA-70.
+                const qaInstructions = detectQAInstructions(outputToSend, commandId);
                 if (qaInstructions) {
                     logger.success(`QA Instructions detected: ${qaInstructions.feature}`);
                     // Send via realtime channel
@@ -2682,10 +2817,20 @@ ${userRequestBody}`;
                 // Record WHICH CLI + model executed it (timeline/history). Model is
                 // best-effort — the CLI/proxy pick the true upstream model internally
                 // (batuta-auto fans out per prompt), so we report the CLI's MODEL CONFIG:
-                const cliTypeForDb = cliCommand === 'orquesta' ? 'orquesta-cli' : cliCommand === 'kimi' ? 'kimi-cli' : 'claude-cli';
+                const cliTypeForDb = cliCommand === 'orquesta'
+                    ? 'orquesta-cli'
+                    : cliCommand === 'kimi'
+                        ? 'kimi-cli'
+                        : cliCommand === 'cursor'
+                            ? 'cursor-cli'
+                            : 'claude-cli';
                 let modelForDb;
                 if (cliCommand === 'kimi')
                     modelForDb = 'kimi-for-coding';
+                // cursor-agent picks the model from the user's own Cursor settings and does
+                // not report it in text mode, so leave it unset rather than guess.
+                else if (cliCommand === 'cursor')
+                    modelForDb = undefined;
                 else if (cliCommand === 'orquesta')
                     modelForDb = (globalCliEndpoint === 'batuta' || !globalCliEndpoint) ? 'batuta-auto' : globalCliEndpoint;
                 else if (cliCommand === 'claude')
@@ -3544,20 +3689,30 @@ export async function startSession(options) {
     // inside bwrap (/ is ro-bound). cliCommand stays the TYPE.
     const cliBinary = cliCommand === 'kimi'
         ? (resolveKimiBinary() || 'kimi')
-        : cliCommand === 'claude'
-            ? (resolveClaudeBinary() || 'claude')
-            : cliCommand;
-    logger.info(`Interactive session CLI: ${cliCommand}${cliCommand === 'kimi' ? ` (${cliBinary})` : ''}`);
+        : cliCommand === 'cursor'
+            ? (resolveCursorBinary() || 'cursor-agent')
+            : cliCommand === 'claude'
+                ? (resolveClaudeBinary() || 'claude')
+                : cliCommand;
+    const resolvedByPath = cliCommand === 'kimi' || cliCommand === 'cursor';
+    logger.info(`Interactive session CLI: ${cliCommand}${resolvedByPath ? ` (${cliBinary})` : ''}`);
     // Best-effort model + cli label reported in session:started so the dashboard
     // can tag the interactive prompt (same mapping dispatched prompts use on
     // completion). claude's exact model isn't knowable from a raw PTY, so it falls
     // back to ANTHROPIC_MODEL when set, else undefined.
     const sessionModel = cliCommand === 'kimi'
         ? 'kimi-for-coding'
-        : cliCommand === 'orquesta'
-            ? ((globalCliEndpoint === 'batuta' || !globalCliEndpoint) ? 'batuta-auto' : globalCliEndpoint)
-            : (process.env.ANTHROPIC_MODEL || undefined);
-    const sessionCliType = cliCommand === 'orquesta' ? 'orquesta' : cliCommand === 'kimi' ? 'kimi' : 'claude';
+        : cliCommand === 'cursor'
+            // cursor-agent uses whatever model the user selected in their own Cursor
+            // account; it isn't knowable from the PTY, so report nothing rather than lie.
+            ? undefined
+            : cliCommand === 'orquesta'
+                ? ((globalCliEndpoint === 'batuta' || !globalCliEndpoint) ? 'batuta-auto' : globalCliEndpoint)
+                : (process.env.ANTHROPIC_MODEL || undefined);
+    const sessionCliType = cliCommand === 'orquesta' ? 'orquesta'
+        : cliCommand === 'kimi' ? 'kimi'
+            : cliCommand === 'cursor' ? 'cursor'
+                : 'claude';
     // Filter undefined env values — node-pty requires Record<string, string>.
     // In strict sandbox mode, sandboxEnv() first reduces to the allowlist so the
     // interactive CLI can't read unrelated host secrets from its own env.
@@ -3637,7 +3792,7 @@ export async function startSession(options) {
     // `ps aux`. Default-off because a file unreadable inside bwrap would silently
     // strip the system prompt (degraded session, not a crash) — flip the default
     // only after E2E confirms the sandbox reads it. Rollback = unset the var.
-    const wantSysPromptFile = cliCommand !== 'kimi' && ((process.platform === 'win32' && cliCommand === 'orquesta') ||
+    const wantSysPromptFile = cliCommand !== 'kimi' && cliCommand !== 'cursor' && ((process.platform === 'win32' && cliCommand === 'orquesta') ||
         /^(1|true|yes|on)$/i.test(process.env.ORQUESTA_SYSPROMPT_FILE || ''));
     if (wantSysPromptFile) {
         try {
@@ -3656,7 +3811,13 @@ export async function startSession(options) {
         }
     }
     let ptyArgs;
-    if (cliCommand === 'kimi') {
+    if (cliCommand === 'cursor') {
+        // cursor-agent has no --append-system-prompt; it reads AGENTS.md / CLAUDE.md
+        // from the working dir (which the agent already syncs), so the capabilities
+        // block isn't injected. `--force` is its --dangerously-skip-permissions.
+        ptyArgs = ['--force'];
+    }
+    else if (cliCommand === 'kimi') {
         // Kimi has neither --dangerously-skip-permissions nor --append-system-prompt.
         // `-y` auto-approves the interactive session; it reads project conventions from
         // CLAUDE.md / AGENTS.md in the working dir (which the agent already syncs), so
@@ -3674,10 +3835,11 @@ export async function startSession(options) {
     // resume flag, so the option is silently ignored there. Prepended so it's an
     // unambiguous standalone flag, separate from --append-system-prompt's value.
     if ((resume || resumeSessionId) && cliCommand !== 'kimi') {
+        // cursor-agent spells these the same way claude does (--continue / --resume <id>).
         // claude can target a SPECIFIC past conversation by id (--resume <id>);
         // orquesta-cli only reattaches the latest (--continue). So when a specific
         // id is requested and we're on claude, use --resume; otherwise --continue.
-        if (resumeSessionId && cliCommand === 'claude') {
+        if (resumeSessionId && (cliCommand === 'claude' || cliCommand === 'cursor')) {
             ptyArgs.unshift('--resume', resumeSessionId);
             logger.info(`[Session] Resuming conversation ${resumeSessionId} (--resume) for ${cliCommand}`);
         }