pi-cursor-sdk 0.1.20 → 0.1.22

package/scripts/tmux-live-smoke.sh

@@ -2,21 +2,32 @@
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=scripts/lib/cursor-smoke-shell.sh
+. "$ROOT/scripts/lib/cursor-smoke-shell.sh"
+
 SMOKE_DIR="${SMOKE_DIR:-/tmp/pi-cursor-sdk-live-smoke-$(date +%Y%m%dT%H%M%S)}"
 SHELL_BIN="${SHELL:-/bin/bash}"
 
-PI_BASE=(
-	pi -e "$ROOT"
-	--cursor-no-fast
-	--model cursor/composer-2.5
-)
+PI_BIN=""
+NODE_BIN=""
+NPM_BIN=""
+RG_BIN=""
+TMUX_BIN=""
+ENV_BIN=""
+SEALED_PATH=""
+PI_BASE=()
+DEBUG_ENV_UNSETS=()
+BASE_ENV=()
+NONE_ENV=()
+DEFAULT_ENV=()
 
 TMUX_SESSIONS=()
 
 cleanup() {
 	local session
+	[[ -n "${TMUX_BIN:-}" ]] || return 0
 	for session in "${TMUX_SESSIONS[@]:-}"; do
-		tmux kill-session -t "$session" 2>/dev/null || true
+		"$TMUX_BIN" kill-session -t "$session" 2>/dev/null || true
 	done
 }
 trap cleanup EXIT
@@ -31,11 +42,13 @@ Usage:
 
 Environment:
   SMOKE_DIR                     Artifact directory. Defaults to /tmp/pi-cursor-sdk-live-smoke-<timestamp>.
-  CURSOR_API_KEY                Required for live Cursor runs.
+  CURSOR_API_KEY                Optional fallback auth. Stored pi auth in ~/.pi/agent/auth.json is also supported.
 
 Prerequisites:
-  pi, node, rg, tmux on PATH
+  pi, node, npm, rg, tmux on PATH
+  Resolved pi/node/npm/rg/tmux paths from the parent shell are reused in tmux-launched checks; pi shims run with the resolved node directory first on PATH.
   timeout or gtimeout optional; bash process-group kill fallback is used when absent
+  Child pi runs clear Cursor SDK event-debug env; isolated cases force PI_CURSOR_SETTING_SOURCES=none and default-settings unsets it.
 
 Coverage:
   - prereq model listing
@@ -48,10 +61,15 @@ Coverage:
   - JSONL assistant usage validation
 
 Not covered here:
-  bridge MCP, standalone native replay, abort/cancel, packaging, full checklist sections 4-9
+  - canonical rendered-PNG visual smoke; collect separately with docs/cursor-native-tool-visual-audit.md
+  - bridge MCP
+  - standalone native replay
+  - abort/cancel cleanup
+  - packaging and isolated smoke
 
 Options:
   -h, --help                    Show this help.
+  --self-test                   Run sealed PATH/env probes without live Cursor auth.
 
 Exit codes:
   0  all partial checks passed
@@ -59,61 +77,16 @@ Exit codes:
 EOF
 }
 
-log() {
-	printf '[smoke] %s\n' "$*"
-}
-
-fail() {
-	printf '[smoke] FAIL: %s\n' "$*" >&2
-	exit 1
-}
+log() { smoke_log "$@"; }
+fail() { smoke_fail "$@"; }
+run_with_timeout() { smoke_run_with_timeout "$@"; }
 
-require_cmd() {
-	command -v "$1" >/dev/null 2>&1 || fail "missing required command: $1"
-}
-
-run_with_timeout() {
-	local timeout_secs="$1"
-	shift
-	if command -v timeout >/dev/null 2>&1; then
-		timeout "$timeout_secs" "$@"
-		return $?
-	fi
-	if command -v gtimeout >/dev/null 2>&1; then
-		gtimeout "$timeout_secs" "$@"
-		return $?
-	fi
-
-	local restore_monitor=0
-	case $- in
-		*m*) ;;
-		*)
-			restore_monitor=1
-			set -m
-			;;
-	esac
-
-	"$@" &
-	local pid=$!
-	(
-		sleep "$timeout_secs"
-		kill -TERM "-$pid" 2>/dev/null || kill -TERM "$pid" 2>/dev/null || true
-		sleep 2
-		kill -KILL "-$pid" 2>/dev/null || kill -KILL "$pid" 2>/dev/null || true
-	) &
-	local watcher=$!
-	local code=0
-	if wait "$pid"; then
-		code=0
-	else
-		code=$?
-	fi
-	kill "$watcher" 2>/dev/null || true
-	wait "$watcher" 2>/dev/null || true
-	if (( restore_monitor )); then
-		set +m
-	fi
-	return "$code"
+build_smoke_env_arrays() {
+	smoke_build_cursor_sdk_event_debug_unsets
+	DEBUG_ENV_UNSETS=( "${SMOKE_CURSOR_SDK_EVENT_DEBUG_ENV_UNSETS[@]}" )
+	BASE_ENV=( "$ENV_BIN" "${DEBUG_ENV_UNSETS[@]}" "PATH=$SEALED_PATH" )
+	NONE_ENV=( "$ENV_BIN" "${DEBUG_ENV_UNSETS[@]}" "PATH=$SEALED_PATH" PI_CURSOR_SETTING_SOURCES=none )
+	DEFAULT_ENV=( "$ENV_BIN" "${DEBUG_ENV_UNSETS[@]}" -u PI_CURSOR_SETTING_SOURCES "PATH=$SEALED_PATH" )
 }
 
 tail_file() {
@@ -131,7 +104,7 @@ assert_file_contains() {
 	local file="$2"
 	local pattern="$3"
 	local label="$4"
-	if ! rg -q "$pattern" "$file"; then
+	if ! "$RG_BIN" -q "$pattern" "$file"; then
 		printf '[smoke] %s missing %s in %s\n' "$name" "$label" "$file" >&2
 		printf '[smoke] %s transcript tail:\n' "$name" >&2
 		tail_file "$file" 120 >&2
@@ -153,7 +126,7 @@ run_direct_attempt() {
 	shift 4
 	rm -f "$stdout" "$stderr"
 
-	if run_with_timeout "$timeout_secs" "$@" >"$stdout" 2>"$stderr"; then
+	if run_with_timeout "$timeout_secs" "$@" </dev/null >"$stdout" 2>"$stderr"; then
 		return 0
 	fi
 	return $?
@@ -193,7 +166,7 @@ run_direct() {
 	else
 		code=$?
 	fi
-	if [[ "$code" == "0" ]] && rg -q "$expected_pattern" "$stdout"; then
+	if [[ "$code" == "0" ]] && "$RG_BIN" -q "$expected_pattern" "$stdout"; then
 		log "$name PASS"
 		return 0
 	fi
@@ -213,7 +186,7 @@ run_direct() {
 			log "$name retrying once after empty output with exit $code"
 			if run_direct_attempt "$name" "$timeout_secs" "$stdout" "$stderr" "$@"; then
 				local retry_code=0
-				if rg -q "$expected_pattern" "$stdout"; then
+				if "$RG_BIN" -q "$expected_pattern" "$stdout"; then
 					log "$name PASS after retry (first exit $code; first stderr: $first_stderr)"
 					return 0
 				fi
@@ -259,21 +232,22 @@ run_tui_math_footer_poll() {
 	command="$(quote_command "$@")"
 	rm -f "$capture"
 
-	printf -v script 'cd %q || exit 97
+	printf -v script 'export PATH=%q
+cd %q || exit 97
 exec %s
-' "$ROOT" "$command"
-	tmux new-session -d -s "$session" -x 120 -y 40 -- "$SHELL_BIN" -lc "$script"
+' "$SEALED_PATH" "$ROOT" "$command"
+	"$TMUX_BIN" new-session -d -s "$session" -x 120 -y 40 -- "$SHELL_BIN" -lc "$script"
 	TMUX_SESSIONS+=("$session")
 
 	local elapsed=0
 	local missing=""
 	while true; do
-		tmux capture-pane -pt "$session" >"$capture" 2>/dev/null || true
+		"$TMUX_BIN" capture-pane -pt "$session" >"$capture" 2>/dev/null || true
 		missing=""
-		rg -q "SUM=42" "$capture" || missing="${missing} SUM=42"
-		rg -q "\\(cursor\\) composer-2\\.5" "$capture" || missing="${missing} footer (cursor) composer-2.5"
+		"$RG_BIN" -q "SUM=42" "$capture" || missing="${missing} SUM=42"
+		"$RG_BIN" -q "\\(cursor\\) composer-2\\.5" "$capture" || missing="${missing} footer (cursor) composer-2.5"
 		if [[ -z "$missing" ]]; then
-			tmux kill-session -t "$session" 2>/dev/null || true
+			"$TMUX_BIN" kill-session -t "$session" 2>/dev/null || true
 			log "$name PASS"
 			return 0
 		fi
@@ -281,7 +255,7 @@ exec %s
 		sleep 2
 		elapsed=$((elapsed + 2))
 		if (( elapsed >= timeout_secs )); then
-			tmux kill-session -t "$session" 2>/dev/null || true
+			"$TMUX_BIN" kill-session -t "$session" 2>/dev/null || true
 			printf '[smoke] %s timed out after %ss; missing:%s\n' "$name" "$timeout_secs" "$missing" >&2
 			printf '[smoke] %s capture tail:\n' "$name" >&2
 			tail_file "$capture" 120 >&2
@@ -304,12 +278,13 @@ run_tmux() {
 	command="$(quote_command "$@")"
 	rm -f "$marker" "$stdout" "$stderr"
 
-	printf -v script 'cd %q || exit 97
+	printf -v script 'export PATH=%q
+cd %q || exit 97
 %s> %q 2> %q
 code=$?
 printf '\''%%s\n'\'' "$code" > %q
-' "$ROOT" "$command" "$stdout" "$stderr" "$marker"
-	tmux new-session -d -s "$session" -- "$SHELL_BIN" -lc "$script"
+' "$SEALED_PATH" "$ROOT" "$command" "$stdout" "$stderr" "$marker"
+	"$TMUX_BIN" new-session -d -s "$session" -- "$SHELL_BIN" -lc "$script"
 	TMUX_SESSIONS+=("$session")
 
 	local elapsed=0
@@ -317,15 +292,15 @@ printf '\''%%s\n'\'' "$code" > %q
 		sleep 2
 		elapsed=$((elapsed + 2))
 		if (( elapsed >= timeout_secs )); then
-			tmux capture-pane -pt "$session" >"$SMOKE_DIR/${name}.capture.txt" || true
-			tmux kill-session -t "$session" 2>/dev/null || true
+			"$TMUX_BIN" capture-pane -pt "$session" >"$SMOKE_DIR/${name}.capture.txt" || true
+			"$TMUX_BIN" kill-session -t "$session" 2>/dev/null || true
 			fail "$name timed out after ${timeout_secs}s (see ${name}.capture.txt)"
 		fi
 	done
 
 	local code
 	code="$(cat "$marker")"
-	tmux kill-session -t "$session" 2>/dev/null || true
+	"$TMUX_BIN" kill-session -t "$session" 2>/dev/null || true
 	if [[ "$code" != "0" ]]; then
 		if [[ "$dump_stderr_on_fail" == "1" ]]; then
 			cat "$stderr" >&2 || true
@@ -337,30 +312,109 @@ printf '\''%%s\n'\'' "$code" > %q
 
 model_listed() {
 	local file="$1"
-	rg -q "composer-2\\.5" "$file"
+	"$RG_BIN" -q "composer-2\\.5" "$file"
+}
+
+run_self_test() {
+	local temp_dir bin_dir fake_pi fake_node fake_node_marker env_capture hostile_path captured_path node_dir name
+	temp_dir="$(mktemp -d /tmp/pi-cursor-sdk-live-smoke-self-test.XXXXXX)"
+	trap 'rm -rf "$temp_dir"' RETURN
+	bin_dir="$temp_dir/bin"
+	mkdir -p "$bin_dir"
+	fake_pi="$bin_dir/pi"
+	fake_node="$bin_dir/node"
+	fake_node_marker="$temp_dir/fake-node-used"
+	env_capture="$temp_dir/fake-pi.env"
+	cat >"$fake_pi" <<EOF_SELFTEST_PI
+#!/usr/bin/env node
+const { writeFileSync } = require("node:fs");
+writeFileSync("$env_capture", Object.entries(process.env).map(([key, value]) => key + "=" + (value ?? "")).join("\\n") + "\\n", "utf8");
+EOF_SELFTEST_PI
+	cat >"$fake_node" <<EOF_SELFTEST_NODE
+#!/usr/bin/env bash
+echo fake-node-used > "$fake_node_marker"
+exit 99
+EOF_SELFTEST_NODE
+	chmod +x "$fake_pi" "$fake_node"
+
+	ENV_BIN="$(smoke_resolve_cmd env)"
+	NODE_BIN="$(smoke_resolve_cmd node)"
+	smoke_load_cursor_sdk_event_debug_env_names "$NODE_BIN" "$ROOT/shared/cursor-sdk-event-debug-env.mjs"
+	hostile_path="$bin_dir:$PATH"
+	[[ "$(smoke_build_sealed_node_path "$NODE_BIN" "")" != *: ]] || fail "self-test failed: empty inherited PATH left a trailing PATH separator"
+	SEALED_PATH="$(smoke_build_sealed_node_path "$NODE_BIN" "$hostile_path")"
+	build_smoke_env_arrays
+	node_dir="$(dirname "$NODE_BIN")"
+
+	PI_CURSOR_SETTING_SOURCES=all \
+	PI_CURSOR_SDK_EVENT_DEBUG=1 \
+	PI_CURSOR_SDK_EVENT_DEBUG_DIR="$temp_dir/debug-dir" \
+	PI_CURSOR_SDK_EVENT_DEBUG_RUN_DIR="$temp_dir/debug-run-dir" \
+	PI_CURSOR_SDK_EVENT_DEBUG_SESSION_DIR="$temp_dir/debug-session-dir" \
+	PI_CURSOR_SDK_EVENT_DEBUG_STDERR=1 \
+		"${NONE_ENV[@]}" "$fake_pi" --version
+	[[ ! -e "$fake_node_marker" ]] || fail "self-test failed: sealed PATH still used hostile fake node"
+	captured_path="$(awk -F= '$1 == "PATH" { print substr($0, 6); exit }' "$env_capture")"
+	[[ "${captured_path%%:*}" == "$node_dir" ]] || fail "self-test failed: PATH did not start with resolved node dir"
+	grep -qx 'PI_CURSOR_SETTING_SOURCES=none' "$env_capture" || fail "self-test failed: isolated env did not force PI_CURSOR_SETTING_SOURCES=none"
+	for name in "${SMOKE_CURSOR_SDK_EVENT_DEBUG_ENV_NAMES[@]}"; do
+		if grep -q "^${name}=" "$env_capture"; then
+			fail "self-test failed: $name was not cleared"
+		fi
+	done
+
+	PI_CURSOR_SETTING_SOURCES=all "${DEFAULT_ENV[@]}" "$fake_pi" --version
+	if grep -q '^PI_CURSOR_SETTING_SOURCES=' "$env_capture"; then
+		fail "self-test failed: default-settings env did not unset PI_CURSOR_SETTING_SOURCES"
+	fi
+	printf '[smoke] self-test PASS\n'
 }
 
 if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
 	print_help
 	exit 0
 fi
+if [[ "${1:-}" == "--self-test" ]]; then
+	run_self_test
+	exit 0
+fi
 
-require_cmd pi
-require_cmd node
-require_cmd rg
-require_cmd tmux
+PI_BIN="$(smoke_resolve_cmd pi)"
+NODE_BIN="$(smoke_resolve_cmd node)"
+NPM_BIN="$(smoke_resolve_cmd npm)"
+RG_BIN="$(smoke_resolve_cmd rg)"
+TMUX_BIN="$(smoke_resolve_cmd tmux)"
+ENV_BIN="$(smoke_resolve_cmd env)"
+smoke_load_cursor_sdk_event_debug_env_names "$NODE_BIN" "$ROOT/shared/cursor-sdk-event-debug-env.mjs"
+SEALED_PATH="$(smoke_build_sealed_node_path "$NODE_BIN" "$PATH")"
+build_smoke_env_arrays
+if [[ "$SHELL_BIN" != /* ]]; then
+	SHELL_BIN="$(smoke_resolve_cmd "$SHELL_BIN")"
+fi
+PI_BASE=(
+	"$PI_BIN" -e "$ROOT"
+	--cursor-no-fast
+	--model cursor/composer-2.5
+)
 
 if [[ -z "${CURSOR_API_KEY:-}" ]]; then
-	fail "CURSOR_API_KEY is required"
+	log "CURSOR_API_KEY is unset; relying on stored pi auth or other supported Cursor auth"
 fi
 
 mkdir -p "$SMOKE_DIR"
 printf '%s\n' "$SMOKE_DIR" >"$SMOKE_DIR/smoke-dir.txt"
 
 log "SMOKE_DIR=$SMOKE_DIR"
+log "pi=$PI_BIN"
+log "node=$NODE_BIN"
+log "npm=$NPM_BIN"
+log "tmux=$TMUX_BIN"
 log "partial live smoke: prereq, basic, default-settings, noninteractive-math, tui, steering, diagnostics, jsonl"
 
-if ! PI_CURSOR_SETTING_SOURCES=none "${PI_BASE[@]}" --list-models cursor 2>"$SMOKE_DIR/prereq.stderr.txt" | tee "$SMOKE_DIR/prereq.models.txt" | rg -q "composer-2\\.5"; then
+"${BASE_ENV[@]}" "$PI_BIN" --version | tee "$SMOKE_DIR/prereq.pi-version.txt"
+"${BASE_ENV[@]}" "$NPM_BIN" --prefix "$ROOT" ls @cursor/sdk @earendil-works/pi-coding-agent @earendil-works/pi-ai @earendil-works/pi-tui | tee "$SMOKE_DIR/prereq.npm-ls.txt"
+
+if ! "${NONE_ENV[@]}" "${PI_BASE[@]}" --list-models cursor 2>"$SMOKE_DIR/prereq.stderr.txt" | tee "$SMOKE_DIR/prereq.models.txt" | "$RG_BIN" -q "composer-2\\.5"; then
 	if ! model_listed "$SMOKE_DIR/prereq.stderr.txt"; then
 		fail "cursor/composer-2.5 not listed"
 	fi
@@ -368,34 +422,34 @@ fi
 log "prereq PASS"
 
 run_direct basic 600 retry-empty-output "PI_CURSOR_SMOKE_OK" "PI_CURSOR_SMOKE_OK" \
-	env PI_CURSOR_SETTING_SOURCES=none "${PI_BASE[@]}" \
+	"${NONE_ENV[@]}" "${PI_BASE[@]}" \
 	--session-dir "$SMOKE_DIR/basic" \
 	--no-tools \
 	-p 'Live smoke. Reply exactly: PI_CURSOR_SMOKE_OK'
 
 run_direct default-settings 300 strict "PRODUCT=42" "PRODUCT=42" \
-	"${PI_BASE[@]}" \
+	"${DEFAULT_ENV[@]}" "${PI_BASE[@]}" \
 	--session-dir "$SMOKE_DIR/default-settings" \
 	--no-tools \
 	-p 'Default settings smoke. Include PRODUCT=42 in the final answer.'
 
 run_direct noninteractive-math 300 strict "SUM=42" "SUM=42" \
-	env PI_CURSOR_SETTING_SOURCES=none "${PI_BASE[@]}" \
+	"${NONE_ENV[@]}" "${PI_BASE[@]}" \
 	--session-dir "$SMOKE_DIR/noninteractive-math" \
 	--no-tools \
 	-p 'Noninteractive math smoke. Compute 19 + 23. Reply only with SUM=42.'
 
 run_tui_math_footer_poll tui 420 \
-	env PI_CURSOR_SETTING_SOURCES=none "${PI_BASE[@]}" \
+	"${NONE_ENV[@]}" "${PI_BASE[@]}" \
 	--session-dir "$SMOKE_DIR/tui" \
 	--no-tools \
 	'TUI smoke. Compute 19 + 23. Reply only with SUM=<number>.'
 
 run_tmux steering 420 1 \
-	env "SMOKE_SESSION_DIR=$SMOKE_DIR/steering" node "$ROOT/scripts/steering-rpc-smoke.mjs"
-rg -q '"steerOk":true' "$SMOKE_DIR/steering.stdout.txt" || fail "steering missing steerOk"
-rg -q '"steerChain":true' "$SMOKE_DIR/steering.stdout.txt" || fail "steering missing steerChain"
-rg -q "already has active run|AgentBusyError" "$SMOKE_DIR/steering.stdout.txt" "$SMOKE_DIR/steering.stderr.txt" && fail "steering hit AgentBusyError" || true
+	"${NONE_ENV[@]}" "SMOKE_SESSION_DIR=$SMOKE_DIR/steering" "PI_BIN=$PI_BIN" "$NODE_BIN" "$ROOT/scripts/steering-rpc-smoke.mjs"
+"$RG_BIN" -q '"steerOk":true' "$SMOKE_DIR/steering.stdout.txt" || fail "steering missing steerOk"
+"$RG_BIN" -q '"steerChain":true' "$SMOKE_DIR/steering.stdout.txt" || fail "steering missing steerChain"
+"$RG_BIN" -q "already has active run|AgentBusyError" "$SMOKE_DIR/steering.stdout.txt" "$SMOKE_DIR/steering.stderr.txt" && fail "steering hit AgentBusyError" || true
 
 forbidden_files="$(find "$SMOKE_DIR" -type f \( -name '*stderr.txt' -o -name '*capture*.txt' \) -print0 |
 	xargs -0 grep -IlE 'CURSOR_API_KEY|Bearer [A-Za-z0-9._-]+|/cursor-pi-tool-bridge/[^ ]+/mcp|127\.0\.0\.1:[0-9]+/cursor-pi-tool-bridge|apiKey|cookie|session-cookie|secret-token' || true)"
@@ -413,6 +467,6 @@ if [[ -n "$forbidden_files" ]]; then
 fi
 log "diagnostics safety PASS"
 
-node "$ROOT/scripts/validate-smoke-jsonl.mjs" "$SMOKE_DIR"
+"$NODE_BIN" "$ROOT/scripts/validate-smoke-jsonl.mjs" "$SMOKE_DIR"
 log "jsonl structural scan PASS"
-log "partial live smoke checks passed (see --help for uncovered checklist sections)"
+log "partial live smoke checks passed (see --help for uncovered named release checks)"