setorra 0.2.5 → 0.3.0

package/README.md

@@ -4,13 +4,13 @@ Onboards a GitHub repository for automated API migration. It installs two workfl
 and opens a pull request for you to review.
 
 ```bash
-npx setorra init claude    # or: codex
+npx setorra init claude    # or: codex, cursor
 ```
 
 ## What it writes
 
-One agent workflow (Claude shown; Codex uses `api-migration-codex.yml`) and a shared
-completion workflow:
+One agent workflow (Claude shown; Codex and Cursor use `api-migration-codex.yml` and
+`api-migration-cursor.yml` respectively) and a shared completion workflow:
 
 ```
 .github/workflows/api-migration-claude.yml
@@ -52,6 +52,7 @@ The workflow needs the selected agent credential:
 | --- | --- |
 | `claude` | `CLAUDE_CODE_OAUTH_TOKEN` (or `ANTHROPIC_API_KEY` with `--credential api_key`) |
 | `codex` | `OPENAI_API_KEY` |
+| `cursor` | `CURSOR_API_KEY` (a Cursor Enterprise service-account key is recommended) |
 
 Add it under **Settings → Secrets and variables → Actions**.
 
@@ -70,7 +71,7 @@ revoke execution. Removing the agent secret alone does not disable PR completion
 
 | Command | Purpose |
 | --- | --- |
-| `setorra init <claude\|codex>` | Install both workflows and open a pull request. |
+| `setorra init <claude\|codex\|cursor>` | Install both workflows and open a pull request. |
 | `setorra status` | Check the agent workflow and reviewed completion contract. |
 | `setorra sync` | Upgrade both workflows, including adding a missing companion. |
 

package/dist/setorra.js

@@ -7301,13 +7301,15 @@ var require_dist = __commonJS({
 var import_yaml = __toESM(require_dist());
 
 // src/workflow/contracts.ts
+var AGENT_KINDS = ["claude", "codex", "cursor"];
 var WORKFLOW_CONTRACT_VERSION = "agent-workflow/1";
 var RESULT_CONTRACT_VERSION = "cloud-agent-result/v1";
 var RESULT_ARTIFACT_NAME = "cloud-agent-result";
 var RESULT_ARTIFACT_FILE = "cloud-agent-result.json";
 var AGENT_WORKFLOW_PATHS = {
   claude: ".github/workflows/api-migration-claude.yml",
-  codex: ".github/workflows/api-migration-codex.yml"
+  codex: ".github/workflows/api-migration-codex.yml",
+  cursor: ".github/workflows/api-migration-cursor.yml"
 };
 var COMPLETION_WORKFLOW_PATH = ".github/workflows/setorra-pr-completion.yml";
 var COMPLETION_MARKER = "# setorra-pr-completion/v1";
@@ -21835,7 +21837,7 @@ var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]
 var DIGEST = /^[a-f0-9]{64}$/u;
 var SHA = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
 var GITHUB_ID = /^[1-9][0-9]{0,19}$/u;
-var WORKFLOW_PATH = /^\.github\/workflows\/api-migration-(?:claude|codex)\.yml$/u;
+var WORKFLOW_PATH = /^\.github\/workflows\/api-migration-(?:claude|codex|cursor)\.yml$/u;
 var HandoffFields = {
   handoffId: external_exports.string().regex(UUID),
   handoffDigest: external_exports.string().regex(DIGEST),
@@ -21935,7 +21937,7 @@ function renderProvenanceValidationScript() {
     "const digest = /^[a-f0-9]{64}$/;",
     "const sha = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/;",
     "const githubId = /^[1-9][0-9]{0,19}$/;",
-    "const workflowPath = /^\\.github\\/workflows\\/api-migration-(?:claude|codex)\\.yml$/;",
+    "const workflowPath = /^\\.github\\/workflows\\/api-migration-(?:claude|codex|cursor)\\.yml$/;",
     "if (!['release-agent-handoff/v2', 'release-agent-handoff/v3', 'release-agent-handoff/v4'].includes(provenance.schemaVersion) || provenance.workflowContractVersion !== 'agent-workflow/1' || provenance.resultContractVersion !== 'cloud-agent-result/v1' || !uuid.test(provenance.handoffId) || (provenance.runId !== undefined && !uuid.test(provenance.runId)) || !digest.test(provenance.handoffDigest) || !digest.test(provenance.contextDigest) || !githubId.test(provenance.repositoryId) || !sha.test(provenance.baseSha) || !githubId.test(provenance.workflowId) || !workflowPath.test(provenance.workflowPath)) fail('invalid_fields');",
     "if (['release-agent-handoff/v3', 'release-agent-handoff/v4'].includes(provenance.schemaVersion) && !digest.test(provenance.contextPayloadDigest)) fail('invalid_fields');",
     "if (provenance.schemaVersion === 'release-agent-handoff/v2' && provenance.contextPayloadDigest !== undefined && !digest.test(provenance.contextPayloadDigest)) fail('invalid_fields');",
@@ -22024,7 +22026,7 @@ const baseBranch = repository.default_branch;
 const run = request(prefix + '/actions/runs/' + inputs.original_run_id);
 const attempt = request(prefix + '/actions/runs/' + inputs.original_run_id + '/attempts/' + inputs.original_attempt);
 for (const r of [run, attempt]) {
-  if (String(r.id) !== inputs.original_run_id || String(r.run_attempt) !== inputs.original_attempt || r.status !== 'completed' || r.event !== 'issues' || r.head_sha !== inputs.expected_base_sha || String(r.repository?.id) !== process.env.GITHUB_REPOSITORY_ID || r.display_title !== 'api-migration-' + inputs.issue_number || !/^\.github\/workflows\/api-migration-(claude|codex)\.yml$/.test(r.path)) fail('original_workflow_changed');
+  if (String(r.id) !== inputs.original_run_id || String(r.run_attempt) !== inputs.original_attempt || r.status !== 'completed' || r.event !== 'issues' || r.head_sha !== inputs.expected_base_sha || String(r.repository?.id) !== process.env.GITHUB_REPOSITORY_ID || r.display_title !== 'api-migration-' + inputs.issue_number || !/^\.github\/workflows\/api-migration-(claude|codex|cursor)\.yml$/.test(r.path)) fail('original_workflow_changed');
 }
 if (run.workflow_id !== attempt.workflow_id || run.path !== attempt.path) fail('original_workflow_changed');
 function validateIssue(issue) {
@@ -22118,6 +22120,11 @@ var AGENT_ACTION_REPOSITORIES = {
   claude: "anthropics/claude-code-action",
   codex: "openai/codex-action"
 };
+var AGENT_TITLES = {
+  claude: "Claude",
+  codex: "Codex",
+  cursor: "Cursor"
+};
 var CHECKOUT_ACTION_REPOSITORY = "actions/checkout";
 var UPLOAD_ARTIFACT_ACTION_REPOSITORY = "actions/upload-artifact";
 var AGENT_CREDENTIALS = {
@@ -22130,6 +22137,10 @@ var AGENT_CREDENTIALS = {
   },
   codex: {
     api_key: { input: "openai-api-key", secret: "OPENAI_API_KEY" }
+  },
+  // The Cursor CLI reads its key from the environment, so its input is a variable name.
+  cursor: {
+    api_key: { input: "CURSOR_API_KEY", secret: "CURSOR_API_KEY" }
   }
 };
 function agentCredentialInputs(agent) {
@@ -22144,15 +22155,49 @@ var PinnedActionSchema = external_exports.object({
   sha: external_exports.string().regex(/^[a-f0-9]{40}$/u),
   version: external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u)
 }).strict();
-var WorkflowTemplateInputSchema = external_exports.object({
-  agent: external_exports.enum(["claude", "codex"]),
+var CursorCliPinSchema = external_exports.object({
+  version: external_exports.string().regex(/^[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[a-f0-9]{7,40}$/u),
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/u)
+}).strict();
+var CURSOR_CLI_DOWNLOAD_PREFIX = "https://downloads.cursor.com/lab/";
+function cursorCliUrl(pin) {
+  return `${CURSOR_CLI_DOWNLOAD_PREFIX}${pin.version}/linux/x64/agent-cli-package.tar.gz`;
+}
+var CURSOR_DENIED_PERMISSIONS = [
+  "Shell(git)",
+  "Shell(gh)",
+  "Shell(curl)",
+  "Shell(wget)",
+  "Shell(ssh)",
+  "Shell(scp)",
+  "Shell(sftp)",
+  "Shell(nc)",
+  "Shell(ncat)",
+  "Shell(sudo)",
+  "Write(.github/**)",
+  "Write(.git/**)"
+];
+var BotLoginSchema = external_exports.string().min(4).max(64).regex(/^[a-z0-9][a-z0-9-]*\[bot\]$/u);
+var LabelSchema = external_exports.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9._-]*$/u);
+var TemplateCommonFields = {
   credential: external_exports.enum(["api_key", "oauth_token"]).default("api_key"),
-  botLogin: external_exports.string().min(4).max(64).regex(/^[a-z0-9][a-z0-9-]*\[bot\]$/u),
-  label: external_exports.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9._-]*$/u),
+  botLogin: BotLoginSchema,
+  label: LabelSchema,
   checkoutAction: PinnedActionSchema,
-  agentAction: PinnedActionSchema,
   uploadArtifactAction: PinnedActionSchema
-}).strict();
+};
+var WorkflowTemplateInputSchema = external_exports.discriminatedUnion("agent", [
+  external_exports.object({
+    agent: external_exports.enum(["claude", "codex"]),
+    ...TemplateCommonFields,
+    agentAction: PinnedActionSchema
+  }).strict(),
+  external_exports.object({
+    agent: external_exports.literal("cursor"),
+    ...TemplateCommonFields,
+    cursorCli: CursorCliPinSchema
+  }).strict()
+]);
 function yamlString(value) {
   return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
 }
@@ -22295,6 +22340,9 @@ function renderHelperStep() {
   ];
 }
 function renderAgentSteps(input, selected) {
+  if (input.agent === "cursor") {
+    return renderCursorAgentStep(input.cursorCli, selected);
+  }
   const { agent, agentAction, botLogin } = input;
   const credential = `${selected.input}: \${{ secrets.${selected.secret} }}`;
   const allowlist = `${AGENT_BOT_ALLOWLIST_INPUTS[agent]}: ${yamlString(botLogin)}`;
@@ -22347,6 +22395,38 @@ function renderAgentSteps(input, selected) {
     "          prompt-file: ${{ runner.temp }}/agent-prompt.md"
   ];
 }
+function renderCursorAgentStep(pin, selected) {
+  const config2 = JSON.stringify({
+    version: 1,
+    editor: { vimMode: false },
+    permissions: { allow: [], deny: CURSOR_DENIED_PERMISSIONS }
+  });
+  return [
+    "      - name: Run the Cursor coding agent",
+    "        id: agent",
+    "        continue-on-error: true",
+    "        env:",
+    "          GITHUB_ENV: /dev/null",
+    "          GITHUB_PATH: /dev/null",
+    `          ${selected.input}: \${{ secrets.${selected.secret} }}`,
+    `          CURSOR_CLI_URL: ${yamlString(cursorCliUrl(pin))}`,
+    `          CURSOR_CLI_SHA256: ${yamlString(pin.sha256)}`,
+    "          CURSOR_CONFIG_DIR: ${{ runner.temp }}/cursor-config",
+    "          AGENT_PROMPT_FILE: ${{ runner.temp }}/agent-prompt.md",
+    "        shell: bash",
+    "        run: |",
+    `          sudo -n sh -c 'user="$1"; gpasswd -d "$user" sudo >/dev/null 2>&1 || true; for file in /etc/sudoers /etc/sudoers.d/*; do if [ -f "$file" ]; then sed -i "/^$user[[:space:]]/d" "$file"; fi; done' sh "$(id -un)"`,
+    "          sudo -K || true",
+    "          if sudo -n true 2>/dev/null; then echo 'sudo is still available to the agent' >&2; exit 1; fi",
+    '          CURSOR_CLI_DIR="$(mktemp -d "$RUNNER_TEMP/cursor-cli.XXXXXX")"',
+    `          curl --fail --silent --show-error --retry 3 --retry-all-errors --proto '=https' --tlsv1.2 --output "$CURSOR_CLI_DIR/cli.tar.gz" "$CURSOR_CLI_URL"`,
+    `          printf '%s  %s\\n' "$CURSOR_CLI_SHA256" "$CURSOR_CLI_DIR/cli.tar.gz" | sha256sum --check --strict --quiet`,
+    '          tar -xzf "$CURSOR_CLI_DIR/cli.tar.gz" -C "$CURSOR_CLI_DIR"',
+    '          mkdir -p "$CURSOR_CONFIG_DIR"',
+    `          printf '%s\\n' '${config2}' > "$CURSOR_CONFIG_DIR/cli-config.json"`,
+    '          "$CURSOR_CLI_DIR/dist-package/cursor-agent" --print --force --disable-auto-update < "$AGENT_PROMPT_FILE"'
+  ];
+}
 function renderPreparationStep() {
   return [
     "      - name: Assess the agent result",
@@ -22580,7 +22660,7 @@ function renderAgentWorkflow(input) {
     );
   }
   const value = parsed.data;
-  if (value.agentAction.repository !== AGENT_ACTION_REPOSITORIES[value.agent]) {
+  if (value.agent !== "cursor" && value.agentAction.repository !== AGENT_ACTION_REPOSITORIES[value.agent]) {
     throw new RepositoryAgentConfigError(
       "invalid_template_input",
       `agentAction.repository must be ${AGENT_ACTION_REPOSITORIES[value.agent]}`
@@ -22606,7 +22686,7 @@ function renderAgentWorkflow(input) {
     );
   }
   const workflowPath = AGENT_WORKFLOW_PATHS[value.agent];
-  const title = value.agent === "claude" ? "Claude" : "Codex";
+  const title = AGENT_TITLES[value.agent];
   return [
     "# Managed by Setorra. Regenerate with `setorra sync`.",
     "# The agent can edit only; deterministic workflow steps own GitHub mutations.",
@@ -22631,7 +22711,9 @@ function renderAgentWorkflow(input) {
     "      contents: write",
     "      issues: write",
     "      pull-requests: write",
-    "      id-token: write",
+    // The marketplace actions may exchange an OIDC token; the Cursor CLI never does, and
+    // its agent has a shell that could otherwise request one.
+    ...value.agent === "cursor" ? [] : ["      id-token: write"],
     "    steps:",
     ...renderProvenanceStep(workflowPath),
     "      - name: Check out the handoff commit",
@@ -22662,8 +22744,8 @@ function renderAgentWorkflow(input) {
   ].join("\n");
 }
 function renderCompletionWorkflow(input) {
-  WorkflowTemplateInputSchema.shape.botLogin.parse(input.botLogin);
-  WorkflowTemplateInputSchema.shape.label.parse(input.label);
+  BotLoginSchema.parse(input.botLogin);
+  LabelSchema.parse(input.label);
   const upload = PinnedActionSchema.parse(input.uploadArtifactAction);
   if (upload.repository !== UPLOAD_ARTIFACT_ACTION_REPOSITORY) {
     throw new Error("completion requires actions/upload-artifact");
@@ -22785,7 +22867,7 @@ function stripProvenance(content) {
 
 // src/workflow/plan.ts
 function managedPaths() {
-  return [AGENT_WORKFLOW_PATHS.claude, AGENT_WORKFLOW_PATHS.codex, COMPLETION_WORKFLOW_PATH];
+  return [...Object.values(AGENT_WORKFLOW_PATHS), COMPLETION_WORKFLOW_PATH];
 }
 function planFile(path, desired, existing, force) {
   const current = existing.get(path);
@@ -22806,21 +22888,14 @@ function planFile(path, desired, existing, force) {
   return { kind: "update", path, contents: desired };
 }
 function planRepositoryAgentFiles(input) {
+  const { existing, force, ...template } = input;
   const actions = [
-    planFile(COMPLETION_WORKFLOW_PATH, stampProvenance(renderCompletionWorkflow(input)), input.existing, input.force),
+    planFile(COMPLETION_WORKFLOW_PATH, stampProvenance(renderCompletionWorkflow(template)), existing, force),
     planFile(
       AGENT_WORKFLOW_PATHS[input.agent],
-      stampProvenance(renderAgentWorkflow({
-        agent: input.agent,
-        credential: input.credential,
-        botLogin: input.botLogin,
-        label: input.label,
-        checkoutAction: input.checkoutAction,
-        agentAction: input.agentAction,
-        uploadArtifactAction: input.uploadArtifactAction
-      })),
-      input.existing,
-      input.force
+      stampProvenance(renderAgentWorkflow(template)),
+      existing,
+      force
     )
   ];
   for (const [agent, path] of Object.entries(AGENT_WORKFLOW_PATHS)) {
@@ -22858,6 +22933,10 @@ var AGENT_ACTIONS = {
     version: "v1"
   }
 };
+var CURSOR_CLI = {
+  version: "2026.10.01-e373342",
+  sha256: "a79726c6e644520e993970be4c45775a6889802b67abe461a677a53219ae28e8"
+};
 var UPLOAD_ARTIFACT_ACTION = {
   repository: UPLOAD_ARTIFACT_ACTION_REPOSITORY,
   sha: "ea165f8d65b6e75b540449e92b4886f43607fa02",
@@ -22866,6 +22945,8 @@ var UPLOAD_ARTIFACT_ACTION = {
 
 // src/workflow/workflow-validate.ts
 var PINNED_ACTION = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[^@\s]+@[a-f0-9]{40}$/u;
+var CURSOR_AGENT_INVOCATION = '"$CURSOR_CLI_DIR/dist-package/cursor-agent" --print --force --disable-auto-update < "$AGENT_PROMPT_FILE"';
+var PINNED_CURSOR_CLI_URL = /^https:\/\/downloads\.cursor\.com\/lab\/[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[a-f0-9]{7,40}\/linux\/x64\/agent-cli-package\.tar\.gz$/u;
 var BASE_SHA_OUTPUT = "${{ steps.provenance.outputs.base_sha }}";
 var HANDOFF_BRANCH = "setorra/${{ steps.provenance.outputs.handoff_id }}";
 function asRecord(value) {
@@ -22942,9 +23023,9 @@ function checkGuards(job, input, findings) {
     push(findings, "missing_label_guard", `The workflow must require the '${input.label}' label.`);
   }
 }
-function checkAgentInputs(step, input, findings) {
+function checkAgentInputs(step, agent, input, findings) {
   const withInputs = stepWith(step);
-  const allowlistInput = AGENT_BOT_ALLOWLIST_INPUTS[input.agent];
+  const allowlistInput = AGENT_BOT_ALLOWLIST_INPUTS[agent];
   const allowlist = asString(withInputs?.[allowlistInput]);
   if (allowlist === void 0) {
     push(findings, "missing_bot_allowlist_input", `The agent step must set '${allowlistInput}'.`);
@@ -22958,11 +23039,38 @@ function checkAgentInputs(step, input, findings) {
   } else if (!allowlist.split(",").map((entry) => entry.trim()).includes(input.botLogin)) {
     push(findings, "bot_allowlist_mismatch", `'${allowlistInput}' must list '${input.botLogin}'.`);
   }
-  const credentialInputs = agentCredentialInputs(input.agent);
+  const credentialInputs = agentCredentialInputs(agent);
   if (!credentialInputs.some((name) => (asString(withInputs?.[name]) ?? "").trim() !== "")) {
     push(findings, "missing_credential_input", "The agent step has no supported credential input.");
   }
 }
+function checkCursorAgent(job, step, findings) {
+  const env = stepEnv(step);
+  const run2 = stepRun(step);
+  if (asString(env?.["CURSOR_API_KEY"]) !== "${{ secrets.CURSOR_API_KEY }}") {
+    push(findings, "missing_credential_input", "The agent step must read 'CURSOR_API_KEY' from secrets.");
+  }
+  if (!PINNED_CURSOR_CLI_URL.test(asString(env?.["CURSOR_CLI_URL"]) ?? "") || !/^[a-f0-9]{64}$/u.test(asString(env?.["CURSOR_CLI_SHA256"]) ?? "") || !run2.includes('"$CURSOR_CLI_URL"') || !run2.includes('"$CURSOR_CLI_SHA256"') || !run2.includes("sha256sum --check --strict")) {
+    push(
+      findings,
+      "unpinned_agent_cli",
+      "The Cursor CLI must be one exact release verified against its SHA-256."
+    );
+  }
+  if (!run2.includes(CURSOR_AGENT_INVOCATION)) {
+    push(findings, "missing_agent_invocation", "The Cursor step must run the pinned CLI on the prompt file.");
+  }
+  if (!run2.includes("if sudo -n true 2>/dev/null; then")) {
+    push(findings, "agent_keeps_sudo", "The Cursor step must drop sudo before the agent runs.");
+  }
+  const permissions = asRecord(job["permissions"]);
+  if (permissions === void 0 || permissions["id-token"] !== void 0) {
+    push(findings, "agent_receives_oidc_token", "The Cursor job must not request an OIDC token.");
+  }
+}
+function isAgentStep(agent, step) {
+  return agent === "cursor" ? asString(stepEnv(step)?.["CURSOR_CLI_URL"])?.startsWith(CURSOR_CLI_DOWNLOAD_PREFIX) === true : stepUses(step)?.startsWith(`${AGENT_ACTION_REPOSITORIES[agent]}@`) === true;
+}
 function oneStep(steps, id) {
   const matches = steps.filter((step) => stepId(step) === id);
   return matches.length === 1 ? matches[0] : void 0;
@@ -23073,18 +23181,16 @@ function validateAgentWorkflow(document, input) {
   for (const { steps } of jobs) {
     checkPinning(steps, findings);
   }
-  const expectedRepository = AGENT_ACTION_REPOSITORIES[input.agent];
-  const otherRepositories = Object.entries(AGENT_ACTION_REPOSITORIES).filter(([agent]) => agent !== input.agent).map(([, repository]) => repository);
+  const otherAgents = AGENT_KINDS.filter((agent) => agent !== input.agent);
   const expectedMatches = [];
   const agentSteps = [];
   let foundOther = false;
   for (const entry of jobs) {
     for (const step of entry.steps) {
-      const uses = stepUses(step);
-      if (uses?.startsWith(`${expectedRepository}@`)) {
+      if (isAgentStep(input.agent, step)) {
         expectedMatches.push({ ...entry, step });
         agentSteps.push(step);
-      } else if (uses !== void 0 && otherRepositories.some((repository) => uses.startsWith(`${repository}@`))) {
+      } else if (otherAgents.some((agent) => isAgentStep(agent, step))) {
         foundOther = true;
         agentSteps.push(step);
       }
@@ -23118,12 +23224,16 @@ function validateAgentWorkflow(document, input) {
     push(
       findings,
       foundOther ? "unexpected_agent_action" : "missing_agent_action",
-      foundOther ? "The workflow runs the wrong agent action." : `No step uses '${expectedRepository}'.`
+      foundOther ? "The workflow runs the wrong agent action." : input.agent === "cursor" ? "No step runs the pinned Cursor CLI." : `No step uses '${AGENT_ACTION_REPOSITORIES[input.agent]}'.`
     );
     return { valid: false, findings };
   }
   checkGuards(matched.job, input, findings);
-  checkAgentInputs(matched.step, input, findings);
+  if (input.agent === "cursor") {
+    checkCursorAgent(matched.job, matched.step, findings);
+  } else {
+    checkAgentInputs(matched.step, input.agent, input, findings);
+  }
   checkContractControls(workflow, matched.steps, allSteps, findings);
   return { valid: !findings.some((finding) => finding.severity === "error"), findings };
 }
@@ -23134,7 +23244,8 @@ var BOT_LOGIN = process.env["SETORRA_BOT_LOGIN"] ?? "setorra[bot]";
 var LABEL = process.env["SETORRA_LABEL"] ?? "api-migration";
 var DEFAULT_CREDENTIALS = {
   claude: "oauth_token",
-  codex: "api_key"
+  codex: "api_key",
+  cursor: "api_key"
 };
 var UsageError = class extends Error {
 };
@@ -23142,7 +23253,7 @@ function parseArguments(argv) {
   const [command, ...rest] = argv;
   if (command !== "init" && command !== "status" && command !== "sync") {
     throw new UsageError(
-      "usage: setorra <init|status|sync> [claude|codex] [--credential api_key|oauth_token] [--force] [--dry-run]"
+      "usage: setorra <init|status|sync> [claude|codex|cursor] [--credential api_key|oauth_token] [--force] [--dry-run]"
     );
   }
   let agent;
@@ -23151,7 +23262,7 @@ function parseArguments(argv) {
   let dryRun = false;
   for (let index = 0; index < rest.length; index += 1) {
     const argument = rest[index];
-    if (argument === "claude" || argument === "codex") {
+    if (AGENT_KINDS.some((kind) => kind === argument)) {
       agent = argument;
     } else if (argument === "--force") {
       force = true;
@@ -23198,10 +23309,14 @@ function readManaged(root) {
   }
   return existing;
 }
+var AGENT_WORKFLOW_MARKERS = {
+  ...AGENT_ACTION_REPOSITORIES,
+  cursor: CURSOR_CLI_DOWNLOAD_PREFIX
+};
 function detectAgent(existing) {
-  for (const agent of ["claude", "codex"]) {
+  for (const agent of AGENT_KINDS) {
     const workflow = existing.get(AGENT_WORKFLOW_PATHS[agent]);
-    if (workflow?.includes(AGENT_ACTION_REPOSITORIES[agent]) === true) {
+    if (workflow?.includes(AGENT_WORKFLOW_MARKERS[agent]) === true) {
       return agent;
     }
   }
@@ -23324,7 +23439,7 @@ pull request updated: ${url2}`);
 }
 function runStatus(options) {
   const existing = readManaged(options.root);
-  const present = ["claude", "codex"].filter((agent2) => existing.has(AGENT_WORKFLOW_PATHS[agent2]));
+  const present = AGENT_KINDS.filter((agent2) => existing.has(AGENT_WORKFLOW_PATHS[agent2]));
   if (present.length === 0) {
     console.error("no migration workflow; run `setorra init <agent>` first");
     return 1;
@@ -23332,7 +23447,7 @@ function runStatus(options) {
   let failures = 0;
   if (present.length > 1) {
     console.error(
-      `error: ${present.length} migration workflows exist (${present.join(", ")}). Both would run on the same issue.`
+      `error: ${present.length} migration workflows exist (${present.join(", ")}). Each would run on the same issue.`
     );
     failures += 1;
   }
@@ -23383,7 +23498,7 @@ function runReconcile(options) {
   const agent = options.command === "sync" ? detectAgent(existing) : options.agent ?? detectAgent(existing);
   if (agent === void 0) {
     console.error(
-      options.command === "sync" ? "no migration workflow; run `setorra init <agent>` first" : "could not determine the agent; pass `claude` or `codex`"
+      options.command === "sync" ? "no migration workflow; run `setorra init <agent>` first" : "could not determine the agent; pass `claude`, `codex` or `cursor`"
     );
     return 1;
   }
@@ -23396,12 +23511,11 @@ function runReconcile(options) {
     return 1;
   }
   const plan = planRepositoryAgentFiles({
-    agent,
     credential,
     botLogin: BOT_LOGIN,
     label: LABEL,
     checkoutAction: CHECKOUT_ACTION,
-    agentAction: AGENT_ACTIONS[agent],
+    ...agent === "cursor" ? { agent, cursorCli: CURSOR_CLI } : { agent, agentAction: AGENT_ACTIONS[agent] },
     uploadArtifactAction: UPLOAD_ARTIFACT_ACTION,
     existing,
     force: options.force

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "setorra",
-  "version": "0.2.5",
+  "version": "0.3.0",
   "description": "Configure automated API migration for a GitHub repository.",
   "license": "Apache-2.0",
   "type": "module",