stacktrace-cli 0.15.0__tar.gz → 0.16.0__tar.gz

{stacktrace_cli-0.15.0 → stacktrace_cli-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stacktrace-cli
-Version: 0.15.0
+Version: 0.16.0
 Summary: CLI for Stacktrace — Detection and Response platform for AI Agents.
 Project-URL: Homepage, https://stacktrace.ai
 Author-email: "Stacktrace AI, Inc" <founders@stacktrace.ai>
@@ -21,7 +21,7 @@ Requires-Python: >=3.11
 Requires-Dist: click>=8.1
 Requires-Dist: httpx<1.0.dev0,>=0.28.1
 Requires-Dist: openaca==0.12.0
-Requires-Dist: openaidr==0.7.1
+Requires-Dist: openaidr==0.8.0
 Requires-Dist: posthog<8,>=7.0
 Requires-Dist: pydantic<3,>=2.10
 Description-Content-Type: text/markdown
@@ -52,7 +52,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.15.0
+stacktrace 0.16.0
 ```
 
 ## Python package namespace
@@ -251,13 +251,14 @@ enables telemetry again under a new identity (ADR-0039, ADR-0090).
 
 Beta, and under active development.
 
-`sessions`, `detect` and `monitor` work end to end today, for Claude Code and
-Devin sessions alike (Devin CLI and Devin Desktop's local agent). Session collection is
+`sessions`, `detect` and `monitor` work end to end today, for Claude Code,
+Devin (Devin CLI and Devin Desktop's local agent), Codex and Cursor (the Cursor
+CLI) sessions. Session collection is
 [OpenAIDR](https://github.com/open-agent-security/openaidr)'s, and further agent
 kinds arrive with it. The daemon observes every kind it reads, sub-agents included.
 [Agent support](docs/agent-support.md) lists what works for each agent, rule by
-rule, and what cannot. Codex is next
-([spec](docs/specs/codex-agent-kind.md)).
+rule, and what cannot. Cursor arrives with OpenAIDR 0.8.0
+([spec](docs/specs/cursor-agent-kind.md)).
 
 ## Built on
 

{stacktrace_cli-0.15.0 → stacktrace_cli-0.16.0}/README.md

@@ -24,7 +24,7 @@ Requires Python 3.11 or newer.
 
 ```console
 $ stacktrace --version
-stacktrace 0.15.0
+stacktrace 0.16.0
 ```
 
 ## Python package namespace
@@ -223,13 +223,14 @@ enables telemetry again under a new identity (ADR-0039, ADR-0090).
 
 Beta, and under active development.
 
-`sessions`, `detect` and `monitor` work end to end today, for Claude Code and
-Devin sessions alike (Devin CLI and Devin Desktop's local agent). Session collection is
+`sessions`, `detect` and `monitor` work end to end today, for Claude Code,
+Devin (Devin CLI and Devin Desktop's local agent), Codex and Cursor (the Cursor
+CLI) sessions. Session collection is
 [OpenAIDR](https://github.com/open-agent-security/openaidr)'s, and further agent
 kinds arrive with it. The daemon observes every kind it reads, sub-agents included.
 [Agent support](docs/agent-support.md) lists what works for each agent, rule by
-rule, and what cannot. Codex is next
-([spec](docs/specs/codex-agent-kind.md)).
+rule, and what cannot. Cursor arrives with OpenAIDR 0.8.0
+([spec](docs/specs/cursor-agent-kind.md)).
 
 ## Built on
 

stacktrace_cli-0.16.0/docs/adrs/0156-the-client-localizes-fleet-policy-targets.md

@@ -0,0 +1,67 @@
+---
+id: 0156
+title: The client localizes Fleet's policy targets before it evaluates or compiles them
+status: accepted
+date: 2026-10-21
+supersedes: null
+superseded-by: null
+amends: null
+amended-by: null
+---
+
+## Context
+
+Fleet's catalog (Fleet ADR-0102 and ADR-0104) writes an exact policy target
+for each MCP server that an administrator approves or blocks. Fleet derives
+the target from the uploaded Agent BOM. The upload is redacted: a launch
+command loses its flags, such as `-y`. So Fleet writes
+`{"command": ["npx", "@acme/jira-mcp@1.4.2"]}`. On the machine, OpenACA's
+matcher compares exact targets with `npx -y @acme/jira-mcp@1.4.2`, and
+matches nothing. A simulation with the real client and Fleet showed that a
+decision made in Fleet did not block the server on the machine.
+
+A URL is uploaded whole only when it normalizes to the server's identity
+(ADR-0155). Any other URL is uploaded as `scheme://host`. Fleet writes a URL
+target only when the uploaded URL has a path (Fleet ADR-0101). An
+administrator can still type a host-only URL target.
+
+## Decision
+
+Before the client evaluates or compiles a fetched policy, it localizes the
+`admission.mcps` lists against the local components. For each local MCP
+server, the client computes the upload form with the same functions that
+prepare the upload. When a list target equals that upload form, the client
+adds the server's exact local target to the same list. The hook path, the
+`remote policy compile` command and the privileged apply worker all localize.
+No new data goes up. Plugins need no step: their `name@marketplace` is not
+redacted.
+
+## Alternatives considered
+
+- **Upload the exact launch command, so Fleet can write exact targets**:
+  rejected because flags can carry user paths, tenant names and secrets. An
+  exact URL is uploaded only because the identity already states its path
+  (ADR-0155). A command has no such identity.
+- **Change OpenACA's matcher to compare redacted forms**: rejected because
+  the matcher is a shared library whose exact semantics other callers
+  depend on, and a client step fixes the defect without a new OpenACA
+  release.
+- **Have Fleet guess the exact form, for example add `-y`**: rejected
+  because flags vary, and a guess matches only some machines.
+
+## Consequences
+
+- A Fleet decision on a launch command now acts on the machine, in the hooks
+  and in Claude's managed settings.
+- A decision on an upload form covers every local variant with the same
+  upload form. An approval covers each flag variant of the same command.
+- An exact URL target already equals the local target, so the join adds
+  nothing for it. A host-only URL target joins each local server whose
+  upload shows only that host: a URL with userinfo, a query or a fragment.
+- The localization must use the upload's own functions. A change to the
+  redaction must keep the two in step; the tests drive both.
+
+## When to revisit
+
+Revisit when Fleet can carry an exact, privacy-safe command target, for
+example a hash that the OpenACA policy language can match.

{stacktrace_cli-0.15.0 → stacktrace_cli-0.16.0}/docs/adrs/INDEX.md

@@ -187,3 +187,4 @@ supersedes anything yet.
 - [0151](0151-step-one-puts-the-daemon-beside-the-gateway.md) — **Step one puts the daemon beside the gateway, names the person, and enforces Fleet policy there; Core is step two** (proposed). With `STACKTRACE_GATEWAY_LISTEN` set, the enrolled daemon on the gateway host serves ADR-0119's `/v1/evaluate` on loopback, runs `BLOCKING_RULES` and Fleet policy (MCP servers, skills, plugin agents, matched by name through the hooks' shared decision function), and uploads findings and verdicts with `actor` and `action`. The `principal` comes only from the gateway's own auth. The hook protocol (ADR-0135) is unchanged. The contract is the seam to Core: adapters move by URL. Amends ADR-0118 decision 2 and ADR-0119 for step one. Rejected: a guard service feeding Core, Core first, the hook socket as is, a header-named person, laptop-only policy, stripping tools, Envoy `ext_authz`. Read before routing a gateway to the daemon or to Core, or enforcing policy at a gateway.
 - [0153](0153-a-gateway-person-reaches-fleet-as-an-account-card.md) — **A gateway person reaches Fleet as an account and its card** (proposed). A gateway finding's `session.account` is a digest of the verified principal, and the payload carries an `accounts[]` card for it. An email principal keeps ADR-0112's email digest, so its person key matches a laptop run under that email; any other principal gets a card with no key and no name. `actor` stays local. Amends ADR-0112. Rejected: an `actor` field, the client's `metadata.user_id`, the principal as the account, no person. Read before changing how a gateway names its person in Fleet.
 - [0155](0155-a-remote-mcp-servers-exact-url-reaches-fleet.md) — **A remote MCP server's exact URL reaches Fleet** (proposed). The redaction pass keeps `openaca:url` and `openaca:install_source` whole on an `mcp_server` when the URL normalizes to the component's own `mcp-remote` identity, so it has no userinfo, query or fragment; the upload contract admits the same values. Every other URL is still reduced to `scheme://host`. Pairs with Fleet ADR-0101; release after that Fleet deploys. Rejected: building the URL from the identity, a URL hash, keeping every path, stripping only the query. Read before changing how a URL is redacted for upload.
+- [0156: The client localizes Fleet's policy targets before it evaluates or compiles them](0156-the-client-localizes-fleet-policy-targets.md). Fleet writes upload-form targets, such as a launch command without its flags; the client adds each matching local server's exact target. An exact URL target (ADR-0155) adds nothing. Rejected: uploading exact commands, changing OpenACA's matcher, guessing flags in Fleet.

{stacktrace_cli-0.15.0 → stacktrace_cli-0.16.0}/docs/agent-support.html

@@ -77,7 +77,8 @@ h1 em { font-family: var(--serif); font-style: italic; font-weight: 600; color:
   font: 500 11px/1 var(--mono); color: var(--ink-muted); background: var(--surface);
   border: 1px solid var(--line); border-radius: 999px; padding: 6px 10px;
 }
-.cards { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 14px; }
+.cards { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 14px; }
+@media (max-width: 1000px) { .cards { grid-template-columns: repeat(2, minmax(0, 1fr)); } }
 @media (max-width: 820px) { .cards { grid-template-columns: 1fr; } }
 .card {
   background: var(--surface); border: 1px solid var(--line); border-radius: 10px;
@@ -171,13 +172,14 @@ tr.group td {
   <header>
     <p class="eyebrow">Stacktrace &middot; runtime detection</p>
     <h1>Agent support, <em>by rule and by feature</em></h1>
-    <p class="lede">What Stacktrace detects and measures for Claude Code, Devin and Codex today, and what cannot be supported for each agent and why. Codex is read by OpenAIDR 0.7.0's Codex reader.</p>
+    <p class="lede">What Stacktrace detects and measures for Claude Code, Devin, Codex and Cursor today, and what cannot be supported for each agent and why. Cursor is read by OpenAIDR 0.8.0's Cursor reader.</p>
     <div class="versions">
-      <span class="chip">stacktrace 0.12.0</span>
-      <span class="chip">OpenAIDR 0.7.0</span>
-      <span class="chip">OpenACA 0.10.1</span>
+      <span class="chip">stacktrace 0.15.0</span>
+      <span class="chip">OpenAIDR 0.8.0</span>
+      <span class="chip">OpenACA 0.12.0</span>
       <span class="chip">Codex CLI 0.163.0 probed</span>
-      <span class="chip">Updated 2026-10-18</span>
+      <span class="chip">Cursor CLI 2026.10.19 probed</span>
+      <span class="chip">Updated 2026-10-21</span>
     </div>
   </header>
 
@@ -196,7 +198,7 @@ tr.group td {
         <label class="toggle"><input type="checkbox" id="diff-only"> Only rules where agents differ</label>
       </div>
       <div class="scroll"><table id="detections"></table></div>
-      <p class="footnote">&dagger; waits on a field not yet confirmed in a real session. <code>cost-personal-anomaly</code> runs in Fleet on uploaded usage, so it works wherever the usage upload does. Codex grades are the built code's, verified end to end over synthetic Codex homes.</p>
+      <p class="footnote">&dagger; waits on a field not yet confirmed in a real session. <code>cost-personal-anomaly</code> runs in Fleet on uploaded usage, so it works wherever the usage upload does. Codex grades are the built code's, verified end to end over synthetic Codex homes. Cursor grades come from the stacktrace-demo policy suite, run through the real Cursor CLI and a stand-in model: 13 of 17 cases passed. Both rm -rf cases were refused by Cursor's Delete protection, which that build always turns on.</p>
     </div>
 
     <div class="panel" role="tabpanel" id="panel-features" aria-labelledby="tab-features" hidden>
@@ -209,7 +211,7 @@ tr.group td {
     </div>
   </section>
 
-  <p class="footnote">Source of truth: <code>docs/agent-support.md</code> in stacktrace-ai/stacktrace. The Codex evidence is Codex CLI 0.163.0 run against a mock model and its source at <code>rust-v0.163.0</code>, and a live run on <code>gpt-6.1-sol</code> against a local Fleet. The reader design is <code>docs/specs/codex.md</code> in open-agent-security/openaidr.</p>
+  <p class="footnote">Source of truth: <code>docs/agent-support.md</code> in stacktrace-ai/stacktrace. The Codex evidence is Codex CLI 0.163.0 run against a mock model and its source at <code>rust-v0.163.0</code>, and a live run on <code>gpt-6.1-sol</code> against a local Fleet. The Cursor evidence is the Cursor CLI <code>2026.10.19-6bbf2c4</code> run against a mock model and a stand-in model, and its shipped bundle. The reader designs are <code>docs/specs/codex.md</code> and <code>docs/specs/cursor.md</code> in open-agent-security/openaidr.</p>
 </div>
 
 <script>
@@ -224,7 +226,10 @@ tr.group td {
       notCovered: "Devin Cloud (remote), Cascade (encrypted store)" },
     { key: "codex", name: "Codex", kind: "codex", status: "Supported", shipped: true,
       covers: "Codex CLI, codex exec, the IDE extension and Codex app through app-server",
-      notCovered: "Codex Cloud (remote)" }
+      notCovered: "Codex Cloud (remote)" },
+    { key: "cursor", name: "Cursor", kind: "cursor", status: "Next release", shipped: true,
+      covers: "Cursor CLI (agent, cursor-agent) in the terminal, in print mode and over ACP",
+      notCovered: "The desktop app's own chats (not read yet), Cloud agents (remote)" }
   ];
 
   // grade: full | partial | none | notshipped ; d: dagger ; n: note
@@ -232,80 +237,120 @@ tr.group td {
     { family: "Security" },
     { id: "credential-egress", what: "A secret in an outbound call's arguments", stage: "det",
       claude: { g: "full" }, devin: { g: "full", d: 1 },
-      codex: { g: "full", n: "Shell script and remote MCP calls. With no recorded transport, the configured one decides, at medium confidence." } },
+      codex: { g: "full", n: "Shell script and remote MCP calls. With no recorded transport, the configured one decides, at medium confidence." },
+      cursor: { g: "full", n: "Shell and remote MCP calls. A remote server's call is read from its configuration, at medium confidence." } },
     { id: "credential-persisted", what: "A secret written to a file by the agent", stage: "det",
       claude: { g: "full" }, devin: { g: "partial", n: "apply_patch is not read." },
-      codex: { g: "full", n: "apply_patch through the canonical edits key, one file at a time." } },
+      codex: { g: "full", n: "apply_patch through the canonical edits key, one file at a time." },
+      cursor: { g: "full", n: "Write, StrReplace and ApplyPatch." } },
     { id: "credential-in-prompt", what: "A secret sent to the model in a prompt", stage: "det",
-      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" } },
+      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" },
+      cursor: { g: "full" } },
     { id: "pii-in-prompt", what: "Personal data sent to the model in a prompt", stage: "det",
-      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" } },
+      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" },
+      cursor: { g: "full" } },
     { id: "destructive-action", what: "A recursive delete that escaped the workspace", stage: "det",
       claude: { g: "full" }, devin: { g: "full", d: 1 },
-      codex: { g: "full", n: "Exit code and per-call directory are recorded." } },
+      codex: { g: "full", n: "Exit code and per-call directory are recorded." },
+      cursor: { g: "full", n: "A refused call never fires. Cursor's Delete protection, a team setting, refuses every rm." } },
     { id: "deceptive-completion", what: "Claimed done while its own check said otherwise", stage: "reasoning",
-      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" } },
+      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" },
+      cursor: { g: "full" } },
     { id: "infra-unsafe-action", what: "An unrequested change to deployed infrastructure", stage: "det + reasoning",
       claude: { g: "full" }, devin: { g: "partial", n: "No entrypoint when the run log is not placed." },
-      codex: { g: "full", n: "cli and vscode read as interactive, exec and mcp as programmatic, in cost and in Jev's question." } },
+      codex: { g: "full", n: "cli and vscode read as interactive, exec and mcp as programmatic, in cost and in Jev's question." },
+      cursor: { g: "full", n: "interactive and acp read as interactive, headless as programmatic." } },
     { id: "vulnerable-dep-invoked", what: "Used a component with a known vulnerability", stage: "det",
       claude: { g: "full" }, devin: { g: "full" },
-      codex: { g: "partial", n: "MCP servers and sub-agents resolve. Skills are read with the shell, so they are never a call." } },
+      codex: { g: "partial", n: "MCP servers and sub-agents resolve. Skills are read with the shell, so they are never a call." },
+      cursor: { g: "partial", n: "MCP servers and sub-agents resolve. Skills are read with a file tool, so they are never a call." } },
     { id: "credential-switched", what: "Got past a refusal with a credential nobody gave it", stage: "det",
-      claude: { g: "full" }, devin: { g: "partial", n: "apply_patch writes are not read." }, codex: { g: "full" } },
+      claude: { g: "full" }, devin: { g: "partial", n: "apply_patch writes are not read." }, codex: { g: "full" },
+      cursor: { g: "full" } },
     { family: "Reliability" },
     { id: "blocked-quota", what: "The account's limit stopped model calls", stage: "det",
       claude: { g: "full" }, devin: { g: "none", n: "Devin's quota wording is not read." },
-      codex: { g: "full", n: "Read from Codex's own error record: usage limit, quota, credits, spend cap." } },
+      codex: { g: "full", n: "Read from Codex's own error record: usage limit, quota, credits, spend cap." },
+      cursor: { g: "none", d: 1, n: "Cursor's own usage-limit wording is not read." } },
     { id: "blocked-policy", what: "A safety check refused the action", stage: "det",
       claude: { g: "full" }, devin: { g: "none", n: "No counterpart." },
-      codex: { g: "partial", d: 1, n: "The Guardian reviewer stops a turn, not the session. Its finding has its own title." } },
+      codex: { g: "partial", d: 1, n: "The Guardian reviewer stops a turn, not the session. Its finding has its own title." },
+      cursor: { g: "none", d: 1, n: "No counterpart confirmed." } },
     { id: "blocked-throttled", what: "The provider throttled the requests", stage: "det",
       claude: { g: "full" }, devin: { g: "partial", n: "Failed-call bodies only." },
-      codex: { g: "full", d: 1, n: "rate_limit_exceeded and server_overloaded error turns." } },
+      codex: { g: "full", d: 1, n: "rate_limit_exceeded and server_overloaded error turns." },
+      cursor: { g: "partial", n: "Failed-call bodies only." } },
     { id: "blocked-upstream", what: "A service refused the request", stage: "det",
-      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" } },
+      claude: { g: "full" }, devin: { g: "full", d: 1 }, codex: { g: "full" },
+      cursor: { g: "full" } },
     { family: "Cost" },
     { id: "cost-runaway-session", what: "A session used far more tokens than similar ones", stage: "det",
       claude: { g: "full" }, devin: { g: "partial", n: "No cache writes on some providers; no context windows." },
-      codex: { g: "partial", n: "Fires. No re-write, hook, fast-mode or refetch reasons." } }
+      codex: { g: "partial", n: "Fires. No re-write, hook, fast-mode or refetch reasons." },
+      cursor: { g: "partial", n: "Fires while the debug log is kept. No usage from the terminal UI. No thinking, fast-mode or hook-cause reasons." } }
   ];
 
   // v: yes | partial | no | planned | plannedpartial | out | notplanned
   var FEATURES = [
     { group: "Sessions and detection" },
-    { f: "Sessions read (stacktrace sessions, detect)", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Daemon follows live sessions", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Sub-agent sessions in a run", claude: ["yes"], devin: ["yes", "Unconfirmed in a signed-in session."], codex: ["yes"] },
-    { f: "MCP connection evidence", claude: ["yes"], devin: ["partial", "No advertised name or version."], codex: ["partial", "None under codex exec; no endpoint."] },
-    { f: "Reasoning stage (opt-in)", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Findings to Slack and webhooks", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Findings to Fleet", claude: ["yes"], devin: ["yes"], codex: ["yes", "Not yet run against a live Fleet."] },
+    { f: "Sessions read (stacktrace sessions, detect)", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes", "The CLI only."] },
+    { f: "Daemon follows live sessions", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes"] },
+    { f: "Sub-agent sessions in a run", claude: ["yes"], devin: ["yes", "Unconfirmed in a signed-in session."], codex: ["yes"],
+      cursor: ["yes"] },
+    { f: "MCP connection evidence", claude: ["yes"], devin: ["partial", "No advertised name or version."], codex: ["partial", "None under codex exec; no endpoint."],
+      cursor: ["partial", "Failed connections only."] },
+    { f: "Reasoning stage (opt-in)", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes"] },
+    { f: "Findings to Slack and webhooks", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes"] },
+    { f: "Findings to Fleet", claude: ["yes"], devin: ["yes"], codex: ["yes", "Not yet run against a live Fleet."],
+      cursor: ["yes", "Run against a local Fleet."] },
     { group: "Cost" },
-    { f: "Tokens per model response", claude: ["yes"], devin: ["yes"], codex: ["yes", "Cached input separated from fresh input."] },
-    { f: "Cache writes", claude: ["yes"], devin: ["partial", "Provider-dependent."], codex: ["no", "OpenAI reports none."] },
-    { f: "Reasoning tokens", claude: ["yes"], devin: ["no"], codex: ["yes"] },
-    { f: "Context window per response", claude: ["yes", "From a model table."], devin: ["partial", "Known for Claude models only."], codex: ["yes", "Recorded by Codex."] },
-    { f: "Cost findings", claude: ["yes"], devin: ["partial"], codex: ["partial"] },
-    { f: "Usage to Fleet and org baselines", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Fleet price rows", claude: ["yes"], devin: ["partial", "Estimated: no per-token price published."], codex: ["partial", "gpt-5 to gpt-5.6 priced; gpt-6 and later unpriced until stacktrace-fleet adds their rows. Codex 0.163.0 defaults to gpt-6.1-sol."] },
+    { f: "Tokens per model response", claude: ["yes"], devin: ["yes"], codex: ["yes", "Cached input separated from fresh input."],
+      cursor: ["partial", "Per turn in print mode, none in the terminal UI, per response in the local-inference build. From Cursor's debug log while it is kept."] },
+    { f: "Cache writes", claude: ["yes"], devin: ["partial", "Provider-dependent."], codex: ["no", "OpenAI reports none."],
+      cursor: ["yes"] },
+    { f: "Reasoning tokens", claude: ["yes"], devin: ["no"], codex: ["yes"],
+      cursor: ["no"] },
+    { f: "Context window per response", claude: ["yes", "From a model table."], devin: ["partial", "Known for Claude models only."], codex: ["yes", "Recorded by Codex."],
+      cursor: ["partial", "Recorded when Cursor states it, else a model table."] },
+    { f: "Cost findings", claude: ["yes"], devin: ["partial"], codex: ["partial"],
+      cursor: ["partial"] },
+    { f: "Usage to Fleet and org baselines", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes", "Run against a local Fleet."] },
+    { f: "Fleet price rows", claude: ["yes"], devin: ["partial", "Estimated: no per-token price published."], codex: ["partial", "gpt-5 to gpt-5.6 priced; gpt-6 and later unpriced until stacktrace-fleet adds their rows. Codex 0.163.0 defaults to gpt-6.1-sol."],
+      cursor: ["partial", "Fleet's agents.cursor rule adds Cursor's fee to claude-* and gpt-* rows; Cursor's own models are unpriced."] },
     { group: "Who" },
-    { f: "Signed-in account and person", claude: ["yes"], devin: ["yes", "Through devin auth status."], codex: ["yes", "ChatGPT sign-in. An API key names no one."] },
+    { f: "Signed-in account and person", claude: ["yes"], devin: ["yes", "Through devin auth status."], codex: ["yes", "ChatGPT sign-in. An API key names no one."],
+      cursor: ["partial", "From cli-config.json, with no plan. A finding from a session with no usage names no one."] },
     { group: "Composition" },
-    { f: "BOM, Inventory and Vulnerabilities tabs", claude: ["yes"], devin: ["yes"], codex: ["yes", "OpenACA 0.10.1 already composes Codex."] },
-    { f: "Posture findings in Fleet", claude: ["yes"], devin: ["partial", "command-policy-allow held back."], codex: ["partial", "command-policy-allow and project-trust held back."] },
+    { f: "BOM, Inventory and Vulnerabilities tabs", claude: ["yes"], devin: ["yes"], codex: ["yes", "OpenACA 0.10.1 already composes Codex."],
+      cursor: ["yes", "OpenACA already composes Cursor."] },
+    { f: "Posture findings in Fleet", claude: ["yes"], devin: ["partial", "command-policy-allow held back."], codex: ["partial", "command-policy-allow and project-trust held back."],
+      cursor: ["partial", "A rule that attaches to no component is held back."] },
     { group: "Local monitor" },
-    { f: "Live tab", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Usage tab", claude: ["yes"], devin: ["yes"], codex: ["yes"] },
-    { f: "Refreshes when the agent's configuration changes", claude: ["yes"], devin: ["no"], codex: ["no", "Refreshes on session changes; configuration needs a reload."] },
+    { f: "Live tab", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes"] },
+    { f: "Usage tab", claude: ["yes"], devin: ["yes"], codex: ["yes"],
+      cursor: ["yes"] },
+    { f: "Refreshes when the agent's configuration changes", claude: ["yes"], devin: ["no"], codex: ["no", "Refreshes on session changes; configuration needs a reload."],
+      cursor: ["no", "As for Codex."] },
     { group: "Gateway (Guard)" },
-    { f: "Recognises the agent's traffic", claude: ["yes"], devin: ["partial", "Named devin-cli, so calls go unclassified."], codex: ["yes"] },
-    { f: "Classifies its calls and refusals", claude: ["yes"], devin: ["no"], codex: ["yes"] },
+    { f: "Recognises the agent's traffic", claude: ["yes"], devin: ["partial", "Named devin-cli, so calls go unclassified."], codex: ["yes"],
+      cursor: ["no", "Cursor's model calls go through Cursor's servers."] },
+    { f: "Classifies its calls and refusals", claude: ["yes"], devin: ["no"], codex: ["yes"],
+      cursor: ["no"] },
     { group: "Claude-only" },
-    { f: "Claude Code plugin: in-session alerts", claude: ["yes"], devin: ["no"], codex: ["out", "Out of scope."] },
-    { f: "Playground (stacktrace.ai/playground)", claude: ["yes"], devin: ["no"], codex: ["out", "Out of scope."] },
-    { f: "Managed policy deployment", claude: ["yes"], devin: ["no"], codex: ["notplanned", "Not planned."] },
-    { f: "Cloud bootstrap", claude: ["yes", "Claude Code on the web."], devin: ["no"], codex: ["notplanned", "Codex Cloud is not read."] }
+    { f: "Claude Code plugin: in-session alerts", claude: ["yes"], devin: ["no"], codex: ["out", "Out of scope."],
+      cursor: ["out", "Out of scope."] },
+    { f: "Playground (stacktrace.ai/playground)", claude: ["yes"], devin: ["no"], codex: ["out", "Out of scope."],
+      cursor: ["out", "Out of scope."] },
+    { f: "Managed policy deployment", claude: ["yes"], devin: ["no"], codex: ["notplanned", "Not planned."],
+      cursor: ["notplanned", "Not planned."] },
+    { f: "Cloud bootstrap", claude: ["yes", "Claude Code on the web."], devin: ["no"], codex: ["notplanned", "Codex Cloud is not read."],
+      cursor: ["notplanned", "Cloud agents are not read."] }
   ];
 
   var GAPS = {
@@ -326,6 +371,17 @@ tr.group td {
       ["Rollouts from before paginated history", "Exit codes are read from Codex's output header."],
       ["Compressed (.jsonl.zst) rollouts", "Reported, not read. Off by default in Codex 0.163.0."],
       ["Codex Cloud", "Not read."]
+    ],
+    cursor: [
+      ["The desktop app's chats are not read", "A session in the Cursor desktop app has no findings or usage yet. Its composition is read."],
+      ["Usage is only in Cursor's debug log", "Kept for 7 days or the 50 newest files, and off with CURSOR_AGENT_DISABLE_DEBUG_LOG. A session read after its log is pruned has no usage. The daemon files usage as the session runs."],
+      ["The standard CLI writes usage per turn in print mode, and none in its terminal UI", "A terminal UI session has no usage and no cost findings. Print mode has one response per turn, so a minute's pace is coarser."],
+      ["The daemon names a run only beside its usage", "A finding from a session with no usage reaches Fleet with no person, account or opening words. This includes every terminal UI session."],
+      ["No thinking tokens, speed tier or hook output", "cost-runaway-session cannot give its thinking, fast-mode or hook-cause reasons."],
+      ["Skills are read with a file tool", "vulnerable-dep-invoked cannot tie a vulnerable skill to a session."],
+      ["Cursor's usage-limit and content-policy wording comes from its server", "blocked-quota and blocked-policy cannot fire until a real session shows it."],
+      ["Only a failed MCP connection is logged", "No advertised identity or transport per call. Egress over MCP uses the configured transport."],
+      ["Cloud agents", "Not read."]
     ]
   };
 
@@ -457,7 +513,7 @@ tr.group td {
 
   function renderGaps() {
     var box = document.getElementById("gaps");
-    [["devin", "Devin"], ["codex", "Codex"]].forEach(function (p) {
+    [["devin", "Devin"], ["codex", "Codex"], ["cursor", "Cursor"]].forEach(function (p) {
       var list = el("ul");
       GAPS[p[0]].forEach(function (g) {
         list.appendChild(el("li", null, [el("strong", { text: g[0] }), el("span", { text: g[1] })]));

{stacktrace_cli-0.15.0 → stacktrace_cli-0.16.0}/docs/agent-support.md

@@ -4,9 +4,9 @@ What Stacktrace supports for each agent kind, rule by rule and feature by
 feature, and what cannot be supported and why.
 
 *Living document. Change a grade in the PR that changes the support. Last
-updated 2026-10-18, against stacktrace 0.12.0, with the Codex work in
-[Codex as an agent kind](specs/codex-agent-kind.md), OpenAIDR 0.7.0 and
-OpenACA 0.10.1.*
+updated 2026-10-21, against stacktrace 0.15.0, with the Cursor work in
+[Cursor as an agent kind](specs/cursor-agent-kind.md), OpenAIDR 0.8.0 and
+OpenACA 0.12.0.*
 
 **Interactive version:** [`agent-support.html`](agent-support.html) in this
 directory, also published at <https://claude.ai/artifact/BfRR9drQ7D9WqVqGkBBkno>
@@ -20,6 +20,7 @@ both together.
 | `claude-code` | Claude Code CLI, IDE extensions, the Agent SDK, Claude Code on the web | — | Supported |
 | `devin` | Devin CLI, Devin Local (Devin Desktop's default agent), editors driving it over ACP | Devin Cloud (remote); Cascade (encrypted store) | Supported |
 | `codex` | Codex CLI, `codex exec`, the IDE extension and Codex app (through `codex app-server`) | Codex Cloud (remote) | Supported from stacktrace 0.12.0 |
+| `cursor` | Cursor CLI (`agent`, `cursor-agent`) in the terminal, in print mode and over ACP | The desktop app's own chats (not read yet); Cloud agents (remote) | Supported from the release that pins OpenAIDR 0.8.0 |
 
 ## Detections
 
@@ -28,31 +29,32 @@ both together.
 - **None**: the evidence does not exist.
 - **†**: waits on a field not yet confirmed in a real session.
 
-| Rule | Claude Code | Devin | Codex |
-|---|---|---|---|
-| **Security** | | | |
-| `credential-egress` | Full | Full† | Full. A remote server's call with no recorded transport is read from its configuration, at medium confidence |
-| `credential-persisted` | Full | Partial: `apply_patch` is not read | Full |
-| `credential-in-prompt` | Full | Full† | Full |
-| `pii-in-prompt` | Full | Full† | Full |
-| `destructive-action` | Full | Full† | Full |
-| `deceptive-completion` (reasoning, opt-in) | Full | Full† | Full |
-| `infra-unsafe-action` | Full | Partial: no entrypoint when the run log is not placed | Full |
-| `vulnerable-dep-invoked` | Full | Full | Partial: skills are never a call |
-| `credential-switched` | Full | Partial: `apply_patch` writes are not read | Full |
-| **Reliability** | | | |
-| `blocked-quota` | Full | None: Devin's wording is not read | Full |
-| `blocked-policy` | Full | None: no counterpart | Partial†: stops a turn, not a session |
-| `blocked-throttled` | Full | Partial: failed-call bodies only | Full† |
-| `blocked-upstream` | Full | Full† | Full |
-| **Cost** | | | |
-| `cost-runaway-session` | Full | Partial: see below | Partial: see below |
+| Rule | Claude Code | Devin | Codex | Cursor |
+|---|---|---|---|---|
+| **Security** | | | | |
+| `credential-egress` | Full | Full† | Full. A remote server's call with no recorded transport is read from its configuration, at medium confidence | Full. A remote MCP server's call is read from its configuration, at medium confidence |
+| `credential-persisted` | Full | Partial: `apply_patch` is not read | Full | Full: `Write`, `StrReplace` and `ApplyPatch` |
+| `credential-in-prompt` | Full | Full† | Full | Full |
+| `pii-in-prompt` | Full | Full† | Full | Full |
+| `destructive-action` | Full | Full† | Full | Full. A refused call never fires. Cursor's Delete protection, a team setting, refuses every `rm` |
+| `deceptive-completion` (reasoning, opt-in) | Full | Full† | Full | Full |
+| `infra-unsafe-action` | Full | Partial: no entrypoint when the run log is not placed | Full | Full |
+| `vulnerable-dep-invoked` | Full | Full | Partial: skills are never a call | Partial: skills are never a call |
+| `credential-switched` | Full | Partial: `apply_patch` writes are not read | Full | Full |
+| **Reliability** | | | | |
+| `blocked-quota` | Full | None: Devin's wording is not read | Full | None†: Cursor's own usage-limit wording is not read |
+| `blocked-policy` | Full | None: no counterpart | Partial†: stops a turn, not a session | None†: no counterpart confirmed |
+| `blocked-throttled` | Full | Partial: failed-call bodies only | Full† | Partial: failed-call bodies only |
+| `blocked-upstream` | Full | Full† | Full | Full |
+| **Cost** | | | | | |
+| `cost-runaway-session` | Full | Partial: see below | Partial: see below | Partial: see below |
 
 | | Full | Partial | None | Not shipped |
 |---|---|---|---|---|
 | Claude Code | 14 | 0 | 0 | 1 |
 | Devin | 7 (6 †) | 5 | 2 | 1 |
 | Codex | 11 (1 †) | 3 | 0 | 1 |
+| Cursor | 9 | 3 | 2 (2 †) | 1 |
 
 `cost-personal-anomaly` runs in Fleet on uploaded usage, so it works wherever
 the usage upload does (see Features).
@@ -83,43 +85,57 @@ the usage upload does (see Features).
 | Compressed (`.jsonl.zst`) rollouts | Reported, not read. Off by default in Codex 0.163.0 |
 | Codex Cloud | Not read |
 
+### Cursor
+
+| Gap | Effect |
+|---|---|
+| The desktop app's chats are not read | A session in the Cursor desktop app has no findings or usage yet. Its composition is read |
+| Usage is only in Cursor's debug log, kept for 7 days or the 50 newest files, and off with `CURSOR_AGENT_DISABLE_DEBUG_LOG` | A session read after its log is pruned has no usage. The daemon files usage as the session runs |
+| The standard CLI writes usage per turn in print mode, and none in its terminal UI | A terminal UI session has no usage and no cost findings. Print mode has one response per turn, so a minute's pace is coarser |
+| The daemon names a run only beside its usage | A finding from a session with no usage reaches Fleet with no person, account or opening words. This includes every terminal UI session |
+| No thinking tokens, speed tier or hook output | `cost-runaway-session` cannot give its thinking, fast-mode or hook-cause reasons |
+| Skills are read with a file tool; no record names one | `vulnerable-dep-invoked` cannot tie a vulnerable skill to a session |
+| Cursor's usage-limit and content-policy wording comes from its server | `blocked-quota` and `blocked-policy` cannot fire until a real session shows it |
+| Only a failed MCP connection is logged | No advertised identity or transport per call. Egress over MCP uses the configured transport |
+| Cloud agents | Not read |
+
 ## Features
 
-| Feature | Claude Code | Devin | Codex |
-|---|---|---|---|
-| **Sessions and detection** | | | |
-| Sessions read (`stacktrace sessions`, `detect`) | Yes | Yes | Yes |
-| Daemon follows live sessions | Yes | Yes | Yes |
-| Sub-agent sessions in a run | Yes | Yes† | Yes |
-| MCP connection evidence | Yes | Partial: no advertised identity | Partial: none under `codex exec`; no endpoint |
-| Reasoning stage (opt-in) | Yes | Yes | Yes |
-| Findings to Slack and webhooks | Yes | Yes | Yes |
-| Findings to Fleet | Yes | Yes | Yes. Not yet run against a live Fleet |
+| Feature | Claude Code | Devin | Codex | Cursor |
+|---|---|---|---|---|
+| **Sessions and detection** | | | | |
+| Sessions read (`stacktrace sessions`, `detect`) | Yes | Yes | Yes | Yes. The CLI only |
+| Daemon follows live sessions | Yes | Yes | Yes | Yes |
+| Sub-agent sessions in a run | Yes | Yes† | Yes | Yes |
+| MCP connection evidence | Yes | Partial: no advertised identity | Partial: none under `codex exec`; no endpoint | Partial: failed connections only |
+| Reasoning stage (opt-in) | Yes | Yes | Yes | Yes |
+| Findings to Slack and webhooks | Yes | Yes | Yes | Yes |
+| Findings to Fleet | Yes | Yes | Yes. Not yet run against a live Fleet | Yes. Run against a local Fleet |
 | **Cost** | | | |
-| Tokens per model response | Yes | Yes | Yes. Cached input separated |
-| Cache writes | Yes | Provider-dependent | No: OpenAI reports none |
-| Reasoning tokens | Yes | No | Yes |
-| Context window per response | From a model table | Partial: known for Claude models only | Recorded by Codex |
-| Cost findings | Yes | Partial | Partial |
-| Usage to Fleet and org baselines | Yes | Yes | Yes |
-| Fleet price rows | Yes | Estimated: no per-token price published | Partial: `gpt-5` to `gpt-5.6` priced; `gpt-6` and later unpriced until stacktrace-fleet adds their rows. Codex 0.163.0 defaults to `gpt-6.1-sol` |
-| **Who** | | | |
-| Signed-in account and person | Yes | Yes, through `devin auth status` | Yes. ChatGPT sign-in; an API key names no one |
-| **Composition** | | | |
-| BOM, Inventory and Vulnerabilities tabs | Yes | Yes | Yes |
-| Posture findings in Fleet | Yes | Partial: `command-policy-allow` is held back, since it attaches to no component | Partial: `command-policy-allow` and `project-trust` are held back, for the same reason |
-| **Local monitor** | | | |
-| Live tab | Yes | Yes | Yes |
-| Usage tab | Yes | Yes | Yes |
-| Refreshes when the agent's configuration changes | Yes | No | No. The page refreshes on session changes; configuration needs a reload |
-| **Gateway (Guard)** | | | |
-| Recognises the agent's traffic | Yes | Partial: named `devin-cli`, so calls go unclassified | Yes |
-| Classifies its calls and refusals | Yes | No | Yes |
-| **Claude-only** | | | |
-| Claude Code plugin: in-session alerts, `/stacktrace:findings` | Yes | No | Out of scope |
-| Playground (stacktrace.ai/playground) | Yes | No | Out of scope |
-| Managed policy deployment | Yes | No | Not planned |
-| Cloud bootstrap (Claude Code on the web) | Yes | No | Not planned: Codex Cloud is not read |
+| Tokens per model response | Yes | Yes | Yes. Cached input separated | Partial: per turn in print mode, none in the terminal UI, per response in the local-inference build. From Cursor's debug log while it is kept. Cached input separated |
+| Cache writes | Yes | Provider-dependent | No: OpenAI reports none | Yes |
+| Reasoning tokens | Yes | No | Yes | No |
+| Context window per response | From a model table | Partial: known for Claude models only | Recorded by Codex | Partial: recorded when Cursor states it, else a model table |
+| Cost findings | Yes | Partial | Partial | Partial |
+| Usage to Fleet and org baselines | Yes | Yes | Yes | Yes. Run against a local Fleet |
+| Fleet price rows | Yes | Estimated: no per-token price published | Partial: `gpt-5` to `gpt-5.6` priced; `gpt-6` and later unpriced until stacktrace-fleet adds their rows. Codex 0.163.0 defaults to `gpt-6.1-sol` | Partial: Fleet's `agents.cursor` rule adds Cursor's fee to `claude-*` and `gpt-*` rows; Cursor's own models are unpriced |
+| **Who** | | | | |
+| Signed-in account and person | Yes | Yes, through `devin auth status` | Yes. ChatGPT sign-in; an API key names no one | Partial: from `cli-config.json`, with no plan. A finding from a session with no usage names no one |
+| **Composition** | | | | |
+| BOM, Inventory and Vulnerabilities tabs | Yes | Yes | Yes | Yes |
+| Posture findings in Fleet | Yes | Partial: `command-policy-allow` is held back, since it attaches to no component | Partial: `command-policy-allow` and `project-trust` are held back, for the same reason | Partial: a rule that attaches to no component is held back, for the same reason |
+| **Local monitor** | | | | |
+| Live tab | Yes | Yes | Yes | Yes |
+| Usage tab | Yes | Yes | Yes | Yes |
+| Refreshes when the agent's configuration changes | Yes | No | No. The page refreshes on session changes; configuration needs a reload | No, as for Codex |
+| **Gateway (Guard)** | | | | |
+| Recognises the agent's traffic | Yes | Partial: named `devin-cli`, so calls go unclassified | Yes | No. Cursor's model calls go through Cursor's servers |
+| Classifies its calls and refusals | Yes | No | Yes | No |
+| **Claude-only** | | | | |
+| Claude Code plugin: in-session alerts, `/stacktrace:findings` | Yes | No | Out of scope | Out of scope |
+| Playground (stacktrace.ai/playground) | Yes | No | Out of scope | Out of scope |
+| Managed policy deployment | Yes | No | Not planned | Not planned |
+| Cloud bootstrap (Claude Code on the web) | Yes | No | Not planned: Codex Cloud is not read | Not planned: Cloud agents are not read |
 
 ## Where each grade comes from
 
@@ -135,4 +151,18 @@ the usage upload does (see Features).
   `gpt-6.1-sol` sent its usage to a local Fleet, which held it unpriced: the
   Fleet price rows grade comes from that run.
 
+- **Cursor:** this branch's code and tests (`tests/test_kind_conformance.py`,
+  `tests/test_openaidr_contract.py`), [Cursor as an agent
+  kind](specs/cursor-agent-kind.md), and OpenAIDR's `docs/specs/cursor.md`.
+  Both rest on the Cursor CLI `2026.10.19-6bbf2c4` (its local-inference build)
+  run against a mock model, and on its shipped bundle. On 2026-10-21 the
+  stacktrace-demo policy suite ran all 17 cases through that CLI and a daemon
+  from this branch, with a stand-in model that makes the calls each case asks
+  for: 13 passed. Both `rm -rf` cases ended `AGENT_REFUSED`, because that build
+  always turns on Cursor's Delete protection. `blocked-quota`
+  and `blocked-policy` ended `MISSING_FINDING`, as on every kind. The cost
+  suite's machine cases ran on generated Cursor sessions; see the spec. An
+  isolated daemon also synced two real Cursor sessions to a local Fleet, which
+  stored the agent, the signed-in account, the usage and a detection.
+
 A new rule adds a row here. A new kind adds a column.