Cursor plugin support: follow-ups from review

Abierto
  • ¿Algo no está bien?
#7,858 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
8/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Activo
Stack tecnológico
markdown, typescript
Área
devtools, documentation, security, testing

Línea de trabajo

This is a checklist of about 30 deferred follow-ups across many PRs, not one task. Start with the entries that name files, such as docs/hooks/plugins.mdx:167, cursorHookRunner.ts:386, pluginHookTrust.ts:253 and mcpConfig.ts:568-575. Each needs its own issue and scope before anyone works on it, so the checklist itself is not a first contribution.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

The Cursor plugin support stack landed on main (#7833, #7835, #7837, #7838, #7841, #7844, #7846, #7847, plus #7834 and the RFC #7829). These follow-ups were found in review and deferred. None blocks the shipped behavior.

Owner: the next agent or person who works on Cursor plugin support. Trigger: before the Cursor plugin feature is announced.

  • docs/hooks/plugins.mdx:167 'Each continuation shows the notice' is loose (newer waiting info notice replaces older): fix in PR 9 docs.
  • PR1 verifier F7: docs/hooks/plugins.mdx:213 does not mention Cursor packages -> PR 9.
  • RFC 7.2 wording: PR 7 moved the single prompt cut into mergeTurnStopContinuation (runTurnStopHooks returns kept reasons). Align RFC text after round 5, together with any round-5 fold-in.
  • RFC final alignment commit after code PRs: r5 findings (notApplied scan rejections, .git exclusion, command-hook gate, disabled settings-base renderer chain, path escaping) + PR7 7.2 cut placement.
  • PR1 F3: a declared folder that escapes via symlink is refused and logged but not in notApplied (needs refusal callback through shared resolveComponentPath). Track as issue after the stack. Install-preview warnings already show it; PR 2 can show component warnings on the card.
  • PR4 F2 (low): settings base naming an agent whose own base is missing: run applies it, list/renderer/ACP ignore as missing.
  • PR4 F3 (low): agent with base: takes Explore's chain and drops the fast agent's own Settings entry/effort (RFC silent on inherited settings base).
  • PR4 F4 (low): no repo test for TTL call site turnRequestBuilder.ts:2295, hint in turnContextAssembler.ts:1699, ACP map, TasksSection + 6 renderer maps.
  • PR3 F4 (low wording): ${PLUGIN_ROOT}/bin/server skipped as 'needs values' names a value Xum supplies. F5: servers refused for other reasons get no notApplied (PR2 card trigger). F6 info: Cursor inherits env_vars forwarding.
  • PR2 open item: plugin card does not show component warnings (servers/folders refused for other reasons); install preview + update review do. Follow-up issue.
  • PR1 follow-up: load .mdc/.markdown Cursor agents (listed as not applied for now).
  • PR2: Cursor marketplace entries with minClientVersions.cursor 'never' (finance, x-money) are listed in Xum; Cursor hides them. URL-string Cursor sources show as a missing folder.
  • PR2 verifier: U+202E can remain in folder paths (pre-existing shared subpath rule). minClientVersions 'never' covers 6 entries.
  • PR8 F2 (low): Stop waits up to timeout+2 s when a hook's detached child keeps stdout open (cursorHookRunner.ts:386). Nothing applied.
  • PR1 follow-up: rules over MAX_PLUGIN_COMMANDS cap need a bounded notApplied summary (RFC r6 P2).
  • MCP headers skip (mcpConfig.ts:568-575) rests on an out-of-date reason: SDK refuses cross-origin redirects since 2.3.0.
  • 'Show full text' gate before install is enforced only by the renderer's disabled button; backend does not check.
  • PR4 follow-up: renderer base map holds one base per agent ID; two agents reaching the same disabled agent from different scopes share a step (use resolved layers).
  • PR8 follow-up: downgrade -> unreviewed update on an old build -> upgrade keeps old hook trust; closing it needs a persisted reviewed-tree record.
  • PR1 low: globs-cap test passes with the fix reverted (memory-only hardening); orphaned docblock cursorRules.ts:64-67.
  • PR8 F6: X8 size check on first-trust review has no test.
  • PR4 L2: no test pins the useWorkspaceAiSelection half of the React Compiler fix.
  • PR8: Codex Stop hooks stay deaf to the Stop signal (follow-up). Journal recovery after crash makes trusted hooks read 'changed' (fails closed).
  • PR8: a trust revoke during runtime.exec's folder-check await still starts the process; needs a trust generation checked right before spawn.
  • PR8: unreadable trust store at registration drops Cursor hooks with no notice (fails closed).
  • PR8 F7 (low): no suite test for the rebind-only-old-commit guard (pluginHookTrust.ts:253); verifier probe covers it.
  • PR1: unrecognized Cursor manifest keys need bounded notApplied entries (RFC r7 P2).
  • PR4: scope the model: fast mapping to Cursor agents (shared mapAiDefaults also maps Claude/foreign agents) (RFC r7 P2).

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Lenguaje dominante
TypeScript
Estrellas
2.1k
Forks
139
Merge medio
4 h 38 min
PR fusionados (30 d)
926

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de coder/xum

Todos los issues de coder/xum

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.