Cursor plugin support: follow-ups from review

Aperta
  • Qualcosa non va?
#7,858 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
8/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
markdown, typescript
Ambito
devtools, documentation, security, testing

Direzione di ricerca

This is a checklist of about 30 deferred follow-ups across many PRs, not one task. Start with the entries that name files, such as docs/hooks/plugins.mdx:167, cursorHookRunner.ts:386, pluginHookTrust.ts:253 and mcpConfig.ts:568-575. Each needs its own issue and scope before anyone works on it, so the checklist itself is not a first contribution.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The Cursor plugin support stack landed on main (#7833, #7835, #7837, #7838, #7841, #7844, #7846, #7847, plus #7834 and the RFC #7829). These follow-ups were found in review and deferred. None blocks the shipped behavior.

Owner: the next agent or person who works on Cursor plugin support. Trigger: before the Cursor plugin feature is announced.

  • docs/hooks/plugins.mdx:167 'Each continuation shows the notice' is loose (newer waiting info notice replaces older): fix in PR 9 docs.
  • PR1 verifier F7: docs/hooks/plugins.mdx:213 does not mention Cursor packages -> PR 9.
  • RFC 7.2 wording: PR 7 moved the single prompt cut into mergeTurnStopContinuation (runTurnStopHooks returns kept reasons). Align RFC text after round 5, together with any round-5 fold-in.
  • RFC final alignment commit after code PRs: r5 findings (notApplied scan rejections, .git exclusion, command-hook gate, disabled settings-base renderer chain, path escaping) + PR7 7.2 cut placement.
  • PR1 F3: a declared folder that escapes via symlink is refused and logged but not in notApplied (needs refusal callback through shared resolveComponentPath). Track as issue after the stack. Install-preview warnings already show it; PR 2 can show component warnings on the card.
  • PR4 F2 (low): settings base naming an agent whose own base is missing: run applies it, list/renderer/ACP ignore as missing.
  • PR4 F3 (low): agent with base: takes Explore's chain and drops the fast agent's own Settings entry/effort (RFC silent on inherited settings base).
  • PR4 F4 (low): no repo test for TTL call site turnRequestBuilder.ts:2295, hint in turnContextAssembler.ts:1699, ACP map, TasksSection + 6 renderer maps.
  • PR3 F4 (low wording): ${PLUGIN_ROOT}/bin/server skipped as 'needs values' names a value Xum supplies. F5: servers refused for other reasons get no notApplied (PR2 card trigger). F6 info: Cursor inherits env_vars forwarding.
  • PR2 open item: plugin card does not show component warnings (servers/folders refused for other reasons); install preview + update review do. Follow-up issue.
  • PR1 follow-up: load .mdc/.markdown Cursor agents (listed as not applied for now).
  • PR2: Cursor marketplace entries with minClientVersions.cursor 'never' (finance, x-money) are listed in Xum; Cursor hides them. URL-string Cursor sources show as a missing folder.
  • PR2 verifier: U+202E can remain in folder paths (pre-existing shared subpath rule). minClientVersions 'never' covers 6 entries.
  • PR8 F2 (low): Stop waits up to timeout+2 s when a hook's detached child keeps stdout open (cursorHookRunner.ts:386). Nothing applied.
  • PR1 follow-up: rules over MAX_PLUGIN_COMMANDS cap need a bounded notApplied summary (RFC r6 P2).
  • MCP headers skip (mcpConfig.ts:568-575) rests on an out-of-date reason: SDK refuses cross-origin redirects since 2.3.0.
  • 'Show full text' gate before install is enforced only by the renderer's disabled button; backend does not check.
  • PR4 follow-up: renderer base map holds one base per agent ID; two agents reaching the same disabled agent from different scopes share a step (use resolved layers).
  • PR8 follow-up: downgrade -> unreviewed update on an old build -> upgrade keeps old hook trust; closing it needs a persisted reviewed-tree record.
  • PR1 low: globs-cap test passes with the fix reverted (memory-only hardening); orphaned docblock cursorRules.ts:64-67.
  • PR8 F6: X8 size check on first-trust review has no test.
  • PR4 L2: no test pins the useWorkspaceAiSelection half of the React Compiler fix.
  • PR8: Codex Stop hooks stay deaf to the Stop signal (follow-up). Journal recovery after crash makes trusted hooks read 'changed' (fails closed).
  • PR8: a trust revoke during runtime.exec's folder-check await still starts the process; needs a trust generation checked right before spawn.
  • PR8: unreadable trust store at registration drops Cursor hooks with no notice (fails closed).
  • PR8 F7 (low): no suite test for the rebind-only-old-commit guard (pluginHookTrust.ts:253); verifier probe covers it.
  • PR1: unrecognized Cursor manifest keys need bounded notApplied entries (RFC r7 P2).
  • PR4: scope the model: fast mapping to Cursor agents (shared mapAiDefaults also maps Claude/foreign agents) (RFC r7 P2).

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Lingua principale
TypeScript
Stelle
2.1k
Fork
139
Merge medio
4h 38m
PR unite (30g)
926

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di coder/xum

Tutte le issue di coder/xum

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.