Enable Cursor reviews with hostile boundary checks

PRODUCT.md

@@ -28,10 +28,13 @@ Developers run `npx diffsplain` in a Git checkout. With no arguments, it compare
 - Compare the current checkout with its default branch when no target is passed.
 - Accept local paths, Git URLs, and GitHub `owner/name` repo names.
 - Report local dependency paths, versions, and readiness with `diffsplain doctor`.
-- Try Codex, Claude, Copilot, then OpenCode when no agent is chosen. Cursor
-  detection does not mean support: Diffsplain detects it only so it can report
-  that Cursor is unsupported. It has no supported read-only, no-network,
-  no-tool mode, so it cannot generate notes.
+- Try Codex, Claude, Copilot, Cursor, then OpenCode when no agent is chosen.
+  Use Cursor only when version 2026.08.11 or newer passes the hostile boundary
+  check. Cursor still contacts its service, but its review tools cannot read or
+  change host files, run commands, use MCP, or reach hosts. Keep Cursor login
+  data outside its readable workspace, and make the canary attempt each blocked
+  action. Once Diffsplain chooses an agent, do not switch agents after a failed
+  check or run.
 - Show tracked and untracked worktree changes, exact local ranges, and remote branches as secondary targets.
 - Present full or shortened unified diffs, including binary-file metadata.
 - Pair the whole change and each file with agent-written summaries, reasons, details, and risks.

README.md

@@ -13,10 +13,13 @@ npx diffsplain
 
 The command opens a local page and compares the checkout with its default
 branch. It starts at port `2299` and uses the next free port when needed. You
-need Node.js 22.13 or newer and a signed-in Codex, Claude, Copilot, or OpenCode
-CLI. Diffsplain tries them in that order. Pull requests also need a signed-in
-GitHub CLI. Cursor reviews stay disabled because Cursor Agent has no supported
-read-only, no-network, no-tool mode.
+need Node.js 22.13 or newer and a signed-in Codex, Claude, Copilot, Cursor, or
+OpenCode CLI. Diffsplain tries them in that order. Cursor Agent must be version
+2026.08.11 or newer and pass a hostile boundary check. It still contacts the
+Cursor service, but its login data stays outside the readable workspace and its
+review tools cannot access the host. Pull requests also need a signed-in GitHub
+CLI. Once Diffsplain chooses an agent, a failed check or run ends the command;
+it does not switch agents.
 
 Common targets:
 
@@ -49,6 +52,7 @@ Arguments:
 | `--batch-size COUNT` | Set the most files per agent pass. The default is `12`; large patches use smaller batches. |
 | `--jobs COUNT` | Set agent passes to run at once. The default is `3`. |
 | `--force` | Regenerate all agent notes instead of using cached notes. |
+| `--skip-safety-checks` | Use an explicitly selected Cursor without its compatibility gate or boundary canary. |
 | `--support-record` | Print a safe JSON record if the review fails. |
 | `--support-record-file FILE` | Write one safe JSON record if the review fails. |
 | `--remote NAME\|URL` | Choose the Git remote. The default is `origin`. |

docs/content/agent-notes.mdx

@@ -6,11 +6,23 @@ sidebar:
 ---
 
 A coding agent writes short notes for each changed file by default. Diffsplain
-tries Codex, Claude, Copilot, then OpenCode, and uses the first installed CLI.
-Each CLI uses its current login. Cursor detection does not mean support:
-Diffsplain detects it only to give a clear unsupported-provider result. Cursor
-stays disabled for note generation because it has no supported read-only,
-no-network, no-tool mode.
+tries Codex, Claude, Copilot, Cursor, then OpenCode, and uses the first usable
+CLI. Each CLI uses its current login.
+
+Cursor Agent needs version 2026.08.11 or newer. Before note work starts,
+Diffsplain checks its flags and runs a hostile canary. Cursor runs in
+non-interactive Ask mode in a disposable workspace. A read-only sandbox turns
+off temporary writes and denies shell network access by default. Fixed rules
+deny shell, write, WebFetch, WebSearch, and MCP actions. The workspace contains
+none of the target repo's Cursor rules, root agent files, skills, hooks,
+plugins, or MCP settings. Login data and private Cursor state stay outside the
+readable workspace. The canary asks Cursor to try each blocked read, write,
+shell, network, search, and MCP action, then checks each permission denial and
+host side effect. Diffsplain does not pass force, yolo, automatic review,
+automatic MCP approval, or workspace trust flags. Cursor still contacts its
+own service. An old CLI, a missing control, a trust prompt, or a failed canary
+stops Cursor before notes start. Once Diffsplain chooses an agent, a failed
+check or run ends the command; it does not switch to another agent.
 
 Use a plain diff when you do not want notes:
 

docs/content/cli.mdx

@@ -145,13 +145,14 @@ pnpm run doctor
 | `--branch NAME` | Compare a remote branch with its default branch. |
 | `--worktree` | Review tracked and untracked changes against `HEAD`. |
 | `--base REF --head REF` | Review an exact local range. |
-| `--agent NAME` | Use `codex`, `claude`, `copilot`, or `opencode`. |
+| `--agent NAME` | Use `codex`, `claude`, `copilot`, `cursor`, or `opencode`. |
 | `--no-agent` | Show the diff without agent notes. |
 | `--model NAME` | Choose the model used for notes. |
 | `--reasoning LEVEL` | Set `minimal`, `low`, `medium`, `high`, or `xhigh`. |
 | `--batch-size COUNT` | Set the most files per agent pass, from `1` to `50`. Large patches use smaller batches. |
 | `--jobs COUNT` | Set agent passes to run at once, from `1` to `8`. |
 | `--force` | Regenerate all agent notes instead of using cached notes. |
+| `--skip-safety-checks` | Use an explicitly selected Cursor without its compatibility gate or boundary canary. |
 | `--support-record` | Print a safe JSON record if the review fails. |
 | `--support-record-file FILE` | Write one safe JSON record if the review fails. |
 | `--remote NAME\|URL` | Choose the Git remote. The default is `origin`. |
@@ -175,13 +176,24 @@ from the current directory. `CODEX_BIN`, `CLAUDE_BIN`, `COPILOT_BIN`,
 accept `--model`. Only Codex and OpenCode accept `--reasoning`; its levels are
 `minimal`, `low`, `medium`, `high`, and `xhigh`.
 
+`--skip-safety-checks` requires `--agent cursor`. It skips Cursor's version and
+feature check and the hostile boundary canary. Cursor still receives the normal
+sandbox and denied-tool settings, but Diffsplain does not verify that the
+installed Cursor version enforces them.
+
 `--batch-size` defaults to `12` and accepts `1` through `50`. `--jobs` defaults
 to `3` and accepts `1` through `8`. `--port` accepts `0` through `65535`. When
 you omit it, Diffsplain starts at `2299` and increments until it finds a free
-port. When you omit `--agent`, Diffsplain tries Codex, Claude, Copilot, then
-OpenCode. It stops with an error if none are installed. Cursor reviews stay
-disabled because Cursor Agent has no supported read-only, no-network, no-tool
-mode. `--agent cursor` reports that boundary failure without starting Cursor.
+port. When you omit `--agent`, Diffsplain tries Codex, Claude, Copilot, Cursor,
+then OpenCode. It stops with an error if none are usable. Cursor Agent needs
+version 2026.08.11 or newer and must pass its hostile boundary canary. It runs
+in Ask mode in an isolated, read-only, no-tool workspace with shell network
+access denied. Login and private Cursor state stay outside that readable
+workspace. The canary attempts each blocked capability and requires permission
+denials without host side effects. Cursor still contacts its own service.
+`--agent cursor` reports an upgrade or boundary error before note generation
+when any check fails. Once Diffsplain chooses an agent, a failed check or run
+ends the command; Diffsplain does not switch agents.
 
 The two support record options are opt-in and cannot be combined. They include
 the selected agent, so you cannot use them with `--no-agent`. See

docs/content/development.mdx

@@ -165,12 +165,12 @@ corepack pnpm run cloud:check
 
 `cloud:check` runs the clean-checkout gate and the provider/browser tests.
 Those tests use fake coding providers and a fake browser command. Real Codex,
-Claude, Copilot, OpenCode, GitHub, or browser login is optional and is needed
-only for a live integration task. Diffsplain tries Codex, Claude, Copilot, then
-OpenCode for notes. Cursor detection does not mean support: it is detected only
-to report that Cursor is unsupported. Cursor stays disabled because it has no
-supported read-only, no-network, no-tool mode. Keep credentials in Codex
-environment settings, not checked-in rules or scripts.
+Claude, Copilot, Cursor, OpenCode, GitHub, or browser login is optional and is
+needed only for a live integration task. Diffsplain tries Codex, Claude,
+Copilot, Cursor, then OpenCode for notes. Cursor Agent 2026.08.11 or newer must
+pass a hostile boundary check in its isolated review workspace. It still
+contacts the Cursor service. Keep credentials in Codex environment settings,
+not checked-in rules or scripts.
 
 To test the linked-worktree path itself, run:
 

docs/content/index.mdx

@@ -11,11 +11,11 @@ patch on the left and a short coding agent note on the right.
 
 ## Start a review
 
-You need Node.js 22.13 or newer and a signed-in Codex, Claude, Copilot, or
-OpenCode CLI. Diffsplain tries Codex, Claude, Copilot, then OpenCode when you
-do not choose one. Cursor detection does not mean support: it is detected only
-to report that Cursor is unsupported. Cursor has no supported read-only,
-no-network, no-tool mode required for note generation, so it stays disabled.
+You need Node.js 22.13 or newer and a signed-in Codex, Claude, Copilot, Cursor,
+or OpenCode CLI. Diffsplain tries Codex, Claude, Copilot, Cursor, then OpenCode
+when you do not choose one. Cursor Agent must be version 2026.08.11 or newer
+and pass a hostile boundary check. Cursor still contacts its service, but its
+review tools cannot access the host.
 
 ```sh
 npx diffsplain

scripts/cli-args.mjs

@@ -40,6 +40,7 @@ export const cliOptions = defineCliOptions({
   '--agent': { kind: 'agent' },
   '--no-agent': { kind: 'no-agent' },
   '--force': { kind: 'flag' },
+  '--skip-safety-checks': { kind: 'flag' },
   '--worktree': { kind: 'flag' },
   '--no-browser': { kind: 'flag' },
   '--support-record': { kind: 'flag' },
@@ -86,13 +87,15 @@ Targets:
 Options:
   --repo PATH|URL|OWNER/NAME
                       Repo to review (default: current repo)
-  --agent NAME        Use codex, claude, copilot, or opencode
+  --agent NAME        Use codex, claude, copilot, cursor, or opencode
   --no-agent          Do not write agent notes
   --model NAME        Model for agent notes
   --reasoning LEVEL   Agent reasoning effort when supported
   --batch-size COUNT  Maximum files per agent pass (default: ${batchSizeOption.default})
   --jobs COUNT        Agent passes to run at once (default: ${jobsOption.default})
   --force             Regenerate all agent notes
+  --skip-safety-checks
+                      Use Cursor without compatibility or boundary checks
   --support-record    Print a safe record if agent notes fail
   --support-record-file FILE
                       Write a safe record if agent notes fail
@@ -107,12 +110,12 @@ Options:
   -h, --help          Show this help
   -v, --version       Show the installed version
 
-Agent fallback:
-  codex, claude, copilot, opencode
+Automatic agent selection:
+  codex, claude, copilot, cursor, opencode
 
 Cursor:
-  Disabled because Cursor Agent has no supported read-only, no-network,
-  no-tool mode
+  Requires Cursor Agent 2026.08.11 or newer and a passing boundary canary.
+  Cursor contacts its service, but its review tools cannot access the host.
 
 Examples:
   diffsplain
@@ -271,6 +274,9 @@ export function parseCliArgs(
   if (noAgent && options.has('--summaries')) {
     fail('--no-agent cannot be used with --summaries');
   }
+  if (options.has('--skip-safety-checks') && agent !== 'cursor') {
+    fail('--skip-safety-checks requires --agent cursor');
+  }
   if (
     noAgent &&
     (options.has('--support-record') ||
@@ -368,6 +374,9 @@ export function parseCliArgs(
   }
   const agentArgs = [...commonArgs];
   if (options.has('--force')) agentArgs.push('--force');
+  if (options.has('--skip-safety-checks')) {
+    agentArgs.push('--skip-safety-checks');
+  }
   for (const name of [
     '--codex-bin',
     '--model',
@@ -472,5 +481,6 @@ export function parseCliArgs(
     host,
     browserEnabled: !options.has('--no-browser'),
     forceSummaryRegeneration: options.has('--force'),
+    skipSafetyChecks: options.has('--skip-safety-checks'),
   };
 }