Repository navigation
feat(trace): add the Cursor harness to the end-to-end suite - #3683
Merged
Merged
Conversation
Run the Cursor CLI (cursor-agent) headless in the Trace end-to-end suite, with HOME next to the workspace so the configuration and hooks of the user do not load. Pin the CLI version in the suite config. Refs chainloop-dev#3635 Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 0f698192-ddc8-487e-b214-474edc859d4e
Contributor
PR validation — ✅ 3 passing
AI Session Checks — 🟢 91% · ✅ 0 failing
|
| Status | Attribution | File | Lines |
|---|---|---|---|
| created | ai | app/cli/internal/trace/e2e/cursor.go |
+262 / -0 |
| created | ai | app/cli/internal/trace/e2e/cursor_test.go |
+160 / -0 |
| created | ai | app/cli/internal/trace/e2e/checks_test.go |
+57 / -0 |
| modified | ai | app/cli/internal/trace/README.md |
+10 / -11 |
| modified | ai | app/cli/internal/trace/e2e/checks.go |
+9 / -0 |
| modified | ai | app/cli/internal/trace/e2e/config.yaml |
+9 / -0 |
| modified | ai | app/cli/internal/trace/PROVIDERS.md |
+2 / -2 |
| modified | ai | app/cli/internal/trace/e2e/claude.go |
+2 / -2 |
| modified | ai | app/cli/internal/trace/e2e/harness.go |
+3 / -0 |
| modified | ai | app/cli/internal/trace/e2e/result_test.go |
+1 / -1 |
| modified | ai | app/cli/internal/trace/e2e/e2e_test.go |
+1 / -0 |
Policies (4)
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | ai-config-ai-agents-allowed |
ai-coding-session-0f6981 |
- |
| ✅ Passed | ai-config-no-dangerous-commands |
ai-coding-session-0f6981 |
- |
| ✅ Passed | ai-config-no-secrets |
ai-coding-session-0f6981 |
- |
| ✅ Passed | ai-config-mcp-servers-allowed |
ai-coding-session-0f6981 |
- |
Security Checks — ✅ 6 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
✅ iac-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | iac-misconfiguration |
- |
Scans not applied (2)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
Security context
✅ Nothing this change touches has a recorded security-fix history.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
Cursor runs its shell tool in a login shell, where the macOS path_helper puts /usr/local/bin first in PATH. The git hooks of a session then ran an installed chainloop, not the CLI under test. The harness now writes shell startup files in its HOME that set PATH back. In auto mode no output names the model, so the model detection check is not covered for an auto session. Set the Cursor cells of the feature tables from the suite results. Refs chainloop-dev#3635 Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 0f698192-ddc8-487e-b214-474edc859d4e
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 7 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
A pasted image stays inline in the Cursor transcript, so the redaction can see media there. The headless CLI cannot attach an image, so the suite cannot check it. Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 0f698192-ddc8-487e-b214-474edc859d4e
javirln
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Cursor harness to the Chainloop Trace end-to-end suite. This is part of milestone 3 of spec issue-3635 (R-003, R-004, R-011). It refs #3635.
e2e/cursor.goruns the Cursor CLI (cursor-agent -p --output-format stream-json --force --trust).HOMEis a folder next to the workspace, so the Cursor configuration and hooks of the user do not load. The Trace hooks read the transcripts from the same folder. The CLI then has no stored login, so a run needsCURSOR_API_KEY.path_helperputs/usr/local/binfirst inPATH, so the git hooks ran an installedchainloop, not the CLI under test. The harness writes shell startup files in itsHOMEthat setPATHback.is_errorfails the run, also when the process exits with status 0.DisableSessionStartremoves thesessionStartentry from.cursor/hooks.json.2026.10.19-6bbf2c4with theautomodel, which is the only model of a free plan. In auto mode no output names the model, so the model name check is "not covered" for anautosession.This PR was written with the help of Claude Code.