[minor] MLAI-1288 - Enforce Cursor skill governance through agent-guard

[shmuelqwak]

Moves Cursor skill governance out of in-plugin Node and into agent-guard, and brings the Cursor wiring in line with the Claude Code plugin — where the behaviour genuinely should match, and deliberately not where Cursor differs.

What the hook does now

npm_config_fetch_retries=0 npm_config_fetch_timeout=10000 \
JF_AGENT_GUARD_ENFORCE_DEADLINE="$(($(date +%s) + 25))" \
npx --yes --prefer-offline --registry "${JFROG_AGENT_GUARD_REPO:-…}" \
  @jfrog/agent-guard --enforce-skill --client cursor

Byte-identical on both governed surfaces — beforeSubmitPrompt (unmatched, so every submission) and preToolUse (matcher Read, since Cursor has no Skill tool).

	before	after
|| exit 2	present	removed
--waiver-helper	passed	removed — gone from agent-guard's flag table
version	${JFROG_AGENT_GUARD_VERSION:+@…}	unpinned → always latest
deadline	none	absolute, computed fresh, no inheritable fallback
fetch bounds	none	retries=0, timeout=10000
cache	none	--prefer-offline, refreshed by a sessionStart pre-warm
timeout / failClosed	20 / true	30 / false

Infrastructure failure now fails OPEN

|| exit 2 is gone and failClosed is false. npx missing, a failed install, an unreachable registry, or no configured JFrog server all let the skill through. A machine that cannot get a verdict is not governed by it, and refusing every skill there enforces nothing except the user's inability to work.

A real policy denial still blocks: on Cursor the verdict travels as JSON on stdout with exit 0, so the payload carries it regardless of failClosed. failClosed was only ever a crash net, never how a block is signalled.

This is where Cursor deliberately diverges from Claude Code. The Claude plugin blocks when the guard reaches the check but cannot finish it in time; here that case allows, because a killed or failed hook is not a block under failClosed: false. The README states the divergence rather than papering over it.

Verified against a genuinely unconfigured machine (0 jf servers, no setup.json, no env):

beforeSubmitPrompt -> {"continue":true}   exit=0
preToolUse         -> {}                  exit=0
agent-guard: could not resolve JFrog credentials, so this skill is NOT governed

Both are the correct Cursor allow shapes — explicit JSON, never silence.

The waiver helper is deleted

agent-guard v1.11.0 files waivers itself via --request-waiver, and --waiver-helper is no longer in its flag table. plugins/jfrog/scripts/governance/ is removed entirely, so the plugin holds no credentials and no waiver logic.

Two earlier commits on this branch had rewritten request-waiver.mjs to the Unified Policy Phase II payload. That work is obsolete under the new split, so the branch was recommitted without it.

Nothing may pin the version

All three invocations name @jfrog/agent-guard bare. Proven empirically, not just asserted — with JFROG_AGENT_GUARD_VERSION=9.9.9 exported, argv still carries bare @jfrog/agent-guard. A shipped GA fix therefore reaches users without a plugin release.

Minimum required: agent-guard ≥ 1.11.0. This matters more than it looks. On 1.10.0 the same event blocks:

	no project, no credentials
v1.10.0	{"continue":false} — "no project is set"
v1.11.0	{"continue":true} — allowed

1.10.0 decided "no project" locally; 1.11.0 refers it to the service and fails open on unresolvable credentials.

Why sessionStart pre-warms the cache

--prefer-offline on the governed hooks is only safe if something refreshes the npx cache. Without it, a machine can serve a stale agent-guard indefinitely — this was hit in real testing: a cached 1.10.0 kept being used while 1.11.0 was latest, silently reinstating the bug above. It read as a governance verdict, not as a stale binary.

Cursor's hook schema has no async field, so the pre-warm detaches itself:

( npx --yes --registry "${JFROG_AGENT_GUARD_REPO:-…}" @jfrog/agent-guard --version >/dev/null 2>&1 & ) ; exit 0

Measured: returns in 0s, and the detached fetch lands the latest version in the cache. It deliberately omits --prefer-offline, since hitting the registry is its only purpose, and the explicit exit 0 keeps a warm failure from ever failing session start.

Validation

scripts/validate-skill-governance.mjs was rewritten — its old assertions demanded the exact things this PR removes (must end in "|| exit 2", must pass the waiver helper, failClosed === true). 34 checks, all passing, asserting the inverted contract and executing the real command string from hooks.json against a stub npx.

Behavioural checks run against both surfaces with surface-shaped payloads, rather than testing preToolUse and inheriting the result. Notable checks:

• npm_config_fetch_timeout is asserted by value (<= 10000), so an edit back to npm's 300000 default fails rather than passing a presence check.
• The deadline check executes the command and reads what the child receives, including that a stale inherited JF_AGENT_GUARD_ENFORCE_DEADLINE does not survive.
• The pre-warm must exist, must not use --prefer-offline, must not pin a version, must detach, and must end in exit 0.
• The package-resolution sessionStart hook is located by content, never by index — that list is shared and other features append to it; it has already moved once.

Not verified

• Windows. Cursor's hook schema has no shell field, so the command runs in the platform's default shell. It is POSIX (${VAR:-default}, $(( ))), so on cmd/PowerShell it cannot run and governed actions are allowed unchecked. Stated in the README; unchanged from before this PR, which was equally POSIX-only.
• Warm per-call cost. The hook spawns a shell, npx and the guard on every prompt submission and every Read, with no throttle and no verdict cache. --prefer-offline is what makes that affordable, but the warm cost has not been measured.
• Cold start allows. With no pre-warm completed and failClosed: false, the first governed action on a cold machine can be allowed. The detached pre-warm narrows the window but does not close it.

Release

[minor] — 0.5.18 → 0.6.0, bumped in both plugins/jfrog/.cursor-plugin/plugin.json and .cursor-plugin/marketplace.json as validate-version.yml requires.

[YoniMelki]

The inline comments list the required changes.

[YoniMelki]

This text says that only JSON on stdout can block and that the hook always exits 0. Cursor treats exit code 2 as a deny. failClosed: false does not change that. scripts/validate-skill-governance.mjs already asserts that path. An Agent Guard internal deadline that exits 2 will block. A Cursor hook kill after the timeout will allow. Split those two cases in this note.

[YoniMelki]

This workflow runs only on a pull request. .github/workflows/release.yml does not run scripts/validate-skill-governance.mjs. CONTRIBUTING.md states that pull-request checks do not see the merge commit. Add the same command to the release job.

[YoniMelki]

Remove this paragraph. The sentence above it already states the same rule.

[YoniMelki]

preToolUse matches only Read. Other tools can put a skill body in front of the model. The Skills governance section already states that gap. Align the capabilities table with that limit.

[YoniMelki]

These checks use a stub npx. They do not run a real @jfrog/agent-guard binary. They also omit JSON that is not valid and empty stdout with exit 0.

[YoniMelki]

This path list watches plugins/jfrog/scripts/**. It does not watch plugins/jfrog/modules/**. The no-governance check uses a fixed list under scripts/governance/. Include plugins/jfrog/modules/** in the path list.

[YoniMelki]

This command returns at once with exit 0. If Cursor stops the hook process group, the background npx does not refresh the cache. The validator only checks the command shape. Confirm that the detached process stays alive after the hook returns.