llm-cli-gateway: Skill for Claude Code

Provider: Cursor Agent CLI

Keep the gateway's Cursor (cursor-agent) integration aligned with the upstream CLI. This skill does not define argv or environment behaviour. The single mechanical source of truth is UPSTREAM_CLI_CONTRACTS.cursor in src/upstream-contracts.ts, enforced by validateUpstreamCliArgs and validateUpstreamCliEnv. Do not re-encode flags, execution modes, ACP rules, or session rules here or in TOML.

Identity

These values mirror UPSTREAM_CLI_CONTRACTS.cursor.upstreamMetadata and docs/upstream/provider-sources.dag.toml ([providers.cursor]). The TypeScript metadata is authoritative; the TOML is scanner input only.

Gateway use

1. Discover the live gateway surface before relying on Cursor-specific controls:

   provider_tool_capabilities({cli:"cursor"})
   

   For a cached read-only resource, use provider-tools://cursor.
2. Use cursor_request for normal work and cursor_request_async for long-running work. Sync calls may auto-defer; poll llm_job_status and fetch with llm_job_result when that happens.
3. Omit model unless the caller explicitly requests one. Use only controls reported by provider_tool_capabilities, especially execution mode, sandbox, workspace, and session controls. Cursor must use approvalStrategy:"legacy": it rejects mcp_managed before launch because ambient MCP configuration cannot be isolated, and approvalPolicy has no effect.
4. Keep provider-owned MCP configuration separate from gateway metadata. Do not assume every Cursor CLI control is safe to expose through a request.
5. Cursor accepts flat prompt only, not promptParts. workingDir selects the child process cwd on transport:"cli", as it does for every other provider. It is CLI-only: transport:"acp" rejects it in rejectUnsupportedCursorAcpParams alongside addDir, because the ACP route resolves its own scope and would otherwise discard it silently. Its workspace field is separate and selects a local target directory, registered alias, or provider-native .code-workspace file. A directory/alias establishes child cwd; a workspace file remains a native argument and is not misused as spawn.cwd. Because both inputs can name a cwd, resolveCursorWorkingDir rejects an absolute workspace path that disagrees with workingDir instead of ranking them; identical values are admitted. Verify the target before reviewing concurrent repositories. An unregistered relative value remains a provider-native saved-workspace name and is passed through verbatim, never resolved against the gateway process cwd. Use an absolute path when selecting an unregistered local directory as child cwd.
6. Use a real resumable Cursor chat only when the response reports it as resumable. Gateway bookkeeping IDs are not automatically valid Cursor chat IDs. Continuation remains provider-native under legacy. A cwd-scoped resumeLatest needs a stable selected target.
7. Native ACP is capability-gated. It rejects approvalStrategy:"mcp_managed" and any approvalPolicy, as does the Cursor CLI gateway path. Probe cursor-agent acp --help when validating the installed entrypoint.
8. An unscoped CLI child uses a fresh neutral temporary cwd, not the gateway repository. Cursor's argv-bound prompt rejects oversized UTF-8 input as non-retryable input_too_large; the gateway never truncates it. All other caller-controlled argv values are admitted in their final encoded form before spawn. Embedded NUL bytes return non-retryable invalid_input without exposing the rejected value.