feat(trace): install the Cursor shell hooks

[jiparis]

The Cursor trace provider installed only the sessionStart, sessionEnd and afterFileEdit hooks, so the trace did not see the shell commands that the Cursor agent runs. Cursor has preToolUse and postToolUse hooks that cover its Shell tool, with the command, the working directory and a per-call tool_use_id.

This change:

• Installs preToolUse and postToolUse with the matcher Shell in .cursor/hooks.json. chainloop trace run installs them too.
• Makes Cursor a command-tool provider. The shell hooks use the shared worktree snapshot path, so the files that a shell command changes are attributed to the AI, the same as for Claude Code and OpenCode. ReadHookInput reads tool_name, tool_use_id, tool_input.command and cwd. The transcript location stays on the first workspace root, because the shell cwd can be a subdirectory.
• Adds the HookInput.Command field, with the same definition as in fix(trace): register checkouts that shell commands work in #3623, which reads it to find other checkouts.
• Makes the pre hook always write {"permission":"allow"} before it does any work. Cursor blocks the action when a preToolUse response is not valid JSON, and the trace must never block the agent.
• Updates the trace README: shell changes attribution is now Partial for Cursor (the hooks are not verified for the Cursor CLI), and the hook table lists the new hooks.

Out of scope: the session link after push (the postToolUse response has no field that Cursor shows to the user), prompt hooks, and the Cursor CLI.

Tested with unit tests for hook install, upgrade of an existing entry without a matcher, payload parsing and the allow response, and with a handler test that drives the pre and post hooks with Cursor payloads and checks the attribution of a file that a shell command created.

AI disclosure: this change was made with Claude Code.

🤖 Opened by the eng-autopilot skill (Claude Code) for @jiparis

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 86% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 86%	1	✅ 0	100% AI / 0% Human	9	+281 / -29	7m25s

🟢 86% — 100% AI — ✅ All policies passing

Oct 14, 2026 18:01 UTC · 7m25s · $9.70 · 356 in / 97.3k out · claude-code 2.1.299 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Installs Cursor pre-tool-use and post-tool-use shell hooks for trace runs.
• Wires Cursor shell events through the trace provider, command handlers, and action layer.
• Adds and updates Go tests for hook installation and command-tool handling.
• Applies a small cleanup pass before commit and push.

AI Session Overall Score

🟢 86% — Well-verified feature work, with only missing pre-edit planning on a multi-file change.

AI Session Analysis Breakdown

🟢 90% · alignment

🟢 Opening handoff specified task, workflow, and commit constraints clearly. · High Impact

🟢 90% · user-trust-signal

No notes.

🟢 87% · solution-quality

No notes.

🟢 86% · scope-discipline

🟢 Edits stayed in cursor trace, hook cmd, action, and related tests. · High Impact

🟢 84% · verification

🟢 AI added tests, saw failures, implemented, then re-ran passing tests. · High Impact

🟡 Local golangci-lint could not type-check under the host Go toolchain. · Low Severity

🟡 72% · context-and-planning

🟠 No observable plan or TODO preceded multi-file edits across cursor, cmd, and action code. · Medium Severity

💡 For multi-file changes, write a brief file-by-file plan before editing.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/cli/internal/trace/cursor/hooks_test.go	+131 / -0
modified	ai	app/cli/internal/trace/cursor/hooks.go	+45 / -14
modified	ai	app/cli/cmd/trace_hook.go	+37 / -0
modified	ai	app/cli/pkg/action/trace_agent_hook_test.go	+28 / -0
modified	ai	app/cli/internal/trace/cursor/provider.go	+18 / -9
modified	ai	app/cli/internal/trace/cursor/announce_test.go	+12 / -0
modified	ai	app/cli/internal/trace/README.md	+4 / -4
modified	ai	app/cli/pkg/action/trace_agent_hook.go	+3 / -2
modified	ai	app/cli/internal/trace/provider.go	+3 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-146200	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-146200	-
✅ Passed	ai-config-no-secrets	ai-coding-session-146200	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-146200	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

This change touches code with 2 recorded security-fix advisories. These are pointers to what past fixes established, not findings in this diff, and they never fail the check.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 9 files

_{View guided diff | Re-trigger cubic}