Add Cursor Cloud Agent integration

[nvdorman]

Summary

• add a secret-safe Cursor Cloud Agents REST/SSE client with resumable run streaming
• expose Cursor as an agent-only provider with approval-gated delegation/status tools and dashboard model discovery
• preserve existing LLM selection, harden credential/model boundaries, and document shared-key operation

Test plan

• go test ./... -count=1 with live-provider credentials unset
• focused Cursor/server/tools race tests and go vet
• bun test and bun x tsc -b --noEmit
• production build, CLI install, daemon restart, and /api/health HTTP 200
• optional live /v1/me + /v1/models smoke test when CURSOR_API_KEY is exported

Made with Cursor

[enowdev]

Merged as 1ec08ca. Reviewed for both architecture fit and credential/security surface.

What held up well:

• The Connect/Activate split in providers/catalog.go is a real abstraction rather than a special case, and the capability boundary is enforced at every entry point (server, commands, TUI, CLI) — not just one.
• No credential leak: two independent redaction layers, the key never logged and never in a URL, and StreamEvent.Raw is populated but never forwarded to the model.
• One new route (GET /api/providers/{id}/models), correctly behind requireDashboardPassword and absent from every exemption allowlist.
• The security.go delta is DNS64/NAT64 support for the existing SSRF guard — IPv4 semantics unchanged, IPv6 literals actually stricter, discovery fails closed, and the RFC 6052 acceptance needs three independent conditions.
• The model can't influence the destination URL; ids are prefix-validated and path-escaped.
• No new dependency — internal/cursor is stdlib only.
• The SSE client is careful work: bounded line buffer, no busy-retry, no-progress budget, and a terminal result that survives a subsequent connection break.

One change on merge, in 51d860f: cursor now defaults to Enabled: false, matching every other bring-your-own-key provider (ollama, lmstudio, custom). With Enabled: true and the default approval_mode: "auto" — which returns before the approval gate and only regex-matches shell commands for its danger check — merely having CURSOR_API_KEY in the environment would let the model spawn billable cloud agents with no human in the loop, reachable via prompt injection from any fetched page or cloned README. The tool's own key check makes this harmless without a key; this is about the case where the key is present. Enabling from the Providers page stays one click. Test fixtures now enable it explicitly instead of inheriting the default.

Worth noting the live /v1/me + /v1/models smoke test is still unchecked in your test plan — the hermetic tests are good but can't catch a wrong endpoint path or a changed response shape. Nice work on this one.