Adaptive reasoning and direct Cursor mode

[nvdorman]

Follow-up to #25, which merged the Cursor Cloud Agent integration. This adds
the two things that integration was missing: reasoning controls that match the
model actually selected, and a way to run a Cursor agent from the composer
without asking an Antares model to manufacture a tool call.

origin/main is merged in (22392df) rather than rebased, so main's
fix(config): ship the Cursor provider disabled by default and its
ReasoningBlock freeze fix are preserved rather than reverted by this branch's
older base.

Summary

Model-aware reasoning. The global none|low|medium|high enum is replaced by
a capability resolved from the selected provider and model. Auto is the new
default and sends no reasoning field at all. Values stay opaque provider
strings — extra-high is never rewritten to xhigh. Off is offered only where
reasoning can genuinely be disabled. Adapter request bodies were corrected so
every displayed choice has its advertised effect: Anthropic adaptive thinking
with output_config.effort, Gemini thinkingLevel (where minimal means
Minimal, not Off), OpenAI/Codex nested vs flat effort, and OpenRouter sending an
explicit disable instead of omitting the field. Preferences are stored per
provider/model, so a value cannot leak across a model switch.

Direct Cursor mode. Cursor models appear in composer search as a separate
execution target; selecting one never changes model.provider or
model.default. POST /api/chat/cursor runs the turn through a shared
internal/cursorrun service and streams over the existing SSE envelope. The
live catalogue is authoritative: Antares copies one concrete variant's whole
param array (including params Cursor does not publish as user-facing, such as
cyber) and never synthesises a combination Cursor did not return.

Safety boundaries. Start, follow-up, and cancel each require an explicit
approval even under approval_mode: auto, and the retained request — not the
displayed card — is what executes. Create requests are never auto-retried; an
ambiguous failure is recorded as ambiguous instead. Local Stop only detaches and
can only win before the non-idempotent POST; remote Cancel is a separate
approved action. Runs survive browser detach and daemon restart via persisted
agent/run IDs, with reset-and-replay rather than duplicated text on resume.
API keys are redacted from every error, event, log, and persisted field.

Test plan

• go test ./internal/llm ./internal/agent ./internal/config ./internal/cursor ./internal/cursorrun ./internal/approval ./internal/tools ./internal/store ./internal/server ./cmd/antares -count=1
• go test -race over the same packages — clean
• make check (vet, full go test ./..., typecheck, 154 web tests) — green
• make smoke — all 16 dashboard routes clean
• Live Cursor verification was metadata-only: GET /v1/me and
  GET /v1/models (34 models, all with variants; confirmed the hidden
  cyber variant param exists upstream). No agent, run, follow-up, or
  cancellation was created.
• Approval boundary covered by regression tests rather than a paid call:
  no upstream request before approval, deny sends nothing, approval payload
  bounded/redacted/immutable, and local interrupt does not cancel remotely.

Suites were run with credential variables stripped so nothing silently went live.

Known issue (pre-existing, not from this branch)

internal/mcp is flaky under full-suite parallel load — TestStdioRoundTrip
and TestRefreshReplacesToolsAndReadiness can exceed their 30s subprocess
deadline. Reproduced on unmodified origin/main (1/9 full-suite runs) as well
as here, in a package this branch does not touch. Left alone rather than
folded into this PR.

Made with Cursor

[nvdorman]

Ditutup atas permintaan pemilik repo. Pendekatan Cursor Cloud Agent dinilai tidak cocok untuk alur kerja lokal; arah integrasi akan dipertimbangkan ulang. Commit tetap tersimpan di branch feature/cursor-agent-provider-impl.