fix(cursor): preserve SDK runtime chunks and helpers in packages

[juliusmarminge]

Cursor catalog discovery failed before checking the API key because bundling relocated the SDK's computed import of 642.js into T3's server dist without shipping that chunk.

Upgrade @cursor/sdk from 1.0.22 to 1.0.31, the npm latest release at verification. Its Node ESM/CJS exports still load computed Webpack chunks, and rebundling 1.0.31 reproduces the same missing 642.js error. The new ./bundled export statically imports bun:sqlite, so it cannot replace the Node loader. The JS dependency closure is unchanged.

Ship the complete SDK and its dependency closure through the shared runtime-external policy. Catalog, agent adapter, recording helper, and text generation use one createRequire loader, which also works in Node SEA. Desktop staging places complete platform packages outside asar under resources/node_modules/@cursor; the SDK's argv-based lookup can then pass real paths to spawn and load its newly vendored tree-sitter native modules. Both hoisted and pnpm-isolated SDK layouts are handled.

Verification:

• 116 focused tests pass across catalog, adapter, text generation, external dependency closure, isolated package smoke, and desktop packaging.

• The new package smoke bundles the real loader, copies its installed dependency graph without checkout symlinks, clears inherited credentials, and calls models.list and me with explicitly empty keys. Both reach the expected local configuration error.

• Actual server bundle build, server/scripts typechecks, targeted lint, and formatting pass. Lint reports only three existing spread warnings.

• With SDK 1.0.31 on macOS arm64, the same catalog smoke passed in an offline-staged production package, a Node 26.8.2 SEA executable, and an Electron asar. Before the change, the equivalent bundled call reproduced missing 642.js; after it, both catalog chunks load and reject the empty key locally.

• Real staged rg --version succeeds. cursorsandbox is present with executable permissions. The staged tree-sitter and tree-sitter-bash native modules load and parse a shell command under both Node and Electron. Complete platform packages are excluded from the archive so they cannot shadow the real resource paths. Staging regression coverage includes vendored JS/native files and platform package metadata.

• With a user-authorized API key supplied through stdin, live models.list and me calls passed in Node, Node SEA, and Electron asar on macOS arm64 using the packaged production loader. Each runtime returned 39 models and a valid account response. The probe used an isolated temporary home that was removed afterward; no credential or account details are included in artifacts.

Coverage limits: no agent generation sessions or sandboxed agent execution were tested. No full signed desktop installer or Windows/Linux runtime was launched. The pinned SDK supplies no native Windows arm64 helper package; this change does not add one. No browsers or dev servers were used. This is backend/packaging behavior, so screenshots do not apply.

Top of the requested two-PR stack; this diff contains only Cursor changes.

Model: GPT-6. Harness: Codex.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This change modifies production Cursor SDK loading and desktop packaging, including external dependency resolution and platform-native resources outside asar. It also adds a static-analysis diagnostic suppression, so the packaging and tooling effects warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.1 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.8 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: cc54368 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.