[WRONG BRANCH] fix(cursor): remove spoofable connection status

[luvs01]

Motivation

• The management UI treated a syntactically matching User-Agent: Cursor/<version> as authoritative evidence that Cursor had contacted the proxy, but the header is caller-controlled and can be spoofed by any admitted data-plane client.
• That allowed a low-integrity local or remote process to make an unconfigured or failed integration appear "applied" in the dashboard, producing a false sense of operational health.

Description

• Remove the in-memory Cursor connection recorder and its use during model discovery so the server no longer records caller-controlled User-Agent values. (deleted src/integrations/cursor-seen.ts, removed recordCursorSeen usage in src/server/index.ts).
• Remove lastSeen from the management status contract and stop returning or relying on the spoofable record in GET /api/native-integrations/cursor. (src/server/management/cursor-integration-routes.ts).
• Remove the connection badge and all UI that presented the spoofable recent-request indicator, keeping installation detection, gateway values, and model predictions intact. (gui/src/pages/integrations/CursorIntegrationPage.tsx, gui/src/pages/integrations/cursor-api.ts, gui/src/pages/integrations/overview-clients.ts).
• Update tests to reflect the new, conservative behavior so installation detection no longer implies "applied" and the management surface no longer exposes lastSeen (updated tests/cursor-integration-status.test.ts, gui/tests/cursor-integration-page.test.tsx, gui/tests/integrations-overview-rows.test.ts).

Testing

• Ran the focused runtime unit test: bun test ./tests/cursor-integration-status.test.ts and it passed.
• Ran the focused GUI tests: cd gui && bun test ./tests/cursor-integration-page.test.tsx ./tests/integrations-overview-rows.test.ts and they passed.
• Ran repository checks: bun run typecheck, cd gui && bun run lint, cd gui && bun run build, and bun run privacy:scan, all of which succeeded for the modified code.
• Ran the full repository test suite (bun run test) and it reported unrelated failures/timeouts across many integration tests; the focused Cursor suites and the required type/lint/build/privacy checks for this PR passed.
• Playwright browser install failed (external CDN returned HTTP 403) so a GUI screenshot could not be produced in this environment.

---

Codex Task

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T08:21:59.848834Z	5fbd601	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 5846008f-7ac3-4912-8ccf-710f1ebee3ef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5fbd6019d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Represent unverifiable Cursor wiring as unknown

Whenever Private Inference is installed, this unconditional absent state renders the literal “Not applied” badge and excludes Cursor from the applied count, including when Cursor is correctly configured. Since this code explicitly acknowledges that the configuration cannot be verified, the change replaces spoofable false positives with deterministic false negatives; use an unknown/unverifiable visual state while continuing not to count it as applied.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Update guidance after removing last-seen status

After this route stops returning the last-seen signal, docs-site/src/content/docs/guides/cursor-private-inference.md:74-93 still says the dashboard shows whether the gateway values took and that Refresh model list flips a Connection card, while docs-site/src/content/docs/guides/integrations.md:62-67 and src/cli/capabilities.ts:500-508 still promise the last request seen. Users and agents are therefore directed to a diagnostic that no longer exists; update the English and localized docs, change the capability summary, and regenerate skills/ocx/references/01_management_surface.md.

AGENTS.md reference: src/AGENTS.md:L29-L29

Useful? React with 👍 / 👎.