Merge origin/main into feat/cursor-cli

Merges latest main branch changes including:
- MCP server support and configuration
- Pipeline configuration system
- Prompt customization settings
- GitHub issue comments in validation
- Auth middleware improvements
- Various UI/UX improvements

All Cursor CLI features preserved:
- Multi-provider support (Claude + Cursor)
- Model override capabilities
- Phase model configuration
- Provider tabs in settings

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

libs/types/src/error.ts

@@ -1,7 +1,13 @@
 /**
  * Error type classification
  */
-export type ErrorType = 'authentication' | 'cancellation' | 'abort' | 'execution' | 'unknown';
+export type ErrorType =
+  | 'authentication'
+  | 'cancellation'
+  | 'abort'
+  | 'execution'
+  | 'rate_limit'
+  | 'unknown';
 
 /**
  * Classified error information
@@ -12,5 +18,7 @@ export interface ErrorInfo {
   isAbort: boolean;
   isAuth: boolean;
   isCancellation: boolean;
+  isRateLimit: boolean;
+  retryAfter?: number; // Seconds to wait before retrying (for rate limit errors)
   originalError: unknown;
 }

libs/types/src/index.ts

@@ -13,6 +13,10 @@ export type {
   InstallationStatus,
   ValidationResult,
   ModelDefinition,
+  McpServerConfig,
+  McpStdioServerConfig,
+  McpSSEServerConfig,
+  McpHttpServerConfig,
 } from './provider.js';
 
 // Feature types
@@ -45,6 +49,21 @@ export { specOutputSchema } from './spec.js';
 // Enhancement types
 export type { EnhancementMode, EnhancementExample } from './enhancement.js';
 
+// Prompt customization types
+export type {
+  CustomPrompt,
+  AutoModePrompts,
+  AgentPrompts,
+  BacklogPlanPrompts,
+  EnhancementPrompts,
+  PromptCustomization,
+  ResolvedAutoModePrompts,
+  ResolvedAgentPrompts,
+  ResolvedBacklogPlanPrompts,
+  ResolvedEnhancementPrompts,
+} from './prompts.js';
+export { DEFAULT_PROMPT_CUSTOMIZATION } from './prompts.js';
+
 // Settings types and constants
 export type {
   ThemeMode,
@@ -56,6 +75,8 @@ export type {
   PhaseModelKey,
   KeyboardShortcuts,
   AIProfile,
+  MCPToolInfo,
+  MCPServerConfig,
   ProjectRef,
   TrashedProjectRef,
   ChatSessionRef,
@@ -92,6 +113,9 @@ export type {
   IssueValidationVerdict,
   IssueValidationConfidence,
   IssueComplexity,
+  PRRecommendation,
+  PRAnalysis,
+  LinkedPRInfo,
   IssueValidationInput,
   IssueValidationRequest,
   IssueValidationResult,
@@ -99,6 +123,9 @@ export type {
   IssueValidationErrorResponse,
   IssueValidationEvent,
   StoredValidation,
+  GitHubCommentAuthor,
+  GitHubComment,
+  IssueCommentsResult,
 } from './issue-validation.js';
 
 // Backlog plan types
@@ -126,3 +153,11 @@ export {
   getBareModelId,
   normalizeModelString,
 } from './provider-utils.js';
+
+// Pipeline types
+export type {
+  PipelineStep,
+  PipelineConfig,
+  PipelineStatus,
+  FeatureStatusWithPipeline,
+} from './pipeline.js';

libs/types/src/issue-validation.ts

@@ -21,6 +21,36 @@ export type IssueValidationConfidence = 'high' | 'medium' | 'low';
  */
 export type IssueComplexity = 'trivial' | 'simple' | 'moderate' | 'complex' | 'very_complex';
 
+/**
+ * Recommendation for PR-related action
+ */
+export type PRRecommendation = 'wait_for_merge' | 'pr_needs_work' | 'no_pr';
+
+/**
+ * Analysis of a linked pull request
+ */
+export interface PRAnalysis {
+  /** Whether there is an open PR linked to this issue */
+  hasOpenPR: boolean;
+  /** Whether the PR appears to fix the issue based on the diff */
+  prFixesIssue?: boolean;
+  /** The PR number that was analyzed */
+  prNumber?: number;
+  /** Brief summary of what the PR changes */
+  prSummary?: string;
+  /** Recommendation: wait for PR to merge, PR needs more work, or no relevant PR */
+  recommendation: PRRecommendation;
+}
+
+/**
+ * Linked PR info for validation
+ */
+export interface LinkedPRInfo {
+  number: number;
+  title: string;
+  state: string;
+}
+
 /**
  * Issue data for validation (without projectPath)
  * Used by UI when calling the validation API
@@ -30,6 +60,10 @@ export interface IssueValidationInput {
   issueTitle: string;
   issueBody: string;
   issueLabels?: string[];
+  /** Comments to include in validation analysis */
+  comments?: GitHubComment[];
+  /** Linked pull requests for this issue */
+  linkedPRs?: LinkedPRInfo[];
 }
 
 /**
@@ -60,6 +94,8 @@ export interface IssueValidationResult {
   missingInfo?: string[];
   /** Estimated effort to address the issue */
   estimatedComplexity?: IssueComplexity;
+  /** Analysis of linked pull requests (if any) */
+  prAnalysis?: PRAnalysis;
 }
 
 /**
@@ -133,3 +169,41 @@ export interface StoredValidation {
   /** ISO timestamp when user viewed this validation (undefined = not yet viewed) */
   viewedAt?: string;
 }
+
+/**
+ * Author of a GitHub comment
+ */
+export interface GitHubCommentAuthor {
+  login: string;
+  avatarUrl?: string;
+}
+
+/**
+ * A comment on a GitHub issue
+ */
+export interface GitHubComment {
+  /** Unique comment ID */
+  id: string;
+  /** Author of the comment */
+  author: GitHubCommentAuthor;
+  /** Comment body (markdown) */
+  body: string;
+  /** ISO timestamp when comment was created */
+  createdAt: string;
+  /** ISO timestamp when comment was last updated */
+  updatedAt?: string;
+}
+
+/**
+ * Result from fetching issue comments
+ */
+export interface IssueCommentsResult {
+  /** List of comments */
+  comments: GitHubComment[];
+  /** Total number of comments on the issue */
+  totalCount: number;
+  /** Whether there are more comments to fetch */
+  hasNextPage: boolean;
+  /** Cursor for pagination (pass to next request) */
+  endCursor?: string;
+}

libs/types/src/pipeline.ts

@@ -0,0 +1,28 @@
+/**
+ * Pipeline types for AutoMaker custom workflow steps
+ */
+
+export interface PipelineStep {
+  id: string;
+  name: string;
+  order: number;
+  instructions: string;
+  colorClass: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface PipelineConfig {
+  version: 1;
+  steps: PipelineStep[];
+}
+
+export type PipelineStatus = `pipeline_${string}`;
+
+export type FeatureStatusWithPipeline =
+  | 'backlog'
+  | 'in_progress'
+  | 'waiting_approval'
+  | 'verified'
+  | 'completed'
+  | PipelineStatus;

libs/types/src/prompts.ts

@@ -0,0 +1,153 @@
+/**
+ * Prompt Customization Types
+ *
+ * Defines the structure for customizable AI prompts used throughout the application.
+ * Allows users to modify prompts for Auto Mode, Agent Runner, and Backlog Planning.
+ */
+
+/**
+ * CustomPrompt - A custom prompt with its value and enabled state
+ *
+ * The value is always preserved even when disabled, so users don't lose their work.
+ */
+export interface CustomPrompt {
+  /** The custom prompt text */
+  value: string;
+
+  /** Whether this custom prompt should be used (when false, default is used instead) */
+  enabled: boolean;
+}
+
+/**
+ * AutoModePrompts - Customizable prompts for Auto Mode feature implementation
+ *
+ * Controls how the AI plans and implements features in autonomous mode.
+ */
+export interface AutoModePrompts {
+  /** Planning mode: Quick outline without approval (lite mode) */
+  planningLite?: CustomPrompt;
+
+  /** Planning mode: Quick outline with approval required (lite with approval) */
+  planningLiteWithApproval?: CustomPrompt;
+
+  /** Planning mode: Detailed specification with task breakdown (spec mode) */
+  planningSpec?: CustomPrompt;
+
+  /** Planning mode: Comprehensive Software Design Document (full SDD mode) */
+  planningFull?: CustomPrompt;
+
+  /** Template for building feature implementation prompts */
+  featurePromptTemplate?: CustomPrompt;
+
+  /** Template for follow-up prompts when resuming work */
+  followUpPromptTemplate?: CustomPrompt;
+
+  /** Template for continuation prompts */
+  continuationPromptTemplate?: CustomPrompt;
+
+  /** Template for pipeline step execution prompts */
+  pipelineStepPromptTemplate?: CustomPrompt;
+}
+
+/**
+ * AgentPrompts - Customizable prompts for Agent Runner (chat mode)
+ *
+ * Controls the AI's behavior in interactive chat sessions.
+ */
+export interface AgentPrompts {
+  /** System prompt defining the agent's role and behavior in chat */
+  systemPrompt?: CustomPrompt;
+}
+
+/**
+ * BacklogPlanPrompts - Customizable prompts for Kanban board planning
+ *
+ * Controls how the AI modifies the feature backlog via the Plan button.
+ */
+export interface BacklogPlanPrompts {
+  /** System prompt for backlog plan generation (defines output format and rules) */
+  systemPrompt?: CustomPrompt;
+
+  /** Template for user prompt (includes current features and user request) */
+  userPromptTemplate?: CustomPrompt;
+}
+
+/**
+ * EnhancementPrompts - Customizable prompts for feature description enhancement
+ *
+ * Controls how the AI enhances feature titles and descriptions.
+ */
+export interface EnhancementPrompts {
+  /** System prompt for "improve" mode (vague → clear) */
+  improveSystemPrompt?: CustomPrompt;
+
+  /** System prompt for "technical" mode (add technical details) */
+  technicalSystemPrompt?: CustomPrompt;
+
+  /** System prompt for "simplify" mode (verbose → concise) */
+  simplifySystemPrompt?: CustomPrompt;
+
+  /** System prompt for "acceptance" mode (add acceptance criteria) */
+  acceptanceSystemPrompt?: CustomPrompt;
+}
+
+/**
+ * PromptCustomization - Complete set of customizable prompts
+ *
+ * All fields are optional. Undefined values fall back to built-in defaults.
+ * Stored in GlobalSettings to allow user customization.
+ */
+export interface PromptCustomization {
+  /** Auto Mode prompts (feature implementation) */
+  autoMode?: AutoModePrompts;
+
+  /** Agent Runner prompts (interactive chat) */
+  agent?: AgentPrompts;
+
+  /** Backlog planning prompts (Plan button) */
+  backlogPlan?: BacklogPlanPrompts;
+
+  /** Enhancement prompts (feature description improvement) */
+  enhancement?: EnhancementPrompts;
+}
+
+/**
+ * Default empty prompt customization (all undefined → use built-in defaults)
+ */
+export const DEFAULT_PROMPT_CUSTOMIZATION: PromptCustomization = {
+  autoMode: {},
+  agent: {},
+  backlogPlan: {},
+  enhancement: {},
+};
+
+/**
+ * Resolved prompt types - all fields are required strings (ready to use)
+ * Used for default prompts and merged prompts after resolving custom values
+ */
+export interface ResolvedAutoModePrompts {
+  planningLite: string;
+  planningLiteWithApproval: string;
+  planningSpec: string;
+  planningFull: string;
+  featurePromptTemplate: string;
+  followUpPromptTemplate: string;
+  continuationPromptTemplate: string;
+  pipelineStepPromptTemplate: string;
+}
+
+export interface ResolvedAgentPrompts {
+  systemPrompt: string;
+}
+
+export interface ResolvedBacklogPlanPrompts {
+  systemPrompt: string;
+  userPromptTemplate: string;
+}
+
+export interface ResolvedEnhancementPrompts {
+  improveSystemPrompt: string;
+  technicalSystemPrompt: string;
+  simplifySystemPrompt: string;
+  acceptanceSystemPrompt: string;
+}

libs/types/src/provider.ts

@@ -28,6 +28,38 @@ export interface SystemPromptPreset {
   append?: string;
 }
 
+/**
+ * MCP server configuration types for SDK options
+ * Matches the Claude Agent SDK's McpServerConfig types
+ */
+export type McpServerConfig = McpStdioServerConfig | McpSSEServerConfig | McpHttpServerConfig;
+
+/**
+ * Stdio-based MCP server (subprocess)
+ * Note: `type` is optional and defaults to 'stdio' to match SDK behavior
+ * and allow simpler configs like { command: "node", args: ["server.js"] }
+ */
+export interface McpStdioServerConfig {
+  type?: 'stdio';
+  command: string;
+  args?: string[];
+  env?: Record<string, string>;
+}
+
+/** SSE-based MCP server */
+export interface McpSSEServerConfig {
+  type: 'sse';
+  url: string;
+  headers?: Record<string, string>;
+}
+
+/** HTTP-based MCP server */
+export interface McpHttpServerConfig {
+  type: 'http';
+  url: string;
+  headers?: Record<string, string>;
+}
+
 /**
  * Options for executing a query via a provider
  */
@@ -38,11 +70,20 @@ export interface ExecuteOptions {
   systemPrompt?: string | SystemPromptPreset;
   maxTurns?: number;
   allowedTools?: string[];
-  mcpServers?: Record<string, unknown>;
+  mcpServers?: Record<string, McpServerConfig>;
+  mcpAutoApproveTools?: boolean; // Auto-approve MCP tool calls without permission prompts
+  mcpUnrestrictedTools?: boolean; // Allow unrestricted tools when MCP servers are enabled
   abortController?: AbortController;
   conversationHistory?: ConversationMessage[]; // Previous messages for context
   sdkSessionId?: string; // Claude SDK session ID for resuming conversations
   settingSources?: Array<'user' | 'project' | 'local'>; // Sources for CLAUDE.md loading
+  sandbox?: { enabled: boolean; autoAllowBashIfSandboxed?: boolean }; // Sandbox configuration
+  /**
+   * If true, the provider should run in read-only mode (no file modifications).
+   * For Cursor CLI, this omits the --force flag, making it suggest-only.
+   * Default: false (allows edits)
+   */
+  readOnly?: boolean;
 }
 
 /**

libs/types/src/settings.ts

@@ -9,6 +9,7 @@
 import type { ModelAlias } from './model.js';
 import type { CursorModelId } from './cursor-models.js';
 import { CURSOR_MODEL_MAP, getAllCursorModelIds } from './cursor-models.js';
+import type { PromptCustomization } from './prompts.js';
 
 // Re-export ModelAlias for convenience
 export type { ModelAlias };
@@ -237,6 +238,55 @@ export function getProfileModelString(profile: AIProfile): string {
   return profile.model || 'sonnet';
 }
 
+/**
+ * MCPToolInfo - Information about a tool provided by an MCP server
+ *
+ * Contains the tool's name, description, and whether it's enabled for use.
+ */
+export interface MCPToolInfo {
+  /** Tool name as exposed by the MCP server */
+  name: string;
+  /** Description of what the tool does */
+  description?: string;
+  /** JSON Schema for the tool's input parameters */
+  inputSchema?: Record<string, unknown>;
+  /** Whether this tool is enabled for use (defaults to true) */
+  enabled: boolean;
+}
+
+/**
+ * MCPServerConfig - Configuration for an MCP (Model Context Protocol) server
+ *
+ * MCP servers provide additional tools and capabilities to AI agents.
+ * Supports stdio (subprocess), SSE, and HTTP transport types.
+ */
+export interface MCPServerConfig {
+  /** Unique identifier for the server config */
+  id: string;
+  /** Display name for the server */
+  name: string;
+  /** User-friendly description of what this server provides */
+  description?: string;
+  /** Transport type: stdio (default), sse, or http */
+  type?: 'stdio' | 'sse' | 'http';
+  /** For stdio: command to execute (e.g., 'node', 'python', 'npx') */
+  command?: string;
+  /** For stdio: arguments to pass to the command */
+  args?: string[];
+  /** For stdio: environment variables to set */
+  env?: Record<string, string>;
+  /** For sse/http: URL endpoint */
+  url?: string;
+  /** For sse/http: headers to include in requests */
+  headers?: Record<string, string>;
+  /** Whether this server is enabled */
+  enabled?: boolean;
+  /** Tools discovered from this server with their enabled states */
+  tools?: MCPToolInfo[];
+  /** Timestamp when tools were last fetched */
+  toolsLastFetched?: string;
+}
+
 /**
  * ProjectRef - Minimal reference to a project stored in global settings
  *
@@ -385,6 +435,20 @@ export interface GlobalSettings {
   // Claude Agent SDK Settings
   /** Auto-load CLAUDE.md files using SDK's settingSources option */
   autoLoadClaudeMd?: boolean;
+  /** Enable sandbox mode for bash commands (default: true, disable if issues occur) */
+  enableSandboxMode?: boolean;
+
+  // MCP Server Configuration
+  /** List of configured MCP servers for agent use */
+  mcpServers: MCPServerConfig[];
+  /** Auto-approve MCP tool calls without permission prompts (uses bypassPermissions mode) */
+  mcpAutoApproveTools?: boolean;
+  /** Allow unrestricted tools when MCP servers are enabled (don't filter allowedTools) */
+  mcpUnrestrictedTools?: boolean;
+
+  // Prompt Customization
+  /** Custom prompts for Auto Mode, Agent Runner, Backlog Planning, and Enhancements */
+  promptCustomization?: PromptCustomization;
 }
 
 /**
@@ -563,6 +627,12 @@ export const DEFAULT_GLOBAL_SETTINGS: GlobalSettings = {
   worktreePanelCollapsed: false,
   lastSelectedSessionByProject: {},
   autoLoadClaudeMd: false,
+  enableSandboxMode: true,
+  mcpServers: [],
+  // Default to true for autonomous workflow. Security is enforced when adding servers
+  // via the security warning dialog that explains the risks.
+  mcpAutoApproveTools: true,
+  mcpUnrestrictedTools: true,
 };
 
 /** Default credentials (empty strings - user must provide API keys) */