✨🧑‍💻 - Test or fix new agents

[efraespada]

Is there an existing issue or feature request for this?

• I have searched the existing issues and feature requests.

What area does this improvement affect?

New Feature

What actions does this improvement affect?

Issue

Description of the idea or improvement

We have recently started adding several types of agents for code analysis and the detection of issues, bugs, and potential security vulnerabilities.

We need to ensure that all of these agents are working correctly, as they have not yet been properly tested.

Testing should start with Codex, followed by Cursor.

Current limitations or challenges

Codex must be pre-logged on a self-hosted runner. Github runners must use API keys from OpenAI or a Codex Enterprise account.

Expected impact

The expected improvements are a significant enhancement in code analysis, enabling deeper and more thorough detection of bugs and potential vulnerabilities.

Alternatives considered

Bugbot from Cursor.

Version of copilot

develop

Additional context or comments

Good luck.

[vypbot]

🪄 Automatic Actions

1. The issue was assigned to @efraespada (creator).
2. The issue's title was updated from Test or fix new agents to ✨ - Test or fix new agents.
3. The issue was linked to vypdev and moved to the column Todo.
4. Priority set to P2 in vypdev.

Debug log

[DEBUG] Setup done. Issue number: 334, isSingleAction: false, isIssue: true, isPullRequest: false, isPush: false
[DEBUG] ✅ No previous runs active. Continuing...
[INFO] Running IssueUseCase for issue #334.
[INFO] 📋 Executing IssueUseCase.
[INFO] 🔐 Executing CheckPermissionsUseCase.
[DEBUG] Ignoring permission checking. Issue state is not 'opened'.
[INFO] 👤 Executing AssignMemberToIssueUseCase.
[DEBUG] #334 needs 1 assignees.
[DEBUG] Assigned Issue creator @efraespada to #334.
[INFO] ✏️ Executing UpdateTitleUseCase.
[DEBUG] Issue title updated to: ✨ - Test or fix new agents
[INFO] 🏷️ Executing UpdateIssueTypeUseCase.
[DEBUG] Setting issue type for issue 334 to Feature
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Successfully updated issue type to Feature
[INFO] 🔗 Executing LinkIssueProjectUseCase.
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Linked I_kwDONSeBW88AAAABOkWb6g with id PVTI_lADOA8wRO84Ajh7Bzg4f48U to project PVT_kwDOA8wRO84Ajh7B
[DEBUG] Target field ID: PVTSSF_lADOA8wRO84Ajh7Bzgb4L2E
[DEBUG] Target option ID: f75ad846
[INFO] 📏 Executing CheckPriorityIssueSizeUseCase.
[DEBUG] Priority: priority: low
[DEBUG] Github Priority Label: P2
[DEBUG] Target field ID: PVTSSF_lADOA8wRO84Ajh7Bzgb4MPQ
[DEBUG] Target option ID: 27f99ddc
[INFO] 🧹 Executing RemoveIssueBranchesUseCase.
[DEBUG] Checking branch type feature
[DEBUG] Checking prefix feature/334-
[DEBUG] Checking branch type bugfix
[DEBUG] Checking prefix bugfix/334-
[INFO] 🧹 Executing RemoveNotNeededBranchesUseCase.
[INFO] 🏷️ Executing DeployAddedUseCase.
[INFO] 🏷️ Executing DeployedAddedUseCase.
[INFO] Main run finished. Results: 7, total steps: 4.
[INFO] Publishing result: 7 result(s), 4 step(s), 0 error(s).
[INFO] 📄 Executing PublishResultUseCase.

🚀 Happy coding!

^{Made with ❤️ by vypdev/copilot}

[vypbot]

✨ Feature Actions

1. The issue's title was updated from ✨ - Test or fix new agents to ✨🧑‍💻 - Test or fix new agents.
2. The branch develop was used to create feature/334-test-or-fix-new-agents.
3. Moved issue to In Progress in vypdev.

Reminder

1. Take a coffee break while you work ☕.
2. Check out the branch:

git fetch -v && git checkout feature/334-test-or-fix-new-agents

3. Commit the needed changes with this prefix:

feature-334-test-or-fix-new-agents

4. Open a Pull Request from feature/334-test-or-fix-new-agents to develop. New PR

Debug log

[DEBUG] Setup done. Issue number: 334, isSingleAction: false, isIssue: true, isPullRequest: false, isPush: false
[DEBUG] ✅ No previous runs active. Continuing...
[INFO] Running IssueUseCase for issue #334.
[INFO] 📋 Executing IssueUseCase.
[INFO] 🔐 Executing CheckPermissionsUseCase.
[DEBUG] Ignoring permission checking. Issue state is not 'opened'.
[INFO] 👤 Executing AssignMemberToIssueUseCase.
[DEBUG] #334 needs 1 assignees.
[INFO] ✏️ Executing UpdateTitleUseCase.
[DEBUG] Issue title updated to: ✨🧑‍💻 - Test or fix new agents
[INFO] 🏷️ Executing UpdateIssueTypeUseCase.
[DEBUG] Setting issue type for issue 334 to Feature
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Successfully updated issue type to Feature
[INFO] 🔗 Executing LinkIssueProjectUseCase.
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Content I_kwDONSeBW88AAAABOkWb6g is already linked to project PVT_kwDOA8wRO84Ajh7B.
[DEBUG] LinkIssueProject: issue already linked to project "vypdev" or link failed.
[INFO] 📏 Executing CheckPriorityIssueSizeUseCase.
[DEBUG] Priority: priority: low
[DEBUG] Github Priority Label: P2
[DEBUG] Target field ID: PVTSSF_lADOA8wRO84Ajh7Bzgb4MPQ
[DEBUG] Target option ID: 27f99ddc
[DEBUG] Field 'Priority' is already set to 'P2'. No update needed.
[INFO] 🌿 Executing PrepareBranchesUseCase.
[DEBUG] Fetching tags and forcing fetch...
[DEBUG] Fetching all remote branches with verbose output...
[DEBUG] Successfully fetched all remote branches.
[DEBUG] - bugfix/280-wrong-orphaned-branches-detection
[DEBUG] - bugfix/287-release-deploy-issues
[DEBUG] - bugfix/303-bugbot-first-message-bugs
[DEBUG] - bugfix/309-setup-crash
[DEBUG] - bugfix/314-error-merging-release-branch-after-successful-deployment
[DEBUG] - bugfix/319-setup-crash-on-repository-with-no-issues
[DEBUG] - bugfix/324-wrong-tag-names
[DEBUG] - bugfix/329-it-ends-up-stuck-in-an-unknown-version-loop-if-no-version-is-detected-in-the-repository
[DEBUG] - chore/239-improve-asking
[DEBUG] - chore/253-chore-test
[DEBUG] - chore/271-test-chore-task
[DEBUG] - develop
[DEBUG] - feature/245-other-test
[DEBUG] - feature/274-add-cli-setup-commands-for-initial-configuration
[DEBUG] - feature/279-introduce-the-new-copilot-agent
[DEBUG] - feature/292-github-action-rename
[DEBUG] - feature/296-bugbot-autofix
[DEBUG] - master
[DEBUG] - release/1.0.51
[DEBUG] - release/1.0.52
[DEBUG] - release/1.1.0
[DEBUG] - release/1.1.1
[DEBUG] - release/1.2.0
[DEBUG] - release/1.3.0
[DEBUG] - release/1.3.1
[DEBUG] - release/1.3.2
[DEBUG] - release/2.0.1
[DEBUG] - release/2.0.2
[DEBUG] - release/2.0.3
[DEBUG] - release/2.0.4
[DEBUG] - release/2.0.5
[DEBUG] - release/2.0.6
[DEBUG] Branch type: feature
[DEBUG] Creating linked branch feature/334-test-or-fix-new-agents from develop
[DEBUG] Repository information retrieved: {"target":{"oid":"433512c5af8d379e3a20d368e223d099dc258d8d"}}
[DEBUG] Linking branch "feature/334-test-or-fix-new-agents" (oid: 433512c5af8d379e3a20d368e223d099dc258d8d) to issue #334
[DEBUG] Linked branch: {"id":"LB_kwDPAAAAATpFm-rOAO43-g","ref":{"name":"feature/334-test-or-fix-new-agents"}}
[INFO] 📜 Executing CommitPrefixBuilderUseCase.
[DEBUG] Commit prefix generated: feature-334-test-or-fix-new-agents
[INFO] 📥 Executing MoveIssueToInProgressUseCase.
[DEBUG] Target field ID: PVTSSF_lADOA8wRO84Ajh7Bzgb4L2E
[DEBUG] Target option ID: 47fc9ee4
[INFO] 🧹 Executing RemoveNotNeededBranchesUseCase.
[INFO] 🏷️ Executing DeployAddedUseCase.
[INFO] 🏷️ Executing DeployedAddedUseCase.
[INFO] Main run finished. Results: 7, total steps: 3.
[INFO] Publishing result: 7 result(s), 3 step(s), 0 error(s).
[INFO] 📄 Executing PublishResultUseCase.

🚀 Happy coding!

^{Made with ❤️ by vypdev/copilot}

[vypbot]

✨ Feature Actions

1. Branch feature/334-test-or-fix-new-agents already exists, nothing to do.

Reminder

1. Take a coffee break while you work ☕.

Debug log

[DEBUG] Setup done. Issue number: 334, isSingleAction: false, isIssue: true, isPullRequest: false, isPush: false
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ⏳ Found 1 previous run(s) still active. Waiting 2s...
[DEBUG] ✅ No previous runs active. Continuing...
[INFO] Running IssueUseCase for issue #334.
[INFO] 📋 Executing IssueUseCase.
[INFO] 🔐 Executing CheckPermissionsUseCase.
[DEBUG] Ignoring permission checking. Issue state is not 'opened'.
[INFO] 👤 Executing AssignMemberToIssueUseCase.
[DEBUG] #334 needs 1 assignees.
[INFO] ✏️ Executing UpdateTitleUseCase.
[INFO] 🏷️ Executing UpdateIssueTypeUseCase.
[DEBUG] Setting issue type for issue 334 to Feature
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Successfully updated issue type to Feature
[INFO] 🔗 Executing LinkIssueProjectUseCase.
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Content I_kwDONSeBW88AAAABOkWb6g is already linked to project PVT_kwDOA8wRO84Ajh7B.
[DEBUG] LinkIssueProject: issue already linked to project "vypdev" or link failed.
[INFO] 📏 Executing CheckPriorityIssueSizeUseCase.
[DEBUG] Priority: priority: low
[DEBUG] Github Priority Label: P2
[DEBUG] Target field ID: PVTSSF_lADOA8wRO84Ajh7Bzgb4MPQ
[DEBUG] Target option ID: 27f99ddc
[DEBUG] Field 'Priority' is already set to 'P2'. No update needed.
[INFO] 🌿 Executing PrepareBranchesUseCase.
[DEBUG] Fetching tags and forcing fetch...
[DEBUG] Fetching all remote branches with verbose output...
[DEBUG] Successfully fetched all remote branches.
[DEBUG] - bugfix/280-wrong-orphaned-branches-detection
[DEBUG] - bugfix/287-release-deploy-issues
[DEBUG] - bugfix/303-bugbot-first-message-bugs
[DEBUG] - bugfix/309-setup-crash
[DEBUG] - bugfix/314-error-merging-release-branch-after-successful-deployment
[DEBUG] - bugfix/319-setup-crash-on-repository-with-no-issues
[DEBUG] - bugfix/324-wrong-tag-names
[DEBUG] - bugfix/329-it-ends-up-stuck-in-an-unknown-version-loop-if-no-version-is-detected-in-the-repository
[DEBUG] - chore/239-improve-asking
[DEBUG] - chore/253-chore-test
[DEBUG] - chore/271-test-chore-task
[DEBUG] - develop
[DEBUG] - feature/245-other-test
[DEBUG] - feature/274-add-cli-setup-commands-for-initial-configuration
[DEBUG] - feature/279-introduce-the-new-copilot-agent
[DEBUG] - feature/292-github-action-rename
[DEBUG] - feature/296-bugbot-autofix
[DEBUG] - feature/334-test-or-fix-new-agents
[DEBUG] - master
[DEBUG] - release/1.0.51
[DEBUG] - release/1.0.52
[DEBUG] - release/1.1.0
[DEBUG] - release/1.1.1
[DEBUG] - release/1.2.0
[DEBUG] - release/1.3.0
[DEBUG] - release/1.3.1
[DEBUG] - release/1.3.2
[DEBUG] - release/2.0.1
[DEBUG] - release/2.0.2
[DEBUG] - release/2.0.3
[DEBUG] - release/2.0.4
[DEBUG] - release/2.0.5
[DEBUG] - release/2.0.6
[DEBUG] Branch type: feature
[INFO] 🧹 Executing RemoveNotNeededBranchesUseCase.
[INFO] 🏷️ Executing DeployAddedUseCase.
[INFO] 🏷️ Executing DeployedAddedUseCase.
[INFO] Main run finished. Results: 6, total steps: 1.
[INFO] Publishing result: 6 result(s), 1 step(s), 0 error(s).
[INFO] 📄 Executing PublishResultUseCase.

🚀 Happy coding!

^{Made with ❤️ by vypdev/copilot}

[vypbot]

✨ Feature Actions

1. Recommended steps (configured agent):

2. Recommended implementation order

3. Create the feature branch and capture a baseline

   Start from develop, then run the existing quality gates.

   git switch -c feature/334-test-or-fix-new-agents develop
   corepack pnpm@10.12.4 exec jest --runInBand
   corepack pnpm@10.12.4 exec tsc --noEmit
   corepack pnpm@10.12.4 run lint

4. Define the provider acceptance matrix

   Cover both agent tasks independently:

   • Findings agent: structured JSON response.
   • Fixer agent: plain-text response and workspace interaction.
   • Codex: stdin transport, explicit model/provider configuration, local session/API-key authentication.
   • Cursor: argv transport, CURSOR_API_KEY, explicit model selection, no unsupported effort flag.
   • Failure cases: missing executable, invalid JSON, timeout, non-zero exit, output limit, and missing credentials.

   Use the existing contracts in provider_specific_cli_adapters.ts and agent_cli_command_policy.ts.

5. Expand deterministic provider tests

   Add or extend tests for:

   • Exact Codex command construction, including model_provider and optional reasoning effort.
   • Exact Cursor command construction and argv prompt delivery.
   • Findings/fixer-specific provider overrides.
   • Credential isolation between Codex, Cursor, and OpenCode.
   • Authentication-preflight behavior for Codex local sessions and Cursor API keys.
   • Provisioning behavior for preinstalled and pinned CLIs.

   Keep these tests credential-free and runnable in normal CI.

6. Add a provider-neutral fake executable integration test

   Build on agent_cli_fake_executable.test.ts to exercise the complete adapter path:

   • Run Codex-mode input through stdin and return a valid Bugbot JSON payload.
   • Run Cursor-mode input through argv and return text.
   • Pass both through FindingsAgentAdapter and FixerAgentAdapter.
   • Verify malformed output is rejected and no findings are published.
   • Verify prompts, model selection, and sanitized environment variables.

7. Run the authorized Codex smoke test first

   On the controlled self-hosted Codex runner:

   node scripts/verify-agent-clis.cjs

   Then run a real, bounded request using the configured Codex model:

   Reply with exactly READY. Do not inspect or modify files.
   

   Use either a preinitialized local Codex session or an authorized OPENAI_API_KEY/CODEX_ACCESS_TOKEN. Record only CLI version, provider, exit status, and sanitized output. The repository explicitly treats help checks as insufficient authentication evidence (Codex documentation).

8. Validate Codex through the actual Bugbot flow

   In a private test repository, create a small fixture containing an intentional, obvious bug or vulnerability. Run detect_potential_problems_action or the commit workflow with:

   agent-provider: codex
   agent-model-provider: openai
   agent-model: <approved-model>

   Confirm that:

   • The findings agent is invoked.
   • The response is parsed into findings.
   • Findings are filtered and published to the issue/PR.
   • Existing markers and resolved findings behave correctly.
   • No credentials appear in logs or comments.

   Then separately test the fixer path with an authorized trusted actor and contents: write, using verification commands before any commit or push.

9. Repeat the same validation for Cursor

   After Codex passes, provision Cursor with the official installer and verified CURSOR_INSTALLER_SHA256. Use a protected environment containing CURSOR_API_KEY, then run:

   agent --version
   agent --help
   node scripts/verify-agent-clis.cjs

   Repeat the bounded smoke test and Bugbot fixture test with:

   agent-provider: cursor
   agent-model-provider: cursor
   agent-model: <approved-model>

   Do not pass CURSOR_API_KEY to fork-controlled or untrusted workflows.

10. Add a manually triggered smoke-test workflow

    Add a separate workflow_dispatch workflow under setup/workflows/ for authorized provider tests. It should:

    • Require an approved GitHub Environment.
    • Run on the appropriate self-hosted runner.
    • Accept a provider/model selection.
    • Run binary verification followed by the bounded smoke request.
    • Never run automatically on pull requests.
    • Never perform repository writes.
    • Avoid printing secrets.

    Keep the existing normal CI focused on deterministic tests; real provider calls must remain opt-in.

11. Update documentation and status

    Update the relevant agent and security-operation pages with:

    • The exact smoke-test workflow and required variables.
    • The Codex test result and approved CLI/model versions.
    • The Cursor test result and installer checksum procedure.
    • Clear separation between deterministic tests, binary checks, and authenticated smoke tests.

    Once Cursor passes, update its current WIP status in cursor-wip.mdx and the runtime status in features.mdx.

12. Run final validation and refresh generated context

    corepack pnpm@10.12.4 exec jest --runInBand
    corepack pnpm@10.12.4 exec tsc --noEmit
    corepack pnpm@10.12.4 run lint
    corepack pnpm@10.12.4 run build
    corepack pnpm@10.12.4 run validate:agent-docs
    git diff --check

    If source files were modified, run graphify update . as required by AGENTS.md.

Reminder

1. Take a coffee break while you work ☕.

Debug log

[DEBUG] Setup done. Issue number: 334, isSingleAction: false, isIssue: true, isPullRequest: false, isPush: false
[DEBUG] ✅ No previous runs active. Continuing...
[INFO] Running IssueUseCase for issue #334.
[INFO] 📋 Executing IssueUseCase.
[INFO] 🔐 Executing CheckPermissionsUseCase.
[DEBUG] Ignoring permission checking. Issue state is not 'opened'.
[INFO] 👤 Executing AssignMemberToIssueUseCase.
[DEBUG] #334 needs 1 assignees.
[INFO] ✏️ Executing UpdateTitleUseCase.
[INFO] 🏷️ Executing UpdateIssueTypeUseCase.
[DEBUG] Setting issue type for issue 334 to Feature
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Successfully updated issue type to Feature
[INFO] 🔗 Executing LinkIssueProjectUseCase.
[DEBUG] Fetched issue ID: I_kwDONSeBW88AAAABOkWb6g
[DEBUG] Content I_kwDONSeBW88AAAABOkWb6g is already linked to project PVT_kwDOA8wRO84Ajh7B.
[DEBUG] LinkIssueProject: issue already linked to project "vypdev" or link failed.
[INFO] 📏 Executing CheckPriorityIssueSizeUseCase.
[DEBUG] Priority: priority: low
[DEBUG] Github Priority Label: P2
[DEBUG] Target field ID: PVTSSF_lADOA8wRO84Ajh7Bzgb4MPQ
[DEBUG] Target option ID: 27f99ddc
[DEBUG] Field 'Priority' is already set to 'P2'. No update needed.
[INFO] 🌿 Executing PrepareBranchesUseCase.
[DEBUG] Fetching tags and forcing fetch...
[DEBUG] Fetching all remote branches with verbose output...
[DEBUG] Successfully fetched all remote branches.
[DEBUG] - bugfix/280-wrong-orphaned-branches-detection
[DEBUG] - bugfix/287-release-deploy-issues
[DEBUG] - bugfix/303-bugbot-first-message-bugs
[DEBUG] - bugfix/309-setup-crash
[DEBUG] - bugfix/314-error-merging-release-branch-after-successful-deployment
[DEBUG] - bugfix/319-setup-crash-on-repository-with-no-issues
[DEBUG] - bugfix/324-wrong-tag-names
[DEBUG] - bugfix/329-it-ends-up-stuck-in-an-unknown-version-loop-if-no-version-is-detected-in-the-repository
[DEBUG] - chore/239-improve-asking
[DEBUG] - chore/253-chore-test
[DEBUG] - chore/271-test-chore-task
[DEBUG] - develop
[DEBUG] - feature/245-other-test
[DEBUG] - feature/274-add-cli-setup-commands-for-initial-configuration
[DEBUG] - feature/279-introduce-the-new-copilot-agent
[DEBUG] - feature/292-github-action-rename
[DEBUG] - feature/296-bugbot-autofix
[DEBUG] - feature/334-test-or-fix-new-agents
[DEBUG] - master
[DEBUG] - release/1.0.51
[DEBUG] - release/1.0.52
[DEBUG] - release/1.1.0
[DEBUG] - release/1.1.1
[DEBUG] - release/1.2.0
[DEBUG] - release/1.3.0
[DEBUG] - release/1.3.1
[DEBUG] - release/1.3.2
[DEBUG] - release/2.0.1
[DEBUG] - release/2.0.2
[DEBUG] - release/2.0.3
[DEBUG] - release/2.0.4
[DEBUG] - release/2.0.5
[DEBUG] - release/2.0.6
[DEBUG] Branch type: feature
[INFO] 🧹 Executing RemoveNotNeededBranchesUseCase.
[INFO] 🏷️ Executing DeployAddedUseCase.
[INFO] 🏷️ Executing DeployedAddedUseCase.
[INFO] 💡 Executing RecommendStepsUseCase.
[DEBUG] RecommendSteps: prompt length=2152, issue description length=1314.
[INFO] 🤖 Recommending steps using the configured agent...
[DEBUG] RecommendSteps: agent response received. Steps length=6133. Full steps:
## Recommended implementation order

1. **Create the feature branch and capture a baseline**

   Start from `develop`, then run the existing quality gates.

   bash
   git switch -c feature/334-test-or-fix-new-agents develop
   corepack pnpm@10.12.4 exec jest --runInBand
   corepack pnpm@10.12.4 exec tsc --noEmit
   corepack pnpm@10.12.4 run lint
   

2. **Define the provider acceptance matrix**

   Cover both agent tasks independently:

   - Findings agent: structured JSON response.
   - Fixer agent: plain-text response and workspace interaction.
   - Codex: stdin transport, explicit model/provider configuration, local session/API-key authentication.
   - Cursor: argv transport, `CURSOR_API_KEY`, explicit model selection, no unsupported effort flag.
   - Failure cases: missing executable, invalid JSON, timeout, non-zero exit, output limit, and missing credentials.

   Use the existing contracts in [`provider_specific_cli_adapters.ts`](/Users/efraespada/actions-runner-4/_work/copilot/copilot/src/data/repository/provider_specific_cli_adapters.ts) and [`agent_cli_command_policy.ts`](/Users/efraespada/actions-runner-4/_work/copilot/copilot/src/data/repository/agent_cli_command_policy.ts).

3. **Expand deterministic provider tests**

   Add or extend tests for:

   - Exact Codex command construction, including `model_provider` and optional reasoning effort.
   - Exact Cursor command construction and argv prompt delivery.
   - Findings/fixer-specific provider overrides.
   - Credential isolation between Codex, Cursor, and OpenCode.
   - Authentication-preflight behavior for Codex local sessions and Cursor API keys.
   - Provisioning behavior for preinstalled and pinned CLIs.

   Keep these tests credential-free and runnable in normal CI.

4. **Add a provider-neutral fake executable integration test**

   Build on [`agent_cli_fake_executable.test.ts`](/Users/efraespada/actions-runner-4/_work/copilot/copilot/src/data/repository/__tests__/agent_cli_fake_executable.test.ts) to exercise the complete adapter path:

   - Run Codex-mode input through stdin and return a valid Bugbot JSON payload.
   - Run Cursor-mode input through argv and return text.
   - Pass both through `FindingsAgentAdapter` and `FixerAgentAdapter`.
   - Verify malformed output is rejected and no findings are published.
   - Verify prompts, model selection, and sanitized environment variables.

5. **Run the authorized Codex smoke test first**

   On the controlled self-hosted Codex runner:

   bash
   node scripts/verify-agent-clis.cjs
   

   Then run a real, bounded request using the configured Codex model:

   text
   Reply with exactly READY. Do not inspect or modify files.
   

   Use either a preinitialized local Codex session or an authorized `OPENAI_API_KEY`/`CODEX_ACCESS_TOKEN`. Record only CLI version, provider, exit status, and sanitized output. The repository explicitly treats help checks as insufficient authentication evidence ([Codex documentation](/Users/efraespada/actions-runner-4/_work/copilot/copilot/docs/agents/codex-openai.mdx)).

6. **Validate Codex through the actual Bugbot flow**

   In a private test repository, create a small fixture containing an intentional, obvious bug or vulnerability. Run `detect_potential_problems_action` or the commit workflow with:

   yaml
   agent-provider: codex
   agent-model-provider: openai
   agent-model: <approved-model>
   

   Confirm that:

   - The findings agent is invoked.
   - The response is parsed into findings.
   - Findings are filtered and published to the issue/PR.
   - Existing markers and resolved findings behave correctly.
   - No credentials appear in logs or comments.

   Then separately test the fixer path with an authorized trusted actor and `contents: write`, using verification commands before any commit or push.

7. **Repeat the same validation for Cursor**

   After Codex passes, provision Cursor with the official installer and verified `CURSOR_INSTALLER_SHA256`. Use a protected environment containing `CURSOR_API_KEY`, then run:

   bash
   agent --version
   agent --help
   node scripts/verify-agent-clis.cjs
   

   Repeat the bounded smoke test and Bugbot fixture test with:

   yaml
   agent-provider: cursor
   agent-model-provider: cursor
   agent-model: <approved-model>
   

   Do not pass `CURSOR_API_KEY` to fork-controlled or untrusted workflows.

8. **Add a manually triggered smoke-test workflow**

   Add a separate `workflow_dispatch` workflow under `setup/workflows/` for authorized provider tests. It should:

   - Require an approved GitHub Environment.
   - Run on the appropriate self-hosted runner.
   - Accept a provider/model selection.
   - Run binary verification followed by the bounded smoke request.
   - Never run automatically on pull requests.
   - Never perform repository writes.
   - Avoid printing secrets.

   Keep the existing normal CI focused on deterministic tests; real provider calls must remain opt-in.

9. **Update documentation and status**

   Update the relevant agent and security-operation pages with:

   - The exact smoke-test workflow and required variables.
   - The Codex test result and approved CLI/model versions.
   - The Cursor test result and installer checksum procedure.
   - Clear separation between deterministic tests, binary checks, and authenticated smoke tests.

   Once Cursor passes, update its current WIP status in [`cursor-wip.mdx`](/Users/efraespada/actions-runner-4/_work/copilot/copilot/docs/agents/cursor-wip.mdx) and the runtime status in [`features.mdx`](/Users/efraespada/actions-runner-4/_work/copilot/copilot/docs/features.mdx).

10. **Run final validation and refresh generated context**

    bash
    corepack pnpm@10.12.4 exec jest --runInBand
    corepack pnpm@10.12.4 exec tsc --noEmit
    corepack pnpm@10.12.4 run lint
    corepack pnpm@10.12.4 run build
    corepack pnpm@10.12.4 run validate:agent-docs
    git diff --check
    

    If source files were modified, run `graphify update .` as required by [`AGENTS.md`](/Users/efraespada/actions-runner-4/_work/copilot/copilot/AGENTS.md).
[INFO] Main run finished. Results: 7, total steps: 2.
[INFO] Publishing result: 7 result(s), 2 step(s), 0 error(s).
[INFO] 📄 Executing PublishResultUseCase.

🚀 Happy coding!

^{Made with ❤️ by vypdev/copilot}