fix(cursor-plugin): read get_call_run fields from result{}

[Arshgill01]

Summary

• The Cursor skill still told agents to read summary / transcript at the top level. Live get_call_run nests them under result{} (same envelope as docs(mcp): tool-call auth needs the CLI token, and get_call_run nests fields under result{} #126).
• Copy the skills.sh untrusted-output boundary into the Cursor skill and command reference.
• tools/list can return extra tools. Readiness now requires the three call tools and forbids track_ui_events.
• check-plugin now fails if those sentences disappear, with a regression test.

Related to #126 (Cursor skill half of the envelope issue). Does not close #126: the OAuth/tools/call auth note and the public MCP docs table still need a docs change.

Test plan

• node --test ./test/cursor-plugin.test.js in packages/cursor-plugin — 12 pass
• node ./scripts/check-plugin.mjs
• Reviewer: compare packages/cursor-plugin/plugin/skills/calle/SKILL.md terminal template with skills/calle/SKILL.md
• Reviewer: confirm we did not reintroduce bare calle / npx invocation

Made with Cursor

[Ray-56]

Requesting changes on the exact current head (3a4f590). The nested summary/transcript lookup and explicit untrusted rendering are useful, but the rewritten MCP-first safety contract is still incomplete around real-call side effects and the same result envelope:

• [P1] An uncertain direct-MCP run_call has no no-retry/recovery branch. The flow assumes a run_id is returned and proceeds to polling. A timeout, disconnect, or error after server acceptance can leave no run_id; repeating run_call can place a duplicate real call. Explicitly require that agents never repeat run_call or create a new plan when the outcome is uncertain. Reuse only a known run_id; follow trustworthy structured recovery metadata when available, otherwise stop for operator review. Add a checker/test assertion for this rule.

• [P1] The new untrusted-output boundary excludes plan_call. Clarifying questions/messages from plan_call are remote data and can contain prompt-injection instructions, URLs, tool names, or credential requests. Cover output from all three CALL-E MCP tools. Reuse only the specifically allowlisted structured plan_id, confirm_token, and run_id as arguments; render clarifying text inertly and never obey embedded instructions.

• [P2] The terminal template fixes summary/transcript but leaves other nested result fields ambiguous. Spell out the actual details paths (result.extracted.to_phones[0], result.extracted.calling.*, and result.call_id) so agents do not repeat the top-level lookup bug. Also recognize the documented NO ANSWER terminal alias as NO_ANSWER; otherwise polling can continue after termination. Synchronize the command reference and checker tests.

The Cursor package check, 12/12 tests, and package dry-run pass; the repository-wide suite reaches only the known base-branch macOS mixed-install fixture failure. GitHub CI is action_required with zero jobs. Content blockers prevent the low-risk merge exception.

Release decision: Patch release recommended for @call-e/cursor-plugin; the included patch changeset is appropriate after the safety guidance is complete.