cursor: project Permissions via .cursor/sandbox.json (move PERMS to native)

[scottmeyer]

Status: deferred from v0.8.0 plugin upgrade.
Plugin: cursor (plugins/cursor.go)
Capability cell: PERMS, currently ----

Context

Cursor 2.4+ added sandbox profiles (.cursor/sandbox.json) for permission policy — domain allowlists, filesystem scoping, per-workspace and admin-level configs. See:

• https://cursor.com/docs/cli/reference/permissions
• https://cursor.com/blog/agent-sandboxing

The current cursor plugin marks PERMS as SupportUnsupported (v0.8.0 capability flip was deferred since the sandbox shape isn't a straight allow/ask/deny list).

What to implement

1. In plugins/cursor.go's Plan(), when proj.Permissions is non-nil, emit a .cursor/sandbox.json op (OpMerge so user-authored keys survive).
2. Translate the canonical tool:pattern grammar to Cursor's sandbox structure:
   • bash:<cmd> * → shell command allowlist / denylist
   • Read|Write|Edit:<path> → filesystem scoping
   • URL or domain patterns → network allowlists
3. Where the translation is lossy (e.g., Cursor's allowlist can't express a pattern), emit an info warning the way other plugins do.
4. Flip Capabilities().Permissions from SupportUnsupported → SupportNative (or SupportDegraded if the translation loses semantics for common cases).
5. Importer parity: extend internal/importer/cursor.go to read .cursor/sandbox.json back into model.Permissions.

Acceptance criteria

• prism capabilities shows cursor PERMS = native (or degr. with clear docs).
• A skill/scope-projected .agents/permissions.yaml round-trips: prism init --from cursor && prism compile && prism check clean.
• Round-trip test in internal/engine/roundtrip_test.go covers a sandbox.json fixture.