Correctness
                                                                                                                                                                                
  Critical — TUI proxy mode is broken for both agents. cli/lib/composefile.bash:98 (set_proxy_tui_mode) rewrites the mitmproxy command to -s /scripts/mitmproxy_addon.py, but
  that file no longer exists (renamed to mitmproxy_addon_claude.py / _cursor.py). Any user running sandcat init --proxy tui — including existing Claude users after upgrade —   
  gets a mitmproxy with no addon loaded: no secret substitution → agent receives the placeholder as its API key → 401s. The rewrite also drops the new --set http2=… 
  stream_large_bodies=1m connection_strategy=lazy anticomp=true timeout_read=300 flags, breaking Cursor streaming in TUI mode regardless.

  Medium.
  - cli/lib/composefile.bash:53-54 — add_cursor_config_volumes unconditionally mounts ~/.cursor/AGENTS.md, rules, skills. If absent on the host, Docker auto-creates them as
  root-owned dirs in the user's $HOME.
  - app-init.sh:86 switched su - vscode → su -m vscode, so ~/.profile is no longer sourced. Compensated for mise, but breaks user-customized PATH/NVM/direnv for existing Claude
   users.
  - mitmproxy_addon_claude.py:4 docstring still references the old mitmproxy_addon.py filename.
  - cli/libexec/init/init:29 fallback to settings-user.json is dead (file was renamed).
  - Cursor addon substitutes body placeholders only for textual content types, regressing behavior for application/octet-stream relative to Claude.

  Security

  HIGH — secret leak into the agent container. mitmproxy_addon_cursor.py:244-248 (_write_secrets_json) writes resolved secrets in plaintext to
  /home/mitmproxy/.mitmproxy/sandcat-secrets.json. compose-proxy.yml:30 maps that path into the shared mitmproxy-config volume, which compose-all.yml:20 mounts read-only into
  the agent container at /mitmproxy-config. Any in-container process (including the agent itself under prompt injection) can read CURSOR_API_KEY, GITHUB_TOKEN, etc. chmod 0600
  doesn't help — the file is readable across the volume. This directly breaks sandcat's "real key never enters the container" invariant. Worse: grep shows nothing reads this
  file — it's dead scaffolding from the reverted "real-key bootstrap" commit.

  Medium. stream_large_bodies=1m is now set for Claude too, so request bodies >1MB bypass flow.request.content-based placeholder leak detection — defence-in-depth regression on
   the existing Claude path.

  Low. _is_cursor_streaming_request is client-triggerable via content-type: application/connect+proto, skipping body substitution. No secret disclosure, but the escape hatch is
   client-controlled.

  Checked, fine: allowlist scope (narrow, no stray wildcards), shell/template injection (agent name is validated against claude|cursor before any substitution), TLS trust (uses
   Debian CA store, no NODE_TLS_REJECT_UNAUTHORIZED=0 or CA widening), debug logging (SHA-256 fingerprints only), Claude addon is a pure rename.

  Conciseness / Duplication

  Major duplication between addons. mitmproxy_addon_cursor.py (448 lines) clones ~180 lines from mitmproxy_addon_claude.py (271 lines): SETTINGS_PATHS, _merge_settings,
  _configure_op_token, _resolve_secret_value, _shell_escape, _validate_env_name, _write_placeholders_env, _load_secrets, _load_network_rules, dns_request, etc. Extracting a
  sandcat_mitm_common.py base would shrink Cursor to ~150 lines.

  Repetition in devcontainer.bash:124-182. Four near-identical placeholder-replacement loops in customize_agent_templates — one replace_placeholder_line helper over a (file,
  token, replacement) list would halve it.

  Inconsistent dispatch in agents.bash. sct_agent_compose_environment_block returns a full environment: block; peers return inner content only. This forces a special-case in
  devcontainer.bash:141-152. Normalize to inner-content and put the YAML key in the template.

  Hard-coded agent names in init. init:302-304 (if [[ "$agent" == "cursor" ]]) and the onepassword branch in the next-steps block defeat the agents.bash abstraction.

  Dead code: the entire SANDCAT_SECRETS_PATH / _write_secrets_json path (also a security finding above).

  Tests

  - Addon tests are thin — 4 Cursor-specific cases against a 448-line addon. Uncovered: _is_cursor_host boundaries (e.g. notcursor.sh), path-based streaming detection,
  basic-auth placeholder decode/replace (~40 lines, zero coverage), _normalize_authorization_header_value, _is_textual_content_type edge cases, responseheaders negative path,
  DNS handler on CursorSandcatAddon, leak detection for streaming-to-disallowed-host.
  - Weakened assertion — user_settings.bats bulk-switched assert_output "X" → assert_output --partial "X", which hides regressions. Unrelated to Cursor support.
  - Soft regression check — regression.bats asserts environment // null == null; an accidental empty environment: {} (which compose rejects — exactly the bug the split is meant
   to prevent) would pass. Assert key absence or that docker compose config parses.
  - Unfocused test — extensions.bats "sets claude mitmproxy defaults" asserts 5 facts; only 2 are agent-driven. The others pass regardless of customize_agent_templates.
  - Redundancy — the two customize_devcontainer_extensions removes placeholder… cases duplicate each other; the composefile cursor-volume test duplicates
  add_cursor_config_volumes adds AGENTS.md and rules.
  - No direct tests for agents.bash (209 lines) — exercised only indirectly.

  Priority fixes before merge

  1. Fix composefile.bash:98 TUI path (filename + lost --set flags). Blocks existing Claude users.
  2. Remove _write_secrets_json and SANDCAT_SECRETS_PATH — dead code that actively leaks secrets.
  3. Revert the --partial weakening in user_settings.bats and tighten the environment: regression assertion.
  4. Extract a shared mitm addon module to de-duplicate ~180 lines.
  5. Decide on the su -m behavior change and document it, or restore login-shell semantics for Claude users.