Summary

Ports three things from upstream openai/codex-plugin-cc, adapted to the Cursor CLI, and bumps the plugin to 0.4.0:

1. /cursor:adversarial-review — a first-class steerable review command that challenges the chosen implementation and design (assumptions, tradeoffs, failure modes, whether a different approach would be simpler/safer), not just implementation defects. It reuses the existing review runtime (review.mjs --adversarial), so --base / --scope / --model / --wait / --background and free-form focus text all work, and it is tracked as a normal job (/cursor:status, /cursor:result, /cursor:cancel). Promotes what used to be only the --adversarial flag into a discoverable command with sharper framing.
2. Estimate-first reviews — /cursor:review and /cursor:adversarial-review now gauge the diff size (git status / git diff --shortstat) and ask wait vs background once via AskUserQuestion when no explicit mode is passed (recommending background beyond a tiny 1–2 file change). Explicit --wait / --background skip the question. Both commands moved from an auto-executing one-liner to a model-orchestrated flow; their allowed-tools gained Bash(git:*) and AskUserQuestion. Background runs still use the plugin's own detached worker (script returns a job id immediately), not a Claude background task.
3. composer-prompting skill — the Cursor prompt-shaping guidance (repo grounding, five-section prompt anatomy + guardrails, chunking heuristics, model selection, resume-vs-fresh) now lives in skills/composer-prompting/SKILL.md. The cursor-runner subagent references it via a new skills: frontmatter entry instead of restating it inline. Mirrors codex's internal gpt-5-4-prompting skill.

Deliberately skipped (out of scope for this PR): the stop-review-gate Stop hook and /transfer (the latter depends on a Codex-specific external-session importer that cursor-agent does not have).

Behaviour note: review.md now sets disable-model-invocation: true (matching upstream), so /cursor:review is user-invoked only — the model no longer auto-triggers the slash command.

Test plan

• npm test — all specs green (89 tests, incl. 2 new: adversarial end-to-end + buildReviewPrompt framing unit test)
• npm run lint — prettier + eslint clean
• Smoke-tested affected commands locally — ran review.mjs --adversarial --wait -- "<focus>" and --adversarial --background -- "<focus>" against the stub cursor-agent: foreground reports (model auto, adversarial) → Status: done → Review section; background self-detaches and prints the job id + /cursor:status hints.
• Docs updated (README.md, AGENTS.md, CHANGELOG.md)
• New tests added for new behaviour

Checklist

• No new runtime dependencies (adversarial-review reuses review.mjs; no new script/deps)
• No build step, no new dist/ or .ts files
• $ARGUMENTS is quoted in the edited/added commands/*.md
• Deviations from the command recipe documented in AGENTS.md (estimate-first commands are model-orchestrated and reuse review.mjs)
• User-visible changes recorded in CHANGELOG.md (under ## 0.4.0)