feat: add Origin (Cursor) adapter

[Meldiron]

What does this PR do?

Adds a new Git adapter for Origin, Cursor's code hosting platform (launched 2026-08-17), plus its test class.

Adapter (src/VCS/Adapter/Git/Origin.php)

• Auth: EdDSA (Ed25519) app JWT — signed with ext-sodium, since Origin apps use Ed25519 keys — exchanged for a short-lived installation access token (oit_…), cached like the GitHub adapter's tokens.
• Content writes over Git HTTPS: Origin's partner API has no create-file/branch/tag endpoints (writes travel over Git), so createFile, createBranch and createTag shell out to git with the installation token (Basic auth, username x-access-token), with the token scrubbed from any error output.
• Check runs: mapped onto Origin's upsert-by-key model while preserving this library's create/update-by-id semantics (stable suite key = run name, unique run key per created run).
• Webhooks: Origin signs deliveries with its own Ed25519 key (webhook-signature: v1ed,BASE64 over the hex SHA-256 of <webhook-id>.<webhook-timestamp>.<raw body>); validateWebhookEvent() verifies that. getEvents() parses the delivery envelope, maps PR lifecycle event types to GitHub-style actions, and expands multi-ref push deliveries into one event per ref.
• Full partner API surface beyond the abstract contract: pull request update/merge/listing, PR comments/commits listings, reviews (create/list/update/dismiss), commit listing/files/compare, blob fetch, batch contents fetch, batch check-run upsert, check suite/run listings, app metadata, installation listing/deletion, webhook delivery listing/redelivery, rate limit, mirror sync.
• Repository deletion uses the Cursor web app's API (POST cursor.com/api/origin/delete-repo) — the partner API has no deletion endpoint. Auth compatibility with app tokens is pending E2E verification.

Not supported by Origin (methods throw or degrade gracefully)

Commit statuses (check runs only), repository visibility flags, archive/presigned downloads, language statistics, user lookup, per-repository webhooks (Origin delivers per app installation), namespace listing.

Test changes

• tests/VCS/Adapter/OriginTest.php: full Base suite wiring plus Origin-specific tests (Ed25519 webhook validation incl. PEM keys, PR lifecycle action mapping, multi-ref pushes, merge/update/list PRs, reviews, batch contents, batch check runs, rate limit, app/installation metadata). Needs TESTS_ORIGIN_PRIVATE_KEY, TESTS_ORIGIN_APP_IDENTIFIER, TESTS_ORIGIN_INSTALLATION_ID.
• tests/VCS/Base.php: new capability flags ($supportsRepositoryDeletion, $reportsRepositoryVisibility, $supportsRepositoryArchives) and teardown now goes through discardRepositories() everywhere.
• src/VCS/Adapter.php: empty JSON POST bodies encode as {} instead of [] (Origin's proto3-JSON endpoints reject bare arrays).

Status

• PHPStan level 8 clean, Pint clean
• Credential-free smoke tests (JWT against real OpenSSL Ed25519 keys, webhook verification, event parsing)
• E2E suite against a live Origin app (pending credentials)

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR adds an Origin/Cursor Git provider with Ed25519 authentication and webhook verification, normalized repository and pull-request operations, Git-backed content writes, and provider-specific tests.

• Adds the Origin adapter and its API, webhook, check-run, and Git-write integrations.
• Registers credential-free Origin tests and adjusts empty JSON request serialization.
• Documents Origin as a supported provider.

Confidence Score: 3/5

The PR is not safe to merge until createFile validates the destination before any recursive directory creation can follow repository-controlled symlinks.

Recursive mkdir can modify a writable host path through a checked-out symlink before the subsequent confinement check rejects the file operation.

Files Needing Attention: src/VCS/Adapter/Git/Origin.php

Security Review

The attempted checkout-confinement fix still permits recursive directory creation through repository-controlled symlinks before validating the resolved parent, allowing persistent directories to be created outside the temporary checkout.

How this was verified: The checkout materializes repository symlinks, recursive mkdir runs before realpath confinement, and cleanup removes only the checkout.

Important Files Changed

Filename	Overview
src/VCS/Adapter/Git/Origin.php	Adds the Origin integration, but createFile performs recursive directory creation before validating symlink-resolved confinement.
tests/VCS/Adapter/OriginTest.php	Adds runnable credential-free Origin behavior tests while isolating the unsupported live suite.
src/VCS/Adapter.php	Serializes empty JSON parameter arrays as an empty object for APIs requiring object-shaped request bodies.
phpunit.xml	Registers the Origin test suite, although existing CI suite matrices do not select it.
README.md	Lists Origin as a supported VCS adapter.

Prompt To Fix All With AI

### Issue 1
src/VCS/Adapter/Git/Origin.php:1805
**Symlink followed before confinement**

When a checked-out repository contains a directory symlink to a writable host directory and `createFile()` targets a missing descendant, recursive `mkdir()` follows the symlink before the parent is validated, creating a persistent directory outside the temporary checkout. Cleanup removes only the checkout.

**How this was verified:** The checkout materializes repository symlinks, recursive `mkdir()` runs before `realpath()` confinement, and cleanup removes only the checkout.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (3): Last reviewed commit: "fix: refuse symlinked write targets and ..." | Re-trigger Greptile}

[Meldiron]

lgtm