Add code-reviewer SDK example

[yurekami]

Summary

• New sdk/code-reviewer example: a small CLI that turns a git diff into a structured code review by streaming a Cursor SDK agent over the diff and validating a strict JSON schema (summary + comments[] with file, line, severity, category, comment, suggestion).
• Uses a three-dot diff (base...head) so it reviews only the work on head, matching what reviewers see on a GitHub PR.
• Exits non-zero on findings at or above --fail-on severity (default high), so it can drop in as a CI gate.
• Default model is claude-4.6-sonnet-high, overridable via --model / $CURSOR_MODEL. Conventions and boilerplate match sdk/quickstart (pnpm, TS, ESM, top-level await, strict tsconfig, Node ≥22).
• Updates the top-level README.md to link the new example.

What it demonstrates

• Structured JSON output with the SDK: a strict prompt contract plus defensive parsing (markdown fence stripping, {...} slice fallback) and full schema validation before use.
• Real-world CLI ergonomics on top of Agent.create({ local: { cwd } }): configurable refs, model, severity threshold, JSON or human output, and exit codes (0 clean, 1 findings, 2 operational error).
• Surfaces friendly errors for the common git failure modes (missing git, not a repo, unknown ref, diff too large) instead of leaking raw stderr.

Test plan

• pnpm install and pnpm typecheck from sdk/code-reviewer — clean.
• pnpm build then node dist/index.js --help — prints usage, exits 0.
• Error-path smoke tests on built artifact (all return clean code-reviewer: <message> and exit 2):
  • Unknown flag (--frobnicate)
  • Invalid --fail-on bogus
  • Invalid --max-diff-bytes -5
  • Missing CURSOR_API_KEY
  • --cwd pointed at a non-git directory
  • --base set to a non-existent ref
• End-to-end review against a live Cursor agent was not exercised in CI here (no API key in the verification environment); the JSON contract and schema validation are exercised at parse time.

Notes

• pnpm-lock.yaml is committed to match the other examples under sdk/.
• The Cursor SDK accepts Claude model ids like claude-4.6-sonnet-high and claude-4.6-opus-max (verified against the regex in sdk/app-builder/src/lib/app-builder/server.ts); the README mentions both Claude and the existing composer-2/gpt-5.3-codex ids so users can swap freely.

---

Note

Low Risk
Adds a new standalone SDK example CLI (plus its lockfile) without modifying existing runtime code paths; primary risk is maintenance/CI noise from the large pnpm-lock.yaml and external model/CLI behavior.

Overview
Adds a new sdk/code-reviewer example: a Node/TypeScript CLI that runs git diff base...head, streams the diff to a Cursor SDK agent with a strict JSON-only prompt, defensively extracts/parses the response, validates it against a summary + comments[] schema, and exits non-zero based on a configurable severity threshold for CI gating.

Updates the top-level README.md to link this new example, and includes the example’s build tooling (package.json, tsconfig.json, workspace config) and pinned dependencies (pnpm-lock.yaml).

^{Reviewed by Cursor Bugbot for commit c583e54. Bugbot is set up for automated code reviews on this repo. Configure here.}