I want you to set up Fresh Jots auto-archiving for my Cursor agent conversations, end to end. Walk me through it conversationally; ask me only what you genuinely can't figure out yourself. Be safe: show diffs before writing any file in my home directory, and never write my API token to any file in the current project or echo it back to me after I paste it.

You are the Cursor agent, so you can inspect your own configuration and transcript files directly — use that. This prompt follows Cursor's hooks reference (cursor.com/docs/agent/hooks). Two things are marked "VERIFY" because the docs leave them open: the layout of your transcript file, and where agent transcripts are switched on. Everything else (hook names, the stdin payload, the hooks.json schema, the Fresh Jots API calls) is fixed and correct as written.

Why this design: Cursor's `sessionEnd` hook fires when a composer, tab or window is closed, and on window close the shell host that would run the command is already gone, so a hook that waits for the end of a conversation can lose it. The `stop` hook fires every time the agent loop ends — after each of your replies — with the conversation id and `transcript_path` in its payload. So this hook keeps one append-only Fresh Jots note per conversation and appends the new part of the transcript after every turn; `preCompact` runs the same script once more just before the context is summarised, so nothing is lost mid-conversation.

End state we're aiming for:
- Two hooks (stop and preCompact) wired in ~/.cursor/hooks.json, both invoking ~/.cursor/hooks/freshjots-cursor-sessions.sh.
- That script (full content in step 3 below) reads the conversation transcript Cursor names on stdin (`transcript_path`), renders it to plain text in ~/.cursor/freshjots-stash/cursor-YYYY-MM-DD-<id>.txt (one file per conversation, named after the first 12 characters of its id, rewritten each turn), and appends only the lines that are new since the previous turn to a Fresh Jots note of the same name inside the "ai_sessions" folder. The note is created append-only on the first turn (trusted-timestamped with an RFC 3161 authority, best-effort via openssl); later turns append through the by-filename endpoint, and Fresh Jots rolls the note over automatically when it reaches the plan's per-note cap (3 MB on the Dev trial and the Dev plan), so a long conversation is never dropped on a size limit. The note starts with a two-line header (`Cursor conversation: <id>` + `Started:`) so it self-identifies. The stash keeps the 500 most-recent conversations.
- My Fresh Jots token stored in ~/.cursor/freshjots-token (mode 600). Cursor is a GUI application, so variables exported in a shell profile do not reliably reach its hooks; the file is what the hook reads. The script also accepts FRESHJOTS_TOKEN from the environment when it is there.

Idempotent by design: if I re-run this prompt later, every step should detect existing state (token file present, script unchanged, hook entries already present, folder already created) and no-op. Tell me which steps you skipped and why.

Step 1 — Confirm intent. Tell me in one sentence what you're about to do. Ask me to type "yes" before you touch any file. After I've confirmed once, you can proceed through the remaining steps without asking again unless you hit a destructive edit you can't reverse.

Step 2 — Token bootstrap.
- Check presence without printing the value: `[ -s "$HOME/.cursor/freshjots-token" ] && echo file || { [ -n "${FRESHJOTS_TOKEN:-}" ] && echo env || echo unset; }`. Use that output, never `cat` the file or `echo $FRESHJOTS_TOKEN` (those would dump the value into the transcript).
- **If "file"**: verify with `curl -sS -o /dev/null -w '%{http_code}' --max-time 15 -H "Authorization: Bearer $(cat "$HOME/.cursor/freshjots-token")" https://freshjots.com/api/v1/folders`. The shell expands the substitution at runtime, so the value never appears in stdout, stderr, or the transcript. Expect 200. On 401, tell me the stored token is rejected and ask me for a fresh one (then continue as "unset"). On 200, jump to step 3.
- **If "env"** (the variable reached this process but no file exists yet): verify the same way with `-H "Authorization: Bearer $FRESHJOTS_TOKEN"`, then write the file: `umask 077 && printf '%s\n' "$FRESHJOTS_TOKEN" > "$HOME/.cursor/freshjots-token"`.
- **If "unset"**, tell me: "Go to https://freshjots.com, sign up (free, no card). At onboarding, pick the 'Plain notes' mode (its card mentions a 14-day free API trial) — that gets you a 14-day Dev trial token automatically. If you already have a Dev account, Settings → API tokens → Create token. Either way, you'll end up with an `mn_...` string. Paste it here when you have it."
- Once I paste a token, verify it with one curl call, substituting the literal `mn_...` value into the Authorization header (this single command is the only place the value appears outside the token file — unavoidable for the paste-in-chat flow): `curl -sS -o /dev/null -w '%{http_code}' --max-time 15 -H "Authorization: Bearer mn_THE_VALUE_I_PASTED" https://freshjots.com/api/v1/folders`. Expect 200. On 401, tell me politely "that token didn't work — paste another?" and retry up to 3 times.
- After verification, write the token file with `umask 077 && printf '%s\n' "mn_..." > "$HOME/.cursor/freshjots-token"` (mode 600, owner-only). Do not edit my shell profile for this; the file is enough.
- Never write the raw token to any file in the current repo, and never echo it back into the chat after that one verify call. From this step on, refer to it only as the token file in any bash command.

Step 3 — Hook script. Write the script below to ~/.cursor/hooks/freshjots-cursor-sessions.sh (create the directory if missing), then `chmod +x` it. If the file already exists with identical content, skip. If it exists with different content, show me the diff and ask before overwriting.

VERIFY (transcript layout) after writing the script: Cursor's docs describe `transcript_path` only as "the path to the main conversation transcript file" (null when transcripts are disabled) and do not publish its layout. User reports place it under ~/.cursor/projects/<project>/agent-transcripts/<conversation-id>/ as a .jsonl file in the same shape Claude Code uses (one JSON object per line with `type` "user" or "assistant" and a `message` whose `content` is text or an array of text, tool_use and tool_result blocks). The flatten below handles that shape and several generic ones (records under messages/history/turns/items/events or at the top level; role plus text/content/parts). Confirm against a real file with the dry run in step 6; adjust the `records`, `pick` or `role_of` definitions only if conversation text is missing from the rendering. The raw-transcript fallback keeps everything whenever the render fails or comes out empty.

Script content (write this verbatim, no edits, no improvements):

#!/usr/bin/env bash
# Auto-archive each Cursor agent conversation into one append-only Fresh Jots
# note inside the ai_sessions folder: on every `stop` (end of an agent turn)
# and on `preCompact`, render the transcript to plain text and append only
# what is new since the previous run. A per-conversation stash file keeps
# the latest full rendering locally as a fallback for offline / API-down
# moments. Always exits 0 and prints "{}"; failures log, never block the user.

set -uo pipefail

STASH_DIR="$HOME/.cursor/freshjots-stash"
LOG_FILE="$STASH_DIR/.log"
FOLDER_ID_FILE="$STASH_DIR/.folder-id"
TOKEN_FILE="$HOME/.cursor/freshjots-token"
FOLDER_NAME="ai_sessions"
KEEP=500
API="https://freshjots.com/api/v1"
# RFC 3161 trusted-timestamp authority, used once per conversation when the
# note is created (the TSA sees only a SHA-256, never the content).
TSA_URL="${FRESHJOTS_TSA_URL:-http://timestamp.digicert.com}"
# FRESHJOTS_DRY_RUN=1 renders and stashes but makes no network call and does
# not advance the per-conversation offset — the way to verify the transcript
# layout (step 6) without posting anything.
DRY_RUN="${FRESHJOTS_DRY_RUN:-0}"

mkdir -p "$STASH_DIR"
log() { printf '[%s] %s\n' "$(date -Iseconds)" "$*" >> "$LOG_FILE"; }
finish() { echo '{}'; exit 0; }

# Cursor pipes one JSON object to the hook on stdin. Every agent hook carries
# conversation_id, generation_id, hook_event_name, workspace_roots and
# transcript_path (null when transcripts are disabled); stop adds status
# (completed|aborted|error) and loop_count; preCompact adds trigger and the
# context counters.
INPUT=$(cat)
CONV_ID=$(printf '%s' "$INPUT" | jq -r '.conversation_id // .session_id // empty')
EVENT=$(printf '%s' "$INPUT" | jq -r '.hook_event_name // empty')
TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty')
log "FIRED event='$EVENT' conversation='$CONV_ID' status='$(printf '%s' "$INPUT" | jq -r '.status // .trigger // empty')'"

[ -z "$CONV_ID" ] && { log "ABORT: no conversation_id"; finish; }

# Token: the environment variable when present, else the owner-only token file
# (a GUI-launched Cursor does not inherit shell-profile exports).
if [ -z "${FRESHJOTS_TOKEN:-}" ] && [ -s "$TOKEN_FILE" ]; then
    FRESHJOTS_TOKEN=$(tr -d '[:space:]' < "$TOKEN_FILE")
fi
[ -z "${FRESHJOTS_TOKEN:-}" ] && [ "$DRY_RUN" != "1" ] && { log "ABORT: no token (FRESHJOTS_TOKEN unset and $TOKEN_FILE missing)"; finish; }

# Fall back to the newest agent transcript under ~/.cursor/projects if the
# payload didn't carry a usable transcript_path (transcripts disabled in
# Cursor's settings, or a moved file). The conversation id is preferred.
if [ -z "$TRANSCRIPT" ] || [ ! -s "$TRANSCRIPT" ]; then
    TRANSCRIPT=$(find "$HOME/.cursor/projects" -type f -path "*agent-transcripts*" -name "*${CONV_ID}*" 2>/dev/null \
        | xargs -r ls -1t 2>/dev/null | head -1)
fi
if [ -z "$TRANSCRIPT" ] || [ ! -s "$TRANSCRIPT" ]; then
    log "ABORT: could not locate transcript for conversation=$CONV_ID (are agent transcripts enabled in Cursor settings?)"
    finish
fi

# One note per conversation, named on the first turn and remembered locally,
# so every later turn appends to the same note: cursor-<YYYY-MM-DD>-<id12>
# (the first 12 alphanumerics of the conversation id).
ID8=$(printf '%s' "$CONV_ID" | tr -cd 'A-Za-z0-9' | cut -c1-12)
NAME_FILE="$STASH_DIR/.name-$ID8"
OFFSET_FILE="$STASH_DIR/.offset-$ID8"
if [ -s "$NAME_FILE" ]; then
    TITLE=$(cat "$NAME_FILE")
else
    TITLE="cursor-$(date +%Y-%m-%d)-$ID8"
    echo "$TITLE" > "$NAME_FILE"
fi
FLAT="$STASH_DIR/${TITLE}.txt"
NEW="$FLAT.new"

# Flatten the transcript -> role-prefixed plain text. Accepts the Claude-style
# JSON Lines shape (records with type user|assistant and a message whose
# content is text or an array of text / tool_use / tool_result blocks) and
# generic shapes (one JSON document or one object per line; records under
# messages/history/turns/items/events or at the top level; role plus
# text/content/parts). Emits "[timestamp] ROLE:\ntext". clean() strips
# re-injected system blocks; cap() bounds tool payloads; prose is never
# truncated. On any jq error or empty output the raw transcript is used.
jq -r '
def clean: gsub("<system-reminder>[\\s\\S]*?</system-reminder>"; "");
def cap($n): if (.|length) > $n then (.[0:$n]) + "\n…[truncated " + (((.|length) - $n)|tostring) + " chars]" else . end;
def pick: (.text // .content // .parts // .message // .payload // .output // .result // .functionCall // .function_call // .functionResponse // .response // null);
def text_of:
  if type == "string" then .
  elif type == "number" or type == "boolean" then tostring
  elif type == "array" then ([.[] | text_of] | map(select(. != "")) | join("\n"))
  elif type == "object" then
    ( if (.thought // false) == true or (.type // "") == "thinking" then ""
      elif (.type // "") == "tool_use" or (has("name") and (has("args") or has("arguments") or has("input"))) then
        "[Tool: " + ((.name // .displayName // "?")|tostring) + "] " + ((.args // .arguments // .input // {}) | tostring | cap(1500))
      elif (.type // "") == "tool_result" then
        "TOOL RESULT:\n" + ((.content // .output // "") | text_of | cap(4000))
      elif has("response") and (has("name") or has("id")) then
        "TOOL RESULT:\n" + (.response | tostring | cap(4000))
      elif has("inlineData") or has("fileData") or (.type // "") == "image" then "[binary content omitted]"
      else (pick | if . == null then "" else text_of end)
      end )
  else "" end;
def role_of: ((.role // .author // .type // "?") | tostring | ascii_upcase);
def result_block: (text_of | cap(4000) | if startswith("TOOL RESULT:") then . else "TOOL RESULT:\n" + . end);
def tool_calls_of:
  ((.toolCalls // []) | map(
      "[Tool: " + ((.name // .displayName // "?")|tostring) + "] " + ((.input // .args // {}) | tostring | cap(1500))
      + (if (.result // null) != null then "\n" + (.result | result_block) else "" end)
    ) | join("\n"));
def without_call_parts:
  if (.content | type) == "array" then .content |= map(select((type == "object" and has("functionCall")) | not)) else . end;
def records:
  if type == "array" then .[]
  elif type == "object" then
    ( if has("$set") or has("$patch") or has("$rewindTo") then empty
      elif has("messages") then .messages[]
      elif has("history")  then .history[]
      elif has("turns")    then .turns[]
      elif has("items")    then .items[]
      elif has("events")   then .events[]
      else . end )
  else empty end;
[ records
  | select(type == "object")
  | . as $m
  | (($m.timestamp // $m.ts // $m.time // $m.created_at // "") | tostring) as $ts
  | (if ($m.message | type) == "object" then $m.message else $m end) as $body_src
  | ($body_src | role_of) as $role
  | (if (($m.toolCalls // []) | length) > 0 then ($body_src | without_call_parts) else $body_src end) as $body
  | ([ ($body | text_of), ($m | tool_calls_of) ] | map(select(. != "")) | join("\n")) as $text
  | select(($text | length) > 0)
  | (if $ts == "" then "" else "[" + $ts + "] " end) + $role + ":\n" + $text + "\n"
] | join("\n") | clean | select(length > 0)
' "$TRANSCRIPT" > "$NEW" 2>>"$LOG_FILE"
render_status=$?
if [ "$render_status" -ne 0 ] || [ ! -s "$NEW" ]; then
    cp "$TRANSCRIPT" "$NEW"
fi

# What is new since the previous successful upload? The offset is the byte
# length of the rendering that was uploaded last time. A rendering shorter
# than the offset means the transcript was rewritten (context compaction):
# then the whole new rendering is appended after a marker, which can repeat
# a little text but never loses any.
new_len=$(wc -c < "$NEW" | tr -d ' ')
old_len=$(cat "$OFFSET_FILE" 2>/dev/null || echo 0)
case "$old_len" in ''|*[!0-9]*) old_len=0 ;; esac
DELTA=$(mktemp)
if [ "$new_len" -lt "$old_len" ]; then
    { printf '\n==================== CONTEXT COMPACTED · %s · transcript restarted ====================\n\n' "$(date -Iseconds)"; cat "$NEW"; } > "$DELTA"
    mode="restart"
else
    tail -c +$((old_len + 1)) "$NEW" > "$DELTA"
    mode="append"
fi
mv "$NEW" "$FLAT"
delta_bytes=$(wc -c < "$DELTA" | tr -d ' ')
if [ "$delta_bytes" -eq 0 ]; then
    log "NOTHING NEW for $TITLE (rendering $new_len bytes, uploaded $old_len)"; rm -f "$DELTA"; finish
fi
log "RENDERED $FLAT ($new_len bytes) from $TRANSCRIPT; $mode delta of $delta_bytes bytes"

if [ "$DRY_RUN" = "1" ]; then
    cp "$DELTA" "$STASH_DIR/.last-delta-$ID8.txt"
    log "DRY RUN: not posting; inspect $FLAT (full rendering) and $STASH_DIR/.last-delta-$ID8.txt (what would be appended)"
    rm -f "$DELTA"; finish
fi

# Find-or-create the ai_sessions folder (cached id, case-insensitive name match).
folder_id=""
LIMITS_JSON=$(curl -sS --max-time 15 -H "Authorization: Bearer $FRESHJOTS_TOKEN" "$API/limits" 2>>"$LOG_FILE" || true)
if [ -s "$FOLDER_ID_FILE" ]; then
    cached=$(cat "$FOLDER_ID_FILE")
    status=$(curl -sS --max-time 15 -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $FRESHJOTS_TOKEN" "$API/folders/$cached")
    [ "$status" = "200" ] && folder_id=$cached
fi
if [ -z "$folder_id" ]; then
    folder_id=$(curl -sS --max-time 15 -H "Authorization: Bearer $FRESHJOTS_TOKEN" "$API/folders" \
      | jq -r --arg n "$FOLDER_NAME" '.folders[]? | select((.name // "" | ascii_downcase) == ($n | ascii_downcase)) | .id' | head -1)
fi
if [ -z "$folder_id" ]; then
    folder_id=$(curl -sS --max-time 15 -H "Authorization: Bearer $FRESHJOTS_TOKEN" -H "Content-Type: application/json" \
        -X POST -d "{\"folder\":{\"name\":\"$FOLDER_NAME\"}}" "$API/folders" | jq -r '.id // empty')
fi
if [ -n "$folder_id" ]; then echo "$folder_id" > "$FOLDER_ID_FILE"; else log "WARN: could not resolve/create folder '$FOLDER_NAME'; creating at root"; fi

# RFC 3161 token over $1's exact bytes (best-effort; empty on any failure).
tsa_token_for() {
    local file="$1" dir tsq tsr
    command -v openssl >/dev/null 2>&1 || { log "TSA: openssl not found; creating without token"; return 0; }
    dir=$(mktemp -d) || return 0
    tsq="$dir/req.tsq"; tsr="$dir/resp.tsr"
    if ! openssl ts -query -data "$file" -sha256 -cert -out "$tsq" 2>>"$LOG_FILE"; then log "TSA: ts -query failed; creating without token"; rm -rf "$dir"; return 0; fi
    if ! curl -sS --max-time 20 -H 'Content-Type: application/timestamp-query' --data-binary "@$tsq" "$TSA_URL" -o "$tsr" 2>>"$LOG_FILE" || [ ! -s "$tsr" ]; then log "TSA: query to $TSA_URL failed; creating without token"; rm -rf "$dir"; return 0; fi
    base64 < "$tsr" | tr -d '\n'
    rm -rf "$dir"
}

# Create the conversation's note from its first chunk (append-only, in the
# folder, trusted-timestamped). Returns 0 on 201.
create_note() {
    local body_file="$1" payload response status tsa_token
    payload=$(mktemp); response=$(mktemp)
    tsa_token=$(tsa_token_for "$body_file")
    jq -Rs --arg title "$TITLE" --arg fid "$folder_id" --arg tok "$tsa_token" --arg tsaurl "$TSA_URL" '
        {note: (
            {title: $title, plain_body: ., format: "plain", append_only: true}
            + (if $fid != "" then {folder_id: ($fid | tonumber)} else {} end)
            + (if $tok != "" then {tsa_token: $tok, tsa_url: $tsaurl} else {} end)
        )}' < "$body_file" > "$payload"
    status=$(curl -sS -o "$response" -w '%{http_code}' --max-time 30 -X POST "$API/notes" \
        -H "Authorization: Bearer $FRESHJOTS_TOKEN" -H "Content-Type: application/json" --data-binary "@$payload" 2>>"$LOG_FILE")
    if [ "$status" = "201" ]; then
        log "CREATED note #$(jq -r '.id // "?"' < "$response") '$TITLE' folder_id=$folder_id"; rm -f "$payload" "$response"; return 0
    fi
    log "FAILURE: create status=$status title='$TITLE' body=$(head -c 256 "$response" 2>/dev/null)"; rm -f "$payload" "$response"; return 1
}

# Append one chunk to the conversation's note by filename. Returns 0 on 2xx.
append_chunk() {
    local body_file="$1" payload response status
    payload=$(mktemp); response=$(mktemp)
    jq -Rs '{text: .}' < "$body_file" > "$payload"
    status=$(curl -sS -o "$response" -w '%{http_code}' --max-time 30 -X POST "$API/notes/by-filename/$TITLE/append" \
        -H "Authorization: Bearer $FRESHJOTS_TOKEN" -H "Content-Type: application/json" --data-binary "@$payload" 2>>"$LOG_FILE")
    case "$status" in
        200|201) log "APPENDED $(wc -c < "$body_file" | tr -d ' ') bytes to '$TITLE'$(jq -r 'if .rolled_over_from then " (rolled over from #" + (.rolled_over_from|tostring) + ")" else "" end' < "$response" 2>/dev/null)"; rm -f "$payload" "$response"; return 0 ;;
        *) log "FAILURE: append status=$status title='$TITLE' body=$(head -c 256 "$response" 2>/dev/null)"; rm -f "$payload" "$response"; return 1 ;;
    esac
}

# Per-chunk ceiling: 90% of the plan's per-note cap (GET /api/v1/limits
# plain_body_bytes), 900,000 bytes when the call failed. Fresh Jots rolls an
# append-only note over when an append would exceed its cap, so chunks only
# have to stay under the single-request ceiling.
cap_bytes=$(printf '%s' "$LIMITS_JSON" | jq -r '.plain_body_bytes // empty' 2>/dev/null)
MAX_BYTES=900000
case "$cap_bytes" in ''|*[!0-9]*) ;; *) [ "$cap_bytes" -gt 0 ] && MAX_BYTES=$(( cap_bytes * 9 / 10 )) ;; esac

# Does the note exist yet? 404 → create from the first chunk; 200 → append.
# Any other answer (401, 5xx, network) → do nothing this turn; the offset is
# unchanged, so the next turn re-sends the same delta.
exists=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 15 -H "Authorization: Bearer $FRESHJOTS_TOKEN" "$API/notes/by-filename/$TITLE" 2>>"$LOG_FILE")
case "$exists" in
    200) need_create=0 ;;
    404) need_create=1 ;;
    *)   log "FAILURE: lookup status=$exists for '$TITLE'; will retry next turn"; rm -f "$DELTA"; finish ;;
esac
if [ "$need_create" = "1" ]; then
    { printf 'Cursor conversation: %s\nStarted: %s\n\n' "$CONV_ID" "$(date '+%Y-%m-%d %H:%M:%S')"; cat "$DELTA"; } > "$DELTA.hdr" && mv "$DELTA.hdr" "$DELTA"
fi

SPLIT_PREFIX="$STASH_DIR/.split-${ID8}."
rm -f "${SPLIT_PREFIX}"* 2>/dev/null
split -C "$MAX_BYTES" -- "$DELTA" "$SPLIT_PREFIX"
ok=1
for part in "${SPLIT_PREFIX}"*; do
    if [ "$need_create" = "1" ]; then
        create_note "$part" || { ok=0; break; }
        need_create=0
    else
        append_chunk "$part" || { ok=0; break; }
    fi
done
rm -f "${SPLIT_PREFIX}"* "$DELTA"
if [ "$ok" = "1" ]; then
    echo "$new_len" > "$OFFSET_FILE"
    log "SUCCESS: '$TITLE' is up to date ($new_len bytes rendered)"
else
    log "INCOMPLETE: '$TITLE' upload failed part-way; offset kept at $old_len, the next turn retries. Full rendering at $FLAT"
fi

# Rotate the stash: keep the 500 most-recently-modified conversation files.
( cd "$STASH_DIR" && ls -1t *.txt 2>/dev/null | tail -n +$((KEEP + 1)) | while IFS= read -r f; do rm -f -- "$f"; done )

finish

Step 4 — hooks.json. Register the stop and preCompact hooks in ~/.cursor/hooks.json (user level, so every project archives; a project-level <project>/.cursor/hooks.json works the same way for one project). If the file doesn't exist, create it with just this content (substitute my actual $HOME — JSON doesn't expand ~):

{
  "version": 1,
  "hooks": {
    "stop": [
      { "command": "bash <HOME>/.cursor/hooks/freshjots-cursor-sessions.sh", "timeout": 120 }
    ],
    "preCompact": [
      { "command": "bash <HOME>/.cursor/hooks/freshjots-cursor-sessions.sh", "timeout": 120 }
    ]
  }
}

This is the schema the hooks reference documents: "version": 1 and a "hooks" object mapping camelCase hook names to arrays of { "command", "timeout" }; "timeout" is in seconds (the platform default is shorter than a multi-chunk upload needs, hence 120); hooks fail open, so a timeout or error never blocks the agent. User-level hooks run from ~/.cursor, which is why every path in the script is absolute.

If the file already exists, read it with jq and append our entry to .hooks.stop[] and .hooks.preCompact[] (creating those arrays if absent), keeping "version" and every other key. Do NOT duplicate: if an entry whose command already matches `bash <HOME>/.cursor/hooks/freshjots-cursor-sessions.sh` is already in either array, leave it alone. Show me the diff before writing. Validate the result with `jq . ~/.cursor/hooks.json > /dev/null`.

Step 5 — Folder bootstrap. Eagerly create the ai_sessions folder so I get a visible confirmation it worked before the first turn is archived:
- `GET https://freshjots.com/api/v1/folders` with the bearer token; look for a folder named "ai_sessions" (Fresh Jots creates a built-in one for plain-notes accounts, so it is usually already there).
- If absent: `POST https://freshjots.com/api/v1/folders` with body `{"folder":{"name":"ai_sessions"}}`.
- Persist the returned id (or the existing one) to ~/.cursor/freshjots-stash/.folder-id. `mkdir -p ~/.cursor/freshjots-stash` first.

Step 6 — Dry run against this very conversation, then tell me what to do next.
- VERIFY (transcripts on): agent transcripts must be enabled for `transcript_path` to be set; the docs name no setting for it, so check Cursor's settings for an agent transcripts option and, if there is none, rely on the dry run below. Find this conversation's transcript: `ls -t ~/.cursor/projects/*/agent-transcripts/*/ 2>/dev/null | head` (the newest .jsonl is this conversation). If nothing is there, tell me transcripts appear to be off and where you looked.
- Run the hook once without posting: `printf '{"conversation_id":"dryrun","hook_event_name":"stop","status":"completed","transcript_path":"<that path>"}' | FRESHJOTS_DRY_RUN=1 bash ~/.cursor/hooks/freshjots-cursor-sessions.sh`. Open ~/.cursor/freshjots-stash/cursor-<today>-dryrun.txt and confirm it contains my prompts and your replies as "USER:" / "ASSISTANT:" blocks (not raw JSON). If it is raw JSON, the layout differs from the one described in step 3: show me one line from the transcript and propose the one-line adjustment to `records`, `pick` or `role_of`. Then remove the dry-run leftovers: `rm -f ~/.cursor/freshjots-stash/*dryrun* ~/.cursor/freshjots-stash/.*dryrun*`.
- Then print a single clear three-line block:
  1. Reload hooks: open Cursor's Customize → Hooks tab (or restart Cursor) and check that stop and preCompact list the freshjots script.
  2. Start a new agent chat and ask anything trivial. When the agent finishes replying, the stop hook fires and creates the conversation's note; every later reply appends to it.
  3. Open freshjots.com → ai_sessions: a note named cursor-<today>-<id> appears and grows with each turn. The Hooks output channel in Cursor shows each run and any error.

Step 7 — Verification helpers. Tell me I can:
  - `tail -f ~/.cursor/freshjots-stash/.log` in another terminal to watch each turn being appended.
  - `ls -1t ~/.cursor/freshjots-stash/` to see one rendering per conversation.
  - `grep -lr "some-keyword" ~/.cursor/freshjots-stash/` to search recent conversations even when offline.

Constraints:
- Use absolute paths everywhere ($HOME expands; ~ inside JSON does not).
- Prefer jq over hand-rolled JSON manipulation.
- Treat every file edit as needing diff + my "yes" the first time, then proceed.
- If any API call returns non-200/201, stop and explain what happened — don't paper over it.
- If `jq` or `curl` is missing, tell me which package manager to use to install it (apt/dnf/brew/pacman based on what's on $PATH) and ask before installing.
- `openssl` is optional (used only to add a client-side RFC 3161 timestamp when the note is created): if it's missing, tell me which package manager to use and ask before installing, but still proceed if I decline — the note is timestamped by Fresh Jots after upload.

Begin.