@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/adapters/cursor/live-transport.ts

@@ -81,6 +81,8 @@ import {
 } from "./native-exec-shell";
 import type { CursorClientMessage, CursorRunRequest, CursorServerMessage } from "./types";
 import type { CursorTransport, CursorTransportFactoryInput } from "./transport";
+import { CursorHttp1BidiConnection } from "./http1-bidi";
+import { isPinnedHttp1 } from "../../lib/upstream-http-version";
 
 const CURSOR_RUN_PATH = "/agent.v1.AgentService/Run";
 const CURSOR_CLIENT_VERSION = "cli-2026.07.08-0c04a8a";
@@ -406,6 +408,7 @@ export function clientToolFinalizeGraceMsForRequest(request: CursorRunRequest, b
 class LiveCursorTransport implements CursorTransport {
   private session?: http2.ClientHttp2Session;
   private stream?: http2.ClientHttp2Stream;
+  private http1Connection?: CursorHttp1BidiConnection;
   private heartbeat?: ReturnType<typeof setInterval>;
   private firstFrameTimer?: ReturnType<typeof setTimeout>;
   private committed = false;
@@ -438,9 +441,12 @@ class LiveCursorTransport implements CursorTransport {
  private firstFrameAt?: number;
  private firstFrameLogged = false;
   /** Stable session identifier sent as x-session-id; mirrors IDE session semantics. */
-  private readonly sessionId = crypto.randomUUID();
+  private readonly sessionId: string;
+  /** Per-transport owner for native-exec / background shells. Must not share conversationId. */
+  private readonly shellOwnerId = crypto.randomUUID();
 
   constructor(private readonly input: CursorTransportFactoryInput) {
+    this.sessionId = input.sessionId?.trim() || crypto.randomUUID();
     this.translatorBudget = input.translatorBudget;
     this.token = resolveCursorToken(input.provider, input.headers);
     // Grace window before a drained client-tool turn is finalized. Small enough not to look like a
@@ -452,7 +458,7 @@ class LiveCursorTransport implements CursorTransport {
     this.desktopDeps = desktopDepsFromConfig(input.provider.desktopExecutor);
     this.execContext = {
       ...this.desktopDeps,
-      sessionId: this.sessionId,
+      sessionId: this.shellOwnerId,
       unsafeAllowNativeLocalExec: effectiveCursorNativeExecAllow(input.provider, input.requestDeclaresFullAccess === true),
     };
     const servers = resolveMcpServers(input.provider);
@@ -487,7 +493,7 @@ class LiveCursorTransport implements CursorTransport {
             ...this.desktopDeps,
             ...mcpDepsFromManager(this.mcpManager!),
             mcpToolDefs,
-            sessionId: this.sessionId,
+            sessionId: this.shellOwnerId,
             unsafeAllowNativeLocalExec: effectiveCursorNativeExecAllow(this.input.provider, this.input.requestDeclaresFullAccess === true),
           };
         } catch (err) {
@@ -680,12 +686,24 @@ class LiveCursorTransport implements CursorTransport {
       || this.pendingTransportFrames >= CURSOR_MAX_PENDING_FRAMES
     ) {
       this.stream?.pause();
+      this.http1Connection?.pause();
       return;
     }
     if (
       this.transportBufferedBytes <= CURSOR_TRANSPORT_RESUME_BYTES
       && this.pendingTransportFrames <= CURSOR_PENDING_FRAMES_RESUME
-    ) this.stream?.resume();
+    ) {
+      this.stream?.resume();
+      this.http1Connection?.resume();
+    }
+  }
+
+  private writeConnectFrame(frame: Uint8Array): void {
+    if (this.http1Connection) {
+      this.http1Connection.write(frame);
+      return;
+    }
+    this.stream?.write(frame);
   }
 
   requestCommitted(): boolean {
@@ -700,7 +718,7 @@ class LiveCursorTransport implements CursorTransport {
   }
 
   private startShellCleanup(): Promise<BackgroundShellTerminationReport> {
-    return this.shellCleanup ??= terminateBackgroundShellsForSession(this.sessionId);
+    return this.shellCleanup ??= terminateBackgroundShellsForSession(this.shellOwnerId);
   }
 
   async close(): Promise<void> {
@@ -709,6 +727,7 @@ class LiveCursorTransport implements CursorTransport {
     this.clearFirstFrameTimer();
     this.stream?.close();
     this.session?.close();
+    this.http1Connection?.close();
     this.releaseBlobRequestScope();
     this.releaseMcpObservation?.();
     this.releaseMcpObservation = undefined;
@@ -721,12 +740,16 @@ class LiveCursorTransport implements CursorTransport {
     this.clearPendingFinalize();
     if (this.heartbeat) clearInterval(this.heartbeat);
     this.clearFirstFrameTimer();
-    try {
-      this.stream?.close(http2.constants.NGHTTP2_CANCEL);
-    } catch {
-      this.stream?.destroy();
+    if (this.http1Connection) {
+      this.http1Connection.close();
+    } else {
+      try {
+        this.stream?.close(http2.constants.NGHTTP2_CANCEL);
+      } catch {
+        this.stream?.destroy();
+      }
+      this.session?.close();
     }
-    this.session?.close();
     this.releaseBlobRequestScope();
     this.releaseMcpObservation?.();
     this.releaseMcpObservation = undefined;
@@ -791,35 +814,52 @@ class LiveCursorTransport implements CursorTransport {
     fail: (error: Error) => void,
     finish: () => void,
   ): void {
+    if (signal?.aborted) {
+      fail(signal.reason instanceof Error ? signal.reason : new Error("Cursor request was aborted"));
+      return;
+    }
     this.turnStartedAt = Date.now();
     this.framesReceived = 0;
     this.sawAssistantText = false;
     this.emittedTerminal = false;
     this.firstFrameAt = undefined;
     this.firstFrameLogged = false;
-    const dialHost = cursorHostLabel(this.input.provider.baseUrl || "https://api2.cursor.sh");
-    debugProviderDiagnostic("cursor", "dial", { host: dialHost });
-    this.session = http2.connect(this.input.provider.baseUrl || "https://api2.cursor.sh");
-    // The run request is buffered until the HTTP/2 session connects. Failures before `connect`
-    // (DNS, ECONNREFUSED, TLS, connect timeout) mean the server never received the request, so they
-    // are safe to retry. Once connected, bytes flush to the server and the turn must not be replayed.
-    this.session.on("connect", () => {
-      this.committed = true;
-      debugProviderDiagnostic("cursor", "connected", { connectMs: Date.now() - this.turnStartedAt });
-    });
-    this.stream = this.session.request({
-      ":method": "POST",
-      ":path": CURSOR_RUN_PATH,
-      "content-type": "application/connect+proto",
-      "connect-protocol-version": "1",
-      te: "trailers",
-      authorization: `Bearer ${this.token}`,
-      "x-ghost-mode": "true",
-      "x-cursor-client-version": CURSOR_CLIENT_VERSION,
-      "x-cursor-client-type": "cli",
-      "x-request-id": crypto.randomUUID(),
-      "x-session-id": this.sessionId,
-    });
+    const baseUrl = this.input.provider.baseUrl || "https://api2.cursor.sh";
+    const useHttp1 = isPinnedHttp1(this.input.provider.upstreamHttpVersion);
+    const requestId = crypto.randomUUID();
+    const dialHost = cursorHostLabel(baseUrl);
+    debugProviderDiagnostic("cursor", "dial", { host: dialHost, transport: useHttp1 ? "http1.1" : "http2" });
+
+    let session: http2.ClientHttp2Session | undefined;
+    let stream: http2.ClientHttp2Stream | undefined;
+    if (!useHttp1) {
+      session = http2.connect(baseUrl);
+      this.session = session;
+      // The run request is buffered until the HTTP/2 session connects. Failures before `connect`
+      // (DNS, ECONNREFUSED, TLS, connect timeout) mean the server never received the request, so they
+      // are safe to retry. Once connected, bytes flush to the server and the turn must not be replayed.
+      session.on("connect", () => {
+        this.committed = true;
+        debugProviderDiagnostic("cursor", "connected", {
+          transport: "http2",
+          connectMs: Date.now() - this.turnStartedAt,
+        });
+      });
+      stream = session.request({
+        ":method": "POST",
+        ":path": CURSOR_RUN_PATH,
+        "content-type": "application/connect+proto",
+        "connect-protocol-version": "1",
+        te: "trailers",
+        authorization: `Bearer ${this.token}`,
+        "x-ghost-mode": "true",
+        "x-cursor-client-version": CURSOR_CLIENT_VERSION,
+        "x-cursor-client-type": "cli",
+        "x-request-id": requestId,
+        "x-session-id": this.sessionId,
+      });
+      this.stream = stream;
+    }
 
     // Single-shot terminal owner for this turn (createTerminalSettler): stream error, session
     // error, trailers, end, abort, and the first-frame timeout all race into it, and only the
@@ -845,11 +885,9 @@ class LiveCursorTransport implements CursorTransport {
       }
       settler.settleFail(error);
     };
-    const session = this.session;
-    const stream = this.stream;
     // Session-level errors (TLS/socket/GOAWAY) do not always propagate to the stream listener;
     // without this handler they could bypass orderly failure reporting entirely.
-    session.on("error", err => {
+    const onSessionError = (err: unknown) => {
       const realErr = err instanceof Error ? err : new Error(String(err));
       debugProviderDiagnostic("cursor", "session-error", {
         code: String((realErr as { code?: unknown }).code ?? ""),
@@ -857,15 +895,18 @@ class LiveCursorTransport implements CursorTransport {
         elapsedMs: Date.now() - this.turnStartedAt,
       });
       failAndClear(realErr);
-    });
+    };
     this.firstFrameTimer = setTimeout(() => {
       this.firstFrameTimer = undefined;
       debugProviderDiagnostic("cursor", "first-frame-timeout", { timeoutMs: this.input.firstFrameTimeoutMs ?? CURSOR_FIRST_FRAME_TIMEOUT_MS });
-      try { stream.close(); } catch { /* already closing */ }
-      try { session.close(); } catch { /* already closing */ }
-      // close() waits for in-flight frames; a dead socket can ignore it — force-destroy shortly
-      // after so a stalled TLS session cannot linger past the timeout.
-      armTimeoutDestroyFallback(stream, session, this.input.timeoutDestroyGraceMs ?? CURSOR_TIMEOUT_DESTROY_GRACE_MS);
+      try { stream?.close(); } catch { /* already closing */ }
+      try { session?.close(); } catch { /* already closing */ }
+      this.http1Connection?.close();
+      if (stream && session) {
+        // close() waits for in-flight frames; a dead socket can ignore it — force-destroy shortly
+        // after so a stalled TLS session cannot linger past the timeout.
+        armTimeoutDestroyFallback(stream, session, this.input.timeoutDestroyGraceMs ?? CURSOR_TIMEOUT_DESTROY_GRACE_MS);
+      }
       releaseBacklogLease();
       settler.settleFail(new Error("Cursor transport timed out before first response"));
     }, this.input.firstFrameTimeoutMs ?? CURSOR_FIRST_FRAME_TIMEOUT_MS);
@@ -963,7 +1004,7 @@ class LiveCursorTransport implements CursorTransport {
           });
       }
     };
-    this.stream.on("data", chunk => {
+    const onData = (chunk: string | Uint8Array) => {
       this.clearFirstFrameTimer();
       // Once the turn has settled, late network bytes must never be charged —
       // the backlog lease is already released and nobody would own these.
@@ -992,13 +1033,13 @@ class LiveCursorTransport implements CursorTransport {
         if (charged && !appended) this.releaseTransportBytes(bytes.byteLength);
         failAndClear(err instanceof Error ? err : new Error(String(err)));
       }
-    });
-    this.stream.on("trailers", trailers => {
+    };
+    const onTrailers = (trailers: http2.IncomingHttpHeaders) => {
       const status = trailers["grpc-status"];
       if (status !== undefined) debugProviderDiagnostic("cursor", "trailers", { grpcStatus: String(status) });
       if (status && status !== "0") failAndClear(new Error(`Cursor gRPC error ${status}`));
-    });
-    this.stream.on("error", err => {
+    };
+    const onStreamError = (err: unknown) => {
       const realErr = err instanceof Error ? err : new Error(String(err));
       if (this.expectedClose) {
         failAndClear(realErr);
@@ -1016,8 +1057,8 @@ class LiveCursorTransport implements CursorTransport {
         elapsedMs: Date.now() - this.turnStartedAt,
       });
       failAndClear(realErr);
-    });
-    this.stream.on("end", () => {
+    };
+    const onStreamEnd = () => {
       this.clearFirstFrameTimer();
       debugProviderDiagnostic("cursor", "stream-end", {
         committed: this.committed,
@@ -1078,16 +1119,56 @@ class LiveCursorTransport implements CursorTransport {
       }, (err) => {
         failAndClear(err instanceof Error ? err : new Error(String(err)));
       });
-    });
+    };
+
+    if (useHttp1) {
+      const providerFetch = this.input.fetch
+        ?? (this.input.provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch;
+      this.http1Connection = new CursorHttp1BidiConnection({
+        baseUrl,
+        token: this.token,
+        clientVersion: CURSOR_CLIENT_VERSION,
+        sessionId: this.sessionId,
+        requestId,
+        translatorBudget: this.translatorBudget,
+        callbacks: {
+          onCommitted: () => {
+            this.committed = true;
+            debugProviderDiagnostic("cursor", "connected", {
+              transport: "http1.1",
+              connectMs: Date.now() - this.turnStartedAt,
+            });
+          },
+          onData,
+          onEnd: onStreamEnd,
+          onError: onStreamError,
+        },
+        ...(providerFetch ? { fetch: providerFetch } : {}),
+      });
+      this.http1Connection.start();
+    } else {
+      session!.on("error", onSessionError);
+      stream!.on("data", onData);
+      stream!.on("trailers", onTrailers);
+      stream!.on("error", onStreamError);
+      stream!.on("end", onStreamEnd);
+    }
 
     signal?.addEventListener("abort", () => {
       this.close();
       failAndClear(new Error("Cursor request was aborted"));
     }, { once: true });
+    // Close the race between the preflight above and listener installation. No request payload is
+    // written until after this check.
+    if (signal?.aborted) {
+      this.close();
+      failAndClear(signal.reason instanceof Error ? signal.reason : new Error("Cursor request was aborted"));
+      return;
+    }
 
-    this.stream.write(encodeConnectFrame(encodedRequest));
+    this.writeConnectFrame(encodeConnectFrame(encodedRequest));
     this.heartbeat = setInterval(() => {
-      this.stream?.write(encodeClientMessage({
+      this.writeConnectFrame(encodeClientMessage({
         message: { case: "clientHeartbeat", value: create(ClientHeartbeatSchema, {}) },
       }));
     }, HEARTBEAT_MS);
@@ -1098,10 +1179,10 @@ class LiveCursorTransport implements CursorTransport {
     state: ReturnType<typeof createCursorProtobufEventState>,
     push: (message: CursorServerMessage) => void,
   ): Promise<void> {
-    if (!this.stream) return;
+    if (!this.stream && !this.http1Connection) return;
     debugProviderDiagnostic("cursor", "frame", describeCursorServerFrame(message));
     if (message.message.case === "kvServerMessage") {
-      this.stream.write(encodeConnectFrame(handleCursorNativeKv(message.message.value, this.blobRequestScope)));
+      this.writeConnectFrame(encodeConnectFrame(handleCursorNativeKv(message.message.value, this.blobRequestScope)));
       return;
     }
     if (message.message.case === "execServerMessage") {
@@ -1122,7 +1203,7 @@ class LiveCursorTransport implements CursorTransport {
       // run the same local action twice.
       push({ type: "local_side_effect" });
       const replies = await handleCursorNativeExec(message.message.value, this.execContext);
-      for (const reply of replies) this.stream.write(encodeConnectFrame(reply));
+      for (const reply of replies) this.writeConnectFrame(encodeConnectFrame(reply));
       return;
     }
     if (message.message.case === "interactionQuery") {
@@ -1132,7 +1213,7 @@ class LiveCursorTransport implements CursorTransport {
       const query = message.message.value;
       const plan = planInteractionQueryReply(query);
       debugProviderDiagnostic("cursor", "interaction-query", { id: query.id, queryCase: query.query.case ?? "unknown", reply: plan.replyCase });
-      this.stream.write(encodeClientMessage({ message: { case: "interactionResponse", value: plan.response } }));
+      this.writeConnectFrame(encodeClientMessage({ message: { case: "interactionResponse", value: plan.response } }));
       if (!state.terminated) {
         if (plan.planText) {
           this.sawAssistantText = true;

package/src/adapters/cursor/native-exec-fs.ts

@@ -47,7 +47,7 @@ function codexNativeMutationRefusal(operation: "write" | "delete", structuredEdi
 }
 
 const NATIVE_LOCAL_EXEC_DISABLED =
-  "Route filesystem work through the Codex Responses bridge shell tool (`shell_command` / `exec_command`, or the listed `mcp_opencodex-responses_*` display alias) with equivalent shell commands (cat, head, ls, rg, grep), or `apply_patch` for file edits. Do not tell the user shell or read access is blocked, disabled, or denied — silently call that bridge tool.";
+  "Cursor-native filesystem tools are not executed locally. Use a catalog tool for this work: `shell_command` / `exec_command` (or the listed `mcp_opencodex-responses_*` display alias) with host-shell-safe equivalents: POSIX (`cat`, `head`, `ls`, `rg`, `grep`) or Windows PowerShell (`Get-Content`, `Get-ChildItem`, `Select-String`); use `apply_patch` for file edits.";
 
 export function rejectReadExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
   if (execMsg.message.case !== "readArgs") throw new Error("invalid read exec");

package/src/adapters/cursor/native-exec-network.ts

@@ -7,7 +7,7 @@ export interface CursorNativeNetworkDeps {
 }
 
 const NATIVE_FETCH_DISABLED =
-  "Route this through the Codex shell bridge tool `shell_command` (aliases: `exec_command`, `mcp_opencodex-responses_shell_command`, `mcp_opencodex-responses_exec_command`) with curl or wget. Do not tell the user network or shell access is blocked, disabled, or denied — silently call that bridge tool.";
+  "Cursor-native fetch is not executed locally. Use the Codex shell bridge tool `shell_command` (aliases: `exec_command`, `mcp_opencodex-responses_shell_command`, `mcp_opencodex-responses_exec_command`) with curl or wget.";
 
 export function rejectFetchExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
   if (execMsg.message.case !== "fetchArgs") throw new Error("invalid fetch exec");

package/src/adapters/cursor/native-exec-shell.ts

@@ -89,7 +89,6 @@ export function nativeShellDisabledMessage(): string {
   // client that executes the bridge (LAN/SSH remote-proxy).
   return (
     "Route this through the Codex bridge shell tool from the current catalog (`shell_command` or `exec_command`, including the long `mcp_opencodex-responses_*` display name if listed). "
-    + "Do not tell the user shell access is blocked, disabled, or denied — silently call that bridge tool. "
     + "Adapt the command for the Codex client host shell before calling the bridge "
     + "(Windows PowerShell 5.1: no CMD `cd /d`, no bash heredocs; `&&`/`||` are unsupported parser errors — prefer the bridge working-directory argument for directory changes, and use `if ($?) { ... }` for success-gated follow-up steps; do not treat `;` as a substitute for `&&`). "
     + "Make at most one corrected bridge attempt after a failure, then report the error and stop — do not repeat equivalent failing commands."

package/src/adapters/cursor/protobuf-request.ts

@@ -5,6 +5,7 @@ import type { OcxAssistantContentPart, OcxMessage, OcxToolResultMessage } from "
 import { namespacedToolName } from "../../types";
 import type { CursorRunRequest } from "./types";
 import { isCursorExternalWireModel } from "./discovery";
+import { normalizeCursorToolResultText } from "./tool-result-normalize";
 import { debugProviderDiagnostic } from "../../lib/debug";
 import {
   createCursorBlobRequestScope,
@@ -68,6 +69,14 @@ export const CURSOR_EXTERNAL_ROOT_BLOB_LIMIT = 192;
 /** Approximate prompt-size guard; tool schemas and protocol framing consume context separately. */
 export const CURSOR_EXTERNAL_ROOT_BYTE_LIMIT = 512 * 1024;
 
+/**
+ * Action text for external-model tool-result continuations. Native models keep
+ * resumeAction; external wire models continue as userMessageAction so the
+ * results already stored in history blobs are visible without a ResumeAction.
+ */
+export const CURSOR_EXTERNAL_TOOL_CONTINUATION_TEXT =
+  "Continue: the requested tool results are provided in the conversation history above.";
+
 /** Runtime timezone for protobuf RequestContextEnv (dynamic, never hardcoded). */
 function runtimeTimeZone(): string {
   try {
@@ -122,6 +131,10 @@ function rootBlobCandidate(
   };
 }
 
+function toolResultRootPayload(text: string): { role: "assistant"; content: [{ type: "text"; text: string }] } {
+  return { role: "assistant", content: [{ type: "text", text }] };
+}
+
 function truncateToolResultBlob(entry: RootBlobCandidate, maxBytes: number): RootBlobCandidate | null {
   if (entry.byteLength <= maxBytes) return entry;
   if (entry.role !== "toolResult" || entry.text === undefined) return null;
@@ -134,7 +147,7 @@ function truncateToolResultBlob(entry: RootBlobCandidate, maxBytes: number): Roo
     while (end > 0 && end < encoded.byteLength && (encoded[end]! & 0xc0) === 0x80) end -= 1;
     const truncated = `${decoder.decode(encoded.subarray(0, end))}${marker}`;
     const result = rootBlobCandidate(
-      { role: "user", content: [{ type: "text", text: truncated }] },
+      toolResultRootPayload(truncated),
       "toolResult",
       { messageIndex: entry.messageIndex, text: truncated },
     );
@@ -143,7 +156,7 @@ function truncateToolResultBlob(entry: RootBlobCandidate, maxBytes: number): Roo
     keepBytes = Math.max(0, end - (result.byteLength - maxBytes) - 16);
   }
   const markerOnly = rootBlobCandidate(
-    { role: "user", content: [{ type: "text", text: marker.trimStart() }] },
+    toolResultRootPayload(marker.trimStart()),
     "toolResult",
     { messageIndex: entry.messageIndex, text: marker.trimStart() },
   );
@@ -175,9 +188,8 @@ function assistantRootText(
 // Cursor builds the actual model prompt from rootPromptMessagesJson (turns[] is UI/display metadata),
 // so prior history — including assistant tool calls and tool results — must be replayed here or a
 // ResumeAction has nothing model-visible to continue from. The active user message is excluded
-// because it travels in the action. Tool results are rendered as user-role text with a marker, and
-// each entry is a SHA-256 blob ID (Cursor fetches the bytes back via getBlobArgs). Mirrors the
-// danger-pi reference buildRootPromptMessagesJson.
+// because it travels in the action. Tool results are assistant-role text with a [Tool Result]
+// or [Tool Error] marker so Cursor does not wrap them as `<user_query>` (#1992). Each entry is a SHA-256 blob ID.
 function rootPromptMessages(request: CursorRunRequest, requestScope: CursorBlobRequestScopeToken): {
   ids: Uint8Array[];
   byteLength: number;
@@ -229,10 +241,12 @@ function rootPromptMessages(request: CursorRunRequest, requestScope: CursorBlobR
       }
       // Assistant tool CALLS are intentionally NOT replayed as visible "[Tool Call]" text here.
     } else if (message.role === "toolResult") {
-      const prefix = message.isError ? "[Tool Error]" : "[Tool Result]";
+      // #1920: the prefix must reflect the NORMALIZED error state (an empty
+      // node_repl result is an error even when the runtime said isError=false).
+      const prefix = normalizedToolResult(message, contentToText(message.content)).isError ? "[Tool Error]" : "[Tool Result]";
       const text = `${prefix}\n${toolResultToText(message)}`;
       entries.push(rootBlobCandidate(
-        { role: "user", content: [{ type: "text", text }] },
+        toolResultRootPayload(text),
         "toolResult",
         { messageIndex: i, text },
       ));
@@ -382,6 +396,8 @@ type DecodedResultPart =
   | { kind: "image"; bytes: Uint8Array; mimeType: string }
   | { kind: "undecodable" };
 
+type NormalizedToolResult = { text: string; isError: boolean };
+
 /**
  * Decode a tool result's parts ONCE. `toolCallStep` may re-serialize a step several times while
  * shrinking it to fit blob admission, and decoding base64 on every attempt made that loop
@@ -413,13 +429,24 @@ function toolResultContentItems(
   message: OcxToolResultMessage,
   decoded?: DecodedResultPart[],
   maxImages = Number.POSITIVE_INFINITY,
+  normalizedText?: NormalizedToolResult,
 ) {
   const parts = decoded ?? decodeResultParts(message);
+  const textItem = (text: string) => [create(McpToolResultContentItemSchema, {
+    content: { case: "text" as const, value: create(McpTextContentSchema, { text }) },
+  })];
   if (!parts) {
-    const text = typeof message.content === "string" ? message.content : "";
-    return [create(McpToolResultContentItemSchema, {
-      content: { case: "text" as const, value: create(McpTextContentSchema, { text }) },
-    })];
+    const normalized = normalizedText
+      ?? normalizedToolResult(message, typeof message.content === "string" ? message.content : "");
+    return textItem(normalized.text);
+  }
+  const normalized = normalizedText ?? normalizedDecodedTextResult(message, parts);
+  if (normalized) {
+    // #1920/#1866: empty or failure-state Computer Use / node_repl results are
+    // normalized before they reach the native wire. Pure-text part arrays use
+    // the same newline-joined representation this serializer already emitted;
+    // image-bearing and undecodable results stay on the lossless part path.
+    return textItem(normalized.text);
   }
   // Images are dropped OLDEST first when the step must shrink: the most recent screenshot is the
   // one the model is reasoning about, so it is the last to go.
@@ -472,16 +499,43 @@ function toolResultContentItems(
 }
 
 function toolResultToText(message: OcxToolResultMessage): string {
+  const normalized = normalizedToolResult(message, contentToText(message.content));
   return [
     "[tool_result]",
     `call_id: ${message.toolCallId}`,
     `name: ${namespacedToolName(message.toolNamespace, message.toolName)}`,
-    `is_error: ${message.isError}`,
+    `is_error: ${normalized.isError}`,
     "output:",
-    contentToText(message.content),
+    normalized.text,
   ].join("\n");
 }
 
+/**
+ * Shared #1920 normalization entry: pure-text results only. Image-bearing or
+ * encrypted results pass through untouched (their content is not plain text).
+ */
+function normalizedToolResult(message: OcxToolResultMessage, text: string): NormalizedToolResult {
+  if (message.containsEncryptedContent) return { text, isError: message.isError };
+  return normalizeCursorToolResultText(text, {
+    toolName: message.toolName,
+    toolNamespace: message.toolNamespace,
+    isError: message.isError,
+  });
+}
+
+/**
+ * A content-part result is plain text only when every decoded part is text (the empty array is the
+ * empty text result). Join it exactly as toolResultContentItems already did, then share the string
+ * normalization contract. Any image or undecodable part keeps the existing part-preserving path.
+ */
+function normalizedDecodedTextResult(
+  message: OcxToolResultMessage,
+  parts: DecodedResultPart[],
+): NormalizedToolResult | undefined {
+  if (parts.some(part => part.kind !== "text")) return undefined;
+  return normalizedToolResult(message, parts.map(part => part.kind === "text" ? part.text : "").join("\n"));
+}
+
 function argBytes(value: unknown): Uint8Array {
   try {
     return toBinary(ValueSchema, fromJson(ValueSchema, value as JsonValue));
@@ -535,12 +589,16 @@ function toolCallStep(
 }
 
 function toolResultPart(message: OcxToolResultMessage, decoded?: DecodedResultPart[], maxImages?: number) {
+  const parts = decoded ?? decodeResultParts(message);
+  const normalized = parts
+    ? normalizedDecodedTextResult(message, parts)
+    : normalizedToolResult(message, typeof message.content === "string" ? message.content : "");
   return create(McpToolResultSchema, {
     result: {
       case: "success",
       value: create(McpSuccessSchema, {
-        isError: message.isError,
-        content: toolResultContentItems(message, decoded, maxImages),
+        isError: normalized?.isError ?? message.isError,
+        content: toolResultContentItems(message, parts, maxImages, normalized),
       }),
     },
   });
@@ -632,11 +690,15 @@ function conversationTurns(
     if (message.role === "toolResult") {
       if (!current) continue;
       if (externalModel) {
-        const prefix = message.isError ? "[Tool Error]" : "[Tool Result]";
+        // #1920/#1866: this external-replay site bypasses toolResultToText, so it
+        // must consume the normalizer directly — cursor/grok-4.6 is the exact
+        // reported repro path for empty Computer Use results.
+        const normalized = normalizedToolResult(message, contentToText(message.content));
+        const prefix = normalized.isError ? "[Tool Error]" : "[Tool Result]";
         current.steps.push(storeCursorBlob(toBinary(ConversationStepSchema, create(ConversationStepSchema, {
           message: {
             case: "assistantMessage",
-            value: create(AssistantMessageSchema, { text: `${prefix}\n${contentToText(message.content)}` }),
+            value: create(AssistantMessageSchema, { text: `${prefix}\n${normalized.text}` }),
           },
         })), requestScope));
         continue;
@@ -728,18 +790,24 @@ function buildPreparedCursorRunRequest(
   const text = lastRole === "user" || lastRole === "developer"
     ? appendCursorGenericToolUseHint(request.tools, rawText)
     : rawText;
-  // Tool-result-only turns resume the remembered Cursor conversation with results in history.
   const lastRawIsToolResult = request.rawMessages?.at(-1)?.role === "toolResult";
-  const actionCase = !lastRawIsToolResult && text.trim().length > 0
+  // Native models resume the remembered Cursor conversation. External wire
+  // models continue as userMessageAction so history-blob tool results stay
+  // visible without a ResumeAction.
+  const externalToolContinuation = lastRawIsToolResult && isCursorExternalWireModel(request.modelId);
+  const actionCase = (externalToolContinuation || (!lastRawIsToolResult && text.trim().length > 0))
     ? "userMessageAction"
     : "resumeAction";
+  const actionText = externalToolContinuation
+    ? CURSOR_EXTERNAL_TOOL_CONTINUATION_TEXT
+    : text;
   const action = create(ConversationActionSchema, {
     action: actionCase === "userMessageAction"
       ? {
           case: "userMessageAction",
           value: create(UserMessageActionSchema, {
             userMessage: create(UserMessageSchema, {
-              text,
+              text: actionText,
               messageId: crypto.randomUUID(),
             }),
             requestContext: buildRequestContext(),
@@ -839,7 +907,7 @@ function buildPreparedCursorRunRequest(
   // tools the payload dropped — the defect that blocked PR #376.
   const modelVisibleParts = [
     ...rootPromptMessagesState.serialized,
-    ...(actionCase === "userMessageAction" ? [text] : []),
+    ...(actionCase === "userMessageAction" ? [actionText] : []),
     ...mcpToolDefs.map(modelVisibleToolText),
   ];
   return {