@bitkyc08/opencodex 2.33.0 → 2.34.0

package/src/adapters/command-code.ts

@@ -7,6 +7,7 @@ import { isAllowedToolChoice, namespacedToolName, resolveToolChoiceWireName, too
 import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { readBoundedResponseBody } from "../lib/bounded-body";
+import { debugDroppedFrame } from "../lib/debug";
 import { configuredReasoningEfforts } from "../reasoning-effort";
 import { commandCodeReasoningEfforts, refreshCommandCodeReasoningEfforts } from "../providers/command-code-efforts";
 import { identifyRoutedModel } from "./identity";
@@ -143,7 +144,8 @@ function wireMessages(messages: OcxMessage[]): Array<Record<string, unknown>> {
     if (typeof message.content === "string") content.push({ type: "text", text: message.content });
     else for (const part of message.content) {
       if (part.type === "text") content.push({ type: "text", text: part.text });
-      else content.push(wireImagePart(part.imageUrl));
+      else if (part.type === "image") content.push(wireImagePart(part.imageUrl));
+      else content.push({ type: "text", text: "[video]" });
     }
     out.push({ role: "user", content });
   }
@@ -365,7 +367,7 @@ async function*ndjson(response: Response, budget: TranslatorBudget): AsyncGenera
       let newline = buffer.indexOf("\n");
       while (newline >= 0) {
         const line = buffer.slice(0, newline).trim(); buffer = buffer.slice(newline + 1);
-        if (line) { try { yield JSON.parse(stripEventFrame(line)) as Record<string, unknown>; } catch { /* ignore non-events */ } }
+        if (line) yield* decodeEventLine(line);
         newline = buffer.indexOf("\n");
       }
       const residualBytes = encoder.encode(buffer).byteLength;
@@ -376,7 +378,7 @@ async function*ndjson(response: Response, budget: TranslatorBudget): AsyncGenera
       if (done) break;
     }
     const final = buffer.trim();
-    if (final) { try { yield JSON.parse(stripEventFrame(final)) as Record<string, unknown>; } catch { /* ignore */ } }
+    if (final) yield* decodeEventLine(final);
   } finally {
     budget.releaseRetained(bufferBytes, { kind: "live_transient" });
     try { await reader.cancel(); } catch { /* already closed */ }
@@ -384,6 +386,41 @@ async function*ndjson(response: Response, budget: TranslatorBudget): AsyncGenera
   }
 }
 
+/**
+ * Yield one NDJSON line as an event record, or nothing.
+ *
+ * `JSON.parse("null")` returns `null` instead of throwing, so the `try/catch` around the parse
+ * cannot see it and the `event.type` read in parseStream crashed the turn — the #1219 defect, on
+ * the one streaming transport the #1240 audit did not cover because it is NDJSON rather than SSE.
+ *
+ * A frame that does not parse to a record is padding, not an event: drop it and continue exactly
+ * as an unparseable line is already dropped, so a stream whose only frames are junk ends in the
+ * same single terminal `done` as an empty body. Skipping is what preserves an answer whose deltas
+ * have already arrived — the observed #1219 case is `null` padding BETWEEN content deltas, where
+ * terminating would discard a complete response (#1240).
+ *
+ * Note this deliberately makes a junk-only stream a quiet `[done]` where it previously threw. That
+ * throw was an unguarded type assumption, not a designed failure signal, and `[done]` is already
+ * what an empty body, a blank-line-only body and an unparseable-only body all produce here. The
+ * broader question — whether this adapter should report *any* no-valid-event stream as a failure
+ * rather than an empty success — is pre-existing, applies to all four of those inputs equally, and
+ * is deliberately not decided by this change.
+ */
+function* decodeEventLine(line: string): Generator<Record<string, unknown>> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stripEventFrame(line));
+  } catch {
+    debugDroppedFrame("command-code", line);
+    return;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    debugDroppedFrame("command-code", line);
+    return;
+  }
+  yield parsed as Record<string, unknown>;
+}
+
 /** The endpoint is newline-delimited JSON; defensively strip an SSE `data:` frame if the gateway ever switches shapes. */
 function stripEventFrame(line: string): string {
   return line.startsWith("data:") ? line.slice("data:".length).trim() : line;

package/src/adapters/cursor/call-id.ts

@@ -0,0 +1,44 @@
+/**
+ * Reversible single-line codec for Cursor composite tool-call ids.
+ *
+ * Cursor's wire delivers tool-call ids that can be two identifiers glued with a
+ * literal newline ("call-<uuid>-<n>\nfc_<uuid>_<n>"). OpenCodex forwards ids
+ * verbatim, so that newline leaked into Responses-visible `call_id` values,
+ * where line-oriented clients (logging, splitting, validation) break. The codec
+ * encodes only ids containing CR/LF into a versioned single-line form and
+ * decodes both that form and legacy raw multi-line ids back to the exact
+ * upstream bytes before anything is serialized toward Cursor.
+ */
+
+const CALL_ID_PREFIX = "ocxc1_";
+
+/** True when the id needs encoding to survive line-oriented consumers. */
+function needsEncoding(id: string): boolean {
+  return id.includes("\n") || id.includes("\r");
+}
+
+/** Encode a Cursor wire call id into a single-line Responses-safe id. */
+export function encodeCursorCallId(id: string): string {
+  if (!needsEncoding(id)) return id;
+  return CALL_ID_PREFIX + Buffer.from(id, "utf8").toString("base64url");
+}
+
+/**
+ * Decode a Responses-visible call id back to the exact Cursor wire id.
+ * Non-encoded ids (including legacy raw multi-line ids replayed by older
+ * clients) pass through unchanged; a malformed encoded payload also passes
+ * through rather than corrupting pairing.
+ */
+export function decodeCursorCallId(id: string): string {
+  if (!id.startsWith(CALL_ID_PREFIX)) return id;
+  const payload = id.slice(CALL_ID_PREFIX.length);
+  if (payload.length === 0) return id;
+  try {
+    const decoded = Buffer.from(payload, "base64url").toString("utf8");
+    // Round-trip guard: only trust payloads our encoder could have produced.
+    if (Buffer.from(decoded, "utf8").toString("base64url") !== payload) return id;
+    return decoded;
+  } catch {
+    return id;
+  }
+}

package/src/adapters/cursor/checkpoint-store.ts

@@ -236,6 +236,7 @@ export function commitCursorCheckpoint(input: {
 }
 
 export function getCursorCheckpointForPrefix(input: {
+  conversationId: string;
   prefixDigest: string;
   systemDigest: string;
   coveredMessageCount: number;
@@ -244,17 +245,21 @@ export function getCursorCheckpointForPrefix(input: {
 }): CursorCheckpointSnapshot | undefined {
   prune();
   const refs = store.prefixIndex.get(input.prefixDigest);
-  if (!refs || refs.size !== 1) return undefined;
-  const [ref] = refs;
-  if (!ref) return undefined;
-  const snapshot = getCursorCheckpoint(ref);
-  if (!snapshot) return undefined;
+  if (!refs) return undefined;
   const identityScope = input.identityScope?.trim() || "local";
-  if (snapshot.systemDigest !== input.systemDigest) return undefined;
-  if (snapshot.coveredMessageCount !== input.coveredMessageCount) return undefined;
-  if (snapshot.identityScope !== identityScope) return undefined;
-  if (snapshot.modelId !== input.modelId) return undefined;
-  return snapshot;
+  let foundRef: string | undefined;
+  for (const ref of refs) {
+    const snapshot = store.snapshots.get(ref);
+    if (!snapshot) continue;
+    if (snapshot.conversationId !== input.conversationId) continue;
+    if (snapshot.systemDigest !== input.systemDigest) continue;
+    if (snapshot.coveredMessageCount !== input.coveredMessageCount) continue;
+    if (snapshot.identityScope !== identityScope) continue;
+    if (snapshot.modelId !== input.modelId) continue;
+    if (foundRef) return undefined;
+    foundRef = ref;
+  }
+  return getCursorCheckpoint(foundRef);
 }
 
 export function getLatestCursorCheckpoint(

package/src/adapters/cursor/discovery.ts

@@ -1,7 +1,9 @@
 import {
   CANONICAL_EFFORT_SUFFIXES,
   cursorModelEffortLadder,
+  cursorModelHasEffortTiers,
   cursorWireModelIdWithEffort,
+  CURSOR_THINKING_MODEL_IDS,
 } from "./effort-map";
 
 export interface CursorModelInfo {
@@ -152,6 +154,25 @@ export function cursorCodexToWireModelId(modelId: string): string {
   return cursorWireModelSelection(modelId).modelId;
 }
 
+/**
+ * Synthetic ultra/big-context picker marker (devlog 260826 070). A `cursor/<base>-1m` row is a
+ * picker-only variant: the wire request keeps `<base>` (plus effort suffix) and turns on Cursor
+ * Max Mode instead. Only ids listed here are treated as synthetic — a real upstream wire id that
+ * happens to end in `-1m` never collides because it will not be in this set.
+ */
+export const CURSOR_ULTRA_1M_MODEL_IDS: ReadonlySet<string> = new Set([
+  "kimi-k3-1m",
+]);
+
+const CURSOR_ULTRA_1M_SUFFIX = "-1m";
+
+/** Resolve a synthetic ultra marker id to its wire base, or undefined for ordinary ids. */
+export function cursorUltraBaseModelId(modelId: string): string | undefined {
+  const normalized = modelId.startsWith("cursor/") ? modelId.slice("cursor/".length) : modelId;
+  if (!CURSOR_ULTRA_1M_MODEL_IDS.has(normalized)) return undefined;
+  return normalized.slice(0, -CURSOR_ULTRA_1M_SUFFIX.length);
+}
+
 /**
  * Cursor-native wire models keep server-side conversation state reliably.
  * External models (gpt/claude/gemini/grok families and similar) are more brittle on resumeAction.
@@ -212,10 +233,27 @@ export function filterCursorConfiguredModelsByLiveDiscovery<T extends { id: stri
   liveIds: readonly string[],
 ): T[] {
   return configured.filter(model =>
-    isCursorRouterModelId(model.id) || isCursorModelAvailableForAccount(model.id, liveIds),
+    !CURSOR_KNOWN_UNCALLABLE_MODEL_IDS.has(model.id)
+    && (
+      isCursorRouterModelId(model.id)
+      // Synthetic ultra rows ride their base model's account availability.
+      || isCursorModelAvailableForAccount(cursorUltraBaseModelId(model.id) ?? model.id, liveIds)
+    ),
   );
 }
 
+/**
+ * Models GetUsableModels advertises but whose every Run returns not_found (catalog honesty,
+ * devlog 260826_cursor_responses_gap 060). Live probes 2026-08-26: cursor/claude-opus-5 failed
+ * 100% ("Cursor Connect error not_found") while its -fast and -thinking siblings — separate
+ * wire families — succeed. Quarantined here, in the shared filter, so live, cached, stale, and
+ * static serving paths all agree. Custom user provider overrides are not routed through this
+ * canonical seed and stay untouched.
+ */
+export const CURSOR_KNOWN_UNCALLABLE_MODEL_IDS: ReadonlySet<string> = new Set([
+  "claude-opus-5",
+]);
+
 export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorModels([
   // Context windows and the model lineup mirror Cursor's public models/pricing docs plus the jawcode
   // SOT (../jawcode/packages/ai/src/models.json, `cursor` provider), which mirrors the real
@@ -243,7 +281,8 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   { id: "claude-opus-4-7-fast", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
   { id: "claude-opus-4-8-fast", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
   { id: "claude-opus-4-8", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-opus-5", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
+  // claude-opus-5 (bare) removed from the seed: GetUsableModels lists it but every Run returns
+  // not_found (quarantined via CURSOR_KNOWN_UNCALLABLE_MODEL_IDS; -fast/-thinking families stay).
   { id: "claude-opus-5-fast", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
   { id: "claude-fable-5", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
 
@@ -257,6 +296,21 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   { id: "gemini-3-pro-image-preview", contextWindow: CONTEXT_200K },
   { id: "gemini-3.1-pro", contextWindow: CONTEXT_GEMINI },
   { id: "gemini-3.5-flash", contextWindow: CONTEXT_200K },
+  // 260825 live GetUsableModels: both ship only as effort-suffixed ids, so each exposes a tier
+  // picker. 3.6 is the only Cursor model with a `minimal` rung.
+  { id: "gemini-3.6-flash", contextWindow: CONTEXT_GEMINI, supportsReasoningEffort: true },
+  { id: "gemini-3.7-flash", contextWindow: CONTEXT_GEMINI, supportsReasoningEffort: true },
+
+  // Explicit-thinking variants (260825 live roster). Exposed as first-class ids the same way the
+  // Opus Fast families were in 831810c13: `isCursorModelAvailableForAccount` matches a base id
+  // against `{base}`, `{base}-{effort}` and the family's wire form, and none of those ever
+  // matched a `-thinking` id, so every one of these was invisible in the routed catalog.
+  // Suffix ORDER differs per family; `cursorWireModelIdWithEffort` owns that mapping.
+  ...CURSOR_THINKING_MODEL_IDS.map(id => ({
+    id,
+    contextWindow: CONTEXT_200K,
+    supportsReasoningEffort: cursorModelHasEffortTiers(id),
+  })),
 
   { id: "gpt-5-codex", contextWindow: CONTEXT_272K },
   { id: "gpt-5-fast", contextWindow: CONTEXT_272K },
@@ -291,6 +345,10 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   // kimi-k3: cursor.com/docs/models/kimi-k3; account-verified via GetUsableModels (2026-07-28) —
   // ships only as effort-suffixed kimi-k3-{low,high,max}, so the tier picker is exposed.
   { id: "kimi-k3", contextWindow: CONTEXT_262K, supportsReasoningEffort: true },
+  // kimi-k3-1m: synthetic ultra/Max-Mode picker variant (CURSOR_ULTRA_1M_MODEL_IDS) — wire sends
+  // kimi-k3-<effort> with maxMode=true; 1M context user-verified live on the Ultra plan
+  // (devlog 260826_cursor_responses_gap/025). inferCursorContextWindow maps "1m" ids to 1M.
+  { id: "kimi-k3-1m", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
 
   { id: "grok-4.5", contextWindow: 500_000, supportsReasoningEffort: true },
   { id: "grok-4.5-fast", contextWindow: 500_000, supportsReasoningEffort: true },

package/src/adapters/cursor/effort-map.ts

@@ -34,12 +34,33 @@ const CURSOR_MODEL_EFFORT_TIERS: Record<string, readonly string[]> = {
   "claude-opus-5-fast": ["low", "medium", "high"],
   "claude-sonnet-5": ["low", "medium", "high", "xhigh", "max"],
   "glm-5.2": ["high", "max"],
+  // 260825 live GetUsableModels. gemini-3.6-flash is the only Cursor model exposing `minimal`;
+  // listing it here is also what admits the suffix into CANONICAL_EFFORT_SUFFIXES below.
+  "gemini-3.6-flash": ["minimal", "low", "medium", "high"],
+  "gemini-3.7-flash": ["low", "medium", "high"],
+  // Explicit-thinking variants (260825 live roster). Tiers are the rungs the wire actually
+  // lists for each family, which is not always the same set the non-thinking id carries:
+  // 4.6-opus thinks only at high/max, 4.5-opus only at high, 4.6-sonnet only at medium.
+  "claude-opus-5-thinking": ["low", "medium", "high", "xhigh", "max"],
+  "claude-opus-5-thinking-fast": ["low", "medium", "high", "xhigh", "max"],
+  "claude-opus-4-8-thinking": ["low", "medium", "high", "xhigh", "max"],
+  "claude-opus-4-8-thinking-fast": ["low", "medium", "high", "xhigh", "max"],
+  "claude-opus-4-7-thinking": ["low", "medium", "high", "xhigh", "max"],
+  "claude-opus-4-7-thinking-fast": ["low", "medium", "high", "xhigh", "max"],
+  "claude-sonnet-5-thinking": ["low", "medium", "high", "xhigh", "max"],
+  "claude-fable-5-thinking": ["low", "medium", "high", "xhigh", "max"],
+  "claude-4.6-opus-thinking": ["high", "max"],
+  "claude-4.5-opus-thinking": ["high"],
+  "claude-4.6-sonnet-thinking": ["medium"],
   // 260814 preemptive: glm-5.3 seeded ahead of Cursor's lineup update. Unlike 5.2, Z.AI folds
   // 5.3 efforts into low/high/max (docs.z.ai/devpack/latest-model), so `low` is a real tier.
   "glm-5.3": ["low", "high", "max"],
   // GetUsableModels (2026-07-28) lists kimi-k3 only as effort-suffixed kimi-k3-{low,high,max};
   // the bare id returns not_found. Tiers mirror the native Kimi provider's K3 ladder.
   "kimi-k3": ["low", "high", "max"],
+  // Synthetic ultra picker variant (devlog 260826 070): same tier ladder as kimi-k3; the -1m
+  // marker is stripped before wire-id composition, so these tiers never form a wire suffix.
+  "kimi-k3-1m": ["low", "high", "max"],
   // Cursor renamed the Grok 4.5 slugs to cursor-grok-4.5-{low,medium,high} and
   // cursor-grok-4.5-{low,medium,high}-fast. The bare Fast id returns not_found.
   "grok-4.5": ["low", "medium", "high"],
@@ -71,6 +92,46 @@ export const CANONICAL_EFFORT_SUFFIXES: ReadonlySet<string> = new Set([
 
 const CANONICAL_CODEX_EFFORT_ORDER = ["low", "medium", "high", "xhigh", "max"] as const;
 
+/**
+ * Cursor's explicit-thinking variants, exposed as first-class Codex model ids the same way the
+ * `-fast` families were.
+ *
+ * `source` is the id whose wire name the variant is built from; `order` is where Cursor puts the
+ * thinking marker relative to the effort rung. All three shapes exist in the live roster
+ * (GetUsableModels, 260825), and using the wrong one is rejected with ERROR_BAD_MODEL_NAME:
+ *
+ *   thinking-then-effort  claude-opus-5-thinking-high, claude-opus-5-thinking-high-fast
+ *   effort-then-thinking  claude-4.6-opus-high-thinking
+ *   bare                  claude-4.5-sonnet-thinking (the model has no effort rung)
+ */
+const CURSOR_THINKING_FAMILIES: Readonly<Record<string, { source: string; order: "thinking-then-effort" | "effort-then-thinking" | "bare" }>> = {
+  "claude-opus-5-thinking": { source: "claude-opus-5", order: "thinking-then-effort" },
+  "claude-opus-5-thinking-fast": { source: "claude-opus-5-fast", order: "thinking-then-effort" },
+  "claude-opus-4-8-thinking": { source: "claude-opus-4-8", order: "thinking-then-effort" },
+  "claude-opus-4-8-thinking-fast": { source: "claude-opus-4-8-fast", order: "thinking-then-effort" },
+  "claude-opus-4-7-thinking": { source: "claude-opus-4-7", order: "thinking-then-effort" },
+  "claude-opus-4-7-thinking-fast": { source: "claude-opus-4-7-fast", order: "thinking-then-effort" },
+  "claude-sonnet-5-thinking": { source: "claude-sonnet-5", order: "thinking-then-effort" },
+  "claude-fable-5-thinking": { source: "claude-fable-5", order: "thinking-then-effort" },
+  "claude-4.6-opus-thinking": { source: "claude-4.6-opus", order: "effort-then-thinking" },
+  "claude-4.5-opus-thinking": { source: "claude-4.5-opus", order: "effort-then-thinking" },
+  "claude-4.6-sonnet-thinking": { source: "claude-4.6-sonnet", order: "effort-then-thinking" },
+  "claude-4.5-sonnet-thinking": { source: "claude-4.5-sonnet", order: "bare" },
+  "claude-4-sonnet-thinking": { source: "claude-4-sonnet", order: "bare" },
+};
+
+/** Codex-facing ids for Cursor's explicit-thinking variants. */
+export const CURSOR_THINKING_MODEL_IDS = Object.keys(CURSOR_THINKING_FAMILIES);
+
+/**
+ * Picker order, which is the canonical ladder plus the declared sentinels that rank below `low`.
+ *
+ * `cursorModelEffortLadder` filters against this, so a tier absent from it is silently dropped
+ * from the Codex picker even though `cursorEffortSuffix` would happily send it. That is what
+ * hid `gemini-3.6-flash-minimal`, the one Cursor model with a `minimal` rung.
+ */
+const CURSOR_PICKER_EFFORT_ORDER = ["minimal", ...CANONICAL_CODEX_EFFORT_ORDER] as const;
+
 function normalizeRequestedEffort(reasoning: string | undefined): string | undefined {
   const normalized = reasoning?.toLowerCase();
   return normalized === "ultra" ? "max" : normalized;
@@ -119,7 +180,7 @@ export function cursorModelEffortLadder(baseModelId: string): string[] | undefin
   const tiers = CURSOR_MODEL_EFFORT_TIERS[baseModelId];
   if (!tiers || tiers.length === 0) return undefined;
   const tierSet = new Set(tiers);
-  return CANONICAL_CODEX_EFFORT_ORDER.filter(effort => tierSet.has(effort));
+  return CURSOR_PICKER_EFFORT_ORDER.filter(effort => tierSet.has(effort));
 }
 
 /** Base models known to carry a reasoning-effort suffix (everything else is sent bare). */
@@ -133,6 +194,23 @@ export function cursorModelHasEffortTiers(baseModelId: string): boolean {
  * and send the base model plus requested_model parameters instead.
  */
 export function cursorWireModelIdWithEffort(baseModelId: string, effortSuffix: string): string {
+  const thinking = CURSOR_THINKING_FAMILIES[baseModelId];
+  if (thinking) {
+    const { source, order } = thinking;
+    // Cursor writes the thinking marker on either side of the effort depending on family
+    // (measured against GetUsableModels, 260825):
+    //   thinking-then-effort  claude-opus-5-thinking-high, ...-thinking-high-fast
+    //   effort-then-thinking  claude-4.6-opus-high-thinking
+    //   bare                  claude-4.5-sonnet-thinking (no effort rung at all)
+    // Sending the wrong order returns ERROR_BAD_MODEL_NAME, so this is not cosmetic.
+    if (order === "bare") return `${source}-thinking`;
+    if (order === "effort-then-thinking") return `${source}-${effortSuffix}-thinking`;
+    if (source.endsWith("-fast")) {
+      const stem = source.slice(0, -"-fast".length);
+      return `${stem}-thinking-${effortSuffix}-fast`;
+    }
+    return `${source}-thinking-${effortSuffix}`;
+  }
   if (baseModelId.endsWith("-fast")) {
     return `${baseModelId.slice(0, -"-fast".length)}-${effortSuffix}-fast`;
   }

package/src/adapters/cursor/envelope-echo.ts

@@ -0,0 +1,162 @@
+/**
+ * External Cursor output quarantine (devlog 260826 gaps 10-11).
+ *
+ * Gap 10: flattened tool-result history can prime an external model to echo the
+ * "[Tool Result]" envelope as its own reply.
+ *
+ * Gap 11: a model can invent a blocked native-tool attempt in visible commentary
+ * even though the only real current-turn tool is the advertised Codex bridge.
+ *
+ * Both failures are observable only at the output boundary. The sniffers below
+ * hold a bounded prefix until it either diverges or proves the failure, allowing
+ * cursor.ts to retry before any invalid text reaches the client.
+ */
+
+const ECHO_MARKERS = ["[Tool Result]", "[Tool Error]", "[tool_result]"] as const;
+const MAX_SNIFF_BYTES = 40;
+const MAX_ROUTING_COMMENTARY_BYTES = 512;
+/** Aggregate quarantine cap: past this, flush and disarm. */
+const MAX_HOLD_BYTES = 8 * 1024;
+const encoder = new TextEncoder();
+
+export class CursorToolResultEchoError extends Error {
+  readonly code = "cursor_tool_result_echo";
+  constructor(marker: string) {
+    super(
+      "Cursor external model echoed the replayed tool-result envelope (\"" + marker
+      + "\") instead of continuing the task.",
+    );
+    this.name = "CursorToolResultEchoError";
+  }
+}
+
+export class CursorRoutingCommentaryError extends Error {
+  readonly code = "cursor_routing_commentary_hallucination";
+  constructor() {
+    super("Cursor external model invented a blocked tool surface before any tool call occurred.");
+    this.name = "CursorRoutingCommentaryError";
+  }
+}
+
+export type EchoSnifferDecision =
+  | { kind: "hold" }
+  | { kind: "flush" }
+  | { kind: "echo"; marker: string };
+
+/**
+ * Incremental envelope-prefix sniffer. Leading whitespace is tolerated so a
+ * marker copied after a newline is still caught.
+ */
+export class CursorEnvelopeEchoSniffer {
+  private buffered = "";
+  private byteCount = 0;
+  private done = false;
+
+  get settled(): boolean {
+    return this.done;
+  }
+
+  feed(textDelta: string): EchoSnifferDecision {
+    if (this.done) return { kind: "flush" };
+    this.buffered += textDelta;
+    this.byteCount += encoder.encode(textDelta).byteLength;
+    const probe = this.buffered.replace(/^\s+/, "");
+    for (const marker of ECHO_MARKERS) {
+      if (probe.startsWith(marker)) {
+        this.done = true;
+        return { kind: "echo", marker };
+      }
+    }
+    const stillPrefix = ECHO_MARKERS.some(marker =>
+      probe.length < marker.length && marker.startsWith(probe),
+    );
+    if (stillPrefix && this.byteCount <= MAX_SNIFF_BYTES && this.buffered.length < MAX_HOLD_BYTES) {
+      return { kind: "hold" };
+    }
+    this.done = true;
+    return { kind: "flush" };
+  }
+
+  finish(): EchoSnifferDecision {
+    if (this.done) return { kind: "flush" };
+    this.done = true;
+    return { kind: "flush" };
+  }
+}
+
+export type RoutingCommentaryDecision =
+  | { kind: "hold" }
+  | { kind: "flush" }
+  | { kind: "hallucination" };
+
+const ROUTING_NATIVE_TOOL_NAME = /\b(shell|read|grep|list|bash)\b/giu;
+const ROUTING_TOOL_HINT =
+  /(?:\b(?:shell|read|grep|list|bash)\b|exec_command|shell_command|브리지|네이티브\s*(?:셸|쉘))/iu;
+const ROUTING_FAILURE_CLAIM =
+  /(?:blocked|unavailable|interrupted|차단|중단|막혀)/iu;
+const ROUTING_REDIRECT_CLAIM =
+  /(?:exec_command|shell_command|\bexec\b|브리지|redirected|fallback|switch(?:ed|ing)?|전환|우회|통과(?:되|하)|다른\s*(?:도구|경로)|경로로)/iu;
+
+/**
+ * Quarantines the first line of code-mode / bridge output long enough to reject
+ * an impossible routing claim. It requires a failure claim plus either an
+ * explicit redirect to another execution surface or two distinct unadvertised
+ * native-tool names; a legitimate sentence such as "Shell is unavailable on
+ * this OS" therefore passes.
+ */
+export class CursorRoutingCommentarySniffer {
+  private buffered = "";
+  private byteCount = 0;
+  private done = false;
+
+  get settled(): boolean {
+    return this.done;
+  }
+
+  feed(textDelta: string): RoutingCommentaryDecision {
+    if (this.done) return { kind: "flush" };
+    this.buffered += textDelta;
+    this.byteCount += encoder.encode(textDelta).byteLength;
+    if (this.matchesHallucination()) {
+      this.done = true;
+      return { kind: "hallucination" };
+    }
+    const lineBreakCount = (this.buffered.match(/\n/gu) ?? []).length;
+    const hasRoutingHint = ROUTING_TOOL_HINT.test(this.buffered) || ROUTING_FAILURE_CLAIM.test(this.buffered);
+    const pendingFailureClaim =
+      ROUTING_TOOL_HINT.test(this.buffered)
+      && ROUTING_FAILURE_CLAIM.test(this.buffered)
+      && lineBreakCount < 2;
+    if (
+      this.byteCount < MAX_ROUTING_COMMENTARY_BYTES
+      && this.buffered.length < MAX_HOLD_BYTES
+      && (lineBreakCount === 0 || pendingFailureClaim)
+      && (hasRoutingHint || this.byteCount < 64)
+    ) {
+      return { kind: "hold" };
+    }
+    this.done = true;
+    return { kind: "flush" };
+  }
+
+  finish(): RoutingCommentaryDecision {
+    if (this.done) return { kind: "flush" };
+    this.done = true;
+    return this.matchesHallucination() ? { kind: "hallucination" } : { kind: "flush" };
+  }
+
+  private matchesHallucination(): boolean {
+    if (!ROUTING_FAILURE_CLAIM.test(this.buffered)) return false;
+    const nativeTools = new Set(
+      [...this.buffered.matchAll(ROUTING_NATIVE_TOOL_NAME)].map(match => match[1]?.toLowerCase()),
+    );
+    if (nativeTools.size === 0) return false;
+    return ROUTING_REDIRECT_CLAIM.test(this.buffered) || nativeTools.size >= 2;
+  }
+}
+
+export const CURSOR_ECHO_RETRY_CONTINUATION_TEXT =
+  "Your previous reply copied an internal tool-output record verbatim and was rejected. Continue the original task now: issue the next required tool call, or answer in your own words if no tool is needed.";
+
+export const CURSOR_ROUTING_COMMENTARY_RETRY_TEXT =
+  "Your previous reply claimed an execution-surface failure that did not occur and was rejected. Use the current tool catalog as ground truth. Perform the requested operation through the advertised execution tool now, with no commentary before the tool call.";

package/src/adapters/cursor/live-models.ts

@@ -43,7 +43,7 @@ export interface CursorUsableModelsOptions {
 }
 
 export type CursorUsableModelsResult =
-  | { ok: true; models: string[] }
+  | { ok: true; models: string[]; maxModeModels?: string[] }
   | { ok: false; error: "auth" | "http" | "policy" | "transport" | "timeout" | "decode" | "empty" | "too_large"; detail?: string };
 
 /** Test-only seam for management connectivity probes; production callers retain the HTTP/2 path. */
@@ -120,6 +120,7 @@ function decodeCursorUsableModels(bytes: Uint8Array): CursorUsableModelsResult {
     // make stale configured ids such as `composer-2` look activated.
     const ids: string[] = [];
     const seenIds = new Set<string>();
+    const maxModeIds: string[] = [];
     for (const model of response.models ?? []) {
       const rawId = (model as { modelId?: string }).modelId;
       if (typeof rawId !== "string") continue;
@@ -127,9 +128,13 @@ function decodeCursorUsableModels(bytes: Uint8Array): CursorUsableModelsResult {
       if (!isValidModelDiscoveryModelId(id) || seenIds.has(id)) continue;
       seenIds.add(id);
       ids.push(id);
+      // Preserve Max-Mode capability for ultra/big-context auto-detection (devlog 260826 070).
+      if ((model as { maxMode?: boolean }).maxMode === true) maxModeIds.push(id);
       if (ids.length >= CURSOR_MAX_DISCOVERED_MODELS) break;
     }
-    return ids.length > 0 ? { ok: true, models: ids } : { ok: false, error: "empty" };
+    return ids.length > 0
+      ? { ok: true, models: ids, ...(maxModeIds.length > 0 ? { maxModeModels: maxModeIds } : {}) }
+      : { ok: false, error: "empty" };
   } catch {
     return { ok: false, error: "decode", detail: "Invalid GetUsableModels protobuf response" };
   }

package/src/adapters/cursor/live-transport.ts

@@ -415,6 +415,20 @@ export function finalizeAfterDrain(state: ReturnType<typeof createCursorProtobuf
 export function clientToolFinalizeGraceMsForRequest(request: CursorRunRequest, baseGraceMs = CLIENT_TOOL_FINALIZE_GRACE_MS): number {
   if (request.rawMessages?.at(-1)?.role === "toolResult") return baseGraceMs;
   const text = activePromptText(request);
+  // Parallel-tool requests with several advertised tools get the expanded window regardless of
+  // prompt shape: external models (grok) assemble sibling calls serially over multiple frames,
+  // and the 50ms drain grace ended the turn after 1-2 of them (devlog 260826_cursor_responses_gap,
+  // live 10-parallel probe: calls=2 then calls=1).
+  if (request.parallelToolCalls === true && (request.tools?.length ?? 0) > 1) {
+    const advertised = request.tools?.length ?? 0;
+    return Math.max(
+      baseGraceMs,
+      Math.min(
+        GENERIC_TOOL_COUNT_MAX_FINALIZE_GRACE_MS,
+        Math.max(GENERIC_TOOL_COUNT_MIN_FINALIZE_GRACE_MS, advertised * GENERIC_TOOL_COUNT_PER_TOOL_GRACE_MS),
+      ),
+    );
+  }
   if (!cursorRequestHasShellAlias(request.tools) || !isGenericToolUseCountDemoPrompt(text)) return baseGraceMs;
   const requestedCount = requestedCursorToolUseCount(text);
   const expandedGraceMs = requestedCount

package/src/adapters/cursor/message-mapper.ts

@@ -1,4 +1,5 @@
 import type { AdapterEvent } from "../../types";
+import { encodeCursorCallId } from "./call-id";
 import { cursorExecResult } from "./exec-policy";
 import type { CursorClientMessage, CursorServerMessage } from "./types";
 import type { CursorKvStore } from "./kv-store";
@@ -18,7 +19,9 @@ export function mapCursorServerMessage(
     case "thinking":
       return [{ type: "thinking_delta", thinking: message.thinking }];
     case "tool_call_start":
-      return [{ type: "tool_call_start", id: message.id, name: message.name }];
+      // Cursor composite ids can contain a literal newline; Responses call_ids
+      // must stay single-line (see call-id.ts).
+      return [{ type: "tool_call_start", id: encodeCursorCallId(message.id), name: message.name }];
     case "tool_call_delta":
       return [{ type: "tool_call_delta", arguments: message.arguments }];
     case "tool_call_end":

package/src/adapters/cursor/native-exec-desktop.ts

@@ -170,10 +170,33 @@ function runExternalJson(command: string, payload: unknown, config: DesktopExecu
       }
     });
 
+    // A command that never reads stdin - `echo`, a script that exits on a bad flag,
+    // anything that fails before its first read - closes the pipe while we are still
+    // writing to it. The write then fails with EPIPE, and on Linux that surfaces as an
+    // ASYNCHRONOUS 'error' event on the stream rather than a throw, so the try/catch
+    // below never saw it and the rejection escaped as an unhandled stream error. On
+    // macOS the same command usually drains the small payload first, which is why this
+    // only ever went red on the Linux shard.
+    //
+    // EPIPE here is not a failure of the executor CONTRACT: the child's exit code and
+    // stdout are what decide the result, and both are handled in 'close' above. So the
+    // pipe error is swallowed deliberately and the outcome is left to the child, which
+    // is what makes "bad output maps to failure" reachable instead of exploding.
+    child.stdin.on("error", (err: NodeJS.ErrnoException) => {
+      if (err.code === "EPIPE" || err.code === "ERR_STREAM_DESTROYED") return;
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
     try {
       child.stdin.write(JSON.stringify(payload));
       child.stdin.end();
     } catch (err) {
+      // Kept for the synchronous half: a stream already destroyed when we reach this
+      // line throws immediately instead of emitting.
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code === "EPIPE" || code === "ERR_STREAM_DESTROYED") return;
       if (!settled) {
         settled = true;
         clearTimeout(timer);