@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/adapters/cursor/protobuf-request.ts

@@ -6,6 +6,7 @@ import { namespacedToolName } from "../../types";
 import type { CursorRunRequest } from "./types";
 import { decodeCursorCallId } from "./call-id";
 import { cursorNeedsExternalToolContinuation, isCursorExternalWireModel } from "./discovery";
+import { stripAssistantEchoedToolEnvelope } from "./envelope-echo";
 import { normalizeCursorToolResultText } from "./tool-result-normalize";
 import { debugProviderDiagnostic } from "../../lib/debug";
 import {
@@ -75,6 +76,8 @@ export const CURSOR_ROUTING_LEVEL_PARAMETER_ID = "optimization";
 export const CURSOR_EXTERNAL_ROOT_BLOB_LIMIT = 192;
 /** Approximate prompt-size guard; tool schemas and protocol framing consume context separately. */
 export const CURSOR_EXTERNAL_ROOT_BYTE_LIMIT = 512 * 1024;
+/** Honest placeholder when native Composer history has a toolCall with no matching toolResult. */
+export const CURSOR_MISSING_TOOL_RESULT = "[missing tool_result for this tool_use in history]";
 /**
  * Byte budget for the serialized arguments named inside ONE replayed tool-result envelope. The
  * invocation identifies the call; the result is the payload. Without an independent cap, a single
@@ -206,11 +209,13 @@ function assistantRootText(
   message: Extract<OcxMessage, { role: "assistant" }>,
   includeThinking: boolean,
 ): string {
-  if (typeof message.content === "string") return message.content;
-  return message.content
-    .map(part => (part.type === "text" ? part.text : includeThinking && part.type === "thinking" ? part.thinking : undefined))
-    .filter((value): value is string => typeof value === "string" && value.length > 0)
-    .join("\n");
+  const raw = typeof message.content === "string"
+    ? message.content
+    : message.content
+      .map(part => (part.type === "text" ? part.text : includeThinking && part.type === "thinking" ? part.thinking : undefined))
+      .filter((value): value is string => typeof value === "string" && value.length > 0)
+      .join("\n");
+  return stripAssistantEchoedToolEnvelope(raw);
 }
 
 // Cursor builds the actual model prompt from rootPromptMessagesJson (turns[] is UI/display metadata),
@@ -1218,6 +1223,20 @@ function argBytes(value: unknown): Uint8Array {
   }
 }
 
+function missingToolResultFor(
+  part: Extract<OcxAssistantContentPart, { type: "toolCall" }>,
+): OcxToolResultMessage {
+  return {
+    role: "toolResult",
+    toolCallId: part.id,
+    toolName: part.name,
+    ...(part.namespace ? { toolNamespace: part.namespace } : {}),
+    content: CURSOR_MISSING_TOOL_RESULT,
+    isError: true,
+    timestamp: 0,
+  };
+}
+
 function toolCallStep(
   part: Extract<OcxAssistantContentPart, { type: "toolCall" }>,
   requestScope: CursorBlobRequestScopeToken,
@@ -1332,7 +1351,9 @@ function conversationTurns(
   const pendingToolCalls = new Map<string, Extract<OcxAssistantContentPart, { type: "toolCall" }>>();
   const flush = () => {
     if (!current) return;
-    for (const part of pendingToolCalls.values()) current.steps.push(toolCallStep(part, requestScope));
+    for (const part of pendingToolCalls.values()) {
+      current.steps.push(toolCallStep(part, requestScope, missingToolResultFor(part), codeMode));
+    }
     turns.push(storeCursorBlob(toBinary(ConversationTurnStructureSchema, create(ConversationTurnStructureSchema, {
       turn: {
         case: "agentConversationTurn",

package/src/adapters/cursor/request-builder.ts

@@ -340,7 +340,13 @@ export function cursorConversationIdFromClientThread(threadId: string, identityS
 
 /**
  * Resolve the Cursor conversation id for this turn.
- * Priority: force-fresh → isolate helper → remembered → client thread owner → random.
+ * Priority: force-fresh → isolate helper → thread remint override → stored conversation id
+ * → client thread hash → random.
+ *
+ * The remint override must beat a stored `_cursorConversationId`. Only the remint path writes
+ * the thread store (cursor.ts), so a stored id that disagrees with it is the pre-remint value,
+ * and preferring it let a second Responses chain in the same Codex thread keep resuming the
+ * conversation the previous turn just rotated away from.
  * Never use OpenAI Responses `previous_response_id` (resp_*) or shared `prompt_cache_key`
  * (cache-cohort fingerprint, not conversation ownership).
  */
@@ -351,11 +357,16 @@ export function resolveCursorConversationId(
 ): string {
   if (options.forceFreshConversation === true) return generatedCursorConversationId();
   if (parsed._cursorIsolateConversation === true) return generatedCursorConversationId();
-  if (parsed._cursorConversationId) return parsed._cursorConversationId;
   const threadId = cursorClientThreadOwner(parsed);
-  if (threadId) {
+  // A compaction turn carries its own conversation id and must not be pulled onto the parent's
+  // thread override. It is isolated in effect without ever setting the isolate flag, which is why
+  // the override check has to exclude it explicitly rather than rely on that flag.
+  if (threadId && parsed._compactionRequest !== true) {
     const recovered = lookupCursorThreadConversation(threadId, parsed._cursorIdentityScope);
     if (recovered) return recovered;
+  }
+  if (parsed._cursorConversationId) return parsed._cursorConversationId;
+  if (threadId) {
     return cursorConversationIdFromClientThread(`thread:${threadId}`, parsed._cursorIdentityScope);
   }
   return generatedCursorConversationId();

package/src/adapters/cursor/text-toolcall.ts

@@ -0,0 +1,230 @@
+/**
+ * Quarantine textual pseudo tool-call markers that Cursor models emit inside
+ * `textDelta` instead of (or in addition to) real `toolCall*` frames.
+ *
+ * `#2305` only rewrote the display alias *inside* `[TOOL_CALL]…[ARGS]`. The
+ * marker still reached Codex/Claude as assistant text, which few-shot-mimics
+ * later calls as inert text and stalls multi-tool turns. This drain strips
+ * every complete marker from visible text and yields the parsed calls so the
+ * protobuf mapper can promote advertised names onto the real tool-call path.
+ *
+ * Incomplete markers (split across streaming deltas) stay in `pending` until
+ * the JSON object closes. Once the retained prefix exceeds the byte cap, the
+ * parser switches to a constant-space suppressed scan until the object closes.
+ */
+import { debugProviderDiagnostic } from "../../lib/debug";
+import { normalizeCursorWireName } from "./tool-naming";
+
+export const MAX_PENDING_TEXT_TOOLCALL_BYTES = 64 * 1024;
+const TOOL_CALL_OPEN = /\[TOOL_CALL\]/gi;
+
+export interface DrainedTextToolCall {
+  readonly name: string;
+  readonly args: string;
+}
+
+export interface SuppressedTextToolCallScan {
+  phase: "args-tag" | "json-start" | "json";
+  argsTagProgress: number;
+  depth: number;
+  inString: boolean;
+  escape: boolean;
+}
+
+export interface DrainTextToolCallsResult {
+  readonly text: string;
+  readonly pending: string;
+  readonly calls: readonly DrainedTextToolCall[];
+  readonly suppressed?: SuppressedTextToolCallScan;
+}
+
+function findJsonObjectEnd(source: string, start: number): number | undefined {
+  if (source[start] !== "{") return undefined;
+  let depth = 0;
+  let inString = false;
+  let escape = false;
+  for (let i = start; i < source.length; i++) {
+    const ch = source[i];
+    if (inString) {
+      if (escape) {
+        escape = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escape = true;
+        continue;
+      }
+      if (ch === "\"") inString = false;
+      continue;
+    }
+    if (ch === "\"") {
+      inString = true;
+      continue;
+    }
+    if (ch === "{") depth += 1;
+    else if (ch === "}") {
+      depth -= 1;
+      if (depth === 0) return i + 1;
+    }
+  }
+  return undefined;
+}
+
+function byteLength(text: string): number {
+  return new TextEncoder().encode(text).byteLength;
+}
+
+function newSuppressedScan(): SuppressedTextToolCallScan {
+  return {
+    phase: "args-tag",
+    argsTagProgress: 0,
+    depth: 0,
+    inString: false,
+    escape: false,
+  };
+}
+
+const ARGS_TAG = "[args]";
+
+function consumeSuppressedScan(
+  state: SuppressedTextToolCallScan,
+  source: string,
+  start = 0,
+): { readonly state?: SuppressedTextToolCallScan; readonly resumeAt: number } {
+  for (let i = start; i < source.length; i++) {
+    const ch = source[i] ?? "";
+    if (state.phase === "args-tag") {
+      const lower = ch.toLowerCase();
+      if (lower === ARGS_TAG[state.argsTagProgress]) {
+        state.argsTagProgress += 1;
+        if (state.argsTagProgress === ARGS_TAG.length) {
+          state.phase = "json-start";
+          state.argsTagProgress = 0;
+        }
+      } else {
+        state.argsTagProgress = lower === ARGS_TAG[0] ? 1 : 0;
+      }
+      continue;
+    }
+    if (state.phase === "json-start") {
+      if (/\s/.test(ch)) continue;
+      if (ch !== "{") {
+        debugProviderDiagnostic("cursor", "text-toolcall-invalid-arguments", {
+          reason: "arguments-did-not-start-with-object",
+        });
+        return { resumeAt: source.length };
+      }
+      state.phase = "json";
+      state.depth = 1;
+      continue;
+    }
+    if (state.inString) {
+      if (state.escape) {
+        state.escape = false;
+      } else if (ch === "\\") {
+        state.escape = true;
+      } else if (ch === "\"") {
+        state.inString = false;
+      }
+      continue;
+    }
+    if (ch === "\"") state.inString = true;
+    else if (ch === "{") state.depth += 1;
+    else if (ch === "}") {
+      state.depth -= 1;
+      if (state.depth === 0) return { resumeAt: i + 1 };
+    }
+  }
+  return { state, resumeAt: source.length };
+}
+
+function holdOrSuppress(hold: string, afterOpen: number): Pick<DrainTextToolCallsResult, "pending" | "suppressed"> {
+  if (byteLength(hold) <= MAX_PENDING_TEXT_TOOLCALL_BYTES) return { pending: hold };
+  const suppressed = newSuppressedScan();
+  const scanned = consumeSuppressedScan(suppressed, hold, afterOpen);
+  return scanned.state ? { pending: "", suppressed: scanned.state } : { pending: "" };
+}
+
+/**
+ * Fold `pending + chunk`, emit surrounding prose, and extract every complete
+ * `[TOOL_CALL]name[ARGS]{…}` block. Names are folded through
+ * `normalizeCursorWireName` so `mcp_opencodex-responses_*` display aliases
+ * become the advertised wire name before promotion.
+ */
+export function drainCursorTextToolCalls(
+  pending: string,
+  chunk: string,
+  suppressed?: SuppressedTextToolCallScan,
+): DrainTextToolCallsResult {
+  let combined = pending + chunk;
+  if (suppressed) {
+    const scanned = consumeSuppressedScan(suppressed, chunk);
+    if (scanned.state) return { text: "", pending: "", calls: [], suppressed: scanned.state };
+    combined = chunk.slice(scanned.resumeAt);
+  }
+  let cursor = 0;
+  let text = "";
+  const calls: DrainedTextToolCall[] = [];
+  const opener = new RegExp(TOOL_CALL_OPEN.source, TOOL_CALL_OPEN.flags);
+
+  while (cursor < combined.length) {
+    opener.lastIndex = cursor;
+    const match = opener.exec(combined);
+    if (!match || match.index === undefined) {
+      text += combined.slice(cursor);
+      return { text, pending: "", calls };
+    }
+
+    text += combined.slice(cursor, match.index);
+    const afterOpen = match.index + match[0].length;
+    const rest = combined.slice(afterOpen);
+    const argsTag = rest.match(/^([^\[\]]*)\[ARGS\]/i);
+    if (!argsTag) {
+      const hold = combined.slice(match.index);
+      return { text, calls, ...holdOrSuppress(hold, afterOpen - match.index) };
+    }
+
+    const name = argsTag[1]?.trim() ?? "";
+    let jsonStart = afterOpen + argsTag[0].length;
+    while (jsonStart < combined.length && /\s/.test(combined[jsonStart] ?? "")) jsonStart += 1;
+    if (jsonStart >= combined.length) {
+      const hold = combined.slice(match.index);
+      return { text, calls, ...holdOrSuppress(hold, afterOpen - match.index) };
+    }
+    if (combined[jsonStart] !== "{") {
+      debugProviderDiagnostic("cursor", "text-toolcall-invalid-arguments", {
+        reason: "arguments-did-not-start-with-object",
+        ...(name ? { toolName: normalizeCursorWireName(name) } : {}),
+      });
+      // No delimiter identifies where a non-JSON payload ends. Resume marker
+      // scanning after `[ARGS]`, while suppressing the malformed payload itself.
+      opener.lastIndex = jsonStart;
+      const nextMarker = opener.exec(combined);
+      if (!nextMarker || nextMarker.index === undefined) return { text, pending: "", calls };
+      cursor = nextMarker.index;
+      continue;
+    }
+
+    const jsonEnd = findJsonObjectEnd(combined, jsonStart);
+    if (jsonEnd === undefined) {
+      const hold = combined.slice(match.index);
+      return { text, calls, ...holdOrSuppress(hold, afterOpen - match.index) };
+    }
+
+    const args = combined.slice(jsonStart, jsonEnd);
+    try {
+      JSON.parse(args);
+      if (name.length > 0) {
+        calls.push({ name: normalizeCursorWireName(name), args });
+      }
+    } catch {
+      debugProviderDiagnostic("cursor", "text-toolcall-invalid-arguments", {
+        reason: "arguments-json-parse-failed",
+        ...(name ? { toolName: normalizeCursorWireName(name) } : {}),
+      });
+    }
+    cursor = jsonEnd;
+  }
+
+  return { text, pending: "", calls };
+}

package/src/adapters/cursor/thread-continuity.ts

@@ -158,3 +158,144 @@ export function cursorOverflowRemintCountForTests(): number {
   pruneOverflowRemints(now());
   return overflowRemintByScope.size;
 }
+
+/** Max next-turn conversation-id rotations after incomplete client-tool streams per retained scope. */
+export const CURSOR_INCOMPLETE_TOOL_REMINT_MAX = 3;
+export const CURSOR_INCOMPLETE_TOOL_REMINT_TTL_MS = CURSOR_OVERFLOW_REMINT_TTL_MS;
+export const CURSOR_INCOMPLETE_TOOL_REMINT_MAX_ENTRIES = CURSOR_OVERFLOW_REMINT_MAX_ENTRIES;
+
+type IncompleteToolRemintState = {
+  remintCount: number;
+  updatedAt: number;
+};
+
+/**
+ * One bounded next-turn remint allowance, keyed by retained thread scope.
+ *
+ * Each recovery reason owns its own instance. Sharing one budget would let a cheap, frequent
+ * failure spend the allowance that a rarer, more expensive recovery depends on.
+ */
+function createCursorRemintBudget(max: number, ttlMs: number, maxEntries: number) {
+  const byScope = new Map<string, IncompleteToolRemintState>();
+
+  const prune = (at: number): void => {
+    for (const [scopeKey, entry] of byScope) {
+      if (at - entry.updatedAt > ttlMs) byScope.delete(scopeKey);
+    }
+    while (byScope.size > maxEntries) {
+      const oldest = byScope.keys().next().value;
+      if (oldest === undefined) break;
+      byScope.delete(oldest);
+    }
+  };
+
+  return {
+    /** Record one remint; returns false when this budget is exhausted. */
+    record(scopeKey: string): boolean {
+      const at = now();
+      prune(at);
+      const existing = byScope.get(scopeKey);
+      if (existing && existing.remintCount >= max) {
+        existing.updatedAt = at;
+        byScope.delete(scopeKey);
+        byScope.set(scopeKey, existing);
+        return false;
+      }
+      const entry = existing ?? { remintCount: 0, updatedAt: at };
+      entry.remintCount += 1;
+      entry.updatedAt = at;
+      byScope.delete(scopeKey);
+      byScope.set(scopeKey, entry);
+      prune(at);
+      return true;
+    },
+    clear(scopeKey: string): void {
+      byScope.delete(scopeKey);
+    },
+    clearForTests(): void {
+      byScope.clear();
+    },
+    countForTests(): number {
+      prune(now());
+      return byScope.size;
+    },
+  };
+}
+
+const incompleteToolRemintBudget = createCursorRemintBudget(
+  CURSOR_INCOMPLETE_TOOL_REMINT_MAX,
+  CURSOR_INCOMPLETE_TOOL_REMINT_TTL_MS,
+  CURSOR_INCOMPLETE_TOOL_REMINT_MAX_ENTRIES,
+);
+
+/** Incomplete-tool and overflow recovery share ownership scope, but keep independent budgets. */
+export function cursorIncompleteToolRemintScopeKey(
+  threadOwner: string | undefined,
+  identityScope?: string,
+): string | null {
+  return cursorOverflowRemintScopeKey(threadOwner, identityScope);
+}
+
+/** Record one incomplete-tool remint; returns false when the independent cap is exhausted. */
+export function recordCursorIncompleteToolRemint(scopeKey: string): boolean {
+  return incompleteToolRemintBudget.record(scopeKey);
+}
+
+/** A clean turn replenishes this recovery without changing the overflow retry budget. */
+export function clearCursorIncompleteToolRemint(scopeKey: string): void {
+  incompleteToolRemintBudget.clear(scopeKey);
+}
+
+export function clearCursorIncompleteToolRemintForTests(): void {
+  incompleteToolRemintBudget.clearForTests();
+}
+
+export function cursorIncompleteToolRemintCountForTests(): number {
+  return incompleteToolRemintBudget.countForTests();
+}
+
+/**
+ * Max next-turn rotations after a MID-STREAM envelope echo, per retained scope.
+ *
+ * Deliberately a separate budget from the incomplete-tool allowance. A mid-stream echo is a
+ * cheap, repeatable formatting failure, while an incomplete client-tool stream is a rarer
+ * structural one; on a shared counter a model that echoes every turn would spend the budget
+ * that incomplete-tool recovery depends on. Bounding it at all is the point: the echo has
+ * already reached the client and cannot be quarantined, so without a cap a persistently
+ * echoing model would remint the conversation on every single turn, forever.
+ */
+export const CURSOR_ENVELOPE_ECHO_REMINT_MAX = 3;
+export const CURSOR_ENVELOPE_ECHO_REMINT_TTL_MS = CURSOR_OVERFLOW_REMINT_TTL_MS;
+export const CURSOR_ENVELOPE_ECHO_REMINT_MAX_ENTRIES = CURSOR_OVERFLOW_REMINT_MAX_ENTRIES;
+
+const envelopeEchoRemintBudget = createCursorRemintBudget(
+  CURSOR_ENVELOPE_ECHO_REMINT_MAX,
+  CURSOR_ENVELOPE_ECHO_REMINT_TTL_MS,
+  CURSOR_ENVELOPE_ECHO_REMINT_MAX_ENTRIES,
+);
+
+/** Echo recovery shares ownership scope with overflow and incomplete-tool, budget apart. */
+export function cursorEnvelopeEchoRemintScopeKey(
+  threadOwner: string | undefined,
+  identityScope?: string,
+): string | null {
+  return cursorOverflowRemintScopeKey(threadOwner, identityScope);
+}
+
+/** Record one envelope-echo remint; returns false when the independent cap is exhausted. */
+export function recordCursorEnvelopeEchoRemint(scopeKey: string): boolean {
+  return envelopeEchoRemintBudget.record(scopeKey);
+}
+
+/** A turn that completed without an echo replenishes only this budget. */
+export function clearCursorEnvelopeEchoRemint(scopeKey: string): void {
+  envelopeEchoRemintBudget.clear(scopeKey);
+}
+
+export function clearCursorEnvelopeEchoRemintForTests(): void {
+  envelopeEchoRemintBudget.clearForTests();
+}
+
+export function cursorEnvelopeEchoRemintCountForTests(): number {
+  return envelopeEchoRemintBudget.countForTests();
+}

package/src/adapters/cursor/tool-guidance.ts

@@ -4,13 +4,14 @@ import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EX
 
 export const CURSOR_SHELL_ALIAS_SYSTEM_NOTE =
   'Shell commands use the Codex shell bridge tool shown in this turn\'s catalog (`shell_command` or `exec_command`) with JSON arguments like {"cmd":"..."}. The long `mcp_opencodex-responses_*` display name is the same tool. Prefer it over Cursor-native Shell.';
-const NEIGHBOR_AGENT_TOOL_NAMES = ["Read", "Grep", "Glob", "Bash", "LS"] as const;
+const NEIGHBOR_AGENT_TOOL_NAMES = ["Read", "Grep", "Glob", "Bash", "LS", "Write"] as const;
 const NEIGHBOR_AGENT_TOOL_ALIASES: Record<(typeof NEIGHBOR_AGENT_TOOL_NAMES)[number], readonly string[]> = {
   Read: ["read", "read_file"],
   Grep: ["grep"],
   Glob: ["glob", "find"],
   Bash: ["bash", "shell"],
   LS: ["ls"],
+  Write: ["write", "write_file"],
 };
 
 export const CURSOR_GENERIC_TOOL_USE_USER_HINT = [
@@ -22,7 +23,7 @@ export const CURSOR_GENERIC_TOOL_USE_USER_HINT = [
   "The Cursor bridge may suspend after the first returned bridge tool call, so emit sibling calls together before any result is needed.",
   "If parallel emission is unavailable, continue with separate shell-bridge calls until the requested count has returned.",
   "Do not use `tool_search`, external MCP, or resource discovery just to pad the count unless explicitly asked.",
-  "Do not suggest or switch to neighboring-agent tools such as `Grep`, `Read`, `Glob`, `Bash`, or `LS` unless this turn's catalog lists those exact names or an equivalent listed client tool.",
+  "Do not suggest or switch to neighboring-agent tools such as `Grep`, `Read`, `Glob`, `Bash`, `LS`, or `Write` unless this turn's catalog lists those exact names or an equivalent listed client tool.",
 ].join(" ");
 
 
@@ -190,7 +191,7 @@ export function buildCursorToolGuidanceSystemNote(
       ? CODE_MODE_RESULT_ECHO_SENTENCE + " There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers. " + CODE_MODE_HOST_CONTRACT_SENTENCE
       : undefined,
     codeMode
-      ? "NEVER attempt Cursor-native Shell, Read, Grep, List, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
+      ? "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
       : undefined,
     hasBareExec
       ? `${shellBridgeLabel} is the Codex Responses shell bridge for this turn, exposed through Cursor's tool protocol; it is not an external MCP server tool. \`shell_command\` and \`exec_command\` are aliases of the same bridge.`
@@ -199,7 +200,7 @@ export function buildCursorToolGuidanceSystemNote(
       ? "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
       : undefined,
     hasBareExec
-      ? `NEVER attempt Cursor-native Shell, Read, Grep, List, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
+      ? `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
       : undefined,
     hasBareExec
       ? "Tool-selection commentary is forbidden: for any shell, read, grep, list, or file operation, your FIRST visible action is the bridge call itself — never a sentence about which tool you will use, which tool was redirected, or switching surfaces. Words like 차단/전환/blocked/switching must not appear in your output for tool-routing reasons."

package/src/adapters/cursor/types.ts

@@ -11,6 +11,11 @@ export interface CursorRequestedModelParameter {
 
 export interface CursorRunRequest {
   modelId: string;
+  /**
+   * Normalized Cursor identity scope carried from request parsing so checkpoint
+   * observations stay scope-local. Transport metadata only; never serialized on the wire.
+   */
+  _cursorIdentityScope?: string;
   /** Cursor model-picker parameters encoded through AgentRunRequest.requested_model. */
   requestedModelParameters?: readonly CursorRequestedModelParameter[];
   /** Cursor Router optimization parameter; valid only while modelId is the `default` wire model. */