@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/adapters/cursor/protobuf-request.ts

@@ -1,7 +1,7 @@
 import { create, fromBinary, toBinary, toJson } from "@bufbuild/protobuf";
 import { fromJson, type JsonValue } from "@bufbuild/protobuf";
 import { ValueSchema } from "@bufbuild/protobuf/wkt";
-import type { OcxAssistantContentPart, OcxMessage, OcxToolResultMessage } from "../../types";
+import type { OcxAssistantContentPart, OcxMessage, OcxTool, OcxToolResultMessage } from "../../types";
 import { namespacedToolName } from "../../types";
 import type { CursorRunRequest } from "./types";
 import { cursorStructuredOutputInstructions } from "./structured-output";
@@ -224,6 +224,7 @@ function systemPromptBlobs(request: CursorRunRequest): RootBlobCandidate[] {
   const cursorToolGuidance = buildCursorToolGuidanceSystemNote(
     cursorToolsForActivePrompt(request.tools, activePromptText(request), request.toolChoice),
     request.toolChoice,
+    request.modelId,
   );
   if (cursorToolGuidance) prompts.push(cursorToolGuidance);
   return prompts.map(content => rootBlobCandidate({ role: "system", content }, "system"));
@@ -1299,12 +1300,13 @@ function toolCallStep(
   requestScope: CursorBlobRequestScopeToken,
   result?: OcxToolResultMessage,
   codeMode = false,
+  catalog?: readonly OcxTool[],
 ): Uint8Array {
   const args: Record<string, Uint8Array> = {};
   for (const [key, value] of Object.entries(part.arguments ?? {})) args[key] = argBytes(value);
   // Replay the same provider-isolated identity advertised in this request. Returned calls are
   // restored to the client name, so transcript parts carry the client name again on the next turn.
-  const toolName = cursorToolWireName(part);
+  const toolName = cursorToolWireName(part, catalog);
   const decodedResult = result ? decodeResultParts(result) : undefined;
   const serialize = (maxImages: number): Uint8Array => toBinary(ConversationStepSchema, create(ConversationStepSchema, {
     message: {
@@ -1357,8 +1359,12 @@ function toolResultPart(message: OcxToolResultMessage, codeMode: boolean, decode
   });
 }
 
-function assistantStep(part: OcxAssistantContentPart, requestScope: CursorBlobRequestScopeToken): Uint8Array | undefined {
-  if (part.type === "toolCall") return toolCallStep(part, requestScope);
+function assistantStep(
+  part: OcxAssistantContentPart,
+  requestScope: CursorBlobRequestScopeToken,
+  catalog?: readonly OcxTool[],
+): Uint8Array | undefined {
+  if (part.type === "toolCall") return toolCallStep(part, requestScope, undefined, false, catalog);
   if (part.type === "thinking") {
     return storeCursorBlob(toBinary(ConversationStepSchema, create(ConversationStepSchema, {
       message: {
@@ -1409,7 +1415,7 @@ function conversationTurns(
   const flush = () => {
     if (!current) return;
     for (const part of pendingToolCalls.values()) {
-      current.steps.push(toolCallStep(part, requestScope, missingToolResultFor(part), codeMode));
+      current.steps.push(toolCallStep(part, requestScope, missingToolResultFor(part), codeMode, request.tools));
     }
     turns.push(storeCursorBlob(toBinary(ConversationTurnStructureSchema, create(ConversationTurnStructureSchema, {
       turn: {
@@ -1451,7 +1457,7 @@ function conversationTurns(
           pendingToolCalls.set(part.id, part);
           continue;
         }
-        const step = assistantStep(part, requestScope);
+        const step = assistantStep(part, requestScope, request.tools);
         if (step) current.steps.push(step);
       }
       continue;
@@ -1478,7 +1484,7 @@ function conversationTurns(
       }
       const priorCall = pendingToolCalls.get(message.toolCallId);
       if (priorCall) {
-        current.steps.push(toolCallStep(priorCall, requestScope, message, codeMode));
+        current.steps.push(toolCallStep(priorCall, requestScope, message, codeMode, request.tools));
         pendingToolCalls.delete(message.toolCallId);
       } else {
         current.steps.push(storeCursorBlob(toBinary(ConversationStepSchema, create(ConversationStepSchema, {

package/src/adapters/cursor/request-builder.ts

@@ -102,8 +102,8 @@ export function applyCursorToolBudget(
   const tryKeep = (tool: OcxTool): boolean => {
     if (keptSet.has(tool) || kept.length >= CURSOR_TOOL_COUNT_LIMIT) return keptSet.has(tool);
     // Repeated protobuf message fields serialize as concatenated tag/length/value entries,
-    // so each one-entry wrapper size is the exact additive contribution to McpTools.
-    const candidateBytes = cursorMcpToolEncodedSize(tool, toolChoice);
+    // so each wrapper uses the same catalog-dependent names and choice as registration.
+    const candidateBytes = cursorMcpToolEncodedSize(tool, toolChoice, eligible);
     if (keptBytes + candidateBytes > CURSOR_TOOL_BYTES_LIMIT) return false;
     kept.push(tool);
     keptSet.add(tool);
@@ -129,7 +129,7 @@ export function applyCursorToolBudget(
       if (!occupant || isCursorExecutionPathTool(occupant)) continue;
       kept.splice(i, 1);
       keptSet.delete(occupant);
-      keptBytes -= cursorMcpToolEncodedSize(occupant, toolChoice);
+      keptBytes -= cursorMcpToolEncodedSize(occupant, toolChoice, eligible);
       if (kept.length < CURSOR_TOOL_COUNT_LIMIT && keptBytes + needBytes <= CURSOR_TOOL_BYTES_LIMIT) {
         return;
       }
@@ -141,7 +141,7 @@ export function applyCursorToolBudget(
   // earlier same-priority pins; evict wait/patch/filler rather than ship wait-only.
   for (const tool of eligible) {
     if (!isCursorExecutionPathTool(tool) || keptSet.has(tool)) continue;
-    const need = cursorMcpToolEncodedSize(tool, toolChoice);
+    const need = cursorMcpToolEncodedSize(tool, toolChoice, eligible);
     if (need > CURSOR_TOOL_BYTES_LIMIT) continue;
     evictNonExecutionPath(need);
     tryKeep(tool);
@@ -157,7 +157,7 @@ export function applyCursorToolBudget(
       keptSet.delete(tool);
       const index = kept.indexOf(tool);
       if (index >= 0) kept.splice(index, 1);
-      keptBytes -= cursorMcpToolEncodedSize(tool, toolChoice);
+      keptBytes -= cursorMcpToolEncodedSize(tool, toolChoice, eligible);
     }
   }
 
@@ -171,8 +171,8 @@ export function applyCursorToolBudget(
 
 function catalogLimitNote(kept: readonly OcxTool[], omitted: readonly OcxTool[]): string | undefined {
   if (omitted.length === 0) return undefined;
-  const recoverable = kept.some(tool => tool.toolSearch || cursorToolWireName(tool) === "tool_search");
-  const names = omitted.slice(0, 12).map(cursorToolWireName);
+  const recoverable = kept.some(tool => tool.toolSearch || cursorToolWireName(tool, kept) === "tool_search");
+  const names = omitted.slice(0, 12).map(tool => cursorToolWireName(tool, kept));
   const remainder = omitted.length - names.length;
   const omittedSummary = `${names.join(", ")}${remainder > 0 ? `, and ${remainder} more` : ""}`;
   return recoverable
@@ -509,8 +509,21 @@ export function createCursorRequest(
 ): CursorRunRequest {
   const messages = cursorRequestMessagesFromRaw(parsed.context.messages);
   const activeText = [...messages].reverse().find(message => message.role === "user" || message.role === "developer")?.content ?? "";
-  const visibleTools = cursorToolsForActivePrompt(parsed.context.tools, activeText, parsed.options.toolChoice);
-  const budget = applyCursorToolBudget(visibleTools, parsed.options.toolChoice);
+  const catalog = parsed.context.tools ?? [];
+  const originalChoice = parsed.options.toolChoice;
+  // Resolve accepted bare wire aliases before filtering can remove their shell-bridge context.
+  // Keep the original selection so a semantic name cannot widen to a namespaced sibling.
+  const selectedTools = catalog.filter(tool => cursorToolAllowedByChoice(tool, originalChoice, catalog));
+  const semanticChoiceName = (name: string): string => selectedTools.find(tool =>
+    !tool.namespace && cursorToolWireName(tool, catalog) === name
+    && cursorToolAllowedByChoice(tool, { name }, catalog))?.name ?? name;
+  const toolChoice = originalChoice && typeof originalChoice === "object"
+    ? "name" in originalChoice
+      ? { ...originalChoice, name: semanticChoiceName(originalChoice.name) }
+      : { ...originalChoice, allowedTools: originalChoice.allowedTools.map(semanticChoiceName) }
+    : originalChoice;
+  const visibleTools = cursorToolsForActivePrompt(selectedTools, activeText, toolChoice);
+  const budget = applyCursorToolBudget(visibleTools, toolChoice);
   const limitNote = catalogLimitNote(budget.tools, budget.omitted);
   const model = normalizeCursorModelId(
     parsed.modelId,
@@ -536,7 +549,7 @@ export function createCursorRequest(
     ...(budget.tools.length === 0 && !cursorClientThreadOwner(parsed)
       ? { suppressDefaultCursorToolCatalog: true }
       : {}),
-    ...(parsed.options.toolChoice ? { toolChoice: parsed.options.toolChoice } : {}),
+    ...(toolChoice ? { toolChoice } : {}),
     ...(parsed.options.parallelToolCalls !== undefined ? { parallelToolCalls: parsed.options.parallelToolCalls } : {}),
   };
   const resolved = resolveCursorCheckpoint(parsed, request, options);

package/src/adapters/cursor/tool-definitions.ts

@@ -4,7 +4,7 @@ import type { OcxRequestOptions, OcxTool } from "../../types";
 import { McpToolDefinitionSchema, McpToolsSchema, type McpToolDefinition } from "./gen/agent_pb";
 import { CURSOR_EDIT_FILE_TOOL, CURSOR_MULTI_EDIT_TOOL, cursorRequestAdvertisesApplyPatch, cursorToolAllowedByChoice, cursorToolWireName, OCX_RESPONSES_TOOL_PROVIDER } from "./tool-naming";
 import { CURSOR_EDIT_FILE_INPUT_SCHEMA, CURSOR_MULTI_EDIT_INPUT_SCHEMA, cursorToolInputSchema } from "./tool-schemas";
-export { OCX_RESPONSES_TOOL_PROVIDER, CODEX_EXEC_COMMAND_TOOL, CODEX_SHELL_COMMAND_TOOL, CODEX_UNIFIED_EXEC_TOOL, CODEX_WAIT_TOOL, CODEX_APPLY_PATCH_TOOL, CODEX_TOOL_SEARCH_TOOL, CURSOR_EDIT_FILE_TOOL, CURSOR_MULTI_EDIT_TOOL, CURSOR_STRUCTURED_EDIT_TOOLS, CURSOR_EXEC_COMMAND_TOOL, CODEX_SHELL_BRIDGE_TOOL_NAMES, isCodexShellBridgeToolName, resolveShellBridgeAliasKey, cursorToolChoiceAliases, isBareCodexShellBridgeTool, isCursorExecutionPathTool, isCursorWaitTool, isCursorCodeModeExecTool, cursorRequestUsesCodeMode, cursorRequestHasShellAlias, cursorRequestAdvertisesApplyPatch, isCursorStructuredEditToolName, isCursorSyntheticStructuredEditTool, cursorToolWireName, normalizeCursorWireName, normalizeCursorTextToolMarkers, responsesToolNameFromCursorWire, cursorToolAllowedByChoice } from "./tool-naming";
+export { OCX_RESPONSES_TOOL_PROVIDER, CODEX_EXEC_COMMAND_TOOL, CODEX_SHELL_COMMAND_TOOL, CODEX_UNIFIED_EXEC_TOOL, CODEX_WAIT_TOOL, CODEX_APPLY_PATCH_TOOL, CODEX_TOOL_SEARCH_TOOL, CURSOR_EDIT_FILE_TOOL, CURSOR_MULTI_EDIT_TOOL, CURSOR_STRUCTURED_EDIT_TOOLS, CURSOR_EXEC_COMMAND_TOOL, CODEX_SHELL_BRIDGE_TOOL_NAMES, isCodexShellBridgeToolName, resolveShellBridgeAliasKey, cursorToolChoiceAliases, isBareCodexShellBridgeTool, isCursorExecutionPathTool, isCursorWaitTool, isCursorCodeModeExecTool, cursorRequestUsesCodeMode, cursorRequestHasShellAlias, cursorRequestAdvertisesApplyPatch, isCursorStructuredEditToolName, isCursorSyntheticStructuredEditTool, CLAUDE_CLIENT_BARE_TOOL_NAMES, isClaudeClientBareToolName, isCursorBareClientToolWireAliased, cursorToolWireName, normalizeCursorWireName, normalizeCursorTextToolMarkers, responsesToolNameFromCursorWire, cursorToolAllowedByChoice } from "./tool-naming";
 export { CURSOR_EXEC_COMMAND_INPUT_SCHEMA, CURSOR_FREEFORM_INPUT_SCHEMA, CURSOR_EDIT_FILE_INPUT_SCHEMA, CURSOR_MULTI_EDIT_INPUT_SCHEMA, CODEX_SHELL_BRIDGE_ARG_NORMALIZE_SCHEMA, cursorToolInputSchema, cursorToolArgNormalizeSchema, shellBridgeRequiredCommandKeys, defaultShellBridgeArgNormalizeSchema, cursorShellBridgeDropError, nonEmptyShellBridgeCommandFromArgs, cursorShellBridgeArgsValid } from "./tool-schemas";
 export { CURSOR_SHELL_ALIAS_SYSTEM_NOTE, CURSOR_GENERIC_TOOL_USE_USER_HINT, isGenericToolUseCountDemoPrompt, requestedCursorToolUseCount, shouldAppendCursorGenericToolUseHint, appendCursorGenericToolUseHint, shouldUseNativeExecOnlyForGenericToolUse, cursorToolsForActivePrompt, buildCursorToolGuidanceSystemNote } from "./tool-guidance";
 
@@ -80,10 +80,11 @@ export function encodeCursorInputSchema(schema: unknown): Uint8Array {
 export function buildCursorToolDefinitions(
   tools: readonly OcxTool[] | undefined,
   toolChoice?: OcxRequestOptions["toolChoice"],
+  catalog: readonly OcxTool[] = tools ?? [],
 ): McpToolDefinition[] {
   if (!tools?.length) return [];
-  return tools.filter(tool => cursorToolAllowedByChoice(tool, toolChoice, tools)).map(tool => {
-    const wireName = cursorToolWireName(tool);
+  return tools.filter(tool => cursorToolAllowedByChoice(tool, toolChoice, catalog)).map(tool => {
+    const wireName = cursorToolWireName(tool, catalog);
     return create(McpToolDefinitionSchema, {
       name: wireName,
       toolName: wireName,
@@ -98,15 +99,17 @@ export function buildCursorToolDefinitions(
 export function cursorMcpToolsEncodedSize(
   tools: readonly OcxTool[] | undefined,
   toolChoice?: OcxRequestOptions["toolChoice"],
+  catalog: readonly OcxTool[] = tools ?? [],
 ): number {
-  const definitions = buildCursorToolDefinitions(tools, toolChoice);
+  const definitions = buildCursorToolDefinitions(tools, toolChoice, catalog);
   return toBinary(McpToolsSchema, create(McpToolsSchema, { mcpTools: definitions })).byteLength;
 }
 
-/** Exact additive contribution of one repeated McpToolDefinition entry. */
+/** Exact additive contribution of one entry, using the registration catalog for wire naming and choice. */
 export function cursorMcpToolEncodedSize(
   tool: OcxTool,
   toolChoice?: OcxRequestOptions["toolChoice"],
+  catalog: readonly OcxTool[] = [tool],
 ): number {
-  return cursorMcpToolsEncodedSize([tool], toolChoice);
+  return cursorMcpToolsEncodedSize([tool], toolChoice, catalog);
 }

package/src/adapters/cursor/tool-guidance.ts

@@ -1,6 +1,7 @@
 import type { OcxRequestOptions, OcxTool } from "../../types";
+import { CURSOR_TOOL_CALL_CONTINUATION, cursorUsesPlainToolWording } from "./tool-wording";
 import { CODE_MODE_HOST_CONTRACT_SENTENCE, CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
-import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EXEC_TOOL, clientSemanticToolNameFromCursorWire, cursorRequestAdvertisesApplyPatch, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolAllowedByChoice, cursorToolWireName, isCodexShellBridgeToolName, isCursorExecutionPathTool, isCursorStructuredEditToolName } from "./tool-naming";
+import { CODEX_SHELL_BRIDGE_TOOL_NAMES, CODEX_TOOL_SEARCH_TOOL, CODEX_UNIFIED_EXEC_TOOL, clientSemanticToolNameFromCursorWire, cursorRequestAdvertisesApplyPatch, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolAllowedByChoice, cursorToolWireName, isBareCodexShellBridgeTool, isClaudeClientBareToolName, isCodexShellBridgeToolName, isCursorExecutionPathTool, isCursorStructuredEditToolName } from "./tool-naming";
 
 export const CURSOR_SHELL_ALIAS_SYSTEM_NOTE =
   'Shell commands use the Codex shell bridge tool shown in this turn\'s catalog (`shell_command` or `exec_command`) with JSON arguments like {"cmd":"..."}. The long `mcp_opencodex-responses_*` display name is the same tool. Prefer it over Cursor-native Shell.';
@@ -129,7 +130,15 @@ function advertisedCoversNeighbor(wireNames: readonly string[], neighbor: (typeo
   return NEIGHBOR_AGENT_TOOL_ALIASES[neighbor].some(alias => advertised.has(alias.toLowerCase()));
 }
 
-function unavailableNeighborAgentToolNames(wireNames: readonly string[]): string[] {
+function unavailableNeighborAgentToolNames(
+  wireNames: readonly string[],
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
+): string[] {
+  if (
+    catalog
+    && !catalog.some(isBareCodexShellBridgeTool)
+    && catalog.some(tool => !tool.namespace && isClaudeClientBareToolName(tool.name))
+  ) return [];
   return NEIGHBOR_AGENT_TOOL_NAMES.filter(name => !advertisedCoversNeighbor(wireNames, name));
 }
 
@@ -144,12 +153,14 @@ function discoveryToolLabel(wireNames: readonly string[]): string | undefined {
 export function buildCursorToolGuidanceSystemNote(
   tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
   toolChoice?: OcxRequestOptions["toolChoice"],
+  modelId?: string,
 ): string | undefined {
   if (!tools?.length) return undefined;
+  const plainToolWording = cursorUsesPlainToolWording(modelId);
   const wireNames = [...new Set(
     tools
       .filter(tool => cursorToolAllowedByChoice(tool, toolChoice, tools))
-      .map(tool => cursorToolWireName(tool)),
+      .map(tool => cursorToolWireName(tool, tools)),
   )];
   if (wireNames.length === 0) return undefined;
 
@@ -170,7 +181,7 @@ export function buildCursorToolGuidanceSystemNote(
     ?.filter(tool => !tool.namespace && isCursorStructuredEditToolName(tool.name))
     .map(tool => tool.name) ?? [];
   const discoveryTools = discoveryToolLabel(wireNames);
-  const unavailableNeighborNames = unavailableNeighborAgentToolNames(wireNames);
+  const unavailableNeighborNames = unavailableNeighborAgentToolNames(wireNames, tools);
   // Host-shell-neutral: the Codex client executes bridge commands, and may differ from
   // the OpenCodex proxy OS (LAN/SSH remote-proxy). Always cover PowerShell 5.1 pitfalls.
   const hostShellNote = hasBareExec
@@ -179,6 +190,9 @@ export function buildCursorToolGuidanceSystemNote(
   const notes = [
     `Cursor tool calls: available tool names are exactly ${listedNames}.`,
     "Use the current tool catalog as ground truth and call only those exact names with their listed argument keys.",
+    plainToolWording && !codeMode && !hasBareExec
+      ? "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not available in this request. Use the listed tool that fits the operation."
+      : undefined,
     unavailableNeighborNames.length > 0
       ? `This turn does not expose neighboring-agent tool names ${quotedNames(unavailableNeighborNames)}; do not call or suggest them unless the catalog lists them.`
       : undefined,
@@ -191,18 +205,24 @@ export function buildCursorToolGuidanceSystemNote(
       ? CODE_MODE_RESULT_ECHO_SENTENCE + " There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers. " + CODE_MODE_HOST_CONTRACT_SENTENCE
       : undefined,
     codeMode
-      ? "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
+      ? plainToolWording
+        ? "Cursor-native Shell, Read, Grep, List, and Write are not available in this request. The exec code cell and its nested helpers provide the execution path; separately listed tools remain callable at the top level."
+        : "NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool absent from the catalog — they are not executed in this environment and every probe wastes a turn. The exec code cell (with its nested helpers) is the ONLY execution surface; go to it directly on the FIRST attempt and do not narrate switching surfaces."
       : undefined,
     hasBareExec
       ? `${shellBridgeLabel} is the Codex Responses shell bridge for this turn, exposed through Cursor's tool protocol; it is not an external MCP server tool. \`shell_command\` and \`exec_command\` are aliases of the same bridge.`
       : undefined,
     hasBareExec
-      ? "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
+      ? plainToolWording
+        ? "Your tool list may display the same shell bridge under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; call the name listed in the catalog."
+        : "Your tool list may display it under a longer `mcp_opencodex-responses_shell_command` / `mcp_opencodex-responses_exec_command` name; those are the SAME tool — call whichever your list shows, and do not comment on the naming difference to the user."
       : undefined,
     hasBareExec
-      ? `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
+      ? plainToolWording
+        ? `Cursor-native Shell, Read, Grep, List, and Write are not available in this request. ${shellBridgeLabel} provides shell execution through the Codex client host.`
+        : `NEVER attempt Cursor-native Shell, Read, Grep, List, Write, or any tool not in the catalog above — they are not executed locally in this environment and every attempt wastes a turn and can stall the session. ${shellBridgeLabel} is the ONLY shell surface; go to it directly on the FIRST attempt, never as a fallback after probing a native tool. Do not narrate switching surfaces ("native is blocked, using the bridge instead") — there is exactly one surface.`
       : undefined,
-    hasBareExec
+    hasBareExec && !plainToolWording
       ? "Tool-selection commentary is forbidden: for any shell, read, grep, list, or file operation, your FIRST visible action is the bridge call itself — never a sentence about which tool you will use, which tool was redirected, or switching surfaces. Words like 차단/전환/blocked/switching must not appear in your output for tool-routing reasons."
       : undefined,
     hostShellNote,
@@ -233,5 +253,6 @@ export function buildCursorToolGuidanceSystemNote(
       ? `For every file read, directory listing, grep, or shell operation use ${shellBridgeLabel} directly with host-shell-safe commands (POSIX: \`cat\`/\`ls\`/\`rg\`; Windows PowerShell: \`Get-Content\`/\`Get-ChildItem\`/\`Select-String\`). For file edits, use ${structuredEditNames.length > 0 ? `the structured edit tools (${quotedNames(structuredEditNames)}) or ` : ""}\`apply_patch\` when available.`
       : undefined,
   ].filter((note): note is string => typeof note === "string");
+  if (plainToolWording) notes.push(CURSOR_TOOL_CALL_CONTINUATION);
   return notes.join(" ");
 }

package/src/adapters/cursor/tool-naming.ts

@@ -67,11 +67,11 @@ function cursorToolChoiceMatches(
     if (catalogHasBareCodexShellBridge(catalog)) {
       return isBareCodexShellBridgeTool(tool);
     }
-    return tool.name === choiceName || cursorToolWireName(tool) === choiceName;
+    return tool.name === choiceName || cursorToolWireName(tool, catalog) === choiceName;
   }
   if (tool.name === choiceName) return true;
   if (cursorToolChoiceAliases(tool).includes(choiceName)) return true;
-  return cursorToolWireName(tool) === choiceName
+  return cursorToolWireName(tool, catalog) === choiceName
     && !catalog.some(candidate => candidate.name === choiceName);
 }
 
@@ -178,16 +178,49 @@ const CURSOR_PROXY_OWNED_BARE_TOOL_NAMES = new Set([
   CODEX_TOOL_SEARCH_TOOL,
 ]);
 
+export const CLAUDE_CLIENT_BARE_TOOL_NAMES = new Set([
+  "Bash",
+  "Read",
+  "Write",
+  "Edit",
+  "Grep",
+  "Glob",
+  "Task",
+  "GetDynamicTools",
+  "EnterMode",
+  "ExitMode",
+  "Todo",
+  "AddTodo",
+  "UpdateTodo",
+  "ViewTodo",
+  "WebSearch",
+  "FetchUrl",
+  "KillProcess",
+  "ListProcesses",
+  "ViewProcessOutput",
+]);
+
+export function isClaudeClientBareToolName(name: string): boolean {
+  return CLAUDE_CLIENT_BARE_TOOL_NAMES.has(name);
+}
+
 /** Avoid collisions with Cursor's private bare-tool namespace. */
-function isCursorBareClientToolWireAliased(
+export function isCursorBareClientToolWireAliased(
   tool: Pick<OcxTool, "namespace" | "name">,
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
 ): boolean {
-  return !tool.namespace
-    && !CURSOR_PROXY_OWNED_BARE_TOOL_NAMES.has(tool.name);
+  if (tool.namespace || CURSOR_PROXY_OWNED_BARE_TOOL_NAMES.has(tool.name)) return false;
+  if (isClaudeClientBareToolName(tool.name)) {
+    return catalog ? catalogHasBareCodexShellBridge(catalog) : false;
+  }
+  return true;
 }
 
-export function cursorToolWireName(tool: Pick<OcxTool, "namespace" | "name">): string {
-  if (isCursorBareClientToolWireAliased(tool)) {
+export function cursorToolWireName(
+  tool: Pick<OcxTool, "namespace" | "name">,
+  catalog?: readonly Pick<OcxTool, "namespace" | "name">[],
+): string {
+  if (isCursorBareClientToolWireAliased(tool, catalog)) {
     return `${CURSOR_CLIENT_TOOL_WIRE_PREFIX}${tool.name}`;
   }
   return namespacedToolName(tool.namespace, tool.name);

package/src/adapters/cursor/tool-wording.ts

@@ -0,0 +1,46 @@
+import type { OcxTool } from "../../types";
+import type { McpToolDefinition } from "./gen/agent_pb";
+import { CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
+import { OCX_RESPONSES_TOOL_PROVIDER, cursorRequestHasExecutionPath, cursorRequestHasShellAlias, cursorRequestUsesCodeMode, cursorToolWireName } from "./tool-naming";
+
+/** Cursor may expose Claude with version-first, family-first, or effort-suffixed ids. */
+export function cursorUsesPlainToolWording(modelId?: string): boolean {
+  return /^(?:cursor\/)?claude-/i.test(modelId?.trim() ?? "");
+}
+
+export const CURSOR_TOOL_CALL_CONTINUATION = "Continue the task with that tool call.";
+const CURSOR_NO_CLIENT_TOOLS = "Cursor-native filesystem, shell, and fetch tools are not available through this execution channel. No client tools are available in this request. Answer without tools using the information already provided, or report that the requested operation cannot be completed without tools.";
+
+/** Factual catalog wording; legacy model wording is owned by native-exec.ts unchanged. */
+export function cursorPlainNativeExecRedirectHint(
+  tools: readonly Pick<OcxTool, "namespace" | "name" | "freeform">[] | undefined,
+  mcpToolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[],
+): string | undefined {
+  const clientTools = tools ?? [];
+  const names = [...new Set([
+    ...clientTools.map(tool => cursorToolWireName(tool, clientTools)),
+    ...mcpToolDefs.map(def => `mcp_${def.providerIdentifier}_${def.name}`),
+  ])];
+  if (names.length === 0) return CURSOR_NO_CLIENT_TOOLS;
+  const shown = names.slice(0, 16).map(name => `\`${name}\``).join(", ");
+  const more = names.length > 16 ? ` (+${names.length - 16} more)` : "";
+  const catalog = `Available tools in this request's catalog: ${shown}${more}. `
+    + `The harness displays a \`${OCX_RESPONSES_TOOL_PROVIDER}\` entry as \`mcp_${OCX_RESPONSES_TOOL_PROVIDER}_<name>\`; that is the same tool. `
+    + "Cursor-native Read/Glob/Grep/LS/Shell/Write/Fetch are not available in this request. ";
+  if (!cursorRequestHasShellAlias(clientTools) && cursorRequestUsesCodeMode(clientTools)) {
+    return catalog + "`exec` takes a JavaScript body evaluated in a V8 isolate, not a shell command. Shell, file, search, and fetch are nested helpers called inside it as `await tools.<name>(...)`, for example `text(await tools.exec_command({cmd: \"ls\"}))`. "
+      + "`shell_command` and `exec_command` are nested helpers, not top-level tools here. Every other listed tool remains callable at the top level. "
+      + CODE_MODE_RESULT_ECHO_SENTENCE + " " + CURSOR_TOOL_CALL_CONTINUATION;
+  }
+  const operation = cursorRequestHasExecutionPath(clientTools)
+    ? "Use the listed execution tool with its advertised argument schema and the Codex client host's shell syntax; use a listed edit tool for file edits. "
+    : "Use the listed tool that fits the operation: a file, search, or fetch tool when provided, or a listed worker-agent delegation tool. ";
+  return catalog + operation + CURSOR_TOOL_CALL_CONTINUATION;
+}
+
+/** Fallback uses advertised dispatcher definitions, never assumed shell/edit tools. */
+export function cursorPlainNativeExecFallback(
+  toolDefs: readonly Pick<McpToolDefinition, "name" | "providerIdentifier">[] = [],
+): string {
+  return cursorPlainNativeExecRedirectHint([], toolDefs)!;
+}

package/src/adapters/cursor.ts

@@ -65,6 +65,7 @@ import {
   type CursorTransportFactory,
 } from "./cursor/transport";
 import { cursorLiveRosterScope } from "./cursor/catalog";
+import { cursorUsesPlainToolWording } from "./cursor/tool-wording";
 
 export const CURSOR_API_URL = "https://api2.cursor.sh";
 
@@ -313,8 +314,10 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
           const armMidstreamEcho = cursorNeedsExternalToolContinuation(activeRequest.modelId) && replaysToolResult;
           const midstreamObserver = armMidstreamEcho ? new CursorMidstreamEchoObserver() : undefined;
           const midstreamFilter = armMidstreamEcho ? new ToolEnvelopeEchoFilter() : undefined;
+          // Claude's factual redirects allow truthful routing prose; it is not a failure claim.
           const armRoutingCommentarySniffer =
             isCursorExternalWireModel(activeRequest.modelId)
+            && !cursorUsesPlainToolWording(activeRequest.modelId)
             && (
               cursorRequestUsesCodeMode(activeRequest.tools, activeRequest.toolChoice)
               || cursorRequestHasShellAlias(activeRequest.tools)

package/src/adapters/devin/live-models.ts

@@ -73,6 +73,8 @@ export const DEVIN_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "claude-fable-5-1": 1_000_000,
   // 260929 preemptive: Claude Sonnet 5.5 (1M per Anthropic) seeded before Devin's live catalog lists it.
   "claude-sonnet-5-5": 1_000_000,
+  // 261008 preemptive: Haiku 5.5 (1M per Anthropic), ahead of Devin live discovery.
+  "claude-haiku-5-5": 1_000_000,
   "claude-sonnet-5": 1_000_000,
   "glm-5-2": 200_000,
   "glm-5-3": 1_048_576,

package/src/adapters/devin.ts

@@ -524,30 +524,44 @@ export function mapOcxMessagesToDevin(
   if (system) items.push({ role: "system", content: system });
 
   let previousToolResult: ChatHistoryItem | undefined;
+  let textChunks: string[] | undefined;
+  const flushText = () => {
+    if (previousToolResult && textChunks) previousToolResult.content = textChunks.join("\n\n");
+    textChunks = undefined;
+  };
   for (const message of parsed.context.messages) {
     // Original-message adjacency matters even when an intervening message maps to nothing.
-    if (message.role !== "toolResult") previousToolResult = undefined;
+    if (message.role !== "toolResult") {
+      flushText();
+      previousToolResult = undefined;
+    }
     const mapped = mapOneMessage(message, parsed.modelId, options);
     if (!mapped) continue;
     if (mapped.role === "tool") {
       if (previousToolResult && previousToolResult.tool_call_id === mapped.tool_call_id) {
         const previous = previousToolResult;
-        previous.content = typeof previous.content === "string" && typeof mapped.content === "string"
-          ? `${previous.content}\n\n${mapped.content}`
-          : [
-              ...(typeof previous.content === "string"
-                ? [{ type: "text" as const, text: previous.content }] : previous.content),
-              { type: "text", text: "\n\n" },
-              ...(typeof mapped.content === "string"
-                ? [{ type: "text" as const, text: mapped.content }] : mapped.content),
-            ];
+        if (textChunks && typeof mapped.content === "string") {
+          textChunks.push(mapped.content);
+        } else {
+          flushText();
+          // mapOneMessage owns these wire arrays; append without recopying their prefix.
+          const parts: ContentPart[] = typeof previous.content === "string"
+            ? [{ type: "text", text: previous.content }] : previous.content;
+          parts.push({ type: "text", text: "\n\n" });
+          if (typeof mapped.content === "string") parts.push({ type: "text", text: mapped.content });
+          else for (const part of mapped.content) parts.push(part);
+          previous.content = parts;
+        }
         if (mapped.is_error) previous.is_error = true;
         continue;
       }
+      flushText();
       previousToolResult = mapped;
+      textChunks = typeof mapped.content === "string" ? [mapped.content] : undefined;
     }
     items.push(mapped);
   }
+  flushText();
   return items;
 }
 
@@ -795,7 +809,7 @@ export function createDevinAdapter(
         // An admitted HTTP turn owns globally shared capacity until this call
         // emits. Without an explicit wait allowance, preserve the typed reset
         // delay in generated diagnostic wording and return immediately.
-        const signedMessages = mapOcxMessagesToDevin(parsed);
+        const signedMessages = messages; // Reuse the history already mapped above.
         // A Claude signature is replayed because it is what carries the reasoning into this
         // turn, but Cognition streams Claude's thinking as a summary the signature does not
         // cover, and some replays are refused with invalid_argument before any output. That

package/src/adapters/kiro-retry.ts

@@ -183,12 +183,12 @@ async function fetchWithResetRecovery(
         sendClass: "transient", targetKey: destination, rebasedTarget: destinationRebased,
       });
       destinationRebased = false;
-      if (decision && (!decision.allowed || !decision.permit.use())) {
+      if (decision && !decision.allowed) {
         throw new SendBudgetExhaustedError(destination);
       }
       // Reported after admission and before dispatch, so a refused send is never counted and an
       // admitted one is counted exactly once whichever way the fetch below settles.
-      notePhysicalSend(attempt > 0);
+      const permit = decision?.allowed ? decision.permit : undefined;
       const requestUrl = request.url;
       try {
         const headers = new Headers(request.headers);
@@ -201,7 +201,12 @@ async function fetchWithResetRecovery(
           ...(recovered ? { keepalive: false } : {}),
         }, timeoutMs, ctx.abortSignal, ctx.stream, (async (input, init) => {
           try {
-            return await (executor.unpacedFetch ?? executor)(input, init);
+            const run = async (): Promise<Response> => {
+              if (permit && !permit.use()) throw new SendBudgetExhaustedError(destination);
+              notePhysicalSend(attempt > 0);
+              return (executor.unpacedFetch ?? executor)(input, init);
+            };
+            return await (permit?.execute ? permit.execute(run) : run());
           } catch (error) {
             if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
             const signal = init?.signal;
@@ -224,7 +229,7 @@ async function fetchWithResetRecovery(
           baseDelayMs: RESET_RETRY_BASE_MS,
           maxDelayMs: RESET_RETRY_MAX_MS,
         }), ctx.abortSignal);
-      }
+      } finally { permit?.release(); }
     } finally {
       releaseProviderRequestSlot(slot);
     }

package/src/adapters/openai-chat/messages.ts

@@ -142,9 +142,12 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
   };
 
   const nativeOpenAI = isNativeOpenAIChatTarget(provider);
-  // Qwen3.8-27B's pinned chat template rejects non-leading system and every developer role;
-  // a later user is rendered in place. Keep this exception specific to that template family.
-  const qwen38LeadingSystemTemplate = !nativeOpenAI && /^(?:Qwen\/)?(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?)$/i.test(parsed.modelId);
+  // Two pinned chat templates reject non-leading system and every developer role while a
+  // later user renders in place: Qwen3.8-27B and the OrcaSAQ-2-Cyber-27B GGUF family.
+  // Gateways serve them under namespaced ids (LiteLLM's openai/Qwen3.8-27B, #6674), so any
+  // number of leading path segments is accepted; the final segment names the checkpoint.
+  // Orca's GGUF marker must precede any colon quant tag; other Orca variants are unchanged.
+  const leadingSystemTemplate = !nativeOpenAI && /^(?:[^/]+\/)*(?:Qwen3\.8-27B|qwen3-8-27b(?:-(?:fp8|lora))?|OrcaSAQ-2-Cyber-27B(?=[^:/\s]*GGUF)[^:/\s]*(?::[\w-]+)?)$/i.test(parsed.modelId);
   // Which role a developer message carries, and why the unrecorded state folds, is stated once
   // in ./developer-role.ts and read from there by the native passthrough as well. Either way the
   // message keeps the slot it arrived in — only the role changes, never the position.
@@ -194,7 +197,7 @@ export function messagesToChatFormat(parsed: OcxParsedRequest, provider: OcxProv
           // message instead is rejected by some upstreams. Native OpenAI keeps its existing
           // empty-developer wire, which is a separate question from placement.
           if (!nativeOpenAI && text.length === 0) break;
-          chatMsg = { role: qwen38LeadingSystemTemplate ? "user" : developerWireRole, content: text };
+          chatMsg = { role: leadingSystemTemplate ? "user" : developerWireRole, content: text };
         } else if (typeof msg.content === "string") {
           chatMsg = { role: "user", content: msg.content };
         } else if (!hasStructured) {

package/src/adapters/physical-send.ts

@@ -36,11 +36,14 @@ export function createAdapterPhysicalSend(ctx: AdapterFetchContext = {}, fallbac
     const physicalExecutor = (async (input, init) => {
       if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
       if (init?.signal?.aborted) throw abortError(init.signal);
-      if (dispatched || (permit && !permit.use())) throw new SendBudgetExhaustedError(options.url);
-      dispatched = true;
-      ordinal += 1;
-      ctx.onPhysicalSend?.({ ordinal, ...(options.recovery ? { recovery: options.recovery } : {}) });
-      return (executor.unpacedFetch ?? executor)(input, init);
+      const run = async (): Promise<Response> => {
+        if (dispatched || (permit && !permit.use())) throw new SendBudgetExhaustedError(options.url);
+        dispatched = true;
+        ordinal += 1;
+        ctx.onPhysicalSend?.({ ordinal, ...(options.recovery ? { recovery: options.recovery } : {}) });
+        return (executor.unpacedFetch ?? executor)(input, init);
+      };
+      return permit?.execute ? permit.execute(run) : run();
     }) as typeof globalThis.fetch;
     let slot: ProviderRequestSlot | undefined;
     try {