@fusengine/harness 0.1.90 → 0.1.92

package/dist/{handle-CBaOcFZq.mjs → handle-BF1dZFjY.mjs}

@@ -3,11 +3,11 @@ import { a as harnessHome, c as resolveTtlSec } from "./dotenv-BLBkBTww.mjs";
 import { r as projectLayout } from "./layout-KWoE_Mqn.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { t as detectHarness } from "./harness-BMuLJ9lm.mjs";
-import { $ as matchPatterns, D as isVendorPath, G as isFileSizeScoped, J as GIT_BLOCKED, K as resolveSolidRefFramework, W as computeEditResultLines, b as interfaceDeclLevel, et as detectFramework, g as conventionsMode, lt as requiredArchSkill, n as FAIL_CLOSED, ot as detectModularArchitecture, rt as maskCommentsAndStrings, st as detectProjectType$1, t as evaluate } from "./evaluate-C1VSI5pb.mjs";
+import { D as isVendorPath, G as computeEditResultLines, K as isFileSizeScoped, V as shellOutputRedirects, Y as GIT_BLOCKED, b as interfaceDeclLevel, ct as detectProjectType$1, et as matchPatterns, g as conventionsMode, it as maskCommentsAndStrings, n as FAIL_CLOSED, q as resolveSolidRefFramework, st as detectModularArchitecture, t as evaluate, tt as detectFramework, ut as requiredArchSkill } from "./evaluate-CMiIqHeH.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, p as evaluateFileSize, r as fusengineCache, t as claudeHome } from "./home-state-oUGFB4ds.mjs";
 import { a as writeJsonFile, i as readJsonFile, r as hashText, t as atomicWrite } from "./json-io-DisYd2fb.mjs";
 import { r as isDocConsulted } from "./doc-helpers-CWZegVdR.mjs";
-import { D as frameworkSolidGate, F as isExcludedSwiftPath, G as evaluateApex, H as PRE_AUTH_GATES, P as isExcludedJsPath, R as capVerbosity, S as parseField, T as usesTailwindUtilities, V as POST_AUTH_GATES, W as docConsultedGate, b as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, g as buildClaudeMdContext, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, p as apexAgentSteps, r as descFromText, s as parseEntry, t as isHtmlLike, v as apexDocName, w as skillTriggerGate, y as harnessHomeSegment, z as detectCreationIntent } from "./validate-DZFtAbLP.mjs";
+import { D as frameworkSolidGate, F as isExcludedSwiftPath, G as evaluateApex, H as PRE_AUTH_GATES, P as isExcludedJsPath, R as capVerbosity, S as parseField, T as usesTailwindUtilities, V as POST_AUTH_GATES, W as docConsultedGate, b as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, g as buildClaudeMdContext, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, p as apexAgentSteps, r as descFromText, s as parseEntry, t as isHtmlLike, v as apexDocName, w as skillTriggerGate, y as harnessHomeSegment, z as detectCreationIntent } from "./validate-KjZ1X9tH.mjs";
 import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DVML3zfp.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as setStateField, t as addRoot } from "./registry-IhHk2KlT.mjs";
@@ -15,11 +15,13 @@ import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cac
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { C as apexAuthorizationGate, S as trivialCount, _ as recordBrainstormRequired, a as journalLogPath, b as recordTarget, c as appendEvent, d as signTrack, f as verifyTrack, g as recordAgent, h as emptyTrack, i as withTrack, l as withTrackLockSync, m as agentsFresh, o as readTrackSync, p as writeLastNonce, r as trackJournalEnabled, s as diffTrackEvents, t as loadTrack, u as LOCK_FAILED, v as recordDoc, x as recordTrivialEdit, y as recordRefRead } from "./store-5-ZPKb0u.mjs";
 import { i as parseApplyPatch, n as canonicalizeMcpToolName, r as canonicalizeCodexShellTool, t as isBypassPermissions } from "./permission-mode-B-SFyR0X.mjs";
-import { _ as commandToString, d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-5bC8TDAz.mjs";
-import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-D6X7b8wF.mjs";
-import { r as toHermesResponse } from "./hermes-kP6NUQlG.mjs";
+import { t as commandToString } from "./command-string-CALMTnwN.mjs";
+import { n as cursorProjectCwd, r as cursorEventContract, t as extractCursorEvent } from "./normalize-Dy8g9Ybl.mjs";
+import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-Ckv2_TgP.mjs";
+import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-G2wcSh5-.mjs";
+import { r as toHermesResponse } from "./hermes-B9-p_3IF.mjs";
 import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
-import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { mkdir, rmdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
@@ -69,9 +71,7 @@ function str(v) {
 	return typeof v === "string" ? v : void 0;
 }
 /**
-* Normalize a harness hook payload into a uniform event. Handles Cline's nested
-* `preToolUse`/`postToolUse` shape and the top-level `tool_name`/`tool_input`
-* shape used by Claude, Codex, Gemini, and Cursor.
+* Normalize a hook payload, including Cline nesting and native Cursor events.
 */
 function normalizeEvent(id, payload) {
 	if (id === "cline") {
@@ -88,6 +88,12 @@ function normalizeEvent(id, payload) {
 			command: str(params.command)
 		};
 	}
+	if (id === "cursor") return {
+		...extractCursorEvent(payload),
+		sessionId: str(payload.session_id) ?? str(payload.conversation_id) ?? "",
+		agentType: str(payload.agent_type),
+		permissionMode: str(payload.permission_mode)
+	};
 	const event = str(payload.hook_event_name) ?? "";
 	const input = payload.tool_input ?? payload;
 	const tool = canonicalizeCodexShellTool(id, canonicalizeMcpToolName(id, str(payload.tool_name) ?? ""));
@@ -97,7 +103,9 @@ function normalizeEvent(id, payload) {
 		input,
 		sessionId: str(payload.session_id) ?? str(payload.conversation_id) ?? "",
 		agentType: str(payload.agent_type) ?? str(input.subagent_type),
-		permissionMode: str(payload.permission_mode)
+		permissionMode: str(payload.permission_mode),
+		toolUseId: str(payload.tool_use_id),
+		cwd: str(payload.cwd)
 	};
 	if (tool === "apply_patch") {
 		const files = parseApplyPatch(str(input.command) ?? str(payload.command) ?? "").map((f) => ({
@@ -2136,13 +2144,114 @@ function postEditTypescript(filePath) {
 	return contextResponse("PostToolUse", `Lint issues in ${basename(filePath)}: ${issues.join(" | ")}`);
 }
 //#endregion
+//#region src/adapters/cursor/plugin-root.ts
+/**
+* Cursor plugin-root resolution — independent from the rules-plugin probing
+* in `../../runtime/lifecycle/rules-root.ts`. Ground truth (Cursor 3.18.25
+* binary + cursor.com/docs/hooks): `CURSOR_PLUGIN_ROOT` / `CLAUDE_PLUGIN_ROOT`
+* (both equal to the plugin install dir) are injected ONLY into
+* plugin-declared hook processes — never user (`~/.cursor/hooks.json`),
+* project (`.cursor/hooks.json`), or enterprise hooks. A plugin hook's cwd is
+* the plugin install dir, EXCEPT for `stop`/`subagentStop`, where it is the
+* workspace root — callers must pass the right `cwd` for the event they are
+* handling. Precedence: (1) `CURSOR_PLUGIN_ROOT` env, (2) `CLAUDE_PLUGIN_ROOT`
+* env, (3) `cwd` when it carries a Cursor plugin marker
+* (`.cursor-plugin/plugin.json`, `plugin.json` + `hooks/hooks.json`, or a
+* bare `hooks/hooks.json` — matches installed-plugin layouts under
+* `~/.cursor/plugins/cache/**` and `~/.cursor/plugins/local/<name>/`), (4)
+* `none`. Cursor refuses symlinked config paths itself; we do not share that
+* constraint, so every resolved candidate is realpath-followed instead.
+*/
+/** Validate an env candidate: non-empty, NUL-free, absolute, existing dir. */
+function validateEnvCandidate(label, value, checked) {
+	if (value === void 0 || value === "") {
+		checked.push(`${label}: unset`);
+		return null;
+	}
+	if (value.includes("\0")) {
+		checked.push(`${label}: invalid (contains NUL): "${value}"`);
+		return null;
+	}
+	if (!isAbsolute(value)) {
+		checked.push(`${label}: invalid (not absolute): "${value}"`);
+		return null;
+	}
+	try {
+		if (!statSync(value).isDirectory()) {
+			checked.push(`${label}: invalid (not a directory): "${value}"`);
+			return null;
+		}
+	} catch {
+		checked.push(`${label}: invalid (no such directory): "${value}"`);
+		return null;
+	}
+	try {
+		return realpathSync.native(value);
+	} catch {
+		checked.push(`${label}: invalid (realpath failed): "${value}"`);
+		return null;
+	}
+}
+/** True when `dir` carries a recognized Cursor plugin install marker. */
+function hasPluginMarker(dir) {
+	if (existsSync(join(dir, ".cursor-plugin", "plugin.json"))) return true;
+	if (existsSync(join(dir, "plugin.json")) && existsSync(join(dir, "hooks", "hooks.json"))) return true;
+	return existsSync(join(dir, "hooks", "hooks.json"));
+}
+/**
+* Resolve the Cursor plugin install root a plugin-declared hook runs from.
+* @param env - Environment (defaults to `process.env`).
+* @param cwd - The hook process's cwd for the current event (plugin root for
+*   most events, workspace root for `stop`/`subagentStop` — caller's choice).
+* @returns The resolved root, its source, and every rejected candidate.
+*/
+function resolveCursorPluginRoot(env, cwd) {
+	const checked = [];
+	const fromCursor = validateEnvCandidate("env:CURSOR_PLUGIN_ROOT", env.CURSOR_PLUGIN_ROOT, checked);
+	if (fromCursor) return {
+		root: fromCursor,
+		source: "env:CURSOR_PLUGIN_ROOT",
+		checked
+	};
+	const fromClaude = validateEnvCandidate("env:CLAUDE_PLUGIN_ROOT", env.CLAUDE_PLUGIN_ROOT, checked);
+	if (fromClaude) return {
+		root: fromClaude,
+		source: "env:CLAUDE_PLUGIN_ROOT",
+		checked
+	};
+	if (hasPluginMarker(cwd)) {
+		let resolved = cwd;
+		try {
+			resolved = realpathSync.native(cwd);
+		} catch {}
+		return {
+			root: resolved,
+			source: "cwd:plugin-marker",
+			checked
+		};
+	}
+	checked.push(`cwd:"${cwd}": no plugin marker found`);
+	return {
+		root: null,
+		source: "none",
+		checked
+	};
+}
+//#endregion
 //#region src/runtime/lifecycle/rules-root.ts
 /**
 * Dynamic rules-plugin root resolution. The historical `CLAUDE_PLUGIN_ROOT ??
 * cwd` chain only worked when the harness exported the plugin root — Kimi
 * injects `KIMI_PLUGIN_ROOT` instead, and a bare cwd fallback never held a
-* `rules/` dir. Resolution order (first hit wins):
-* 1. `CLAUDE_PLUGIN_ROOT` (claude-code/codex plugin-declared hooks);
+* `rules/` dir.
+*
+* `id === "cursor"` is resolved by a SEPARATE branch (`resolveCursorPluginRoot`)
+* before any of the below, because Cursor's env contract differs from the
+* other harnesses (see `../../adapters/cursor/plugin-root.ts`) — it is never
+* folded into the shared switch. For every other id, resolution order (first
+* hit wins, unchanged):
+* 1. `CLAUDE_PLUGIN_ROOT` (read for ALL non-cursor ids, historical quirk —
+*    frozen by non-regression tests, do not "fix" without an explicit ask);
 * 2. `KIMI_PLUGIN_ROOT` (kimi plugin-declared hooks);
 * 3. Per-harness install probe (claude marketplace, codex versioned cache,
 *    kimi managed plugins) — first `<plugin>/rules` dir whose plugin folder
@@ -2196,6 +2305,12 @@ function probeKimi(env, home) {
 * @returns The plugin root to read `rules/` from.
 */
 function resolveRulesRoot(id, cwd, env = process.env) {
+	if (id === "cursor") {
+		const result = resolveCursorPluginRoot(env, cwd);
+		if (result.root) return result.root;
+		process.stderr.write(`[fuse-harness] cursor: no plugin root proven (checked: ${result.checked.join("; ")}); rules root falls back to ${cwd}\n`);
+		return cwd;
+	}
 	if (env.CLAUDE_PLUGIN_ROOT) return env.CLAUDE_PLUGIN_ROOT;
 	if (env.KIMI_PLUGIN_ROOT) return env.KIMI_PLUGIN_ROOT;
 	const home = env.HOME ?? homedir();
@@ -3064,7 +3179,7 @@ function lessonsStateFileFor(root) {
 //#endregion
 //#region src/tracking/one-shot-store.ts
 /** A fresh, empty state — always spread (`{ ...EMPTY }`) so the const is never shared. */
-const EMPTY = {
+const EMPTY$1 = {
 	gates: {},
 	firstTry: 0,
 	corrected: 0,
@@ -3076,7 +3191,7 @@ const EMPTY = {
 * gates/pending older than `windowMs`. Keeps the "7d" window honest, bounds size.
 */
 function pruneState(s, now, windowMs) {
-	if (now - s.updatedAt >= windowMs) return { ...EMPTY };
+	if (now - s.updatedAt >= windowMs) return { ...EMPTY$1 };
 	const gates = {};
 	for (const [k, g] of Object.entries(s.gates)) if (now - g.lastTs < windowMs) gates[k] = g;
 	const pending = {};
@@ -3309,16 +3424,16 @@ const SIDECAR$1 = "one-shot.json";
 /** Retention window: 7 days. Aggregates and pending denies older than this are pruned. */
 const WINDOW_MS = 10080 * 60 * 1e3;
 /** Load the state, or a fresh copy when missing/corrupt. */
-function loadState(path) {
+function loadState$1(path) {
 	try {
-		if (!existsSync(path)) return { ...EMPTY };
+		if (!existsSync(path)) return { ...EMPTY$1 };
 		const d = JSON.parse(readFileSync(path, "utf8"));
 		return d && typeof d === "object" && !Array.isArray(d) ? {
-			...EMPTY,
+			...EMPTY$1,
 			...d
-		} : { ...EMPTY };
+		} : { ...EMPTY$1 };
 	} catch {
-		return { ...EMPTY };
+		return { ...EMPTY$1 };
 	}
 }
 /**
@@ -3341,7 +3456,7 @@ function recordOneShot(prompt, input, opts) {
 		});
 		if (!burstFirst(op, prompt ? `deny:${prompt.title}` : "allow", opts)) return;
 		const path = join(opts.dir, SIDECAR$1);
-		let s = pruneState(loadState(path), opts.now, WINDOW_MS);
+		let s = pruneState(loadState$1(path), opts.now, WINDOW_MS);
 		s = prompt ? applyDeny(s, prompt.title, op, opts.now) : applyAllow(s, op, opts.now, input.content != null || input.command != null);
 		atomicWrite(path, JSON.stringify(s));
 	} catch {}
@@ -3356,7 +3471,7 @@ function recordOneShot(prompt, input, opts) {
 */
 function oneShotSummary(cwd) {
 	try {
-		return formatSummary(pruneState(loadState(join(defaultStateDir(cwd), SIDECAR$1)), Date.now(), WINDOW_MS));
+		return formatSummary(pruneState(loadState$1(join(defaultStateDir(cwd), SIDECAR$1)), Date.now(), WINDOW_MS));
 	} catch {
 		return "";
 	}
@@ -3401,7 +3516,7 @@ function recordFailure(tool, opts) {
 	try {
 		if (!burstFirst(`fail:${tool}`, "failure", opts)) return;
 		const path = join(opts.dir, SIDECAR$1);
-		const next = applyFailure(pruneState(loadState(path), opts.now, WINDOW_MS), tool, opts.now);
+		const next = applyFailure(pruneState(loadState$1(path), opts.now, WINDOW_MS), tool, opts.now);
 		atomicWrite(path, JSON.stringify(next));
 	} catch {}
 }
@@ -3414,8 +3529,12 @@ function recordFailure(tool, opts) {
 * matches the failure message — reusing the PreToolUse {@link lessonFor} index and
 * its cooldown (idempotent under the ~11-process fan-out). Fail-open throughout.
 *
-* Claude-Code-only: no equivalent `PostToolUseFailure` hook exists on Codex or
-* Hermes, so this handler is never reached through those adapters.
+* Claude-Code-only in the sense that no equivalent `PostToolUseFailure` hook
+* exists on Codex or Hermes — but Cursor's own `postToolUseFailure` DOES
+* arrive here too, via `lifecycle-bridge.ts`'s `lifecycleStdout` translating
+* the wire event name and forwarding to `dispatchLifecycle`'s
+* `"PostToolUseFailure"` case (see `handle.ts`'s `cursorRawPayloadProjection`
+* for how `data.tool_name` below arrives already canonicalized on Cursor).
 * @packageDocumentation
 */
 /** The failure message across the documented `error` field and defensive fallbacks; "" when none. */
@@ -6024,7 +6143,7 @@ async function dispatchAipilot(event, payload, cwd, now, home = homedir(), id =
 		await cacheAnalyticsSave(home, now);
 		return "";
 	}
-	if (event === "PreToolUse") return docCacheGate(payload, cwd, now, home, id);
+	if (event === "PreToolUse" || id === "cursor" && event === "BeforeMCPExecution") return docCacheGate(payload, cwd, now, home, id);
 	return null;
 }
 /** PostToolUse (Write/Edit SOLID check, else TaskCreate/TaskUpdate sync) for the ai-pilot scope; `id` selects the harness target (defaults to "claude-code"). */
@@ -6646,13 +6765,571 @@ async function autoDocumentRead(filePath, now = Date.now(), id = "claude-code")
 	return systemMessage(`📖 [${docType}] ${fname} logged`);
 }
 //#endregion
+//#region src/adapters/cursor/native-schemas.ts
+const stringValue = (value) => typeof value === "string";
+const booleanValue = (value) => typeof value === "boolean";
+/** A plain `{}`-literal or `Object.create(null)` object — never a class instance or array. */
+const plainRecord = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	try {
+		const prototype = Object.getPrototypeOf(value);
+		return prototype === Object.prototype || prototype === null;
+	} catch {
+		return false;
+	}
+};
+function jsonChildren(value) {
+	const keys = Reflect.ownKeys(value);
+	const descriptors = Object.getOwnPropertyDescriptors(value);
+	if (Array.isArray(value)) {
+		if (Object.getPrototypeOf(value) !== Array.prototype) return null;
+		const length = descriptors.length;
+		if (!length || !("value" in length) || !Number.isSafeInteger(length.value) || length.value < 0) return null;
+		if (keys.length !== length.value + 1 || keys.some((key) => typeof key === "symbol")) return null;
+		const children = [];
+		for (let index = 0; index < length.value; index += 1) {
+			const descriptor = descriptors[String(index)];
+			if (!descriptor?.enumerable || !("value" in descriptor)) return null;
+			children.push(descriptor.value);
+		}
+		return children;
+	}
+	if (!plainRecord(value) || keys.some((key) => typeof key === "symbol")) return null;
+	const children = [];
+	for (const key of keys) {
+		const descriptor = descriptors[key];
+		if (!descriptor?.enumerable || !("value" in descriptor)) return null;
+		children.push(descriptor.value);
+	}
+	return children;
+}
+function jsonValue(root) {
+	const active = /* @__PURE__ */ new WeakSet();
+	const stack = [{ value: root }];
+	while (stack.length > 0) {
+		const frame = stack.pop();
+		if (frame.leave) {
+			active.delete(frame.value);
+			continue;
+		}
+		const { value } = frame;
+		if (value === null || typeof value === "string" || typeof value === "boolean") continue;
+		if (typeof value === "number") {
+			if (!Number.isFinite(value)) return false;
+			continue;
+		}
+		if (typeof value !== "object" || active.has(value)) return false;
+		let children;
+		try {
+			children = jsonChildren(value);
+		} catch {
+			return false;
+		}
+		if (!children) return false;
+		active.add(value);
+		stack.push({
+			value,
+			leave: true
+		});
+		for (let index = children.length - 1; index >= 0; index -= 1) stack.push({ value: children[index] });
+	}
+	return true;
+}
+/** A JSON-safe plain object (no cycles, no non-finite numbers, no exotic prototypes). */
+const recordValue = (value) => plainRecord(value) && jsonValue(value);
+const stringRecord = (value) => {
+	if (!recordValue(value)) return false;
+	try {
+		return Object.values(Object.getOwnPropertyDescriptors(value)).every((descriptor) => "value" in descriptor && typeof descriptor.value === "string");
+	} catch {
+		return false;
+	}
+};
+const stringArray = (value) => Array.isArray(value) && value.every(stringValue);
+const permission = (...values) => (value) => typeof value === "string" && values.includes(value);
+const EMPTY = { fields: {} };
+const FOLLOWUP = { fields: { followup_message: stringValue } };
+const PERMISSION_ASK = {
+	fields: {
+		permission: permission("allow", "deny", "ask"),
+		user_message: stringValue,
+		agent_message: stringValue
+	},
+	required: ["permission"]
+};
+const PRE_TOOL_USE = {
+	fields: {
+		permission: permission("allow", "deny", "ask"),
+		user_message: stringValue,
+		agent_message: stringValue,
+		updated_input: recordValue,
+		additional_context: stringValue
+	},
+	required: ["permission"]
+};
+/**
+* Exact native stdout field set Cursor 3.18.25 reads per hook event.
+* Nothing beyond this list is invented: any additional key on a candidate
+* value fails {@link isNativeCursorResponse} in native-response.ts.
+*/
+const NATIVE_SCHEMAS = {
+	sessionStart: { fields: {
+		env: stringRecord,
+		additional_context: stringValue,
+		continue: booleanValue,
+		user_message: stringValue
+	} },
+	sessionEnd: EMPTY,
+	beforeSubmitPrompt: {
+		fields: {
+			continue: booleanValue,
+			user_message: stringValue,
+			additional_context: stringValue
+		},
+		required: ["continue"]
+	},
+	preCompact: { fields: { user_message: stringValue } },
+	subagentStart: {
+		fields: {
+			permission: permission("allow", "deny"),
+			user_message: stringValue
+		},
+		required: ["permission"]
+	},
+	subagentStop: FOLLOWUP,
+	preToolUse: PRE_TOOL_USE,
+	postToolUse: { fields: {
+		updated_mcp_tool_output: recordValue,
+		additional_context: stringValue
+	} },
+	postToolUseFailure: { fields: { additional_context: stringValue } },
+	beforeShellExecution: PERMISSION_ASK,
+	afterShellExecution: EMPTY,
+	beforeMCPExecution: PERMISSION_ASK,
+	afterMCPExecution: EMPTY,
+	beforeReadFile: {
+		fields: {
+			permission: permission("allow", "deny"),
+			user_message: stringValue
+		},
+		required: ["permission"]
+	},
+	afterFileEdit: EMPTY,
+	beforeTabFileRead: {
+		fields: { permission: permission("allow", "deny") },
+		required: ["permission"]
+	},
+	afterTabFileEdit: EMPTY,
+	afterAgentResponse: EMPTY,
+	afterAgentThought: EMPTY,
+	stop: FOLLOWUP,
+	workspaceOpen: { fields: { pluginPaths: stringArray } }
+};
+//#endregion
+//#region src/adapters/cursor/native-response.ts
+/**
+* Check that every enumerable own key of `value` is a documented field for
+* `eventName` and passes its validator, and that every required field is
+* present. Rejects prototype-polluted or exotic-shaped candidates via
+* {@link recordValue}.
+* @param value - Parsed JSON candidate.
+* @param eventName - The Cursor hook event the candidate would answer.
+*/
+function isNativeCursorResponse(value, eventName) {
+	try {
+		if (!recordValue(value)) return false;
+		const schema = NATIVE_SCHEMAS[eventName];
+		if (!schema) return false;
+		const descriptors = Object.getOwnPropertyDescriptors(value);
+		if (schema.required?.some((field) => !Object.hasOwn(descriptors, field))) return false;
+		return Reflect.ownKeys(descriptors).every((field) => {
+			if (typeof field !== "string") return false;
+			const descriptor = descriptors[field];
+			if (!Object.hasOwn(schema.fields, field)) return false;
+			const validate = schema.fields[field];
+			return descriptor?.enumerable === true && "value" in descriptor && validate !== void 0 && validate(descriptor.value);
+		});
+	} catch {
+		return false;
+	}
+}
+/** Preserve raw stdout only when JSON.parse proves a documented native Cursor response. */
+function parseNativeCursorStdout(stdout, eventName) {
+	if (typeof stdout !== "string") return null;
+	try {
+		return isNativeCursorResponse(JSON.parse(stdout), eventName) ? stdout : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/adapters/cursor/context-limit.ts
+/**
+* @module context-limit
+* Cursor 3.18.25's `hooks-carriers` drops an `additional_context` carrier
+* once `o.length>1e4` — but `o` is the MERGED text of every hook's
+* `additional_context` for that event (concatenated with `"\n\n---\n\n"`
+* before the 10,000-char check), not this harness's response in isolation.
+* Capping our own contribution at {@link ADDITIONAL_CONTEXT_LIMIT} is
+* therefore the LAST-RESORT guard, not the real protection: on its own it
+* only proves OUR piece stays under 10,000, while the total across every
+* hook plugin configured on the same event can still exceed it and get
+* dropped wholesale — measured at ~8,400 chars on `sessionStart` from core
+* plugins alone, close enough to the ceiling that one more plugin tips it
+* over. The actual protection is the cross-process shared budget registry
+* in `./context-budget.ts` (Cursor id only), which reserves a slice of the
+* 10,000 ceiling per (session, event, generation) key BEFORE calling
+* {@link truncateAdditionalContext} here with the reserved amount instead of
+* the flat {@link ADDITIONAL_CONTEXT_LIMIT} — this module stays a pure,
+* budget-agnostic primitive so it keeps working unbudgeted (its historical,
+* still-correct behavior) wherever no budget context is available. The
+* limit unit is UTF-16 code units (`String.prototype.length`), matching
+* `value.length` here exactly. Only 5 events carry `additional_context`
+* through this carrier — sessionStart, beforeSubmitPrompt, preToolUse,
+* postToolUse, postToolUseFailure — subagentStart/subagentStop use a
+* different, unlimited channel. "Drops silently" also only holds when no
+* `failClosed: true` hook is declared on that step/tool: with one declared,
+* an oversized carrier REJECTS the tool call instead of being dropped quiet.
+*/
+/** Cursor's hard `additional_context` character ceiling. */
+const ADDITIONAL_CONTEXT_LIMIT = 1e4;
+/** Suffix appended by {@link truncateAdditionalContext} once a value is cut. */
+const TRUNCATION_MARKER = "\n[fuse-harness] additional_context truncated to Cursor's 10000-char limit";
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Truncate a string to end with {@link TRUNCATION_MARKER} once its length
+* exceeds `limit`. Leaves shorter values untouched. Idempotent under a
+* SHRINKING `limit` across repeated calls (e.g. an unbudgeted flat-cap pass
+* followed by a budgeted re-cap of the same stdout — see `./respond.ts`'s
+* `toCursorLifecycleResponse` doc): when `value` already ends with
+* {@link TRUNCATION_MARKER}, that marker is stripped BEFORE re-slicing so the
+* result carries exactly one marker instead of risking a duplicated/cut one.
+* @param value - Candidate `additional_context` body.
+* @param limit - Effective ceiling for this call (defaults to the flat
+* {@link ADDITIONAL_CONTEXT_LIMIT}; a shared-budget caller passes a smaller,
+* per-reservation value instead).
+*/
+function truncateAdditionalContext(value, limit = ADDITIONAL_CONTEXT_LIMIT) {
+	const alreadyMarked = value.endsWith(TRUNCATION_MARKER);
+	if (!alreadyMarked && value.length <= limit) return value;
+	if (limit <= 73) return TRUNCATION_MARKER.slice(0, Math.max(0, limit));
+	return (alreadyMarked ? value.slice(0, value.length - 73) : value).slice(0, limit - 73) + TRUNCATION_MARKER;
+}
+/**
+* Length of a Cursor stdout JSON's `additional_context` string field, or 0
+* when the stdout is not JSON, has no such field, or that field isn't a
+* string.
+* @param stdout - A native Cursor JSON stdout candidate.
+*/
+function additionalContextLength(stdout) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return 0;
+	}
+	return isPlainObject(parsed) && typeof parsed.additional_context === "string" ? parsed.additional_context.length : 0;
+}
+/**
+* Re-serialize a Cursor stdout string with its `additional_context` field
+* dropped entirely — used once the shared budget has no room left even for
+* a truncated marker. Returns the input byte-for-byte unchanged when it is
+* not JSON or has no string `additional_context` field.
+* @param stdout - A native Cursor JSON stdout candidate.
+*/
+function omitAdditionalContext(stdout) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return stdout;
+	}
+	if (!isPlainObject(parsed) || typeof parsed.additional_context !== "string") return stdout;
+	const { additional_context: _omitted, ...rest } = parsed;
+	return JSON.stringify(rest);
+}
+/**
+* Re-serialize a Cursor stdout string with its `additional_context` field
+* capped at `limit` characters. Returns the input byte-for-byte unchanged
+* when it is not JSON, has no string `additional_context` field, or that
+* field is already within the limit — so callers can wrap every return path
+* unconditionally.
+* @param stdout - A native Cursor JSON stdout candidate.
+* @param limit - Effective ceiling for this call (see {@link truncateAdditionalContext}).
+*/
+function capAdditionalContext(stdout, limit = ADDITIONAL_CONTEXT_LIMIT) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return stdout;
+	}
+	if (!isPlainObject(parsed) || typeof parsed.additional_context !== "string") return stdout;
+	const truncated = truncateAdditionalContext(parsed.additional_context, limit);
+	if (truncated === parsed.additional_context) return stdout;
+	return JSON.stringify({
+		...parsed,
+		additional_context: truncated
+	});
+}
+//#endregion
+//#region src/adapters/cursor/context-budget.ts
+/**
+* @module context-budget
+* Cursor-only shared `additional_context` budget registry. Cursor 3.18.25
+* runs every hook plugin configured on an event in its OWN process, then
+* merges their `additional_context` outputs with a 9-char `"\n\n---\n\n"`
+* separator and drops the WHOLE merge past 10,000 UTF-16 units — so no
+* single process can know the total by itself. This module gives every
+* plugin's process a shared, best-effort view of that total via a small
+* JSON registry file under the project's state dir (see `../../runtime/paths.ts`),
+* keyed by `${sessionId}|${event}|${generationId ?? ""}|${toolUseId ?? ""}`
+* (one key per merge group — Cursor merges preToolUse/postToolUse/
+* postToolUseFailure PER TOOL CALL, so `toolUseId` joins the key on those
+* three events), with entries older than 10s ignored (concurrent hooks on one
+* event fire within the same second). Best-effort, fail-open throughout: any
+* I/O or JSON error degrades to "no shared budget", i.e. the flat
+* per-response cap in `./context-limit.ts` alone — never a thrown error, and
+* never a Cursor-side regression.
+*/
+const REGISTRY_FILE = "cursor-context-budget.json";
+/** Matches Cursor 3.18.25's observed `"\n\n---\n\n"` merge separator length. */
+const SEPARATOR_LENGTH = 9;
+const ENTRY_WINDOW_MS = 1e4;
+/** Below this, a truncated value would carry more marker than budget — omit the field instead. */
+const OMIT_THRESHOLD = 173;
+function isRegistry(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function registryPath(stateDir) {
+	return join(stateDir, REGISTRY_FILE);
+}
+function budgetKey(ctx) {
+	return `${ctx.sessionId}|${ctx.event}|${ctx.generationId ?? ""}|${ctx.toolUseId ?? ""}`;
+}
+function loadRegistry(path) {
+	try {
+		if (!existsSync(path)) return {};
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		return isRegistry(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+function freshEntries(entries, now) {
+	return (entries ?? []).filter((entry) => now - entry.at <= ENTRY_WINDOW_MS);
+}
+/** Sum of a key's fresh entry lengths plus the separators already joining them. */
+function consumed(entries) {
+	return entries.reduce((total, entry) => total + entry.length, 0) + SEPARATOR_LENGTH * Math.max(0, entries.length - 1);
+}
+/**
+* Reserve room in the shared budget for one hook's `additional_context`
+* contribution to one (session, event, generation) merge group. `wanted` is
+* accepted for a symmetric call shape with {@link recordAdditionalContext}
+* but does not shrink `allowed` itself — the ceiling only depends on what
+* OTHER entries already hold; a smaller `wanted` simply means the caller
+* won't need all of it. Best-effort, fail-open: any I/O/JSON error returns
+* the full flat ceiling, as if no other plugin had run.
+* @param input - Registry location, reservation key, and the wanted length.
+*/
+function reserveAdditionalContext(input) {
+	try {
+		const now = input.now ?? Date.now();
+		const fresh = freshEntries(loadRegistry(registryPath(input.stateDir))[budgetKey(input)], now);
+		const separator = fresh.length > 0 ? SEPARATOR_LENGTH : 0;
+		return { allowed: Math.max(0, ADDITIONAL_CONTEXT_LIMIT - consumed(fresh) - separator) };
+	} catch {
+		return { allowed: ADDITIONAL_CONTEXT_LIMIT };
+	}
+}
+/**
+* Record the length actually emitted for one reservation, best-effort.
+* Prunes every key's stale entries while it holds the write so the registry
+* file stays bounded. Silently no-ops on any I/O error (fail-open).
+* @param input - Registry location, reservation key, and the emitted length.
+*/
+function recordAdditionalContext(input) {
+	try {
+		const now = input.now ?? Date.now();
+		const path = registryPath(input.stateDir);
+		const registry = loadRegistry(path);
+		const pruned = {};
+		for (const [key, entries] of Object.entries(registry)) {
+			const fresh = freshEntries(entries, now);
+			if (fresh.length > 0) pruned[key] = fresh;
+		}
+		const key = budgetKey(input);
+		pruned[key] = [...pruned[key] ?? [], {
+			at: now,
+			length: input.emitted
+		}];
+		atomicWrite(path, JSON.stringify(pruned));
+	} catch {}
+}
+/**
+* Cap a Cursor stdout JSON's `additional_context` against the shared budget
+* instead of the flat per-response ceiling alone. Falls back to the plain
+* cap (`./context-limit.ts`), unbudgeted, when `budget` is `undefined` or
+* the stdout carries no `additional_context` at all.
+* @param stdout - A native Cursor JSON stdout candidate.
+* @param budget - Shared budget context, or `undefined` to skip it.
+*/
+function capAdditionalContextWithBudget(stdout, budget) {
+	if (!budget) return capAdditionalContext(stdout);
+	const wanted = additionalContextLength(stdout);
+	if (wanted === 0) return stdout;
+	const { allowed } = reserveAdditionalContext({
+		...budget,
+		wanted
+	});
+	if (allowed < OMIT_THRESHOLD) {
+		process.stderr.write(`[fuse-harness] cursor: additional_context budget exhausted for ${budget.event} (allowed=${allowed})\n`);
+		return omitAdditionalContext(stdout);
+	}
+	const capped = capAdditionalContext(stdout, Math.min(ADDITIONAL_CONTEXT_LIMIT, allowed));
+	recordAdditionalContext({
+		...budget,
+		emitted: additionalContextLength(capped)
+	});
+	return capped;
+}
+//#endregion
+//#region src/adapters/cursor/respond.ts
+const AGENT_MESSAGE_EVENTS = /* @__PURE__ */ new Set([
+	"preToolUse",
+	"beforeShellExecution",
+	"beforeMCPExecution"
+]);
+const USER_MESSAGE_EVENTS = /* @__PURE__ */ new Set([
+	"preToolUse",
+	"beforeShellExecution",
+	"beforeMCPExecution",
+	"beforeReadFile",
+	"subagentStart"
+]);
+function permissionMessages(eventName, userMessage, agentMessage) {
+	return {
+		...userMessage && USER_MESSAGE_EVENTS.has(eventName) ? { user_message: userMessage } : {},
+		...agentMessage && AGENT_MESSAGE_EVENTS.has(eventName) ? { agent_message: agentMessage } : {}
+	};
+}
+function joinMessages(...values) {
+	return values.filter((value) => typeof value === "string" && value.length > 0).join("\n");
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Render a portable policy prompt using the native Cursor event contract.
+* Switches exhaustively on {@link CursorResponseKind} — the `never` default
+* fails to compile if a new kind is ever added without a matching case.
+* `contract.known === false` is not tested separately: the single
+* `UNKNOWN_EVENT` fallback in events.ts always pairs `known: false` with
+* `response: "neutral"`, so both collapse to the same `"{}"` branch.
+*/
+function toCursorResponse(prompt, eventName) {
+	const contract = cursorEventContract(eventName);
+	const message = formatPrompt(prompt);
+	switch (contract.response) {
+		case "neutral":
+		case "plugin-paths": return "{}";
+		case "post-context":
+		case "session-context": return capAdditionalContext(JSON.stringify({ additional_context: message }));
+		case "followup": return JSON.stringify({ followup_message: message });
+		case "compact-notice": return JSON.stringify({ user_message: prompt.userMessage ?? message });
+		case "submit-control": return JSON.stringify({
+			continue: prompt.kind !== "block",
+			user_message: prompt.userMessage ?? message
+		});
+		case "permission": {
+			if (prompt.kind === "inform") return JSON.stringify({
+				permission: "allow",
+				...permissionMessages(eventName, prompt.userMessage, prompt.reason ? message : void 0)
+			});
+			const userMessage = prompt.kind === "ask" ? `[downgraded from ask — Cursor does not enforce approval for this event]\n${message}` : message;
+			return JSON.stringify({
+				permission: "deny",
+				...permissionMessages(eventName, userMessage, userMessage)
+			});
+		}
+		default: return contract.response;
+	}
+}
+/**
+* Convert a shared lifecycle handler's output to the native Cursor envelope.
+* The `neutral` and empty-`text` short circuits run before the switch (they
+* apply identically across several {@link CursorResponseKind} values), so
+* only the remaining 7 kinds need a case — `never` below still catches a
+* future kind added without updating this function. This is the single
+* point every Cursor stdout passes through exactly once (see `handle.ts`'s
+* `handleHook`), so `budget` — when supplied — is reserved from and
+* recorded into here, never at the inner `toCursorResponse` pre-cap (that
+* one's output is re-capped here again on the native-passthrough branch
+* below, so budgeting it too would double-count the same contribution).
+* @param stdout - The shared handler's raw stdout for this hook invocation.
+* @param eventName - Cursor's raw `hook_event_name`.
+* @param budget - Shared `additional_context` budget context (see
+* {@link CursorBudgetContext}); `undefined` falls back to the flat
+* per-response 10,000-char cap, unbudgeted.
+*/
+function toCursorLifecycleResponse(stdout, eventName, budget) {
+	const contract = cursorEventContract(eventName);
+	const native = parseNativeCursorStdout(stdout, eventName);
+	if (native !== null) return capAdditionalContextWithBudget(native, budget);
+	let text = stdout;
+	let decision;
+	let userMessage = "";
+	let agentMessage = "";
+	let decisionMessage = "";
+	let structured = false;
+	try {
+		const parsed = JSON.parse(stdout);
+		const subagentAsk = eventName === "subagentStart" && isRecord(parsed) && Object.hasOwn(parsed, "permission") && parsed.permission === "ask";
+		const shared = isRecord(parsed) ? parsed : {};
+		structured = true;
+		decision = shared.hookSpecificOutput?.permissionDecision ?? (subagentAsk ? "ask" : void 0);
+		userMessage = shared.systemMessage ?? (subagentAsk && Object.hasOwn(shared, "user_message") && typeof shared.user_message === "string" ? shared.user_message : "");
+		decisionMessage = joinMessages(shared.hookSpecificOutput?.permissionDecisionReason, shared.reason);
+		agentMessage = joinMessages(shared.hookSpecificOutput?.additionalContext, decisionMessage);
+		text = joinMessages(agentMessage, userMessage, shared.followup_message);
+	} catch {
+		text = stdout;
+	}
+	if (contract.response === "neutral") return "{}";
+	if (!text) return contract.response === "permission" ? "{\"permission\":\"allow\"}" : "{}";
+	switch (contract.response) {
+		case "session-context":
+		case "post-context": return capAdditionalContextWithBudget(JSON.stringify({ additional_context: text }), budget);
+		case "permission": {
+			const permission = decision === "deny" || decision === "ask" ? "deny" : "allow";
+			const denied = permission === "deny";
+			if (eventName === "subagentStart" && !denied) return "{\"permission\":\"allow\"}";
+			return JSON.stringify({
+				permission,
+				...permissionMessages(eventName, userMessage || (denied ? decisionMessage || agentMessage : ""), agentMessage || (denied ? decisionMessage || userMessage : structured ? "" : text))
+			});
+		}
+		case "followup": return JSON.stringify({ followup_message: text });
+		case "compact-notice": return JSON.stringify({ user_message: text });
+		case "submit-control": return JSON.stringify({
+			continue: true,
+			user_message: text
+		});
+		case "plugin-paths": return "{}";
+		default: return contract.response;
+	}
+}
+//#endregion
 //#region src/runtime/lifecycle-bridge.ts
 /** Raw event name from a payload (Cline lacks one; lifecycle is Claude-only). */
 function rawEvent(payload) {
 	return typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
 }
 /** Extract the `additionalContext` body from a `contextResponse(...)` stdout string ("" when empty/unparseable). */
-function additionalContextOf(stdout) {
+function additionalContextOf$1(stdout) {
 	if (!stdout) return "";
 	try {
 		return JSON.parse(stdout).hookSpecificOutput?.additionalContext ?? "";
@@ -6673,14 +7350,30 @@ function additionalContextOf(stdout) {
 * @returns The native stdout, or `null` when unhandled.
 */
 function lifecycleStdout(payload, cwd, scope, now, id = "claude-code") {
-	return dispatchLifecycle({
-		event: rawEvent(payload),
+	const wireEvent = rawEvent(payload);
+	if (id !== "cursor") return dispatchLifecycle({
+		event: wireEvent,
 		payload,
 		cwd,
 		scope,
 		now,
 		id
 	});
+	const lifecycleEvent = cursorEventContract(wireEvent).lifecycle;
+	if (lifecycleEvent === null) return null;
+	const sessionId = typeof payload.session_id === "string" ? payload.session_id : payload.conversation_id;
+	const stdout = dispatchLifecycle({
+		event: lifecycleEvent,
+		payload: {
+			...payload,
+			session_id: sessionId
+		},
+		cwd,
+		scope,
+		now,
+		id
+	});
+	return stdout === null ? null : toCursorLifecycleResponse(stdout, wireEvent);
 }
 /**
 * Post-edit additions for core-scope PostToolUse: auto-document a Read of a
@@ -6702,7 +7395,7 @@ async function postEditContext(scope, event, now, id = "claude-code") {
 	const sniper = trackSessionChanges(event.sessionId, event.filePath, void 0, now);
 	const lint = postEditTypescript(event.filePath);
 	if (!sniper || !lint) return sniper || lint;
-	return contextResponse("PostToolUse", `${additionalContextOf(sniper)}\n\n${additionalContextOf(lint)}`);
+	return contextResponse("PostToolUse", `${additionalContextOf$1(sniper)}\n\n${additionalContextOf$1(lint)}`);
 }
 //#endregion
 //#region src/policy/trivial-edits.ts
@@ -7694,11 +8387,37 @@ const TRIVIAL_BUDGET = 4;
 * {@link withDenyLoop} rewrite an identical retried deny (decision unchanged).
 */
 async function gate(input) {
-	const prompt = await runGates(input);
+	return finalizeGate(input, await runGates(input), input.command);
+}
+/**
+* Gate independent Cursor command candidates without merging their shell syntax.
+* Stateful outcome bookkeeping runs once, against the command that decided the
+* aggregate result. A single distinct candidate follows {@link gate} verbatim.
+*/
+async function gateCommandCandidates(input, candidates) {
+	const distinct = [...new Set(candidates)];
+	if (distinct.length <= 1) return gate(input);
+	let decisive;
+	for (const command of distinct) {
+		const prompt = await runGates({
+			...input,
+			command
+		});
+		if (!prompt) continue;
+		if (!decisive || promptRank(prompt) > promptRank(decisive.prompt)) decisive = {
+			prompt,
+			command
+		};
+		if (prompt.kind === "block") break;
+	}
+	return finalizeGate(input, decisive?.prompt ?? null, decisive?.command ?? input.command);
+}
+/** Persist one final gate outcome and apply deny-loop enrichment exactly once. */
+function finalizeGate(input, prompt, command) {
 	const op = {
 		filePath: input.filePath,
 		content: input.content,
-		command: input.command
+		command
 	};
 	const dir = dirname(input.trackFile);
 	recordOneShot(prompt, op, {
@@ -7713,6 +8432,10 @@ async function gate(input) {
 		sessionId: input.sessionId
 	});
 }
+/** Higher numeric values dominate while equal values preserve wire order. */
+function promptRank(prompt) {
+	return prompt.kind === "block" ? 3 : prompt.kind === "ask" ? 2 : 1;
+}
 /** Stateless guards, then the trivial fast path, then the stateful APEX gates. */
 async function runGates(input) {
 	const precommit = preCommitGate(input.tool, input.command, input.cwd);
@@ -7900,8 +8623,8 @@ async function recordActivity(file, activity) {
 * - gemini-cli/cline: their real hook schemas have no interactive "ask"
 *   state (deny is the only blocking outcome), so `ask` and `inform` already
 *   both resolve to non-blocking context injection — unchanged.
-* - cursor: `ask` keeps its current best-effort `permission:"ask"` shape;
-*   only `inform` is fixed to a non-blocking `permission:"allow"` note.
+* - cursor: `ask` degrades to a native `permission:"deny"` because Cursor does
+*   not reliably apply `ask` on `preToolUse`; `inform` stays non-blocking.
 * - hermes: delegated to the adapter's `toHermesResponse` — `block` ->
 *   `{decision:"block",reason}`; `ask`/`inform` degrade to non-blocking
 *   `{context}` (Hermes has no interactive "ask" state).
@@ -7955,25 +8678,7 @@ function respond(id, prompt, event = "PreToolUse") {
 				systemMessage: userMessage
 			});
 			return JSON.stringify({ hookSpecificOutput: { additionalContext: message } });
-		case "cursor":
-			if (kind === "inform") {
-				if (userMessage) return JSON.stringify({
-					permission: "allow",
-					user_message: userMessage,
-					...reason ? { agent_message: message } : {}
-				});
-				return JSON.stringify({
-					permission: "allow",
-					user_message: message,
-					agent_message: message
-				});
-			}
-			return JSON.stringify({
-				permission: kind === "block" ? "deny" : "ask",
-				continue: false,
-				user_message: message,
-				agent_message: message
-			});
+		case "cursor": return toCursorResponse(prompt, event === "PreToolUse" ? "preToolUse" : event);
 		case "hermes": return toHermesResponse(prompt);
 		case "kimi": return toKimiResponse(prompt);
 		case "cline":
@@ -8658,8 +9363,8 @@ function segments(command) {
 }
 /** Strip a redirection (`>`, `>>`, `<`, `2>`, `&>`, …) and everything after — its target is WRITTEN, not read. */
 function beforeRedirect(segment) {
-	const m = segment.match(/\s(?:\d*>{1,2}|<|&>)\s*\S/);
-	return m ? segment.slice(0, m.index) : segment;
+	const first = shellOutputRedirects(segment)[0];
+	return first ? segment.slice(0, first.start) : segment;
 }
 /** Naive shell tokenizer: whitespace-split, stripping one matching layer of quotes per token. */
 function tokenize(segment) {
@@ -9155,7 +9860,7 @@ async function allowOutcome(id, event, payload, mcpDir, cwd, evidence, corpusRoo
 			stdout: respond(id, userMessage ? {
 				...lesson,
 				userMessage
-			} : lesson),
+			} : lesson, event.eventName ?? "PreToolUse"),
 			exit: 0
 		};
 	}
@@ -9170,12 +9875,12 @@ async function allowOutcome(id, event, payload, mcpDir, cwd, evidence, corpusRoo
 				title: "APEX freshness",
 				reason: "",
 				userMessage
-			}),
+			}, event.eventName ?? "PreToolUse"),
 			exit: 0
 		};
 	}
 	return {
-		stdout: notice ? respond(id, notice) : "",
+		stdout: notice ? respond(id, notice, event.eventName ?? "PreToolUse") : "",
 		exit: 0
 	};
 }
@@ -9316,7 +10021,7 @@ function getPendingDeny(sessionIdRaw, home = homedir()) {
 //#endregion
 //#region src/runtime/confirm/confirm-state.ts
 /** Confirmation freshness window (G2) — 5 minutes, matches the validated prototype. */
-const TTL_MS = 300 * 1e3;
+const TTL_MS$1 = 300 * 1e3;
 /**
 * Pose a confirmation token for this session's pending action. No-op while
 * {@link isSubagentActive} (G0, confirm-subagent.ts) — the sole gate that
@@ -9356,7 +10061,7 @@ function consumeConfirmToken(sessionIdRaw, hash, now, home = homedir()) {
 	if (!sid) return false;
 	const tok = loadSessionState(sid, home).confirmToken;
 	if (!tok || tok.hash !== hash) return false;
-	if (now - tok.ts > TTL_MS) {
+	if (now - tok.ts > TTL_MS$1) {
 		dropConfirmToken(sid, home);
 		return false;
 	}
@@ -9364,6 +10069,141 @@ function consumeConfirmToken(sessionIdRaw, hash, now, home = homedir()) {
 	return true;
 }
 //#endregion
+//#region src/runtime/confirm/codex-confirm.ts
+const TTL_MS = 300 * 1e3;
+const STATE_VERSION = 1;
+function statePath(sid, home) {
+	return join(sessionsDir(home), `codex-confirm-${sid}.json`);
+}
+function lockDir(sid, home) {
+	return join(sessionsDir(home), ".confirm-locks", sid);
+}
+function loadState(sid, home) {
+	const path = statePath(sid, home);
+	if (!existsSync(path)) return {};
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+function saveState(sid, state, home) {
+	mkdirSync(sessionsDir(home), {
+		recursive: true,
+		mode: 448
+	});
+	atomicWrite(statePath(sid, home), JSON.stringify(state, null, 2));
+}
+/** Canonical identity of one Codex shell action and its display token. */
+function codexAction(tool, cwd, command, now) {
+	const canonicalCommand = commandToString(command);
+	if (!canonicalCommand) return null;
+	const identity = JSON.stringify({
+		version: STATE_VERSION,
+		harness: "codex",
+		tool,
+		cwd: resolve(cwd),
+		command: canonicalCommand
+	});
+	return {
+		hash: hashForAction(identity),
+		code: displayCodeForAction(identity),
+		command: canonicalCommand,
+		ts: now
+	};
+}
+/** Atomically authorize or reject a Codex action, recording the current denial when needed. */
+function authorizeCodexAction(sessionIdRaw, action, toolUseId, now, home = homedir()) {
+	const sid = sanitizeSessionId(sessionIdRaw);
+	if (!sid) return {
+		allow: false,
+		reason: "state-io"
+	};
+	try {
+		const result = withTrackLockSync(lockDir(sid, home), () => {
+			const state = loadState(sid, home);
+			const token = state.codexConfirmToken;
+			const receipt = state.codexConfirmReceipt;
+			const receiptExpired = receipt !== void 0 && now - receipt.ts > TTL_MS;
+			if (!receiptExpired && receipt?.hash === action.hash && receipt.toolUseId === toolUseId && toolUseId) return { allow: true };
+			let reason = "no-token";
+			if (token) if (token.hash !== action.hash) reason = "mismatch";
+			else if (now - token.ts > TTL_MS) reason = "expired";
+			else if (!toolUseId) reason = "missing-tool-use-id";
+			else {
+				const { codexConfirmToken: _token, codexConfirmPending: _pending, ...rest } = state;
+				saveState(sid, {
+					...rest,
+					codexConfirmReceipt: {
+						...action,
+						toolUseId
+					}
+				}, home);
+				return { allow: true };
+			}
+			else if (receipt?.hash === action.hash) reason = receiptExpired ? "expired" : "already-consumed";
+			if (reason === "missing-tool-use-id") return {
+				allow: false,
+				reason
+			};
+			const pending = state.codexConfirmPending;
+			const stablePending = pending?.hash === action.hash ? pending : action;
+			const { codexConfirmToken: _token, codexConfirmReceipt: _receipt, ...withoutReceipt } = state;
+			const rest = receiptExpired ? withoutReceipt : {
+				...withoutReceipt,
+				codexConfirmReceipt: receipt
+			};
+			saveState(sid, {
+				...rest,
+				codexConfirmPending: stablePending
+			}, home);
+			return {
+				allow: false,
+				reason
+			};
+		});
+		return result === LOCK_FAILED ? {
+			allow: false,
+			reason: "state-io"
+		} : result;
+	} catch {
+		return {
+			allow: false,
+			reason: "state-io"
+		};
+	}
+}
+/**
+* Atomically arm the last Codex denial, consuming its pending record exactly once.
+* A classified root prompt may bypass G0; classified subagent/unknown prompts fail closed.
+*/
+function submitCodexConfirmation(sessionIdRaw, text, now, home = homedir(), origin) {
+	const sid = sanitizeSessionId(sessionIdRaw);
+	if (!sid) return;
+	const refusal = /\b(non|no|stop|annule|cancel|abort|nope|laisse tomber|pas maintenant)\b/i.test(text);
+	const typedCode = text.trim().match(/^confirm[ _-]*([0-9a-f]{4})$/i)?.[1];
+	try {
+		withTrackLockSync(lockDir(sid, home), () => {
+			const state = loadState(sid, home);
+			if (origin !== void 0 && origin !== "root") return;
+			if (refusal) {
+				const { codexConfirmPending: _pending, codexConfirmToken: _token, ...rest } = state;
+				saveState(sid, rest, home);
+				return;
+			}
+			if (!typedCode) return;
+			if (origin === void 0 && isSubagentActive(sid, now, home)) return;
+			const pending = state.codexConfirmPending;
+			if (!pending || pending.code.toLowerCase() !== typedCode.toLowerCase()) return;
+			const { codexConfirmPending: _pending, ...rest } = state;
+			saveState(sid, {
+				...rest,
+				codexConfirmToken: {
+					...pending,
+					ts: now
+				}
+			}, home);
+		});
+	} catch {}
+}
+//#endregion
 //#region src/runtime/confirm/confirm-gate.ts
 /**
 * Harnesses where `respond.ts` silently downgrades `kind: "ask"` to a hard
@@ -9387,9 +10227,23 @@ const DEGRADES_ASK_TO_DENY = /* @__PURE__ */ new Set(["codex", "kimi"]);
 * @param now - Epoch ms.
 * @param home - Test-only OS home override.
 */
-function confirmGate(id, prompt, command, sessionId, now, home) {
+function confirmGate(id, prompt, command, sessionId, now, home, codex) {
 	if (prompt.kind !== "ask" || !DEGRADES_ASK_TO_DENY.has(id) || !command || isIrreversible(command)) return null;
 	try {
+		if (id === "codex" && codex) {
+			const action = codexAction(codex.tool, codex.cwd, command, now);
+			if (!action) return null;
+			const verdict = authorizeCodexAction(sessionId, action, codex.toolUseId, now, home);
+			if (verdict.allow) return verdict;
+			const diagnostic = `rule ID: ${prompt.ruleId ?? "policy:ask"}\ncanonical command: ${action.command}\nexpected token: CONFIRM ${action.code}\nrejection: ${verdict.reason}`;
+			return {
+				allow: false,
+				prompt: {
+					...prompt,
+					reason: `${prompt.reason}\nPour autoriser, réponds : CONFIRM ${action.code}\n${diagnostic}`
+				}
+			};
+		}
 		const hash = hashForAction(command);
 		if (consumeConfirmToken(sessionId, hash, now, home)) return { allow: true };
 		const code = displayCodeForAction(command);
@@ -9430,9 +10284,19 @@ async function handlePre(ctx) {
 	}
 	const designBlock = designGate(payload, event, designCacheDir, opts.cwd, opts.corpusRoot);
 	if (designBlock) return {
-		stdout: withDenyNotice(id, respond(id, designBlock), designBlock, event.sessionId, dirname(file), opts.now),
+		stdout: withDenyNotice(id, respond(id, designBlock, event.eventName ?? "PreToolUse"), designBlock, event.sessionId, dirname(file), opts.now),
 		exit: 0
 	};
+	if (id === "cursor" && (event.eventName === "beforeReadFile" || event.eventName === "beforeTabFileRead")) {
+		const readPolicy = evaluate({
+			tool: event.tool,
+			filePath: event.filePath
+		});
+		return {
+			stdout: readPolicy.prompt ? respond(id, readPolicy.prompt, event.eventName) : JSON.stringify({ permission: "allow" }),
+			exit: 0
+		};
+	}
 	if (opts.scope === "security") return {
 		stdout: event.files?.length ? securityAdvisoryForPatch(event.files, opts.now) : securityAdvisory(event.tool, event.filePath ?? "", opts.now),
 		exit: 0
@@ -9448,11 +10312,12 @@ async function handlePre(ctx) {
 	if (event.files && event.files.length > 0) {
 		const patchPrompt = applyPatchGate(event.files, opts.cwd);
 		if (patchPrompt) return {
-			stdout: withDenyNotice(id, respond(id, patchPrompt), patchPrompt, event.sessionId, dirname(file), opts.now),
+			stdout: withDenyNotice(id, respond(id, patchPrompt, event.eventName ?? "PreToolUse"), patchPrompt, event.sessionId, dirname(file), opts.now),
 			exit: 0
 		};
 	}
-	const prompt = await gate({
+	const refs = opts.refsDir ? await loadRefs(opts.refsDir) : void 0;
+	const gateInput = {
 		sessionId: event.sessionId,
 		framework,
 		tool: event.tool,
@@ -9460,7 +10325,7 @@ async function handlePre(ctx) {
 		content: event.content,
 		command: event.command,
 		cwd: opts.cwd,
-		refs: opts.refsDir ? await loadRefs(opts.refsDir) : void 0,
+		refs,
 		isReplaceAll: event.input.replace_all === true,
 		oldString: event.oldString,
 		agentType: event.agentType,
@@ -9470,9 +10335,14 @@ async function handlePre(ctx) {
 		trackFile: file,
 		transcriptPath: typeof payload.transcript_path === "string" ? payload.transcript_path : void 0,
 		neverApproval: id === "codex" && isBypassPermissions(event.permissionMode)
-	});
+	};
+	const prompt = id === "cursor" && (event.commandCandidates?.length ?? 0) > 1 ? await gateCommandCandidates(gateInput, event.commandCandidates) : await gate(gateInput);
 	if (prompt) {
-		const confirm = confirmGate(id, prompt, event.command, event.sessionId, opts.now, opts.home);
+		const confirm = confirmGate(id, prompt, event.command, event.sessionId, opts.now, opts.home, id === "codex" ? {
+			tool: event.tool,
+			cwd: event.cwd ?? opts.cwd,
+			toolUseId: event.toolUseId
+		} : void 0);
 		if (confirm?.allow) return allowOutcome(id, event, payload, designCacheDir, opts.cwd, {
 			trackFile: file,
 			windowMs: opts.windowMs,
@@ -9480,7 +10350,7 @@ async function handlePre(ctx) {
 		}, opts.corpusRoot);
 		const finalPrompt = confirm ? confirm.prompt : prompt;
 		return {
-			stdout: withDenyNotice(id, respond(id, finalPrompt), finalPrompt, event.sessionId, dirname(file), opts.now),
+			stdout: withDenyNotice(id, respond(id, finalPrompt, event.eventName ?? "PreToolUse"), finalPrompt, event.sessionId, dirname(file), opts.now),
 			exit: 0
 		};
 	}
@@ -9847,14 +10717,14 @@ function recordCodexPostFailure(tool, result, opts) {
 //#endregion
 //#region src/runtime/post-fanout.ts
 /**
-* Fan a Codex `apply_patch` envelope's `event.files` into one synthetic
+* Fan Codex `apply_patch` or Cursor `afterFileEdit` `event.files` into one
 * per-file event per touched file, so the per-file PostToolUse gates (SOLID
 * size, Tailwind, tracking, post-edit context) see EACH file instead of the
 * whole patch (whose own `filePath`/`content` are always undefined). `add`
 * maps to `Write`, `update` to `Edit` (mirrors the Pre-phase `applyPatchGate`'s
 * tool mapping); `delete`/`move` map to a tool none of those Write|Edit-gated
 * checks recognize, so they no-op on it without special-casing each gate.
-* Returns `[event]` unchanged for every non-`apply_patch` tool/harness.
+* Returns `[event]` unchanged when no per-file changes are present.
 * @param event - The normalized PostToolUse event.
 * @returns One event per touched file, or the original event.
 */
@@ -9864,7 +10734,8 @@ function fanOutFiles(event) {
 		...event,
 		tool: f.op === "add" ? "Write" : f.op === "update" ? "Edit" : "apply_patch:delete",
 		filePath: f.filePath,
-		content: f.op === "delete" ? void 0 : f.content
+		content: f.op === "delete" ? void 0 : f.content,
+		oldString: f.oldString
 	}));
 }
 /**
@@ -9884,7 +10755,106 @@ function firstFileMatch(files, check) {
 	return "";
 }
 //#endregion
+//#region src/runtime/post-outcome.ts
+/** Extract the additional-context body from a Claude-shaped post response. */
+function additionalContextOf(stdout) {
+	if (!stdout) return "";
+	try {
+		return JSON.parse(stdout).hookSpecificOutput?.additionalContext ?? "";
+	} catch {
+		return "";
+	}
+}
+function cursorPostToolOutput(eventName, designWarn, userMessage, extra) {
+	if (!/^postToolUse$/i.test(eventName)) return "";
+	const context = [
+		designWarn ? formatPrompt(designWarn) : "",
+		designWarn?.userMessage,
+		userMessage,
+		additionalContextOf(extra)
+	].filter(Boolean).join("\n");
+	return context ? JSON.stringify({ additional_context: context }) : "";
+}
+/**
+* Assemble the final PostToolUse response after all side effects and deny paths.
+* @param input - Final assembly values captured at their original evaluation times.
+* @returns The native hook outcome.
+*/
+function postOutcome(input) {
+	const { id, agentId, sessionId, now, cwd, activities, files, designCacheDir, designWarn, extra, cursorAfterFileEdit, cursorEventName } = input;
+	const noticeLines = [];
+	for (const f of files) {
+		const notice = designPassNotice({
+			agentId,
+			tool: f.tool,
+			filePath: f.filePath ?? "",
+			content: f.content ?? "",
+			url: "",
+			phase: "post"
+		}, designCacheDir);
+		if (notice?.userMessage) noticeLines.push(notice.userMessage);
+	}
+	const notice = noticeLines.length ? {
+		kind: "inform",
+		title: "Design pipeline",
+		reason: "",
+		userMessage: noticeLines.join("\n")
+	} : null;
+	const refNotice = refCreditNoticeFor(activities, sessionId, now, defaultStateDir(cwd));
+	const userMessage = [notice?.userMessage, refNotice].filter(Boolean).join("\n") || void 0;
+	if (cursorAfterFileEdit) return {
+		stdout: "{}",
+		exit: 0
+	};
+	if (id === "cursor") return {
+		stdout: cursorPostToolOutput(cursorEventName, designWarn, userMessage, extra),
+		exit: 0
+	};
+	if (designWarn) return {
+		stdout: respond(id, userMessage ? {
+			...designWarn,
+			userMessage
+		} : designWarn, "PostToolUse"),
+		exit: 0
+	};
+	if (!userMessage) return {
+		stdout: extra,
+		exit: 0
+	};
+	const withUserMessage = notice ? {
+		...notice,
+		userMessage
+	} : {
+		kind: "inform",
+		title: "Compliance",
+		reason: "",
+		userMessage
+	};
+	if (!extra) return {
+		stdout: respond(id, withUserMessage, "PostToolUse"),
+		exit: 0
+	};
+	if (id === "claude-code" || id === "codex") return {
+		stdout: attachSystemMessage(extra, userMessage),
+		exit: 0
+	};
+	if (id === "kimi") return {
+		stdout: respond(id, withUserMessage, "PostToolUse"),
+		exit: 0
+	};
+	return {
+		stdout: respond(id, withUserMessage, "PostToolUse") || extra,
+		exit: 0
+	};
+}
+//#endregion
 //#region src/runtime/handle-post.ts
+function isCursorAfterFileEdit(id, payload) {
+	if (id !== "cursor") return false;
+	const hookEvent = typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
+	if (hookEvent) return /^afterFileEdit$/i.test(hookEvent);
+	return typeof payload.file_path === "string" && Array.isArray(payload.edits);
+}
 /**
 * Run the PostToolUse pipeline: store the MCP response, emit a design warning,
 * record the activity into the session track, apply per-scope side-effects (SEO
@@ -9907,8 +10877,14 @@ function firstFileMatch(files, check) {
 */
 async function handlePost(ctx) {
 	const { id, payload, event, framework, mcpDir, file, opts } = ctx;
+	const cursorAfterFileEdit = isCursorAfterFileEdit(id, payload);
 	const designCacheDir = ctx.designCacheDir ?? mcpDir;
-	const response = payload.tool_response ?? payload.tool_output;
+	let response = payload.tool_response ?? payload.tool_output;
+	if (id === "cursor" && /^afterMCPExecution$/i.test(event.eventName ?? "")) try {
+		response = typeof payload.result_json === "string" ? JSON.parse(payload.result_json) : payload.result_json;
+	} catch {
+		response = void 0;
+	}
 	mcpPostStore(event.tool, event.input, response, mcpDir);
 	const designWarn = designGate(payload, event, designCacheDir, opts.cwd, opts.corpusRoot);
 	const activities = activityFor({
@@ -9932,27 +10908,27 @@ async function handlePost(ctx) {
 	const files = fanOutFiles(event);
 	for (const f of files) postTrackingSideEffects(opts.scope ?? "core", f, f.input, opts.now, payload, opts.cwd);
 	const seoDeny = opts.scope === "seo" ? seoPostToolUseResponse(payload) : null;
-	if (seoDeny) return {
+	if (seoDeny && !cursorAfterFileEdit) return {
 		stdout: seoDeny,
 		exit: 0
 	};
 	if (opts.scope === "solid") {
 		const solidWarn = firstFileMatch(files, checkFileSize);
-		if (solidWarn) return {
+		if (solidWarn && !cursorAfterFileEdit) return {
 			stdout: solidWarn,
 			exit: 0
 		};
 	}
 	if (opts.scope === "tailwindcss") {
 		const tailwindWarn = firstFileMatch(files, validateTailwind);
-		if (tailwindWarn) return {
+		if (tailwindWarn && !cursorAfterFileEdit) return {
 			stdout: tailwindWarn,
 			exit: 0
 		};
 	}
 	if (opts.scope === "aipilot" && (event.tool === "TaskCreate" || event.tool === "TaskUpdate" || event.tool === "Write" || event.tool === "Edit")) {
 		const out = await aipilotPostToolUse(payload, opts.cwd, id);
-		if (out) return {
+		if (out && !cursorAfterFileEdit) return {
 			stdout: out,
 			exit: 0
 		};
@@ -9962,63 +10938,20 @@ async function handlePost(ctx) {
 		extra = await postEditContext(opts.scope ?? "core", f, opts.now, id);
 		if (extra) break;
 	}
-	const agentId = typeof payload.agent_id === "string" ? payload.agent_id : "";
-	const noticeLines = [];
-	for (const f of files) {
-		const n = designPassNotice({
-			agentId,
-			tool: f.tool,
-			filePath: f.filePath ?? "",
-			content: f.content ?? "",
-			url: "",
-			phase: "post"
-		}, designCacheDir);
-		if (n?.userMessage) noticeLines.push(n.userMessage);
-	}
-	const notice = noticeLines.length ? {
-		kind: "inform",
-		title: "Design pipeline",
-		reason: "",
-		userMessage: noticeLines.join("\n")
-	} : null;
-	const refNotice = refCreditNoticeFor(activities, event.sessionId, opts.now, defaultStateDir(opts.cwd));
-	const userMessage = [notice?.userMessage, refNotice].filter(Boolean).join("\n") || void 0;
-	if (designWarn) return {
-		stdout: respond(id, userMessage ? {
-			...designWarn,
-			userMessage
-		} : designWarn, "PostToolUse"),
-		exit: 0
-	};
-	if (!userMessage) return {
-		stdout: extra,
-		exit: 0
-	};
-	const withUserMessage = notice ? {
-		...notice,
-		userMessage
-	} : {
-		kind: "inform",
-		title: "Compliance",
-		reason: "",
-		userMessage
-	};
-	if (!extra) return {
-		stdout: respond(id, withUserMessage, "PostToolUse"),
-		exit: 0
-	};
-	if (id === "claude-code" || id === "codex") return {
-		stdout: attachSystemMessage(extra, userMessage),
-		exit: 0
-	};
-	if (id === "kimi") return {
-		stdout: respond(id, withUserMessage, "PostToolUse"),
-		exit: 0
-	};
-	return {
-		stdout: respond(id, withUserMessage, "PostToolUse") || extra,
-		exit: 0
-	};
+	return postOutcome({
+		id,
+		agentId: typeof payload.agent_id === "string" ? payload.agent_id : "",
+		sessionId: event.sessionId,
+		now: opts.now,
+		cwd: opts.cwd,
+		activities,
+		files,
+		designCacheDir,
+		designWarn,
+		extra,
+		cursorAfterFileEdit,
+		cursorEventName: typeof payload.hook_event_name === "string" ? payload.hook_event_name : ""
+	});
 }
 //#endregion
 //#region src/runtime/handle-scope-async.ts
@@ -10038,9 +10971,12 @@ async function handlePost(ctx) {
 * @returns The native stdout when intercepted, or `null` to fall through.
 */
 async function asyncScopeStdout(scope, event, payload, cwd, now, id = "claude-code") {
-	if (scope === "aipilot") return dispatchAipilot(event, payload, cwd, now, void 0, id);
-	if (scope === "memory") return dispatchMemory(event, payload, cwd, now);
-	return null;
+	const dispatchedEvent = id === "cursor" ? cursorEventContract(event).lifecycle : event;
+	if (dispatchedEvent === null) return null;
+	let stdout = null;
+	if (scope === "aipilot") stdout = await dispatchAipilot(dispatchedEvent, payload, cwd, now, void 0, id);
+	if (scope === "memory") stdout = await dispatchMemory(dispatchedEvent, payload, cwd, now);
+	return id === "cursor" && stdout !== null ? toCursorLifecycleResponse(stdout, event) : stdout;
 }
 //#endregion
 //#region src/runtime/design-cache-resolve.ts
@@ -10509,19 +11445,99 @@ function handleConfirmSubmit(sessionId, text, now, home) {
 	} catch {}
 }
 //#endregion
+//#region src/runtime/confirm/codex-prompt-origin.ts
+const AGENT_FIELDS = ["agent_id", "agent_type"];
+/**
+* Classify Codex prompt provenance from its optional agent metadata.
+* Missing metadata is the observed root shape; malformed metadata fails closed.
+*/
+function codexPromptOrigin(payload) {
+	const present = AGENT_FIELDS.filter((field) => Object.hasOwn(payload, field));
+	if (present.length === 0) return "root";
+	return present.every((field) => typeof payload[field] === "string" && payload[field].trim().length > 0) ? "subagent" : "unknown";
+}
+//#endregion
 //#region src/runtime/handle.ts
 /** Raw Claude hook event name from a payload (empty when absent). */
 function rawEventName(payload) {
 	return typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
 }
 /**
+* `payload.tool_input` parsed into an object when it's a JSON STRING —
+* Cursor's real wire format for `beforeMCPExecution`/`afterMCPExecution`
+* (ground truth), unlike every other harness (and Cursor's own
+* `preToolUse`/`postToolUse`), which always sends it as an object already.
+* `undefined` when `tool_input` is already an object, absent, or fails to
+* parse into one (fail-open — the caller then keeps the original value).
+* @param payload - The raw hook payload.
+*/
+function cursorParsedToolInput(payload) {
+	const raw = payload.tool_input;
+	if (typeof raw !== "string") return void 0;
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* `id === "cursor"` only: project the already-resolved canonical `tool_name`
+* (`event.tool`, normalized by {@link normalizeEvent}) and `cwd` (the project
+* root resolved via `cursorProjectCwd`, already applied to `opts.cwd`) onto a
+* shallow payload copy — the single passage point for every downstream
+* consumer that reads `payload.tool_name`/`payload.cwd`/`payload.tool_input`
+* RAW instead of `event.tool`/`opts.cwd`/`event.input` (lifecycle-bridge's
+* `failure-lesson.ts`/`agent-memory.ts`, handle-scope-async's aipilot/memory
+* dispatchers — including `doc-cache-gate.ts`'s `libraryOf`, which never
+* `JSON.parse`s a string `tool_input` itself — and the seo scope's
+* `post-tool-use.ts`). `tool_input` is additionally replaced by its parsed
+* object form via {@link cursorParsedToolInput} when Cursor sent it as a
+* JSON string (`beforeMCPExecution`/`afterMCPExecution`). Cursor's own wire
+* values ("Shell", `MCP:<tool>`, a bare `workspace_roots` array with no
+* `cwd` field, a stringified `tool_input`, …) are preserved under
+* `cursor_tool_name`/`cursor_cwd`/`cursor_tool_input` so nothing is lost.
+* Every other harness id is untouched (returns the SAME object,
+* byte-identical).
+* @param payload - The raw hook payload.
+* @param event - The already-normalized event (`event.tool` is canonical).
+* @param cwd - The resolved project root for this invocation.
+* @param id - Harness adapter id.
+*/
+function cursorRawPayloadProjection(payload, event, cwd, id) {
+	if (id !== "cursor") return payload;
+	const parsedToolInput = cursorParsedToolInput(payload);
+	return {
+		...payload,
+		cursor_tool_name: payload.tool_name,
+		cursor_cwd: payload.cwd,
+		tool_name: event.tool,
+		cwd,
+		...parsedToolInput ? {
+			cursor_tool_input: payload.tool_input,
+			tool_input: parsedToolInput
+		} : {}
+	};
+}
+/**
 * The full hook handler: on a PRE event it gates the tool-use (stateless guards
 * then APEX gates from the session track) and returns the native response; on a
 * POST event it records the activity into the track. The loop that makes the
 * package behave like the Claude plugin, on any harness.
 */
-async function handleHook(id, payload, opts) {
+async function handleHookCore(id, payload, opts) {
 	const event = normalizeEvent(id, payload);
+	if (id === "cursor") {
+		const cursorCwd = cursorProjectCwd(event.cwd, event.workspaceRoots ?? [], event.filePath, opts.cwd);
+		if (cursorCwd !== opts.cwd) opts = {
+			...opts,
+			cwd: cursorCwd
+		};
+	}
+	const hookPayload = cursorRawPayloadProjection(payload, event, opts.cwd, id);
+	const rawPrompt = payload.prompt;
+	const userPrompt = typeof rawPrompt === "string" || Array.isArray(rawPrompt) ? promptText(rawPrompt) : void 0;
+	if (id === "codex" && rawEventName(payload) === "UserPromptSubmit" && userPrompt !== void 0) submitCodexConfirmation(event.sessionId, userPrompt, opts.now, opts.home, codexPromptOrigin(payload));
 	resetFragmentRegistry();
 	const layout = projectLayout(opts.cwd);
 	const file = trackFile(event.sessionId, defaultStateDir(opts.cwd));
@@ -10533,20 +11549,18 @@ async function handleHook(id, payload, opts) {
 		exit: 0
 	};
 	if (id === "codex" && rawEventName(payload) === "SessionStart") resyncCodexAgents();
-	const asyncOut = await asyncScopeStdout(opts.scope, rawEventName(payload), payload, opts.cwd, opts.now, id);
+	const asyncOut = await asyncScopeStdout(opts.scope, rawEventName(payload), hookPayload, opts.cwd, opts.now, id);
 	if (asyncOut !== null) return {
 		stdout: asyncOut,
 		exit: 0
 	};
-	const life = lifecycleStdout(payload, opts.cwd, opts.scope ?? "core", opts.now, id);
+	const life = lifecycleStdout(hookPayload, opts.cwd, opts.scope ?? "core", opts.now, id);
 	if (life !== null) return {
 		stdout: id === "claude-code" ? attachBudgetRecap(life, rawEventName(payload), event.sessionId, opts.cwd, opts.now) : life,
 		exit: 0
 	};
-	const rawPrompt = payload.prompt;
-	const userPrompt = typeof rawPrompt === "string" || Array.isArray(rawPrompt) ? promptText(rawPrompt) : void 0;
 	if (userPrompt !== void 0) {
-		handleConfirmSubmit(event.sessionId, userPrompt, opts.now, opts.home);
+		if (id !== "codex") handleConfirmSubmit(event.sessionId, userPrompt, opts.now, opts.home);
 		await withTrack(file, (track) => recordBrainstormRequired(track, detectCreationIntent(userPrompt)));
 		return {
 			stdout: promptSubmitContext(userPrompt, opts.cwd, id),
@@ -10555,7 +11569,7 @@ async function handleHook(id, payload, opts) {
 	}
 	if (event.phase === "post") return handlePost({
 		id,
-		payload,
+		payload: hookPayload,
 		event,
 		framework,
 		mcpDir,
@@ -10565,7 +11579,7 @@ async function handleHook(id, payload, opts) {
 	});
 	return handlePre({
 		id,
-		payload,
+		payload: hookPayload,
 		event,
 		framework,
 		mcpDir,
@@ -10574,5 +11588,41 @@ async function handleHook(id, payload, opts) {
 		opts
 	});
 }
+/**
+* Run one hook and adapt every Cursor scope outcome at the common runtime exit.
+* Other harnesses retain the core handler's stdout and exit status unchanged.
+* Cursor's shared `additional_context` budget context (see
+* `../adapters/cursor/context-budget.ts`) is assembled here too — this is
+* the single point every Cursor stdout passes through exactly once, so it's
+* also the single point that reserves from and records into the registry.
+* With no `session_id`/`conversation_id` at all, `sessionId` is `""` — the
+* registry key would degenerate to one bucket shared by every session-less
+* call on the same (cwd, event) pair, so `budget` stays `undefined` instead
+* (falls back to the flat per-response cap in `toCursorLifecycleResponse`,
+* with zero registry I/O). `stateDir` honors `opts.home` (test-only OS home
+* override, see `HandleOptions`) so tests never need the real `os.homedir()`.
+*/
+async function handleHook(id, payload, opts) {
+	const outcome = await handleHookCore(id, payload, opts);
+	if (id !== "cursor") return outcome;
+	const eventName = rawEventName(payload);
+	const cursorEvent = normalizeEvent(id, payload);
+	const cwd = cursorProjectCwd(cursorEvent.cwd, cursorEvent.workspaceRoots ?? [], cursorEvent.filePath, opts.cwd);
+	const sessionId = cursorEvent.sessionId;
+	const generationId = typeof payload.generation_id === "string" && payload.generation_id ? payload.generation_id : void 0;
+	const toolUseId = typeof payload.tool_use_id === "string" && payload.tool_use_id ? payload.tool_use_id : void 0;
+	const stateDir = join(fuseHarnessHome(opts.home), "state", projectHash$1(cwd));
+	const budget = sessionId ? {
+		stateDir,
+		sessionId,
+		event: eventName,
+		generationId,
+		toolUseId
+	} : void 0;
+	return {
+		...outcome,
+		stdout: toCursorLifecycleResponse(outcome.stdout, eventName, budget)
+	};
+}
 //#endregion
-export { runningVersion as $, trackMcpResearch as A, defaultStateDir as At, generateProjectMap as B, seoPostToolUse as C, trimLogFile as Ct, securityAdvisoryForPatch as D, claudeMdKey as Dt, securityAdvisory as E, projectContext as Et, dispatchAipilot as F, loadSecurityState as Ft, countFiles as G, writeTree as H, dispatchLessons as I, saveSecurityState as It, lessonsArchiveFileFor as J, getFileDesc as K, cartoSessionStart as L, securityStateDir as Lt, trackEnrichment as M, trackFile as Mt, dispatchLifecycle as N, normalizeEvent as Nt, postTrackingSideEffects as O, promptSubmitContext as Ot, aipilotPostToolUse as P, isoUtc as Pt, runDoctor as Q, generateEcosystemMap as R, securityStatePath as Rt, postEditContext as S, removeOldFiles as St, dispatchMemory as T, gitContext as Tt, loadEnriched as U, isProject as V, mergeLines as W, lessonsStateFileFor as X, lessonsFileFor as Y, notify as Z, preCommitGate as _, readRules as _t, recordActivity as a, saveApexState as at, extractSymbols as b, pruneEmptyDirs as bt, MCP_TTL_MS as c, trackAgentMemory as ct, isMcpTool as d, validateSolidGate as dt, versionBanner as et, queryOf as f, checkFileSize as ft, gate as g, injectRules as gt, TRIVIAL_BUDGET as h, solidDetectStart as ht, respond as i, cleanupSession as it, trackSkillRead as j, projectHash$1 as jt, trackWatchResearch as k, taskContext as kt, WEBFETCH_TTL_MS as l, subagentCacheContext as lt, REQUIRED_AGENTS as m, detectSolidProfile as mt, activityFor as n, trackSessionChanges as nt, mcpPostStore as o, logToolFailure as ot, DEFAULT_WINDOW_MS as p, countLoc as pt, listChildren as q, handlePre as r, validateRulesLoaded as rt, mcpPreIntercept as s, validateTeammateOutput as st, handleHook as t, postEditTypescript as tt, cacheQueryOf as u, validateTailwind as ut, detectDuplication as v, runSessionStartCleanups as vt, seoPostToolUseResponse as w, devContext as wt, lifecycleStdout as x, purgeTtlTree as xt, dryGate as y, sessionStartCore as yt, writePluginMap as z, todayUtc as zt };
+export { runDoctor as $, trackWatchResearch as A, taskContext as At, writePluginMap as B, todayUtc as Bt, postEditContext as C, removeOldFiles as Ct, securityAdvisory as D, projectContext as Dt, dispatchMemory as E, gitContext as Et, aipilotPostToolUse as F, isoUtc as Ft, mergeLines as G, isProject as H, dispatchAipilot as I, loadSecurityState as It, listChildren as J, countFiles as K, dispatchLessons as L, saveSecurityState as Lt, trackSkillRead as M, projectHash$1 as Mt, trackEnrichment as N, trackFile as Nt, securityAdvisoryForPatch as O, claudeMdKey as Ot, dispatchLifecycle as P, normalizeEvent as Pt, notify as Q, cartoSessionStart as R, securityStateDir as Rt, lifecycleStdout as S, purgeTtlTree as St, seoPostToolUseResponse as T, devContext as Tt, writeTree as U, generateProjectMap as V, loadEnriched as W, lessonsFileFor as X, lessonsArchiveFileFor as Y, lessonsStateFileFor as Z, gateCommandCandidates as _, injectRules as _t, recordActivity as a, cleanupSession as at, dryGate as b, sessionStartCore as bt, MCP_TTL_MS as c, validateTeammateOutput as ct, isMcpTool as d, validateTailwind as dt, runningVersion as et, queryOf as f, validateSolidGate as ft, gate as g, solidDetectStart as gt, TRIVIAL_BUDGET as h, detectSolidProfile as ht, respond as i, validateRulesLoaded as it, trackMcpResearch as j, defaultStateDir as jt, postTrackingSideEffects as k, promptSubmitContext as kt, WEBFETCH_TTL_MS as l, trackAgentMemory as lt, REQUIRED_AGENTS as m, countLoc as mt, activityFor as n, postEditTypescript as nt, mcpPostStore as o, saveApexState as ot, DEFAULT_WINDOW_MS as p, checkFileSize as pt, getFileDesc as q, handlePre as r, trackSessionChanges as rt, mcpPreIntercept as s, logToolFailure as st, handleHook as t, versionBanner as tt, cacheQueryOf as u, subagentCacheContext as ut, preCommitGate as v, readRules as vt, seoPostToolUse as w, trimLogFile as wt, extractSymbols as x, pruneEmptyDirs as xt, detectDuplication as y, runSessionStartCleanups as yt, generateEcosystemMap as z, securityStatePath as zt };