@fusengine/harness 0.1.91 → 0.1.92

package/dist/{handle-C43gA-Pr.mjs → handle-BF1dZFjY.mjs}

@@ -16,12 +16,12 @@ import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { C as apexAuthorizationGate, S as trivialCount, _ as recordBrainstormRequired, a as journalLogPath, b as recordTarget, c as appendEvent, d as signTrack, f as verifyTrack, g as recordAgent, h as emptyTrack, i as withTrack, l as withTrackLockSync, m as agentsFresh, o as readTrackSync, p as writeLastNonce, r as trackJournalEnabled, s as diffTrackEvents, t as loadTrack, u as LOCK_FAILED, v as recordDoc, x as recordTrivialEdit, y as recordRefRead } from "./store-5-ZPKb0u.mjs";
 import { i as parseApplyPatch, n as canonicalizeMcpToolName, r as canonicalizeCodexShellTool, t as isBypassPermissions } from "./permission-mode-B-SFyR0X.mjs";
 import { t as commandToString } from "./command-string-CALMTnwN.mjs";
-import { n as cursorProjectCwd, r as cursorEventContract, t as extractCursorEvent } from "./normalize-BjG6unTj.mjs";
+import { n as cursorProjectCwd, r as cursorEventContract, t as extractCursorEvent } from "./normalize-Dy8g9Ybl.mjs";
 import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-Ckv2_TgP.mjs";
 import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-G2wcSh5-.mjs";
 import { r as toHermesResponse } from "./hermes-B9-p_3IF.mjs";
 import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
-import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { mkdir, rmdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
@@ -2144,13 +2144,114 @@ function postEditTypescript(filePath) {
 	return contextResponse("PostToolUse", `Lint issues in ${basename(filePath)}: ${issues.join(" | ")}`);
 }
 //#endregion
+//#region src/adapters/cursor/plugin-root.ts
+/**
+* Cursor plugin-root resolution — independent from the rules-plugin probing
+* in `../../runtime/lifecycle/rules-root.ts`. Ground truth (Cursor 3.18.25
+* binary + cursor.com/docs/hooks): `CURSOR_PLUGIN_ROOT` / `CLAUDE_PLUGIN_ROOT`
+* (both equal to the plugin install dir) are injected ONLY into
+* plugin-declared hook processes — never user (`~/.cursor/hooks.json`),
+* project (`.cursor/hooks.json`), or enterprise hooks. A plugin hook's cwd is
+* the plugin install dir, EXCEPT for `stop`/`subagentStop`, where it is the
+* workspace root — callers must pass the right `cwd` for the event they are
+* handling. Precedence: (1) `CURSOR_PLUGIN_ROOT` env, (2) `CLAUDE_PLUGIN_ROOT`
+* env, (3) `cwd` when it carries a Cursor plugin marker
+* (`.cursor-plugin/plugin.json`, `plugin.json` + `hooks/hooks.json`, or a
+* bare `hooks/hooks.json` — matches installed-plugin layouts under
+* `~/.cursor/plugins/cache/**` and `~/.cursor/plugins/local/<name>/`), (4)
+* `none`. Cursor refuses symlinked config paths itself; we do not share that
+* constraint, so every resolved candidate is realpath-followed instead.
+*/
+/** Validate an env candidate: non-empty, NUL-free, absolute, existing dir. */
+function validateEnvCandidate(label, value, checked) {
+	if (value === void 0 || value === "") {
+		checked.push(`${label}: unset`);
+		return null;
+	}
+	if (value.includes("\0")) {
+		checked.push(`${label}: invalid (contains NUL): "${value}"`);
+		return null;
+	}
+	if (!isAbsolute(value)) {
+		checked.push(`${label}: invalid (not absolute): "${value}"`);
+		return null;
+	}
+	try {
+		if (!statSync(value).isDirectory()) {
+			checked.push(`${label}: invalid (not a directory): "${value}"`);
+			return null;
+		}
+	} catch {
+		checked.push(`${label}: invalid (no such directory): "${value}"`);
+		return null;
+	}
+	try {
+		return realpathSync.native(value);
+	} catch {
+		checked.push(`${label}: invalid (realpath failed): "${value}"`);
+		return null;
+	}
+}
+/** True when `dir` carries a recognized Cursor plugin install marker. */
+function hasPluginMarker(dir) {
+	if (existsSync(join(dir, ".cursor-plugin", "plugin.json"))) return true;
+	if (existsSync(join(dir, "plugin.json")) && existsSync(join(dir, "hooks", "hooks.json"))) return true;
+	return existsSync(join(dir, "hooks", "hooks.json"));
+}
+/**
+* Resolve the Cursor plugin install root a plugin-declared hook runs from.
+* @param env - Environment (defaults to `process.env`).
+* @param cwd - The hook process's cwd for the current event (plugin root for
+*   most events, workspace root for `stop`/`subagentStop` — caller's choice).
+* @returns The resolved root, its source, and every rejected candidate.
+*/
+function resolveCursorPluginRoot(env, cwd) {
+	const checked = [];
+	const fromCursor = validateEnvCandidate("env:CURSOR_PLUGIN_ROOT", env.CURSOR_PLUGIN_ROOT, checked);
+	if (fromCursor) return {
+		root: fromCursor,
+		source: "env:CURSOR_PLUGIN_ROOT",
+		checked
+	};
+	const fromClaude = validateEnvCandidate("env:CLAUDE_PLUGIN_ROOT", env.CLAUDE_PLUGIN_ROOT, checked);
+	if (fromClaude) return {
+		root: fromClaude,
+		source: "env:CLAUDE_PLUGIN_ROOT",
+		checked
+	};
+	if (hasPluginMarker(cwd)) {
+		let resolved = cwd;
+		try {
+			resolved = realpathSync.native(cwd);
+		} catch {}
+		return {
+			root: resolved,
+			source: "cwd:plugin-marker",
+			checked
+		};
+	}
+	checked.push(`cwd:"${cwd}": no plugin marker found`);
+	return {
+		root: null,
+		source: "none",
+		checked
+	};
+}
+//#endregion
 //#region src/runtime/lifecycle/rules-root.ts
 /**
 * Dynamic rules-plugin root resolution. The historical `CLAUDE_PLUGIN_ROOT ??
 * cwd` chain only worked when the harness exported the plugin root — Kimi
 * injects `KIMI_PLUGIN_ROOT` instead, and a bare cwd fallback never held a
-* `rules/` dir. Resolution order (first hit wins):
-* 1. `CLAUDE_PLUGIN_ROOT` (claude-code/codex plugin-declared hooks);
+* `rules/` dir.
+*
+* `id === "cursor"` is resolved by a SEPARATE branch (`resolveCursorPluginRoot`)
+* before any of the below, because Cursor's env contract differs from the
+* other harnesses (see `../../adapters/cursor/plugin-root.ts`) — it is never
+* folded into the shared switch. For every other id, resolution order (first
+* hit wins, unchanged):
+* 1. `CLAUDE_PLUGIN_ROOT` (read for ALL non-cursor ids, historical quirk —
+*    frozen by non-regression tests, do not "fix" without an explicit ask);
 * 2. `KIMI_PLUGIN_ROOT` (kimi plugin-declared hooks);
 * 3. Per-harness install probe (claude marketplace, codex versioned cache,
 *    kimi managed plugins) — first `<plugin>/rules` dir whose plugin folder
@@ -2204,6 +2305,12 @@ function probeKimi(env, home) {
 * @returns The plugin root to read `rules/` from.
 */
 function resolveRulesRoot(id, cwd, env = process.env) {
+	if (id === "cursor") {
+		const result = resolveCursorPluginRoot(env, cwd);
+		if (result.root) return result.root;
+		process.stderr.write(`[fuse-harness] cursor: no plugin root proven (checked: ${result.checked.join("; ")}); rules root falls back to ${cwd}\n`);
+		return cwd;
+	}
 	if (env.CLAUDE_PLUGIN_ROOT) return env.CLAUDE_PLUGIN_ROOT;
 	if (env.KIMI_PLUGIN_ROOT) return env.KIMI_PLUGIN_ROOT;
 	const home = env.HOME ?? homedir();
@@ -3422,8 +3529,12 @@ function recordFailure(tool, opts) {
 * matches the failure message — reusing the PreToolUse {@link lessonFor} index and
 * its cooldown (idempotent under the ~11-process fan-out). Fail-open throughout.
 *
-* Claude-Code-only: no equivalent `PostToolUseFailure` hook exists on Codex or
-* Hermes, so this handler is never reached through those adapters.
+* Claude-Code-only in the sense that no equivalent `PostToolUseFailure` hook
+* exists on Codex or Hermes — but Cursor's own `postToolUseFailure` DOES
+* arrive here too, via `lifecycle-bridge.ts`'s `lifecycleStdout` translating
+* the wire event name and forwarding to `dispatchLifecycle`'s
+* `"PostToolUseFailure"` case (see `handle.ts`'s `cursorRawPayloadProjection`
+* for how `data.tool_name` below arrives already canonicalized on Cursor).
 * @packageDocumentation
 */
 /** The failure message across the documented `error` field and defensive fallbacks; "" when none. */
@@ -6032,7 +6143,7 @@ async function dispatchAipilot(event, payload, cwd, now, home = homedir(), id =
 		await cacheAnalyticsSave(home, now);
 		return "";
 	}
-	if (event === "PreToolUse") return docCacheGate(payload, cwd, now, home, id);
+	if (event === "PreToolUse" || id === "cursor" && event === "BeforeMCPExecution") return docCacheGate(payload, cwd, now, home, id);
 	return null;
 }
 /** PostToolUse (Write/Edit SOLID check, else TaskCreate/TaskUpdate sync) for the ai-pilot scope; `id` selects the harness target (defaults to "claude-code"). */
@@ -6654,9 +6765,10 @@ async function autoDocumentRead(filePath, now = Date.now(), id = "claude-code")
 	return systemMessage(`📖 [${docType}] ${fname} logged`);
 }
 //#endregion
-//#region src/adapters/cursor/native-response.ts
+//#region src/adapters/cursor/native-schemas.ts
 const stringValue = (value) => typeof value === "string";
 const booleanValue = (value) => typeof value === "boolean";
+/** A plain `{}`-literal or `Object.create(null)` object — never a class instance or array. */
 const plainRecord = (value) => {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
 	try {
@@ -6723,6 +6835,7 @@ function jsonValue(root) {
 	}
 	return true;
 }
+/** A JSON-safe plain object (no cycles, no non-finite numbers, no exotic prototypes). */
 const recordValue = (value) => plainRecord(value) && jsonValue(value);
 const stringRecord = (value) => {
 	if (!recordValue(value)) return false;
@@ -6744,6 +6857,21 @@ const PERMISSION_ASK = {
 	},
 	required: ["permission"]
 };
+const PRE_TOOL_USE = {
+	fields: {
+		permission: permission("allow", "deny", "ask"),
+		user_message: stringValue,
+		agent_message: stringValue,
+		updated_input: recordValue,
+		additional_context: stringValue
+	},
+	required: ["permission"]
+};
+/**
+* Exact native stdout field set Cursor 3.18.25 reads per hook event.
+* Nothing beyond this list is invented: any additional key on a candidate
+* value fails {@link isNativeCursorResponse} in native-response.ts.
+*/
 const NATIVE_SCHEMAS = {
 	sessionStart: { fields: {
 		env: stringRecord,
@@ -6755,7 +6883,8 @@ const NATIVE_SCHEMAS = {
 	beforeSubmitPrompt: {
 		fields: {
 			continue: booleanValue,
-			user_message: stringValue
+			user_message: stringValue,
+			additional_context: stringValue
 		},
 		required: ["continue"]
 	},
@@ -6768,18 +6897,12 @@ const NATIVE_SCHEMAS = {
 		required: ["permission"]
 	},
 	subagentStop: FOLLOWUP,
-	preToolUse: {
-		fields: {
-			...PERMISSION_ASK.fields,
-			updated_input: recordValue
-		},
-		required: ["permission"]
-	},
+	preToolUse: PRE_TOOL_USE,
 	postToolUse: { fields: {
 		updated_mcp_tool_output: recordValue,
 		additional_context: stringValue
 	} },
-	postToolUseFailure: EMPTY,
+	postToolUseFailure: { fields: { additional_context: stringValue } },
 	beforeShellExecution: PERMISSION_ASK,
 	afterShellExecution: EMPTY,
 	beforeMCPExecution: PERMISSION_ASK,
@@ -6802,6 +6925,16 @@ const NATIVE_SCHEMAS = {
 	stop: FOLLOWUP,
 	workspaceOpen: { fields: { pluginPaths: stringArray } }
 };
+//#endregion
+//#region src/adapters/cursor/native-response.ts
+/**
+* Check that every enumerable own key of `value` is a documented field for
+* `eventName` and passes its validator, and that every required field is
+* present. Rejects prototype-polluted or exotic-shaped candidates via
+* {@link recordValue}.
+* @param value - Parsed JSON candidate.
+* @param eventName - The Cursor hook event the candidate would answer.
+*/
 function isNativeCursorResponse(value, eventName) {
 	try {
 		if (!recordValue(value)) return false;
@@ -6830,6 +6963,240 @@ function parseNativeCursorStdout(stdout, eventName) {
 	}
 }
 //#endregion
+//#region src/adapters/cursor/context-limit.ts
+/**
+* @module context-limit
+* Cursor 3.18.25's `hooks-carriers` drops an `additional_context` carrier
+* once `o.length>1e4` — but `o` is the MERGED text of every hook's
+* `additional_context` for that event (concatenated with `"\n\n---\n\n"`
+* before the 10,000-char check), not this harness's response in isolation.
+* Capping our own contribution at {@link ADDITIONAL_CONTEXT_LIMIT} is
+* therefore the LAST-RESORT guard, not the real protection: on its own it
+* only proves OUR piece stays under 10,000, while the total across every
+* hook plugin configured on the same event can still exceed it and get
+* dropped wholesale — measured at ~8,400 chars on `sessionStart` from core
+* plugins alone, close enough to the ceiling that one more plugin tips it
+* over. The actual protection is the cross-process shared budget registry
+* in `./context-budget.ts` (Cursor id only), which reserves a slice of the
+* 10,000 ceiling per (session, event, generation) key BEFORE calling
+* {@link truncateAdditionalContext} here with the reserved amount instead of
+* the flat {@link ADDITIONAL_CONTEXT_LIMIT} — this module stays a pure,
+* budget-agnostic primitive so it keeps working unbudgeted (its historical,
+* still-correct behavior) wherever no budget context is available. The
+* limit unit is UTF-16 code units (`String.prototype.length`), matching
+* `value.length` here exactly. Only 5 events carry `additional_context`
+* through this carrier — sessionStart, beforeSubmitPrompt, preToolUse,
+* postToolUse, postToolUseFailure — subagentStart/subagentStop use a
+* different, unlimited channel. "Drops silently" also only holds when no
+* `failClosed: true` hook is declared on that step/tool: with one declared,
+* an oversized carrier REJECTS the tool call instead of being dropped quiet.
+*/
+/** Cursor's hard `additional_context` character ceiling. */
+const ADDITIONAL_CONTEXT_LIMIT = 1e4;
+/** Suffix appended by {@link truncateAdditionalContext} once a value is cut. */
+const TRUNCATION_MARKER = "\n[fuse-harness] additional_context truncated to Cursor's 10000-char limit";
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Truncate a string to end with {@link TRUNCATION_MARKER} once its length
+* exceeds `limit`. Leaves shorter values untouched. Idempotent under a
+* SHRINKING `limit` across repeated calls (e.g. an unbudgeted flat-cap pass
+* followed by a budgeted re-cap of the same stdout — see `./respond.ts`'s
+* `toCursorLifecycleResponse` doc): when `value` already ends with
+* {@link TRUNCATION_MARKER}, that marker is stripped BEFORE re-slicing so the
+* result carries exactly one marker instead of risking a duplicated/cut one.
+* @param value - Candidate `additional_context` body.
+* @param limit - Effective ceiling for this call (defaults to the flat
+* {@link ADDITIONAL_CONTEXT_LIMIT}; a shared-budget caller passes a smaller,
+* per-reservation value instead).
+*/
+function truncateAdditionalContext(value, limit = ADDITIONAL_CONTEXT_LIMIT) {
+	const alreadyMarked = value.endsWith(TRUNCATION_MARKER);
+	if (!alreadyMarked && value.length <= limit) return value;
+	if (limit <= 73) return TRUNCATION_MARKER.slice(0, Math.max(0, limit));
+	return (alreadyMarked ? value.slice(0, value.length - 73) : value).slice(0, limit - 73) + TRUNCATION_MARKER;
+}
+/**
+* Length of a Cursor stdout JSON's `additional_context` string field, or 0
+* when the stdout is not JSON, has no such field, or that field isn't a
+* string.
+* @param stdout - A native Cursor JSON stdout candidate.
+*/
+function additionalContextLength(stdout) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return 0;
+	}
+	return isPlainObject(parsed) && typeof parsed.additional_context === "string" ? parsed.additional_context.length : 0;
+}
+/**
+* Re-serialize a Cursor stdout string with its `additional_context` field
+* dropped entirely — used once the shared budget has no room left even for
+* a truncated marker. Returns the input byte-for-byte unchanged when it is
+* not JSON or has no string `additional_context` field.
+* @param stdout - A native Cursor JSON stdout candidate.
+*/
+function omitAdditionalContext(stdout) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return stdout;
+	}
+	if (!isPlainObject(parsed) || typeof parsed.additional_context !== "string") return stdout;
+	const { additional_context: _omitted, ...rest } = parsed;
+	return JSON.stringify(rest);
+}
+/**
+* Re-serialize a Cursor stdout string with its `additional_context` field
+* capped at `limit` characters. Returns the input byte-for-byte unchanged
+* when it is not JSON, has no string `additional_context` field, or that
+* field is already within the limit — so callers can wrap every return path
+* unconditionally.
+* @param stdout - A native Cursor JSON stdout candidate.
+* @param limit - Effective ceiling for this call (see {@link truncateAdditionalContext}).
+*/
+function capAdditionalContext(stdout, limit = ADDITIONAL_CONTEXT_LIMIT) {
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return stdout;
+	}
+	if (!isPlainObject(parsed) || typeof parsed.additional_context !== "string") return stdout;
+	const truncated = truncateAdditionalContext(parsed.additional_context, limit);
+	if (truncated === parsed.additional_context) return stdout;
+	return JSON.stringify({
+		...parsed,
+		additional_context: truncated
+	});
+}
+//#endregion
+//#region src/adapters/cursor/context-budget.ts
+/**
+* @module context-budget
+* Cursor-only shared `additional_context` budget registry. Cursor 3.18.25
+* runs every hook plugin configured on an event in its OWN process, then
+* merges their `additional_context` outputs with a 9-char `"\n\n---\n\n"`
+* separator and drops the WHOLE merge past 10,000 UTF-16 units — so no
+* single process can know the total by itself. This module gives every
+* plugin's process a shared, best-effort view of that total via a small
+* JSON registry file under the project's state dir (see `../../runtime/paths.ts`),
+* keyed by `${sessionId}|${event}|${generationId ?? ""}|${toolUseId ?? ""}`
+* (one key per merge group — Cursor merges preToolUse/postToolUse/
+* postToolUseFailure PER TOOL CALL, so `toolUseId` joins the key on those
+* three events), with entries older than 10s ignored (concurrent hooks on one
+* event fire within the same second). Best-effort, fail-open throughout: any
+* I/O or JSON error degrades to "no shared budget", i.e. the flat
+* per-response cap in `./context-limit.ts` alone — never a thrown error, and
+* never a Cursor-side regression.
+*/
+const REGISTRY_FILE = "cursor-context-budget.json";
+/** Matches Cursor 3.18.25's observed `"\n\n---\n\n"` merge separator length. */
+const SEPARATOR_LENGTH = 9;
+const ENTRY_WINDOW_MS = 1e4;
+/** Below this, a truncated value would carry more marker than budget — omit the field instead. */
+const OMIT_THRESHOLD = 173;
+function isRegistry(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function registryPath(stateDir) {
+	return join(stateDir, REGISTRY_FILE);
+}
+function budgetKey(ctx) {
+	return `${ctx.sessionId}|${ctx.event}|${ctx.generationId ?? ""}|${ctx.toolUseId ?? ""}`;
+}
+function loadRegistry(path) {
+	try {
+		if (!existsSync(path)) return {};
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		return isRegistry(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+function freshEntries(entries, now) {
+	return (entries ?? []).filter((entry) => now - entry.at <= ENTRY_WINDOW_MS);
+}
+/** Sum of a key's fresh entry lengths plus the separators already joining them. */
+function consumed(entries) {
+	return entries.reduce((total, entry) => total + entry.length, 0) + SEPARATOR_LENGTH * Math.max(0, entries.length - 1);
+}
+/**
+* Reserve room in the shared budget for one hook's `additional_context`
+* contribution to one (session, event, generation) merge group. `wanted` is
+* accepted for a symmetric call shape with {@link recordAdditionalContext}
+* but does not shrink `allowed` itself — the ceiling only depends on what
+* OTHER entries already hold; a smaller `wanted` simply means the caller
+* won't need all of it. Best-effort, fail-open: any I/O/JSON error returns
+* the full flat ceiling, as if no other plugin had run.
+* @param input - Registry location, reservation key, and the wanted length.
+*/
+function reserveAdditionalContext(input) {
+	try {
+		const now = input.now ?? Date.now();
+		const fresh = freshEntries(loadRegistry(registryPath(input.stateDir))[budgetKey(input)], now);
+		const separator = fresh.length > 0 ? SEPARATOR_LENGTH : 0;
+		return { allowed: Math.max(0, ADDITIONAL_CONTEXT_LIMIT - consumed(fresh) - separator) };
+	} catch {
+		return { allowed: ADDITIONAL_CONTEXT_LIMIT };
+	}
+}
+/**
+* Record the length actually emitted for one reservation, best-effort.
+* Prunes every key's stale entries while it holds the write so the registry
+* file stays bounded. Silently no-ops on any I/O error (fail-open).
+* @param input - Registry location, reservation key, and the emitted length.
+*/
+function recordAdditionalContext(input) {
+	try {
+		const now = input.now ?? Date.now();
+		const path = registryPath(input.stateDir);
+		const registry = loadRegistry(path);
+		const pruned = {};
+		for (const [key, entries] of Object.entries(registry)) {
+			const fresh = freshEntries(entries, now);
+			if (fresh.length > 0) pruned[key] = fresh;
+		}
+		const key = budgetKey(input);
+		pruned[key] = [...pruned[key] ?? [], {
+			at: now,
+			length: input.emitted
+		}];
+		atomicWrite(path, JSON.stringify(pruned));
+	} catch {}
+}
+/**
+* Cap a Cursor stdout JSON's `additional_context` against the shared budget
+* instead of the flat per-response ceiling alone. Falls back to the plain
+* cap (`./context-limit.ts`), unbudgeted, when `budget` is `undefined` or
+* the stdout carries no `additional_context` at all.
+* @param stdout - A native Cursor JSON stdout candidate.
+* @param budget - Shared budget context, or `undefined` to skip it.
+*/
+function capAdditionalContextWithBudget(stdout, budget) {
+	if (!budget) return capAdditionalContext(stdout);
+	const wanted = additionalContextLength(stdout);
+	if (wanted === 0) return stdout;
+	const { allowed } = reserveAdditionalContext({
+		...budget,
+		wanted
+	});
+	if (allowed < OMIT_THRESHOLD) {
+		process.stderr.write(`[fuse-harness] cursor: additional_context budget exhausted for ${budget.event} (allowed=${allowed})\n`);
+		return omitAdditionalContext(stdout);
+	}
+	const capped = capAdditionalContext(stdout, Math.min(ADDITIONAL_CONTEXT_LIMIT, allowed));
+	recordAdditionalContext({
+		...budget,
+		emitted: additionalContextLength(capped)
+	});
+	return capped;
+}
+//#endregion
 //#region src/adapters/cursor/respond.ts
 const AGENT_MESSAGE_EVENTS = /* @__PURE__ */ new Set([
 	"preToolUse",
@@ -6855,33 +7222,63 @@ function joinMessages(...values) {
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Render a portable policy prompt using the native Cursor event contract. */
+/**
+* Render a portable policy prompt using the native Cursor event contract.
+* Switches exhaustively on {@link CursorResponseKind} — the `never` default
+* fails to compile if a new kind is ever added without a matching case.
+* `contract.known === false` is not tested separately: the single
+* `UNKNOWN_EVENT` fallback in events.ts always pairs `known: false` with
+* `response: "neutral"`, so both collapse to the same `"{}"` branch.
+*/
 function toCursorResponse(prompt, eventName) {
 	const contract = cursorEventContract(eventName);
 	const message = formatPrompt(prompt);
-	if (!contract.known || contract.response === "neutral" || contract.response === "plugin-paths") return "{}";
-	if (contract.response === "post-context" || contract.response === "session-context") return JSON.stringify({ additional_context: message });
-	if (contract.response === "followup") return JSON.stringify({ followup_message: message });
-	if (contract.response === "compact-notice") return JSON.stringify({ user_message: prompt.userMessage ?? message });
-	if (contract.response === "submit-control") return JSON.stringify({
-		continue: prompt.kind !== "block",
-		user_message: prompt.userMessage ?? message
-	});
-	if (prompt.kind === "inform") return JSON.stringify({
-		permission: "allow",
-		...permissionMessages(eventName, prompt.userMessage, prompt.reason ? message : void 0)
-	});
-	const userMessage = prompt.kind === "ask" ? `[downgraded from ask — Cursor does not enforce approval for this event]\n${message}` : message;
-	return JSON.stringify({
-		permission: "deny",
-		...permissionMessages(eventName, userMessage, userMessage)
-	});
-}
-/** Convert a shared lifecycle handler's output to the native Cursor envelope. */
-function toCursorLifecycleResponse(stdout, eventName) {
+	switch (contract.response) {
+		case "neutral":
+		case "plugin-paths": return "{}";
+		case "post-context":
+		case "session-context": return capAdditionalContext(JSON.stringify({ additional_context: message }));
+		case "followup": return JSON.stringify({ followup_message: message });
+		case "compact-notice": return JSON.stringify({ user_message: prompt.userMessage ?? message });
+		case "submit-control": return JSON.stringify({
+			continue: prompt.kind !== "block",
+			user_message: prompt.userMessage ?? message
+		});
+		case "permission": {
+			if (prompt.kind === "inform") return JSON.stringify({
+				permission: "allow",
+				...permissionMessages(eventName, prompt.userMessage, prompt.reason ? message : void 0)
+			});
+			const userMessage = prompt.kind === "ask" ? `[downgraded from ask — Cursor does not enforce approval for this event]\n${message}` : message;
+			return JSON.stringify({
+				permission: "deny",
+				...permissionMessages(eventName, userMessage, userMessage)
+			});
+		}
+		default: return contract.response;
+	}
+}
+/**
+* Convert a shared lifecycle handler's output to the native Cursor envelope.
+* The `neutral` and empty-`text` short circuits run before the switch (they
+* apply identically across several {@link CursorResponseKind} values), so
+* only the remaining 7 kinds need a case — `never` below still catches a
+* future kind added without updating this function. This is the single
+* point every Cursor stdout passes through exactly once (see `handle.ts`'s
+* `handleHook`), so `budget` — when supplied — is reserved from and
+* recorded into here, never at the inner `toCursorResponse` pre-cap (that
+* one's output is re-capped here again on the native-passthrough branch
+* below, so budgeting it too would double-count the same contribution).
+* @param stdout - The shared handler's raw stdout for this hook invocation.
+* @param eventName - Cursor's raw `hook_event_name`.
+* @param budget - Shared `additional_context` budget context (see
+* {@link CursorBudgetContext}); `undefined` falls back to the flat
+* per-response 10,000-char cap, unbudgeted.
+*/
+function toCursorLifecycleResponse(stdout, eventName, budget) {
 	const contract = cursorEventContract(eventName);
 	const native = parseNativeCursorStdout(stdout, eventName);
-	if (native !== null) return native;
+	if (native !== null) return capAdditionalContextWithBudget(native, budget);
 	let text = stdout;
 	let decision;
 	let userMessage = "";
@@ -6903,23 +7300,27 @@ function toCursorLifecycleResponse(stdout, eventName) {
 	}
 	if (contract.response === "neutral") return "{}";
 	if (!text) return contract.response === "permission" ? "{\"permission\":\"allow\"}" : "{}";
-	if (contract.response === "session-context" || contract.response === "post-context") return JSON.stringify({ additional_context: text });
-	if (contract.response === "permission") {
-		const permission = decision === "deny" || decision === "ask" ? "deny" : "allow";
-		const denied = permission === "deny";
-		if (eventName === "subagentStart" && !denied) return "{\"permission\":\"allow\"}";
-		return JSON.stringify({
-			permission,
-			...permissionMessages(eventName, userMessage || (denied ? decisionMessage || agentMessage : ""), agentMessage || (denied ? decisionMessage || userMessage : structured ? "" : text))
+	switch (contract.response) {
+		case "session-context":
+		case "post-context": return capAdditionalContextWithBudget(JSON.stringify({ additional_context: text }), budget);
+		case "permission": {
+			const permission = decision === "deny" || decision === "ask" ? "deny" : "allow";
+			const denied = permission === "deny";
+			if (eventName === "subagentStart" && !denied) return "{\"permission\":\"allow\"}";
+			return JSON.stringify({
+				permission,
+				...permissionMessages(eventName, userMessage || (denied ? decisionMessage || agentMessage : ""), agentMessage || (denied ? decisionMessage || userMessage : structured ? "" : text))
+			});
+		}
+		case "followup": return JSON.stringify({ followup_message: text });
+		case "compact-notice": return JSON.stringify({ user_message: text });
+		case "submit-control": return JSON.stringify({
+			continue: true,
+			user_message: text
 		});
+		case "plugin-paths": return "{}";
+		default: return contract.response;
 	}
-	if (contract.response === "followup") return JSON.stringify({ followup_message: text });
-	if (contract.response === "compact-notice") return JSON.stringify({ user_message: text });
-	if (contract.response === "submit-control") return JSON.stringify({
-		continue: true,
-		user_message: text
-	});
-	return "{}";
 }
 //#endregion
 //#region src/runtime/lifecycle-bridge.ts
@@ -11062,6 +11463,63 @@ function rawEventName(payload) {
 	return typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
 }
 /**
+* `payload.tool_input` parsed into an object when it's a JSON STRING —
+* Cursor's real wire format for `beforeMCPExecution`/`afterMCPExecution`
+* (ground truth), unlike every other harness (and Cursor's own
+* `preToolUse`/`postToolUse`), which always sends it as an object already.
+* `undefined` when `tool_input` is already an object, absent, or fails to
+* parse into one (fail-open — the caller then keeps the original value).
+* @param payload - The raw hook payload.
+*/
+function cursorParsedToolInput(payload) {
+	const raw = payload.tool_input;
+	if (typeof raw !== "string") return void 0;
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* `id === "cursor"` only: project the already-resolved canonical `tool_name`
+* (`event.tool`, normalized by {@link normalizeEvent}) and `cwd` (the project
+* root resolved via `cursorProjectCwd`, already applied to `opts.cwd`) onto a
+* shallow payload copy — the single passage point for every downstream
+* consumer that reads `payload.tool_name`/`payload.cwd`/`payload.tool_input`
+* RAW instead of `event.tool`/`opts.cwd`/`event.input` (lifecycle-bridge's
+* `failure-lesson.ts`/`agent-memory.ts`, handle-scope-async's aipilot/memory
+* dispatchers — including `doc-cache-gate.ts`'s `libraryOf`, which never
+* `JSON.parse`s a string `tool_input` itself — and the seo scope's
+* `post-tool-use.ts`). `tool_input` is additionally replaced by its parsed
+* object form via {@link cursorParsedToolInput} when Cursor sent it as a
+* JSON string (`beforeMCPExecution`/`afterMCPExecution`). Cursor's own wire
+* values ("Shell", `MCP:<tool>`, a bare `workspace_roots` array with no
+* `cwd` field, a stringified `tool_input`, …) are preserved under
+* `cursor_tool_name`/`cursor_cwd`/`cursor_tool_input` so nothing is lost.
+* Every other harness id is untouched (returns the SAME object,
+* byte-identical).
+* @param payload - The raw hook payload.
+* @param event - The already-normalized event (`event.tool` is canonical).
+* @param cwd - The resolved project root for this invocation.
+* @param id - Harness adapter id.
+*/
+function cursorRawPayloadProjection(payload, event, cwd, id) {
+	if (id !== "cursor") return payload;
+	const parsedToolInput = cursorParsedToolInput(payload);
+	return {
+		...payload,
+		cursor_tool_name: payload.tool_name,
+		cursor_cwd: payload.cwd,
+		tool_name: event.tool,
+		cwd,
+		...parsedToolInput ? {
+			cursor_tool_input: payload.tool_input,
+			tool_input: parsedToolInput
+		} : {}
+	};
+}
+/**
 * The full hook handler: on a PRE event it gates the tool-use (stateless guards
 * then APEX gates from the session track) and returns the native response; on a
 * POST event it records the activity into the track. The loop that makes the
@@ -11076,6 +11534,7 @@ async function handleHookCore(id, payload, opts) {
 			cwd: cursorCwd
 		};
 	}
+	const hookPayload = cursorRawPayloadProjection(payload, event, opts.cwd, id);
 	const rawPrompt = payload.prompt;
 	const userPrompt = typeof rawPrompt === "string" || Array.isArray(rawPrompt) ? promptText(rawPrompt) : void 0;
 	if (id === "codex" && rawEventName(payload) === "UserPromptSubmit" && userPrompt !== void 0) submitCodexConfirmation(event.sessionId, userPrompt, opts.now, opts.home, codexPromptOrigin(payload));
@@ -11090,12 +11549,12 @@ async function handleHookCore(id, payload, opts) {
 		exit: 0
 	};
 	if (id === "codex" && rawEventName(payload) === "SessionStart") resyncCodexAgents();
-	const asyncOut = await asyncScopeStdout(opts.scope, rawEventName(payload), payload, opts.cwd, opts.now, id);
+	const asyncOut = await asyncScopeStdout(opts.scope, rawEventName(payload), hookPayload, opts.cwd, opts.now, id);
 	if (asyncOut !== null) return {
 		stdout: asyncOut,
 		exit: 0
 	};
-	const life = lifecycleStdout(payload, opts.cwd, opts.scope ?? "core", opts.now, id);
+	const life = lifecycleStdout(hookPayload, opts.cwd, opts.scope ?? "core", opts.now, id);
 	if (life !== null) return {
 		stdout: id === "claude-code" ? attachBudgetRecap(life, rawEventName(payload), event.sessionId, opts.cwd, opts.now) : life,
 		exit: 0
@@ -11110,7 +11569,7 @@ async function handleHookCore(id, payload, opts) {
 	}
 	if (event.phase === "post") return handlePost({
 		id,
-		payload,
+		payload: hookPayload,
 		event,
 		framework,
 		mcpDir,
@@ -11120,7 +11579,7 @@ async function handleHookCore(id, payload, opts) {
 	});
 	return handlePre({
 		id,
-		payload,
+		payload: hookPayload,
 		event,
 		framework,
 		mcpDir,
@@ -11132,13 +11591,37 @@ async function handleHookCore(id, payload, opts) {
 /**
 * Run one hook and adapt every Cursor scope outcome at the common runtime exit.
 * Other harnesses retain the core handler's stdout and exit status unchanged.
+* Cursor's shared `additional_context` budget context (see
+* `../adapters/cursor/context-budget.ts`) is assembled here too — this is
+* the single point every Cursor stdout passes through exactly once, so it's
+* also the single point that reserves from and records into the registry.
+* With no `session_id`/`conversation_id` at all, `sessionId` is `""` — the
+* registry key would degenerate to one bucket shared by every session-less
+* call on the same (cwd, event) pair, so `budget` stays `undefined` instead
+* (falls back to the flat per-response cap in `toCursorLifecycleResponse`,
+* with zero registry I/O). `stateDir` honors `opts.home` (test-only OS home
+* override, see `HandleOptions`) so tests never need the real `os.homedir()`.
 */
 async function handleHook(id, payload, opts) {
 	const outcome = await handleHookCore(id, payload, opts);
 	if (id !== "cursor") return outcome;
+	const eventName = rawEventName(payload);
+	const cursorEvent = normalizeEvent(id, payload);
+	const cwd = cursorProjectCwd(cursorEvent.cwd, cursorEvent.workspaceRoots ?? [], cursorEvent.filePath, opts.cwd);
+	const sessionId = cursorEvent.sessionId;
+	const generationId = typeof payload.generation_id === "string" && payload.generation_id ? payload.generation_id : void 0;
+	const toolUseId = typeof payload.tool_use_id === "string" && payload.tool_use_id ? payload.tool_use_id : void 0;
+	const stateDir = join(fuseHarnessHome(opts.home), "state", projectHash$1(cwd));
+	const budget = sessionId ? {
+		stateDir,
+		sessionId,
+		event: eventName,
+		generationId,
+		toolUseId
+	} : void 0;
 	return {
 		...outcome,
-		stdout: toCursorLifecycleResponse(outcome.stdout, rawEventName(payload))
+		stdout: toCursorLifecycleResponse(outcome.stdout, eventName, budget)
 	};
 }
 //#endregion