@gotcos/glasses-server 6.52.3 → 6.53.1

package/server/lib/attached-provider-adapter.ts

@@ -59,8 +59,14 @@
 //   aborted        a child existed, we terminated it, no prompt byte was written
 //   ambiguous      we called write(); we cannot prove the provider did not act
 //   delivered      clean exit 0 AND the provider echoed our exact target id
+//   cancelled      (6.53.0) we called write(), then the USER asked us to stop and we
+//                  killed the child. The provider may have acted on part of the turn,
+//                  but that is the user's decision, not an unknown: nothing is lost and
+//                  nothing may be sent again by COS on its own.
 //
-// Only the first two are provably safe to report as a clean failure.
+// Only the first two are provably safe to report as a clean failure. `cancelled` is not
+// a clean failure either. It avoids a fence only when the whole spawned process tree was
+// positively reaped; doubt or a surviving member is ambiguous and fences fail-closed.
 // `attachedDeliveryAmbiguous` makes that mapping total, and treats any state it
 // does not recognise as ambiguous, so adding a state later cannot silently open
 // the replay path.
@@ -87,7 +93,7 @@
 import { accessSync, constants as fsConstants, statSync } from 'node:fs'
 import { delimiter, isAbsolute, join } from 'node:path'
 import { homedir } from 'node:os'
-import { spawn as nodeSpawn } from 'node:child_process'
+import { execFileSync, spawn as nodeSpawn } from 'node:child_process'
 
 import { isValidNativeThreadId } from './native-thread-id.js'
 import { isBindableProvider, type BindableProvider } from './agent-session-binding-store.js'
@@ -129,9 +135,11 @@ export type AttachedTurnFailure =
   | 'no_native_id_returned'
   | 'native_id_mismatch'
   | 'adapter_internal_error'
+  /** 6.53.0: the caller's abort signal fired (a cancel from the lens). Never ambiguous. */
+  | 'cancelled'
 
 /** See the header. The boundary is the first byte handed to the child's stdin. */
-export type AttachedDeliveryState = 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered'
+export type AttachedDeliveryState = 'not_attempted' | 'aborted' | 'ambiguous' | 'delivered' | 'cancelled'
 
 /**
  * Bounded classification of a provider's stderr.
@@ -202,7 +210,10 @@ export type AttachedTurnResult = AttachedTurnSuccess | AttachedTurnFailureResult
  */
 export function attachedDeliveryAmbiguous(result: AttachedTurnResult): boolean {
   if (result.ok) return false
-  return result.delivery !== 'not_attempted' && result.delivery !== 'aborted'
+  // `cancelled` is listed by name, not inferred: a state added later still defaults to
+  // fenced. It is not ambiguous because the user ended the turn, and a fence would lock
+  // them out of the thread they just stopped (plan validation B2, 2026-09-21).
+  return result.delivery !== 'not_attempted' && result.delivery !== 'aborted' && result.delivery !== 'cancelled'
 }
 
 // ---------------------------------------------------------------------------
@@ -305,6 +316,12 @@ export interface AttachedTurnDeps {
    * process group on the developer's machine.
    */
   terminate: (child: AttachedChildProcess, signal: NodeJS.Signals) => void
+  /**
+   * True while any verified member of the provider process tree is still live.
+   * Unknown/probe failure MUST read as true: a cancellation may only be reported
+   * reaped after the whole tree is positively gone.
+   */
+  processTreeAlive: (child: AttachedChildProcess) => boolean
   /**
    * Argv builder. Optional, defaults to the real one.
    *
@@ -342,6 +359,13 @@ export interface AttachedTurnRequest {
   deps: AttachedTurnDeps
   /** Wall-clock budget for the provider run. Omitted uses the default. */
   timeoutMs?: number
+  /**
+   * 6.53.0: the cancel from the lens. Checked before the spawn and before the prompt is
+   * written (a turn that never started is `cancelled` with delivery `not_attempted` or
+   * `aborted`); after the write it stops the child's process group, SIGTERM then SIGKILL
+   * after CANCEL_KILL_GRACE_MS. A natural exit 0 with our id that lands first still wins.
+   */
+  abortSignal?: AbortSignal
 }
 
 /**
@@ -358,6 +382,14 @@ export const MAX_ATTACHED_TIMEOUT_MS = 30 * 60_000
 /** SIGTERM first; this is how long the child gets before SIGKILL. */
 export const KILL_GRACE_MS = 2_000
 
+/**
+ * The same escalation for a CANCEL, with a longer grace. A timeout is a child that has
+ * stopped answering; a cancel lands on a child that is working and may be mid-write, and
+ * canary C3 (2026-09-21) saw `claude -p --resume` end cleanly on SIGTERM in about 4 s with
+ * a transcript that parses and resumes. Two seconds would SIGKILL it inside that window.
+ */
+export const CANCEL_KILL_GRACE_MS = 5_000
+
 /**
  * Last-resort settle after SIGKILL.
  *
@@ -778,6 +810,11 @@ async function run(
   if (bannedArg !== null) {
     return fail('unsupported_policy', 'not_attempted', { ...base, detail: `banned_arg:${bannedArg}`, durationMs: duration() })
   }
+  // 6.53.0: a cancel that landed before the spawn. No process is created, so nothing can
+  // have been delivered; the turn ends `cancelled`, which the route never fences.
+  if (request.abortSignal?.aborted === true) {
+    return fail('cancelled', 'not_attempted', { ...base, detail: 'before_spawn', durationMs: duration() })
+  }
   let child: AttachedChildProcess
   try {
     child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv() })
@@ -830,7 +867,7 @@ async function run(
   }
 
   try {
-    return await driveChild({ child, pid, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt })
+    return await driveChild({ child, pid, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt, abortSignal: request.abortSignal })
   } finally {
     // Every path: success, mismatch, non-zero exit, timeout, throw. A leaked
     // entry lets a recycled pid inherit our self-ownership claim.
@@ -847,6 +884,15 @@ function safeTerminate(deps: AttachedTurnDeps, child: AttachedChildProcess, sign
   }
 }
 
+function safeProcessTreeAlive(deps: AttachedTurnDeps, child: AttachedChildProcess): boolean {
+  try {
+    return deps.processTreeAlive(child) === true
+  } catch {
+    // A failed ownership probe is not proof that the process tree is gone.
+    return true
+  }
+}
+
 function safeRelease(deps: AttachedTurnDeps, pid: number): void {
   try {
     deps.releaseSpawn(pid)
@@ -864,10 +910,11 @@ interface DriveInput {
   prompt: string
   timeoutMs: number
   startedAt: number
+  abortSignal?: AbortSignal
 }
 
 function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
-  const { child, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt } = input
+  const { child, deps, provider, nativeThreadId, prompt, timeoutMs, startedAt, abortSignal } = input
 
   return new Promise<AttachedTurnResult>((resolve) => {
     /** Distinct ids seen. More than one means a fork happened; see the header. */
@@ -879,16 +926,22 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
     let exitCode: number | null = null
     let settled = false
     let timedOut = false
+    /** 6.53.0: the caller's abort fired after the child existed. Read before `timedOut`. */
+    let cancelled = false
     let spawnErrored = false
+    let onAbort: (() => void) | null = null
 
     let deadline: ReturnType<typeof setTimeout> | null = null
     let graceTimer: ReturnType<typeof setTimeout> | null = null
     let forceTimer: ReturnType<typeof setTimeout> | null = null
+    let treePollTimer: ReturnType<typeof setTimeout> | null = null
+    let terminalObserved = false
 
     const clearTimers = () => {
       if (deadline) { clearTimeout(deadline); deadline = null }
       if (graceTimer) { clearTimeout(graceTimer); graceTimer = null }
       if (forceTimer) { clearTimeout(forceTimer); forceTimer = null }
+      if (treePollTimer) { clearTimeout(treePollTimer); treePollTimer = null }
     }
 
     const duration = () => readDuration(deps, startedAt)
@@ -897,6 +950,10 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
       if (settled) return
       settled = true
       clearTimers()
+      if (onAbort) {
+        try { abortSignal?.removeEventListener('abort', onAbort) } catch { /* nothing to release */ }
+        onAbort = null
+      }
       resolve(result)
     }
 
@@ -955,6 +1012,10 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
     }
 
     const finishTerminal = () => {
+      // The CLI wrapper may close before a tool in a separate process group.
+      // Keep the escalation timers alive until the verified whole tree is gone.
+      if ((cancelled || timedOut) && safeProcessTreeAlive(deps, child)) return
+
       // Drain whatever sat in the trailing partial line before judging.
       if (stdoutTail.length > 0) {
         for (const id of extractNativeIdsFromLine(stdoutTail)) {
@@ -963,6 +1024,13 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
         stdoutTail = ''
       }
 
+      // 6.53.0: a cancel outranks every failure below, the timeout included (a cancel in
+      // the timeout's kill grace is still the user's decision). It does NOT outrank a
+      // clean exit 0 that echoed our exact id: that turn finished before the stop landed,
+      // and reporting it cancelled would hide a delivered turn.
+      if (cancelled && !(exitCode === 0 && delivery === 'ambiguous' && observedIds.length === 1 && observedIds[0] === nativeThreadId)) {
+        return settleFailure('cancelled', { delivery: 'cancelled' })
+      }
       if (timedOut) return settleFailure('timeout')
       if (spawnErrored) return settleFailure('spawn_failed', { detail: 'child_error' })
 
@@ -1018,6 +1086,7 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
       })
       child.on('close', (code: number | null) => {
         if (typeof code === 'number') exitCode = code
+        terminalObserved = true
         finishTerminal()
       })
     } catch {
@@ -1051,15 +1120,60 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
       safeTerminate(deps, child, 'SIGTERM')
       graceTimer = setTimeout(() => {
         safeTerminate(deps, child, 'SIGKILL')
-        forceTimer = setTimeout(() => {
+        const forceAt = Date.now() + FORCE_SETTLE_MS
+        const pollForTreeExit = () => {
+          if (settled) return
+          if (terminalObserved && !safeProcessTreeAlive(deps, child)) return finishTerminal()
+          if (Date.now() < forceAt) {
+            treePollTimer = setTimeout(pollForTreeExit, 25)
+            return
+          }
           // A child that survived SIGKILL cannot be reached from here, and
           // blocking forever would wedge the coordinator and any Control drain
-          // behind it.
-          settleFailure('timeout', { detail: 'unreaped', reaped: false })
-        }, FORCE_SETTLE_MS)
+          // behind it. A cancel that landed during this escalation still reads
+          // as the user's (6.53.0).
+          if (cancelled) settleFailure('cancelled', { delivery: 'cancelled', detail: 'unreaped', reaped: false })
+          else settleFailure('timeout', { detail: 'unreaped', reaped: false })
+        }
+        forceTimer = setTimeout(pollForTreeExit, 25)
       }, KILL_GRACE_MS)
     }, timeoutMs)
 
+    // --- the cancel (6.53.0) ---------------------------------------------------
+    // Registered before the write so an abort from here on is seen. The group SIGTERM then
+    // SIGKILL is the timeout's own sequence with a longer grace; the force settle keeps a
+    // child that survives SIGKILL from wedging the route's claim.
+    if (abortSignal) {
+      onAbort = () => {
+        if (settled || cancelled) return
+        cancelled = true
+        // A timeout already escalating keeps its own timers; the result still reads
+        // cancelled (finishTerminal checks `cancelled` first).
+        if (timedOut) return
+        if (deadline) { clearTimeout(deadline); deadline = null }
+        safeTerminate(deps, child, 'SIGTERM')
+        graceTimer = setTimeout(() => {
+          safeTerminate(deps, child, 'SIGKILL')
+          const forceAt = Date.now() + FORCE_SETTLE_MS
+          const pollForTreeExit = () => {
+            if (settled) return
+            if (terminalObserved && !safeProcessTreeAlive(deps, child)) return finishTerminal()
+            if (Date.now() < forceAt) {
+              treePollTimer = setTimeout(pollForTreeExit, 25)
+              return
+            }
+            settleFailure('cancelled', { delivery: 'cancelled', detail: 'unreaped', reaped: false })
+          }
+          forceTimer = setTimeout(pollForTreeExit, 25)
+        }, CANCEL_KILL_GRACE_MS)
+      }
+      try {
+        abortSignal.addEventListener('abort', onAbort, { once: true })
+      } catch {
+        onAbort = null
+      }
+    }
+
     // --- deliver the prompt --------------------------------------------------
     const stdin = child.stdin
     if (!stdin || typeof stdin.write !== 'function' || typeof stdin.end !== 'function' || !child.stdout) {
@@ -1078,6 +1192,15 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
       /* an stdin that cannot take a listener still gets the write attempt below */
     }
 
+    // 6.53.0: a cancel that landed between the spawn check and here (a dependency that
+    // yielded, or one that aborted synchronously). No prompt byte is written: the child is
+    // killed and the turn is provably undelivered.
+    if (abortSignal?.aborted === true) {
+      safeTerminate(deps, child, 'SIGKILL')
+      delivery = 'aborted'
+      return settleFailure('cancelled', { detail: 'before_write', reaped: false })
+    }
+
     try {
       // THE BOUNDARY. From this call on, we cannot prove the provider did not
       // act on the prompt, so every non-success outcome is ambiguous.
@@ -1097,6 +1220,207 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
 // Production wiring
 // ---------------------------------------------------------------------------
 
+interface AttachedProcessRow {
+  pid: number
+  ppid: number
+  pgid: number
+}
+
+/**
+ * Read the live parent and process-group graph for an attached provider.
+ *
+ * Codex may put a shell tool in its OWN process group. Signalling only the
+ * detached CLI group then kills Codex while the tool is re-parented to pid 1.
+ * This probe is synchronous because termination is a one-shot ownership
+ * boundary: the parent graph must be captured before the CLI can exit and erase
+ * it. A failed probe still signals the original root group below, but latches
+ * uncertainty so the adapter cannot later report a false whole-tree reap.
+ */
+function readAttachedProcessRows(): AttachedProcessRow[] | null {
+  if (process.platform === 'win32') return []
+  try {
+    const output = execFileSync('/bin/ps', ['-axo', 'pid=,ppid=,pgid='], {
+      encoding: 'utf8',
+      timeout: 1_000,
+      maxBuffer: 2 * 1024 * 1024,
+    })
+    return output.split('\n').flatMap(line => {
+      const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s*$/)
+      if (!match) return []
+      const pid = Number(match[1])
+      const ppid = Number(match[2])
+      const pgid = Number(match[3])
+      if (![pid, ppid, pgid].every(Number.isSafeInteger) || pid <= 0 || ppid < 0 || pgid <= 0) return []
+      return [{ pid, ppid, pgid }]
+    })
+  } catch {
+    return null
+  }
+}
+
+function attachedProcessTree(rows: AttachedProcessRow[], roots: Iterable<number>): AttachedProcessRow[] {
+  const owned = new Set<number>(roots)
+  let changed = true
+  while (changed) {
+    changed = false
+    for (const row of rows) {
+      if (!owned.has(row.pid) && owned.has(row.ppid)) {
+        owned.add(row.pid)
+        changed = true
+      }
+    }
+  }
+  return rows.filter(row => owned.has(row.pid))
+}
+
+function signalPid(pid: number, signal: NodeJS.Signals): void {
+  try { process.kill(pid, signal) } catch { /* already terminal or unavailable */ }
+}
+
+function signalGroup(pgid: number, signal: NodeJS.Signals): void {
+  if (process.platform === 'win32') return
+  try { process.kill(-pgid, signal) } catch { /* already terminal or unavailable */ }
+}
+
+/**
+ * Stop the provider plus every descendant visible before its parent link is
+ * lost. Captured pid/start identities survive the SIGTERM grace, so SIGKILL can
+ * still reach an uncooperative tool after the CLI has exited and the tool has
+ * been re-parented to launchd. Identities are re-checked before reuse; a recycled
+ * pid is never signalled from remembered state.
+ */
+function terminateAttachedProcessTree(
+  child: AttachedChildProcess,
+  signal: NodeJS.Signals,
+  rememberedByRoot: Map<number, Map<number, number>>,
+  uncertainRoots: Set<number>,
+): void {
+  const rootPid = child.pid
+  if (typeof rootPid !== 'number' || !Number.isSafeInteger(rootPid) || rootPid <= 0) {
+    try { ;(child as any).kill?.(signal) } catch { /* nothing further is available */ }
+    return
+  }
+
+  const remembered = rememberedByRoot.get(rootPid) ?? new Map<number, number>()
+  rememberedByRoot.set(rootPid, remembered)
+
+  // Only identities that still name the same kernel process may seed a fresh
+  // descendant scan. This is what makes the five-second SIGKILL safe after the
+  // provider leader has already disappeared.
+  const rememberedRoots: number[] = []
+  for (const [pid, startedAt] of remembered) {
+    if (realProcessStartMs(pid) === startedAt) rememberedRoots.push(pid)
+  }
+
+  const rows = readAttachedProcessRows()
+  if (rows === null) uncertainRoots.add(rootPid)
+  const knownRootStart = remembered.get(rootPid)
+  const currentRootStart = realProcessStartMs(rootPid)
+  const rootVerified = currentRootStart !== null
+    && (knownRootStart === undefined || currentRootStart === knownRootStart)
+  if (currentRootStart === null && rows?.some(row => row.pid === rootPid)) uncertainRoots.add(rootPid)
+  if (knownRootStart === undefined && currentRootStart !== null) remembered.set(rootPid, currentRootStart)
+  const roots = [...rememberedRoots]
+  if (rootVerified && !roots.includes(rootPid)) roots.push(rootPid)
+  const tree = rows === null ? [] : attachedProcessTree(rows, roots)
+  for (const row of tree) {
+    const startedAt = realProcessStartMs(row.pid)
+    if (startedAt !== null) remembered.set(row.pid, startedAt)
+    else uncertainRoots.add(rootPid)
+  }
+
+  // A child in a separate group must be signalled BEFORE the CLI group. If the
+  // CLI exits first, macOS reparents that child to pid 1 and the relationship is
+  // no longer discoverable.
+  const descendantGroups = new Set(
+    tree.filter(row => row.pid !== rootPid && row.pgid !== rootPid).map(row => row.pgid),
+  )
+  for (const pgid of descendantGroups) signalGroup(pgid, signal)
+  for (const row of tree) {
+    if (row.pid !== rootPid) signalPid(row.pid, signal)
+  }
+
+  const rootGroupStillOwned = rootVerified || tree.some(row => row.pgid === rootPid)
+  if (rootGroupStillOwned) signalGroup(rootPid, signal)
+
+  // Direct-child fallback covers a spawn that failed before setsid established
+  // the detached group, and is harmless after a successful group signal.
+  try { ;(child as any).kill?.(signal) } catch { /* already terminal */ }
+
+}
+
+function attachedProcessTreeAlive(
+  child: AttachedChildProcess,
+  rememberedByRoot: Map<number, Map<number, number>>,
+  uncertainRoots: Set<number>,
+): boolean {
+  const rootPid = child.pid
+  if (typeof rootPid !== 'number' || !Number.isSafeInteger(rootPid) || rootPid <= 0) return false
+  const remembered = rememberedByRoot.get(rootPid)
+  const rows = readAttachedProcessRows()
+  // A failed global process-table read cannot prove closure. Keep the record so
+  // the SIGKILL escalation can still target identities captured before TERM.
+  if (rows === null) return true
+
+  let anyLive = false
+  if (remembered) {
+    const verifiedRoots: number[] = []
+    for (const [pid, startedAt] of remembered) {
+      const rowExists = rows.some(row => row.pid === pid)
+      if (!rowExists) {
+        // Absence from a successful full process-table snapshot is the only
+        // positive proof this identity is gone.
+        remembered.delete(pid)
+        continue
+      }
+      const currentStart = realProcessStartMs(pid)
+      if (currentStart === startedAt) {
+        anyLive = true
+        verifiedRoots.push(pid)
+      } else if (currentStart === null) {
+        // The pid still exists but its start could not be read. That is doubt,
+        // not death; retain the identity and permanently fail this cancellation
+        // toward the route's ambiguity fence.
+        anyLive = true
+        uncertainRoots.add(rootPid)
+      } else {
+        // A different start means PID reuse. The original identity is gone and
+        // the replacement may never be signalled from remembered state.
+        remembered.delete(pid)
+      }
+    }
+    const fresh = attachedProcessTree(rows, verifiedRoots)
+    for (const row of fresh) {
+      const startedAt = realProcessStartMs(row.pid)
+      if (startedAt !== null) {
+        remembered.set(row.pid, startedAt)
+        anyLive = true
+      } else {
+        anyLive = true
+        uncertainRoots.add(rootPid)
+      }
+    }
+  }
+
+  // Once a snapshot/start probe missed part of the tree, later ancestry cannot
+  // reconstruct a process that may already have been re-parented. Never convert
+  // that uncertainty into reaped:true; the route will fence after force-settle.
+  if (uncertainRoots.has(rootPid)) anyLive = true
+
+  try {
+    process.kill(-rootPid, 0)
+    anyLive = true
+  } catch (error: any) {
+    if (error?.code !== 'ESRCH') anyLive = true
+  }
+
+  if (!anyLive) {
+    rememberedByRoot.delete(rootPid)
+    uncertainRoots.delete(rootPid)
+  }
+  return anyLive
+}
+
 /**
  * The real dependency set.
  *
@@ -1106,6 +1430,8 @@ function driveChild(input: DriveInput): Promise<AttachedTurnResult> {
  * which is the one answer this module must never invent.
  */
 export function realAttachedTurnDeps(preflight: () => AttachedPreflightVerdict): AttachedTurnDeps {
+  const rememberedProcesses = new Map<number, Map<number, number>>()
+  const uncertainProcessTrees = new Set<number>()
   return {
     now: () => Date.now(),
     preflight,
@@ -1121,23 +1447,7 @@ export function realAttachedTurnDeps(preflight: () => AttachedPreflightVerdict):
     processStartMs: pid => realProcessStartMs(pid),
     recordSpawn: (pid, startMs) => recordCosSpawn(pid, startMs),
     releaseSpawn: pid => releaseCosSpawn(pid),
-    terminate: (child, signal) => {
-      const pid = child.pid
-      if (typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0) {
-        try {
-          // Negative pid = process group, reachable because we spawned
-          // detached. Kills the CLI's own children too.
-          process.kill(-pid, signal)
-          return
-        } catch {
-          /* fall through to the direct signal */
-        }
-      }
-      try {
-        ;(child as any).kill?.(signal)
-      } catch {
-        /* nothing further is available */
-      }
-    },
+    terminate: (child, signal) => terminateAttachedProcessTree(child, signal, rememberedProcesses, uncertainProcessTrees),
+    processTreeAlive: child => attachedProcessTreeAlive(child, rememberedProcesses, uncertainProcessTrees),
   }
 }

package/server/lib/claude-hooks-installer.ts

@@ -46,6 +46,15 @@ export interface HookSubscription {
  * UserPromptSubmit would leave a running turn reading idle). The write is a few
  * milliseconds. PermissionRequest must be synchronous to return a decision; the rest
  * are fire-and-forget.
+ *
+ * 6.53.0: PreToolUse is SYNCHRONOUS with NO matcher, so the script's halt check sees every
+ * tool call and can stop a desk run (cancel from the lens). Canaries, 2026-09-21: the stop
+ * needs `permissionDecision: deny` plus `continue: false` (C1b; `continue: false` alone
+ * still ran the tool), the check costs about 11 ms per call (C2), and a hook that times out
+ * (C6) or exits 1 (C7) lets the tool run, so a broken hook fails open. ONE block per event,
+ * because the merge keeps exactly one of ours per event and status requires it: the script
+ * spools only AskUserQuestion and ExitPlanMode, which is what the old async matcher block
+ * did. Changing this row makes every existing install read `drift` until Install hooks.
  */
 export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'SessionStart', async: false, timeout: 5 },
@@ -55,7 +64,7 @@ export const HOOK_SUBSCRIPTIONS: readonly HookSubscription[] = [
   { event: 'StopFailure', async: true, timeout: 10 },
   { event: 'PermissionRequest', async: false, timeout: 130 },
   { event: 'PermissionDenied', async: true, timeout: 10 },
-  { event: 'PreToolUse', matcher: 'AskUserQuestion|ExitPlanMode', async: true, timeout: 10 },
+  { event: 'PreToolUse', async: false, timeout: 5 },
   { event: 'PostToolUse', async: true, timeout: 10 },
   { event: 'PostToolUseFailure', async: true, timeout: 10 },
   { event: 'Notification', matcher: 'permission_prompt|idle_prompt|elicitation_dialog|agent_needs_input', async: true, timeout: 10 },

package/server/lib/cursor-model-catalog.ts

@@ -20,12 +20,19 @@ const DEFAULT_REFRESH_TIMEOUT_MS = 7_000
 /**
  * Stable slot → CLI model id mapping.
  * Composer stays pinned (no versioned high-fast family). Grok high-fast is
- * chosen at catalog build: newest `cursor-grok-<ver>-high-fast` in `agent
- * models`. This grok id is only the fallback when the live list has none.
- * `xhigh-fast` is a different SKU and is never selected here.
+ * chosen at catalog build: newest `grok-<ver>-high-fast` or
+ * `cursor-grok-<ver>-high-fast` proven by `agent models`. The constant records
+ * the current canonical id; it is not returned when the live catalog does not
+ * prove that model exists. `xhigh-fast` is a different SKU and is never selected.
+ *
+ * 2026-09-21 (6.53.0): Grok 4.7 shipped under a NEW id scheme with no `cursor-`
+ * prefix (`grok-4.7-high-fast`, per `cursor-agent models` on CLI 2026.09.18,
+ * which still lists the old `cursor-grok-4.6-high-fast` and 4.5 ids). The ask:
+ * "make sure we're running the latest and greatest on the grok front". The
+ * canonical id moves to the new scheme; the live list remains authoritative.
  */
 export const CURSOR_SLOT_MODEL_IDS = {
-  'cursor-grok': 'cursor-grok-4.5-high-fast',
+  'cursor-grok': 'grok-4.7-high-fast',
   'cursor-composer': 'composer-2.5-fast',
 } as const satisfies Record<CursorModelPreference, string>
 
@@ -34,7 +41,12 @@ const SLOT_DISPLAY_FALLBACK = {
   'cursor-composer': 'Composer 2.5 Fast',
 } as const satisfies Record<CursorModelPreference, string>
 
-const GROK_HIGH_FAST_RE = /^cursor-grok-(\d+(?:\.\d+)*)-high-fast$/i
+/**
+ * Both id schemes: `cursor-grok-4.6-high-fast` (through 4.6) and `grok-4.7-high-fast`
+ * (4.7 on). Anchored at both ends, so `-xhigh-fast`, `-medium-fast`, `-low-fast` and the
+ * non-fast `-high` never match.
+ */
+const GROK_HIGH_FAST_RE = /^(?:cursor-)?grok-(\d+(?:\.\d+)*)-high-fast$/i
 
 export function parseCursorGrokHighFastVersion(id: string): number[] | null {
   const match = GROK_HIGH_FAST_RE.exec(id.trim())
@@ -42,6 +54,17 @@ export function parseCursorGrokHighFastVersion(id: string): number[] | null {
   return match[1].split('.').map(part => Number(part))
 }
 
+/**
+ * A display name as the CLI prints it, made printable. CLI 2026.09.18 writes
+ * "Grok 4.7  High Fast" with a double space and trailing zero-width characters; the lens
+ * would draw neither correctly. Format characters (`\p{Cf}`: zero-width space and joiners,
+ * direction marks, BOM) are removed, runs of whitespace become one space, and the ends
+ * are trimmed.
+ */
+export function normalizeCursorDisplayName(name: string): string {
+  return name.replace(/\p{Cf}/gu, '').replace(/\s+/g, ' ').trim()
+}
+
 export function compareVersionTuples(a: number[], b: number[]): number {
   const length = Math.max(a.length, b.length)
   for (let index = 0; index < length; index++) {
@@ -52,16 +75,22 @@ export function compareVersionTuples(a: number[], b: number[]): number {
   return 0
 }
 
-/** Newest `cursor-grok-*-high-fast`. Ignores low/medium/xhigh and non-fast. */
+/**
+ * Newest Grok high-fast, either id scheme, compared numerically. Ignores low/medium/xhigh
+ * and non-fast. On an exact version tie the unprefixed id (the new scheme) wins, whatever
+ * order the CLI lists them in.
+ */
 export function selectNewestCursorGrokHighFast(
   models: CursorCatalogModel[],
 ): CursorCatalogModel | undefined {
-  let best: { model: CursorCatalogModel; version: number[] } | undefined
+  let best: { model: CursorCatalogModel; version: number[]; prefixed: boolean } | undefined
   for (const model of models) {
     const version = parseCursorGrokHighFastVersion(model.id)
     if (!version) continue
-    if (!best || compareVersionTuples(version, best.version) > 0) {
-      best = { model, version }
+    const prefixed = /^cursor-/i.test(model.id.trim())
+    const order = best ? compareVersionTuples(version, best.version) : 1
+    if (!best || order > 0 || (order === 0 && best.prefixed && !prefixed)) {
+      best = { model, version, prefixed }
     }
   }
   return best?.model
@@ -109,7 +138,7 @@ export function parseAgentModelsText(text: string): CursorCatalogModel[] {
     const match = /^([a-z0-9][a-z0-9._\[\]-]*)\s+-\s+(.+)$/i.exec(line)
     if (!match) continue
     const id = match[1]
-    const displayName = match[2].trim()
+    const displayName = normalizeCursorDisplayName(match[2])
     if (!id || !displayName || seen.has(id)) continue
     seen.add(id)
     models.push({ id, displayName })
@@ -126,7 +155,6 @@ export function buildCursorModelCatalog(
 ): CursorModelCatalog {
   const byId = new Map(models.map(model => [model.id, model]))
   const grok = selectNewestCursorGrokHighFast(models)
-    ?? byId.get(CURSOR_SLOT_MODEL_IDS[CURSOR_GROK_MODEL])
   const composer = byId.get(CURSOR_SLOT_MODEL_IDS[CURSOR_COMPOSER_MODEL])
   const options: CursorModelOption[] = [
     {
@@ -168,7 +196,12 @@ function readDiskCatalog(): CursorModelCatalog | null {
       refreshedAt?: string
       agentBinary?: string
     }
-    const models = Array.isArray(parsed.models) ? parsed.models.filter(m => typeof m?.id === 'string' && m.id) : []
+    // A cache written before 6.53.0 kept the CLI's raw display names; normalize on read.
+    const models = Array.isArray(parsed.models)
+      ? parsed.models
+        .filter(m => typeof m?.id === 'string' && m.id)
+        .map(m => ({ ...m, displayName: normalizeCursorDisplayName(typeof m.displayName === 'string' ? m.displayName : '') }))
+      : []
     if (models.length === 0) return null
     return buildCursorModelCatalog(
       models,