@gotcos/glasses-server 6.61.6 → 6.62.1

package/server/index.ts

@@ -24,9 +24,10 @@ import { agentSessionStreamRouter } from './routes/agent-session-stream.js'
 import { createAttachedTurnStream } from './lib/session-stream-producer.js'
 import { claudeSessionsRouter } from './routes/claude-sessions.js'
 import { createSessionHooksRouter } from './routes/session-hooks.js'
-import { cachedHookStatus, claudeDeskRunning, onSessionRowEnded, deskIdleSeconds, deskTurnEndedAt, haltHandedOffTurn, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
-import { writeHaltMarker } from './lib/session-halt.js'
-import { appendSessionCancelLedger, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, threadCancel } from './lib/session-cancel.js'
+import { cachedHookStatus, claudeDeskRunning, onSessionRowEnded, deskIdleSeconds, deskTurnEndedAt, haltHandedOffTurn, providerHookSeen, registerDrainKickStats, registryIdleAfterStop, sessionHooksEnabled, sessionSignalStore, signalFor, startSessionHooksRuntime } from './lib/session-hooks-runtime.js'
+import { clearingHaltOnSpawn, writeHaltMarker } from './lib/session-halt.js'
+import { startProviderObserveRefresh } from './lib/provider-observe.js'
+import { appendSessionCancelLedger, cancelHoldUntil as cancelHoldUntilFor, noteThreadCancelled, setDeskCancelReaders, threadCancel } from './lib/session-cancel.js'
 import { makeQueueTurnEvidence } from './lib/queue-turn-evidence.js'
 import {
   PermissionBroker,
@@ -55,6 +56,14 @@ import { readCodexTurnEndedAtMs } from './lib/codex-turn-clock.js'
 import { codexLiveQueueEnabled } from './lib/codex-live-queue.js'
 import { realAttachedWorkspaceDeps, resolveAttachedWorkspace } from './lib/attached-workspace.js'
 import { deliverAttachedTurn, realAttachedTurnDeps } from './lib/attached-provider-adapter.js'
+import { resolveSessionContinueFacts } from './lib/session-continue-facts.js'
+import { fallbackContinueNote } from './lib/continue-plan.js'
+import { codexFolderTrustedNow, realContinueFactsDeps } from './lib/session-continue-facts-real.js'
+import { prepareCursorFork, resolveCursorForkWorkspace } from './lib/cursor-fork-context.js'
+import { readComposerFacts } from './lib/cursor-session-model.js'
+import { MAX_PROMPT_CHARS } from './lib/attached-provider-adapter.js'
+import { readRecentSessionTurns } from './lib/agent-session-turns.js'
+import { parseAgentSession } from './lib/agent-session-store.js'
 import { makeLiveTurnDeliverer } from './lib/session-peer-inbox-deps.js'
 import { makeCodexLiveDeliverer } from './lib/codex-live-queue-deps.js'
 import { forkThread, realForkDeps } from './lib/fork-thread.js'
@@ -105,6 +114,7 @@ import { skillsRouter } from './routes/skills.js'
 import { shutdownLiveCues } from './lib/live-cues-engine.js'
 import { prewarmContext } from './lib/context-builder.js'
 import { preWarmCLI } from './lib/claude-bridge.js'
+import { sweepStaleTurnRequests } from './lib/turn-request.js'
 import { getCodexRunConfig } from './lib/codex-run-ledger.js'
 import {
   startCodexModelCatalogRefresh,
@@ -166,7 +176,7 @@ const app = express()
 import { createThreadTurnQueueRouter, drainAllThreads } from './routes/thread-turn-queue.js'
 import { createCursorStopFollowupRouter } from './routes/cursor-stop-followup.js'
 import { queuedThreadKeys, readQueue, transcriptTurnVerdict, writeQueue } from './lib/thread-turn-queue-store.js'
-import { hookHaltReady, readHookToken } from './lib/claude-hooks-installer.js'
+import { cursorDeskHaltReady, hookHaltReady, readHookToken } from './lib/claude-hooks-installer.js'
 import { OPEN_TURN_CEILING_MS } from './lib/session-state-derive.js'
 import { createDrainKick, kickPlanFor } from './lib/thread-drain-kick.js'
 import { transcriptPathFor } from './lib/native-head.js'
@@ -461,6 +471,8 @@ bindingReapTimer.unref()
 const occupancyDirs = realOccupancyDirs()
 const nativeHeadDeps = realNativeHeadDeps()
 const attachedWorkspaceDeps = realAttachedWorkspaceDeps(nativeHeadDeps)
+// 6.62.0: one set of readers for the Continue plan, rows, detail and the attach verdict.
+const continueFactsDeps = realContinueFactsDeps()
 /**
  * THE ONE PLACE the idle-holder relaxation is switched on, on the ONE flag
  * that also registers the write routes (6.33.0).
@@ -507,6 +519,15 @@ const occupancyProbes = withCursorComposerTurn(withCodexTurnClock(sessionHooksEn
 // before any router is registered so the first list request already sees the replayed
 // ledger. With COS_SESSION_HOOKS off it still drains and stamps the spool (see the module).
 const sessionHooksRuntime = startSessionHooksRuntime({ port: PORT })
+// 6.62.0: the Codex hooks, their trust and the Cursor observer, read in the background for
+// health and the desk cancel (never on a request path; see lib/provider-observe.ts).
+startProviderObserveRefresh()
+// 6.62.0 (QA W1, W2): a desk Cursor cancel needs the CURRENT script, and a Codex or Cursor one
+// needs that engine's hooks already seen for the thread (see lib/session-cancel.ts).
+setDeskCancelReaders({
+  cursorReady: () => cursorDeskHaltReady(cachedHookStatus()),
+  threadHookSeen: (provider, threadId) => providerHookSeen(provider, threadId),
+})
 
 /**
  * The shim between the route's request shape and the adapter's.
@@ -540,6 +561,8 @@ const deliverAttachedTurnForRoute = async (request: {
   onSpawn: (pid: number) => boolean
   /** 6.53.0: the cancel from the lens, passed straight through to the adapter. */
   abortSignal?: AbortSignal
+  /** 6.62.0 /qa (Q3): the client shows `continue_note`; only then Cursor Run Everything. */
+  continueNoteAck?: boolean
 }): Promise<unknown> => {
   // Resolved here, not stored on the binding: the cwd is read from the transcript,
   // which records it verbatim. Decoding the project slug is lossy — this Mac's own
@@ -568,6 +591,27 @@ const deliverAttachedTurnForRoute = async (request: {
   // turn sees `working` rather than silence, and closed in a `finally` because the
   // duplicate-suppression gate it holds must be released on EVERY exit path -- a stuck
   // gate would silence Phase 2 for that session permanently.
+  // 6.62.0 (D1): what this Continue runs with. Claude: no plan, unchanged. Codex: the
+  // session's own sandbox, model and effort. Cursor: Run Everything on its own model. A
+  // read that fails plans the 6.61 posture with a note; never anything broader. With
+  // COS_CONTINUE_FULL_PERMISSIONS=0 no plan is resolved and the adapter builds the 6.61 argv.
+  let plan: unknown
+  if (request.provider !== 'claude') {
+    try {
+      const facts = await resolveSessionContinueFacts({
+        provider: request.provider,
+        threadId: request.nativeThreadId,
+        transcriptPath: attachedWorkspaceDeps.transcriptPath(request.provider, request.nativeThreadId),
+        cwd: workspace.path,
+        noteAck: request.continueNoteAck === true,
+      }, continueFactsDeps)
+      plan = facts.plan
+    } catch (error) {
+      console.error(`[attached] continue plan failed provider=${request.provider}: ${error instanceof Error ? error.message : error}`)
+      plan = undefined
+    }
+  }
+
   const live = createAttachedTurnStream({
     provider: request.provider,
     sessionId: request.nativeThreadId,
@@ -579,12 +623,18 @@ const deliverAttachedTurnForRoute = async (request: {
       nativeThreadId: request.nativeThreadId,
       prompt: request.prompt,
       cwd: workspace.path,
-      // The only policy this build accepts. The adapter refuses anything else and
-      // asserts no bypass/always-approve flag reaches the argv (plan 4.7).
-      policy: 'read_only',
+      // 6.62.0: the session's own posture, carried by `plan`. The adapter refuses any other
+      // policy word, validates the plan, and still bans every bypass flag but the one the
+      // plan's allowance names, at both of its checks (plan 3.1).
+      policy: 'session_posture',
+      plan,
       abortSignal: request.abortSignal,
       deps: {
-        ...base,
+        // 6.62.0 /qa (Q4): the child is about to start, every gate passed (a Continue or a
+        // queue drain): no earlier desk-cancel marker may deny COS's own turn.
+        ...clearingHaltOnSpawn(base, request.nativeThreadId, 'continue'),
+        // 6.62.0 /qa (W5): full access is re-checked against Codex's own trust at the spawn.
+        codexFolderTrusted: cwd => codexFolderTrustedNow(cwd),
         // `startMs` is deliberately unused: the adapter already probed it as a GATE
         // (a null there aborts before this is reached), and the route probes again
         // as the recorder. One record, one authority.
@@ -630,16 +680,55 @@ const deliverAttachedTurnForRoute = async (request: {
  *    ever report `unverified`, and it would report that honestly rather than
  *    claiming a verification it never performed.
  */
-const forkThreadForRoute = (request: {
-  provider: 'claude' | 'codex'
+const forkThreadForRoute = async (request: {
+  provider: 'claude' | 'codex' | 'cursor'
   nativeThreadId: string
   prompt: string
   cwd: string
   policy: 'read_only'
-}): Promise<unknown> => forkThread({
-  ...request,
-  deps: realForkDeps((provider, threadId) => nativeHead(provider, threadId, nativeHeadDeps)),
-})
+}): Promise<unknown> => {
+  // 6.62.0 (D4, plan 3.7): Cursor has no native fork, so its "fork" is a NEW read-only chat
+  // whose first prompt carries a bounded bundle of the source, then the message, on the
+  // session's own model. Claude and Codex are unchanged.
+  let prompt = request.prompt
+  let cursorModel: string | null = null
+  if (request.provider === 'cursor') {
+    const prepared = await prepareCursorFork(request.nativeThreadId, request.prompt, {
+      transcriptPath: threadId => attachedWorkspaceDeps.transcriptPath('cursor', threadId),
+      readTurns: async (path, limit) => (await readRecentSessionTurns('cursor', path, limit)).turns,
+      readTitle: async path => {
+        const parsed = await parseAgentSession('cursor', path)
+        return { title: parsed.display_label || null, firstPrompt: parsed.first_prompt || null }
+      },
+      sessionModel: async (threadId, path) => {
+        const facts = await resolveSessionContinueFacts({ provider: 'cursor', threadId, transcriptPath: path, cwd: request.cwd }, continueFactsDeps)
+        if (facts.plan?.provider === 'cursor' && facts.plan.matched) return facts.plan.model
+        return facts.reportedModel && continueFactsDeps.isKnownCursorModel(facts.reportedModel) ? facts.reportedModel : null
+      },
+      maxChars: MAX_PROMPT_CHARS,
+    })
+    prompt = prepared.prompt
+    cursorModel = prepared.cursorModel
+  }
+  return forkThread({
+    ...request,
+    prompt,
+    ...(cursorModel ? { cursorModel } : {}),
+    deps: forkDepsClearingIdleHalt(request.provider, request.nativeThreadId),
+  })
+}
+
+/**
+ * 6.62.0 /qa (Q4): the fork deps, with the source thread's halt marker cleared at the spawn,
+ * but ONLY when no desk run is working there. A fork has no occupancy gate (it may run while
+ * the desk works), and clearing then would undo the person's own cancel.
+ */
+function forkDepsClearingIdleHalt(provider: 'claude' | 'codex' | 'cursor', threadId: string) {
+  return clearingHaltOnSpawn(realForkDeps((p, id) => nativeHead(p, id, nativeHeadDeps)), threadId, 'fork', () => {
+    const reason = threadOccupancy(provider, threadId, occupancyProbes, occupancyDirs).reason
+    return reason !== 'native_thread_working' && reason !== 'live_desktop_process'
+  })
+}
 
 // API routes
 app.use('/api', healthRouter)
@@ -802,6 +891,8 @@ if (threadAttachEnabled()) {
     deliver: (turn: QueuedThreadTurn) => deliverQueuedTurnOverLoopback(turn, PORT, API_TOKEN),
     // 6.53.0: parked turns hold for two minutes after a cancel on their thread.
     cancelHoldUntil: (provider: string, threadId: string) => cancelHoldUntilFor(provider, threadId),
+    // 6.62.0 (W14): a busy Agent CLI chat's parked turn drains here (no Stop hook fires for `-p`).
+    cursorCliChat: (threadId: string) => continueFactsDeps.cursorChatDir(threadId) !== null,
     now: () => Date.now(),
   }
   app.use('/api', createThreadTurnQueueRouter(queueDeps))
@@ -882,13 +973,36 @@ app.use('/api', createAgentSessionBindingsRouter({
   // (`codex queue`), never into a resume child that cannot open a held thread.
   // `COS_CODEX_LIVE_QUEUE=0` restores the 6.50 path.
   deliverCodexLiveTurn: makeCodexLiveDeliverer(),
+  // 6.62.0 (plan 3.6, W8): a BUSY thread the Codex app holds takes the same hop, but only
+  // while the COS queue holds nothing for it, so a new turn never jumps a parked one. The
+  // turn route's clientTurnId ledger is the one idempotency key per turn.
+  busyCodexHop: (threadId: string) => codexLiveQueueEnabled()
+    && readQueue('codex', threadId, Date.now()).every(turn => turn.status !== 'waiting' && turn.status !== 'delivering'),
+  // 6.62.0 (plan 3.12): the attach verdict says what a Continue would run with.
+  continueNote: async (provider, threadId, options) => (await resolveSessionContinueFacts({
+    provider,
+    threadId,
+    transcriptPath: attachedWorkspaceDeps.transcriptPath(provider, threadId),
+    cwd: resolveAttachedWorkspace(provider, threadId, attachedWorkspaceDeps)?.path ?? null,
+    noteAck: options?.noteAck === true,
+  }, continueFactsDeps)).note,
+  // 6.62.0 /qa (W9): the fixed note when the read misses its budget.
+  continueNoteFallback: (provider, options) => fallbackContinueNote(provider, { noteAck: options.noteAck, codexFallbackSandbox: continueFactsDeps.codexFallbackSandbox() }),
   forkThread: forkThreadForRoute,
   // The fork's real spawn directory. Separate from `resolveTarget` above, which
   // deliberately yields only fingerprints because plan 3.3 keeps a filesystem path
   // off anything client-visible. Null refuses: never fall back to the server's own
   // working directory, which is wherever the LaunchAgent happened to start.
-  resolveForkWorkspace: (provider, threadId) =>
-    resolveAttachedWorkspace(provider, threadId, attachedWorkspaceDeps)?.path ?? null,
+  // 6.62.0 (W9): a Cursor IDE composer has no spawn spelling; its fork runs in the hook
+  // signal's cwd, else the composer's own recorded folder, else the CLI chat's spelling.
+  resolveForkWorkspace: (provider, threadId) => provider === 'cursor'
+    ? resolveCursorForkWorkspace(threadId, {
+        signalCwd: id => signalFor(id)?.cwd ?? null,
+        composerWorkspace: async id => (await readComposerFacts([id], continueFactsDeps.cursorComposerDb)).get(id)?.workspace ?? null,
+        spawnWorkspace: id => attachedWorkspaceDeps.cursorSpawnWorkspace?.(id) ?? null,
+        dirExists: path => attachedWorkspaceDeps.dirExists(path),
+      })
+    : resolveAttachedWorkspace(provider, threadId, attachedWorkspaceDeps)?.path ?? null,
   // One instance per process. The epoch high-water mark is only monotonic if a
   // single reader owns the durable store, so this must never be constructed twice.
   // `open()` never throws: an unreadable store yields a DEGRADED registry whose
@@ -1227,6 +1341,11 @@ listenRequiredServers(listeners).then(() => {
       })
       .catch(error => console.warn('[meeting-merge] pending re-drive failed', error))
 
+    // Turn-request files (lib/turn-request.ts) carry a user's words for the COS memory hook
+    // and die with their child. One left by a crash or a kill must not outlive an hour.
+    const staleTurnRequests = sweepStaleTurnRequests()
+    if (staleTurnRequests > 0) console.log(`[turn-request] removed ${staleTurnRequests} stale file(s)`)
+
     void initQueryJobRuntime().then(health => {
       if (process.env.COS_DURABLE_QUERY_JOBS !== '0') {
         console.log(`[COS API] Durable query jobs: ${health.store.state} · ${health.store.retainedIdentities} retained · ${health.store.requeuedOnBoot ?? 0} requeued from the last boot`)

package/server/lib/agent-session-binding-store.ts

@@ -39,12 +39,18 @@ import type { AgentProvider } from './agent-session-store.js'
 
 export type BindingState = 'staging' | 'active' | 'detaching' | 'detached'
 
-/** Providers that can carry a Continue binding. Cursor is bindable, not forkable. */
+/** Providers that can carry a Continue binding. */
 export const BINDABLE_PROVIDERS = ['claude', 'codex', 'cursor'] as const
 export type BindableProvider = (typeof BINDABLE_PROVIDERS)[number]
 
-/** Providers that can fork. Cursor Agent has no `--fork-session` equivalent. */
-export const FORKABLE_PROVIDERS = ['claude', 'codex'] as const
+/**
+ * Providers the fork route serves. 6.62.0 (D4, plan 3.7): Cursor Agent has no
+ * `--fork-session`, so a Cursor "fork" is a NEW read-only chat seeded with a bounded
+ * context bundle ("New session with this context"). Work's own fork list
+ * (`work-activity.ts` FORK_PROVIDERS) and the Jev recommender stay Claude and Codex until
+ * the Control release (W9).
+ */
+export const FORKABLE_PROVIDERS = ['claude', 'codex', 'cursor'] as const
 export type ForkableProvider = (typeof FORKABLE_PROVIDERS)[number]
 
 export interface NativeBinding {

package/server/lib/agent-session-store.ts

@@ -1270,10 +1270,12 @@ export async function listCursorSessions(
       const candidate = candidates[i]
       const peek = await peekCursorDiscussion(candidate.file)
       const firstPrompt = await firstCursorUserTitle(candidate.file) ?? peek.lastUser ?? ''
+      // 6.62.0 (plan 1.6): the composer's name, else the FIRST query, as the detail titles it.
+      // The newest query is what changes turn to turn; a title that moved with every prompt
+      // never named the session.
       const title = composerNames.get(candidate.sessionDir)
-        ?? peek.lastUser
-        ?? firstPrompt
-        ?? 'Cursor session'
+        || firstPrompt
+        || 'Cursor session'
       if (isKeepWarmSessionTitle(title)) continue
       const alive = now.getTime() - candidate.mtimeMs < 180_000
       rows.push(row({
@@ -1835,7 +1837,8 @@ export async function parseAgentSession(
         const query = cursorUserTitle(text, true) ?? cursorUserTitle(text, false)
         collectTurn(query ?? text, tail)
         if (query) {
-          title = query
+          // 6.62.0 (plan 1.6): the FIRST query titles the session, as on its list row.
+          if (!title) title = query
           if (!firstPrompt) firstPrompt = query
         }
       } else {

package/server/lib/attached-provider-adapter.ts

@@ -90,6 +90,7 @@
 //     process and lets a RECYCLED pid inherit our self-ownership claim, which
 //     is the one input that can turn a live foreign owner into `attachable`.
 
+import { PROVIDER_QUOTA_RE } from './provider-failure-text.js'
 import { accessSync, constants as fsConstants, statSync } from 'node:fs'
 import { delimiter, isAbsolute, join } from 'node:path'
 import { homedir } from 'node:os'
@@ -101,19 +102,30 @@ import { recordCosSpawn, releaseCosSpawn } from './agent-session-ownership-store
 import { interpretPsLstart, processStartMs as realProcessStartMs } from './occupancy-probes.js'
 import { getCodexTrustMode } from './codex-run-ledger.js'
 import { CURSOR_SLOT_MODEL_IDS } from './cursor-model-catalog.js'
+import { cursorIsolationUnavailableError, cursorSpawnEnv, isCursorIsolationUnavailable, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
+import type { PermissionAllowance } from './banned-permission-args.js'
+import {
+  continueAllowanceFor,
+  validateContinuePlan,
+  type AttachedContinuePlan,
+  type CodexContinuePlan,
+  type CursorContinuePlan,
+} from './continue-plan.js'
 
 /** Providers with a certified attached path. Cursor is bindable, not forkable. */
 export type AttachedProvider = BindableProvider
 
 /**
- * Protocol 1 ships text-only read-only continuation (plan 4.7). The type has
- * one member on purpose: `agent` is not "not implemented yet", it is a value
- * this module must refuse until Control gates it per binding.
+ * 6.62.0 (D1): a Continue runs with the SESSION'S OWN posture, described by the request's
+ * `plan` (`continue-plan.ts`). Until 6.61 this was `'read_only'`, a name that had stopped
+ * being true for Claude on 2026-08-16. The type still has one member on purpose: `agent`
+ * and anything else is a value this module refuses, and the plan, not the policy word,
+ * is what may ever widen the argv.
  */
-export type AttachedPermissionPolicy = 'read_only'
+export type AttachedPermissionPolicy = 'session_posture'
 
 export function isAttachedPermissionPolicy(value: unknown): value is AttachedPermissionPolicy {
-  return value === 'read_only'
+  return value === 'session_posture'
 }
 
 /** Terminal reason on failure. Never carries prompt or transcript text. */
@@ -284,6 +296,11 @@ export interface AttachedSpawnRequest {
   args: readonly string[]
   cwd: string
   env: NodeJS.ProcessEnv
+  /**
+   * 6.62.0: which CLI this is, so the real spawn can isolate a Cursor child's config dir
+   * (`cursor-spawn-env.ts`). Optional so every test double keeps its shape.
+   */
+  provider?: AttachedProvider
 }
 
 /** Result of the final occupancy re-check (plan 4.3 step 6). */
@@ -341,7 +358,7 @@ export interface AttachedTurnDeps {
    * Exists ONLY so a test can hand back an argv carrying a banned permission flag
    * and prove the turn is refused with zero spawns. Production never sets it.
    */
-  buildArgs?: (provider: AttachedProvider, nativeThreadId: string, cwd: string) => string[]
+  buildArgs?: (provider: AttachedProvider, nativeThreadId: string, cwd: string, plan?: AttachedContinuePlan) => string[]
   /**
    * A PASSIVE reader of the child's stdout. Optional; omitted changes nothing.
    *
@@ -361,6 +378,13 @@ export interface AttachedTurnDeps {
    * future edit can let it modify what the scan sees.
    */
   observeStdout?: (chunk: string) => void
+  /**
+   * 6.62.0 /qa (W5, N1): does Codex itself trust this cwd RIGHT NOW (the cwd or its git
+   * root is a trusted `[projects]` entry)? Asked at the spawn for a full-access plan only;
+   * absent, false, or a throw refuses that plan. The plan was built from the same rule
+   * seconds earlier; this is the second check, so the allowance never outlives the trust.
+   */
+  codexFolderTrusted?: (cwd: string) => boolean
 }
 
 export interface AttachedTurnRequest {
@@ -369,6 +393,12 @@ export interface AttachedTurnRequest {
   prompt: unknown
   cwd: unknown
   policy: unknown
+  /**
+   * 6.62.0: what this Continue runs with (`continue-plan.ts`). Absent: the 6.61 argv for
+   * every provider. Validated here, structurally, before any argv is built; a plan for
+   * another provider or with an unusable value refuses the turn rather than being ignored.
+   */
+  plan?: unknown
   deps: AttachedTurnDeps
   /** Wall-clock budget for the provider run. Omitted uses the default. */
   timeoutMs?: number
@@ -506,7 +536,13 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
 }
 
 /**
- * Codex: `codex exec -s read-only -C <cwd> resume --json <id> -`.
+ * Codex: `codex exec [-m <model>] [-c model_reasoning_effort=…] --sandbox <s> [-c
+ * sandbox_workspace_write.network_access=…] --cd <cwd> resume --json <id> -`.
+ *
+ * 6.62.0 (D1, canary C11): with a plan, the session's OWN model, effort and sandbox are
+ * passed, because `exec resume` otherwise takes the config defaults for all three. Every
+ * one of them is an option of `exec` and precedes `resume`. With no plan (the kill switch,
+ * or an older caller) the argv is the 6.61 one, byte for byte.
  *
  * Verified against codex-cli 0.148.0-alpha.9 on 2026-08-15:
  * `codex exec resume [OPTIONS] [SESSION_ID] [PROMPT]`. `--sandbox` and `--cd`
@@ -518,33 +554,61 @@ export function buildClaudeAttachedArgs(nativeThreadId: string): string[] {
  * `--ephemeral` is deliberately absent: the whole point is that the turn
  * persists into the user's rollout.
  */
-export function buildCodexAttachedArgs(nativeThreadId: string, cwd: string): string[] {
-  return [
-    'exec',
-    // The posture ordinary Codex runs use on this host, not a stricter one
-    // invented here. `COS_CODEX_SANDBOX=workspace-write` opts in; absent stays
-    // read-only, so this is never MORE permissive than the rest of the server.
-    '--sandbox', getCodexTrustMode(),
-    '--cd', cwd,
-    'resume',
-    '--json',
-    '--skip-git-repo-check',
-    nativeThreadId,
-    '-',
-  ]
+export function buildCodexAttachedArgs(nativeThreadId: string, cwd: string, plan?: CodexContinuePlan): string[] {
+  if (!plan) {
+    return [
+      'exec',
+      // The posture ordinary Codex runs use on this host, not a stricter one
+      // invented here. `COS_CODEX_SANDBOX=workspace-write` opts in; absent stays
+      // read-only, so this is never MORE permissive than the rest of the server.
+      '--sandbox', getCodexTrustMode(),
+      '--cd', cwd,
+      'resume',
+      '--json',
+      '--skip-git-repo-check',
+      nativeThreadId,
+      '-',
+    ]
+  }
+  const args = ['exec']
+  if (plan.model) args.push('-m', plan.model)
+  if (plan.effort) args.push('-c', `model_reasoning_effort="${plan.effort}"`)
+  args.push('--sandbox', plan.sandbox)
+  if (plan.sandbox === 'workspace-write' && typeof plan.networkAccess === 'boolean') {
+    args.push('-c', `sandbox_workspace_write.network_access=${plan.networkAccess}`)
+  }
+  args.push('--cd', cwd, 'resume', '--json', '--skip-git-repo-check', nativeThreadId, '-')
+  return args
 }
 
 /**
- * Cursor Agent CLI: ask-mode resume into an existing thread.
+ * Cursor Agent CLI: resume into an existing thread.
+ *
+ * 6.62.0 (D1, canaries C4/C5): with a plan, Run Everything (`--force`) on the session's
+ * own model. Agent mode alone is not full permissions (C4: the CLI's allowlist still
+ * blocked `touch`), and `--resume` without `--model` runs the GLOBAL default (C5). `--force`
+ * stays on the ban list: only the plan's allowance lets this one argv slot through, at
+ * both checks. With no plan (the kill switch) the argv is the 6.61 ask-mode one.
  *
- * `--force` is the agent-mode bypass and is banned here. Workspace is the
- * spawn spelling from `spawnWorkspace`, never realpath of `meta.json.cwd`.
+ * Workspace is the spawn spelling from `spawnWorkspace`, never realpath of `meta.json.cwd`.
  */
-export function buildCursorAttachedArgs(nativeThreadId: string, cwd: string): string[] {
+export function buildCursorAttachedArgs(nativeThreadId: string, cwd: string, plan?: CursorContinuePlan): string[] {
+  if (!plan) {
+    return [
+      '-p',
+      '--mode', 'ask',
+      '--model', CURSOR_SLOT_MODEL_IDS['cursor-composer'],
+      '--output-format', 'stream-json',
+      '--stream-partial-output',
+      '--trust',
+      '--workspace', cwd,
+      '--resume', nativeThreadId,
+    ]
+  }
   return [
     '-p',
-    '--mode', 'ask',
-    '--model', CURSOR_SLOT_MODEL_IDS['cursor-composer'],
+    '--force',
+    '--model', plan.model,
     '--output-format', 'stream-json',
     '--stream-partial-output',
     '--trust',
@@ -567,13 +631,20 @@ export function buildCursorAttachedArgs(nativeThreadId: string, cwd: string): st
  * than returning a sentinel: there is no safe degraded argv, and the caller's
  * outer catch already maps a throw to a terminal refusal before any spawn.
  */
-function buildArgs(provider: AttachedProvider, nativeThreadId: string, cwd: string): string[] {
+export function buildAttachedArgs(
+  provider: AttachedProvider,
+  nativeThreadId: string,
+  cwd: string,
+  plan?: AttachedContinuePlan,
+  allowance?: PermissionAllowance,
+): string[] {
   const args = provider === 'claude'
     ? buildClaudeAttachedArgs(nativeThreadId)
     : provider === 'codex'
-      ? buildCodexAttachedArgs(nativeThreadId, cwd)
-      : buildCursorAttachedArgs(nativeThreadId, cwd)
-  const banned = findBannedPermissionArg(args)
+      ? buildCodexAttachedArgs(nativeThreadId, cwd, plan?.provider === 'codex' ? plan : undefined)
+      : buildCursorAttachedArgs(nativeThreadId, cwd, plan?.provider === 'cursor' ? plan : undefined)
+  // 6.62.0: the SAME allowance object the spawn boundary below receives (plan 3.1).
+  const banned = findBannedPermissionArg(args, allowance)
   if (banned !== null) {
     // The flag name only. Never the argv, which carries the thread id and cwd.
     throw new Error(`attached argv carries a banned permission flag: ${banned}`)
@@ -644,7 +715,8 @@ export function classifyStderr(text: string): AttachedStderrClass {
     return 'thread_not_found'
   }
   if (/unauthor|forbidden|not logged in|sign in|login|auth|credential|token expired/.test(sample)) return 'auth'
-  if (/rate limit|too many requests|quota|overloaded/.test(sample)) return 'rate_limit'
+  // 6.62.1: the shared pattern, so "hit your session limit" / "usage limit" class as a limit here too.
+  if (/rate limit|too many requests|quota|overloaded/.test(sample) || PROVIDER_QUOTA_RE.test(sample)) return 'rate_limit'
   if (/permission|denied|read-only|sandbox|operation not permitted|eacces/.test(sample)) return 'permission'
   return 'unclassified'
 }
@@ -757,6 +829,17 @@ async function run(
     return fail('unsupported_policy', 'not_attempted', { ...base, durationMs: duration() })
   }
 
+  // 6.62.0: the plan, validated before anything is built from it. A wrong-provider or
+  // malformed plan is a wiring bug, and a wiring bug refuses rather than falling back to
+  // a different argv than the caller meant.
+  const checkedPlan = validateContinuePlan(provider, request.plan)
+  if (checkedPlan === 'invalid') {
+    return fail('unsupported_policy', 'not_attempted', { ...base, detail: 'invalid_plan', durationMs: duration() })
+  }
+  const plan: AttachedContinuePlan | undefined = checkedPlan ?? undefined
+  // ONE allowance, built once, handed to the builder AND the spawn-boundary recheck.
+  const allowance = continueAllowanceFor(plan)
+
   if (typeof request.prompt !== 'string' || request.prompt.length === 0) {
     return fail('invalid_prompt', 'not_attempted', { ...base, detail: 'empty', durationMs: duration() })
   }
@@ -824,6 +907,21 @@ async function run(
     return fail('native_owner_appeared', 'not_attempted', { ...base, detail: reasonText, durationMs: duration() })
   }
 
+  // 6.62.0 /qa (W5, N1): a full-access Codex plan is re-checked against Codex's own trust at
+  // the spawn. A folder that stopped being trusted (or never was) refuses, never downgrades:
+  // the note promised full access, and a quieter posture would make the note a lie.
+  if (plan?.provider === 'codex' && plan.sandbox === 'danger-full-access') {
+    let trusted = false
+    try {
+      trusted = typeof deps.codexFolderTrusted === 'function' && deps.codexFolderTrusted(cwd) === true
+    } catch {
+      trusted = false
+    }
+    if (!trusted) {
+      return fail('unsupported_policy', 'not_attempted', { ...base, detail: 'codex_folder_untrusted', durationMs: duration() })
+    }
+  }
+
   // --- 4. Spawn ---------------------------------------------------------------
   // Built through an injectable seam so the banned-flag check below is reachable
   // by a test. Without the seam no test could make the builders emit a banned
@@ -832,14 +930,16 @@ async function run(
   // nowhere.
   let args: string[]
   try {
-    args = (deps.buildArgs ?? buildArgs)(provider, nativeThreadId, cwd)
+    args = deps.buildArgs
+      ? deps.buildArgs(provider, nativeThreadId, cwd, plan)
+      : buildAttachedArgs(provider, nativeThreadId, cwd, plan, allowance)
   } catch {
     return fail('unsupported_policy', 'not_attempted', { ...base, detail: 'argv_build_failed', durationMs: duration() })
   }
   // Plan 4.7, enforced against the argv that is about to be spawned rather than
   // against the source that builds it. No safe degraded argv exists, so this is a
   // terminal refusal before any process is created.
-  const bannedArg = findBannedPermissionArg(args)
+  const bannedArg = findBannedPermissionArg(args, allowance)
   if (bannedArg !== null) {
     return fail('unsupported_policy', 'not_attempted', { ...base, detail: `banned_arg:${bannedArg}`, durationMs: duration() })
   }
@@ -852,10 +952,11 @@ async function run(
   }
   let child: AttachedChildProcess
   try {
-    child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv() })
-  } catch {
+    child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv(), provider })
+  } catch (error) {
     // Includes ENOENT. No process exists, so no turn can have landed.
-    return fail('spawn_failed', 'not_attempted', { ...base, detail: 'threw', durationMs: duration() })
+    const detail = isCursorIsolationUnavailable(error) ? 'cursor_isolation_unavailable' : 'threw'
+    return fail('spawn_failed', 'not_attempted', { ...base, detail, durationMs: duration() })
   }
   if (!child || typeof child !== 'object' || typeof child.on !== 'function') {
     return fail('spawn_failed', 'not_attempted', { ...base, detail: 'no_child', durationMs: duration() })
@@ -1764,14 +1865,26 @@ export function realAttachedTurnDeps(preflight: () => AttachedPreflightVerdict):
       // after it. This is the floor that keeps group ownership (rule 4 above) from ever
       // claiming a process that predates the turn.
       const floor = Date.now() - OWNED_START_SLACK_MS
-      const child = nodeSpawn(request.binaryPath, [...request.args], {
-        stdio: ['pipe', 'pipe', 'pipe'],
-        cwd: request.cwd,
-        env: request.env,
-        // Group leader, so the whole provider tree can be signalled on timeout —
-        // matching what both ordinary bridges do.
-        detached: true,
-      })
+      // 6.62.0 (plan 3.4): a Cursor child gets a config dir of its own, so `--model` cannot
+      // rewrite the person's CLI default (C9). Child env only; removed when it exits.
+      const isolation = request.provider === 'cursor' ? cursorSpawnEnv({ baseEnv: request.env }) : null
+      // 6.62.0 /qa (W6): a Continue never falls back to the shared Cursor config.
+      if (isolation && !isolation.isolated) throw cursorIsolationUnavailableError()
+      let child: ReturnType<typeof nodeSpawn>
+      try {
+        child = nodeSpawn(request.binaryPath, [...request.args], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+          cwd: request.cwd,
+          env: isolation ? isolation.env : request.env,
+          // Group leader, so the whole provider tree can be signalled on timeout —
+          // matching what both ordinary bridges do.
+          detached: true,
+        })
+      } catch (error) {
+        isolation?.release()
+        throw error
+      }
+      if (isolation) releaseCursorSpawnOnExit(child, isolation)
       const pid = child.pid
       if (typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0) treeMemory.floorByRoot.set(pid, floor)
       return child as unknown as AttachedChildProcess