@gotcos/glasses-server 6.61.6 → 6.62.1

package/server/lib/codex-subagent-activity.ts

@@ -0,0 +1,119 @@
+// Read-only display evidence. Never imported by attachment, queue or write gates.
+// Open spawn edges describe relationships, not work: completed children remain open.
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { open, realpath, readdir, stat } from 'node:fs/promises'
+import { dirname, join, relative } from 'node:path'
+
+const exec = promisify(execFile)
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+export const SUBAGENT_FRESH_MS = 5 * 60_000
+const MAX_ROWS = 512
+const MAX_TAIL = 4 * 1024 * 1024
+const MAX_SNAPSHOT_BYTES = 16 * 1024 * 1024
+export interface SubagentActivity {
+  active: number
+  completed: number
+  unknown: number
+  total: number
+  checked_at: number
+  partial: boolean
+}
+export type ChildState = 'active' | 'completed' | 'unknown'
+
+/** Latest explicit turn lifecycle wins; ordinary output alone never starts a turn. */
+interface ChildEvidence { lifecycle: 'open' | 'completed' | 'unknown'; latest: number }
+function parseChildEvidence(text: string, now: number, startsMidFile = false): ChildEvidence {
+  const lines = text.split('\n')
+  if (startsMidFile) lines.shift()
+  let latest = 0
+  for (let i = lines.length - 1; i >= 0; i--) {
+    let row: any
+    try { row = JSON.parse(lines[i]) } catch { continue }
+    const at = Date.parse(row?.timestamp)
+    if (Number.isFinite(at) && at <= now + 5000 && at > 0) latest = Math.max(latest, at)
+    if (row?.type !== 'event_msg') continue
+    const kind = row.payload?.type
+    if (['task_complete', 'task_failed', 'turn_aborted', 'turn_cancelled'].includes(kind)) return { lifecycle: Number.isFinite(at) && at > 0 && at <= now + 5000 ? 'completed' : 'unknown', latest }
+    if (kind === 'task_started') {
+      // A crashed/interrupted writer with no terminal event must age into uncertainty.
+      return { lifecycle: Number.isFinite(at) && at > 0 && at <= now + 5000 ? 'open' : 'unknown', latest }
+    }
+  }
+  return { lifecycle: 'unknown', latest }
+}
+function stateOf(evidence: ChildEvidence, now: number): ChildState {
+  if (evidence.lifecycle === 'completed') return 'completed'
+  return evidence.lifecycle === 'open' && evidence.latest <= now + 5000 && now - evidence.latest <= SUBAGENT_FRESH_MS ? 'active' : 'unknown'
+}
+export function childStateFromTail(text: string, now: number, startsMidFile = false): ChildState {
+  return stateOf(parseChildEvidence(text, now, startsMidFile), now)
+}
+
+const fileMemo = new Map<string, { mtime: number; size: number; evidence: ChildEvidence }>()
+async function childState(file: string, root: string, now: number, budget: { bytes: number }): Promise<ChildState> {
+  try {
+    const canonical = await realpath(file)
+    const rel = relative(await realpath(root), canonical)
+    if (!rel || rel.startsWith('..') || rel.startsWith('/') || !canonical.endsWith('.jsonl')) return 'unknown'
+    const st = await stat(canonical)
+    if (!st.isFile()) return 'unknown'
+    const hit = fileMemo.get(canonical)
+    if (hit && hit.mtime === st.mtimeMs && hit.size === st.size) return stateOf(hit.evidence, now)
+    const handle = await open(canonical, 'r')
+    let evidence: ChildEvidence = { lifecycle: 'unknown', latest: 0 }
+    try {
+      for (let limit = 256 * 1024; ; limit *= 4) {
+        if (budget.bytes <= 0) return 'unknown'
+        const length = Math.min(st.size, limit, budget.bytes), start = st.size - length
+        budget.bytes -= length
+        const buffer = Buffer.alloc(length)
+        const read = await handle.read(buffer, 0, length, start)
+        evidence = parseChildEvidence(buffer.subarray(0, read.bytesRead).toString('utf8'), now, start > 0)
+        if (evidence.lifecycle !== 'unknown' || start === 0 || limit >= MAX_TAIL) break
+      }
+    } finally { await handle.close() }
+    // Cache only lifecycle metadata, never transcript text. Freshness is recomputed.
+    if (fileMemo.size >= MAX_ROWS) fileMemo.delete(fileMemo.keys().next().value!)
+    fileMemo.set(canonical, { mtime: st.mtimeMs, size: st.size, evidence })
+    return stateOf(evidence, now)
+  } catch { return 'unknown' }
+}
+
+/** One bounded read-only SQLite snapshot per list/detail read. */
+export async function readCodexSubagents(
+  parents: readonly string[], sessionsRoot: string, now = Date.now(),
+): Promise<Map<string, SubagentActivity>> {
+  const ids = [...new Set(parents.filter(id => UUID.test(id)).map(id => id.toLowerCase()))].slice(0, 80)
+  const out = new Map<string, SubagentActivity>()
+  if (!ids.length) return out
+  try {
+    const home = dirname(sessionsRoot)
+    const files = (await readdir(home)).filter(n => /^state_\d+\.sqlite$/.test(n)).sort((a,b) => Number(b.match(/\d+/)![0])-Number(a.match(/\d+/)![0]))
+    if (!files.length) return out // older installations do not advertise this capability
+    // UUID validation above is the SQL parameter boundary; no prompt/path reaches SQL.
+    const values = ids.map(id => `'${id}'`).join(',')
+    const query = `WITH RECURSIVE children(root,id,depth,trail) AS (
+      SELECT parent_thread_id,child_thread_id,1,','||parent_thread_id||','||child_thread_id||',' FROM thread_spawn_edges WHERE status='open' AND parent_thread_id IN (${values})
+      UNION ALL SELECT c.root,e.child_thread_id,c.depth+1,c.trail||e.child_thread_id||',' FROM children c JOIN thread_spawn_edges e ON e.parent_thread_id=c.id WHERE e.status='open' AND c.depth<16 AND instr(c.trail,','||e.child_thread_id||',')=0
+    ) SELECT DISTINCT c.root,c.id,t.rollout_path,t.archived,c.depth FROM children c LEFT JOIN threads t ON t.id=c.id LIMIT ${MAX_ROWS+1}`
+    const { stdout } = await exec('/usr/bin/sqlite3', ['-readonly', '-json', join(home,files[0]), query], { timeout: 2000, maxBuffer: 2*1024*1024 })
+    const rows = JSON.parse(stdout || '[]') as Array<{root:string;id:string;rollout_path?:string;archived?:number;depth:number}>
+    for (const id of ids) out.set(id, {active:0,completed:0,unknown:0,total:0,checked_at:now,partial:rows.length>MAX_ROWS})
+    const seen = new Set<string>()
+    const budget = { bytes: MAX_SNAPSHOT_BYTES }
+    // Sequential bounded reads avoid descriptor storms; most children are memo hits.
+    for (const row of rows.slice(0, MAX_ROWS)) {
+      const key = row.root+':'+row.id, summary = out.get(row.root)
+      if (!summary || seen.has(key)) continue
+      seen.add(key); summary.total++
+      if (row.depth >= 16) summary.partial = true
+      const state = row.archived === 1 ? 'completed' : typeof row.rollout_path === 'string' ? await childState(row.rollout_path, sessionsRoot, now, budget) : 'unknown'
+      summary[state === 'active' ? 'active' : state === 'completed' ? 'completed' : 'unknown']++
+    }
+  } catch {
+    // Do not convert a schema/read failure into a fabricated zero-agent count.
+    for (const id of ids) out.set(id, {active:0,completed:0,unknown:0,total:0,checked_at:now,partial:true})
+  }
+  return out
+}

package/server/lib/continue-plan.ts

@@ -0,0 +1,180 @@
+// What one Continue runs with, per provider (6.62.0, plans 3.1-3.3 and 3.12, decision D1).
+//
+// D1 (Miles, binding): every Continue carries its session's full permissions.
+//   Claude  unchanged: `claude -p --resume` already runs as the session runs (APA:473-496),
+//           and keeps the session's model (canary C5).
+//   Codex   the session's own sandbox, model and effort, read from its rollout
+//           (`codex-session-posture.ts`), passed explicitly because resume takes the
+//           config defaults otherwise (C11). Full access only in a folder Codex trusts.
+//   Cursor  Run Everything (`--force`) on the session's own model (C4, C5), with every
+//           spawn isolated so `--model` cannot rewrite the user's CLI default (C9).
+//
+// THE PLAN IS DATA. The index shim resolves it, the adapter builds argv from it, and the
+// SAME plan names the one `PermissionAllowance` both of the adapter's ban checks receive.
+// A plan the adapter cannot validate is refused there, never widened.
+//
+// THE KILL SWITCH. `COS_CONTINUE_FULL_PERMISSIONS=0` in `~/.cos-glasses/.env` resolves NO
+// plan for Codex and Cursor, and the adapter then builds exactly the 6.61 argv (Codex
+// `getCodexTrustMode()`, Cursor `--mode ask` on composer-2.5-fast). Default on. Control
+// 0.5.254's provider allowlist does not carry the key, so it belongs in `.env`.
+
+import type { PermissionAllowance } from './banned-permission-args.js'
+import { CONTINUE_NOTE_MAX, fitModelNote, type CodexContinuePlan } from './codex-session-posture.js'
+import { CURSOR_CONTINUE_FALLBACK_MODEL } from './cursor-session-model.js'
+
+export type { CodexContinuePlan } from './codex-session-posture.js'
+
+export interface CursorContinuePlan {
+  provider: 'cursor'
+  /** `force` is Run Everything. The only mode a 6.62 plan carries; Ask is "no plan". */
+  mode: 'force'
+  /** A flat slug the installed Cursor lists, or the fallback. */
+  model: string
+  /** The session's own model was read AND listed. False means the fallback. */
+  matched: boolean
+  note: string
+}
+
+export type AttachedContinuePlan = CodexContinuePlan | CursorContinuePlan
+
+/** `COS_CONTINUE_FULL_PERMISSIONS`: ON unless exactly '0'. */
+export function continueFullPermissionsEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_CONTINUE_FULL_PERMISSIONS !== '0'
+}
+
+const CODEX_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
+const MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/
+const EFFORT_RE = /^[a-z]{2,16}$/
+
+/**
+ * Is this a plan the adapter may build from? Structural, and total: anything that is not
+ * exactly a plan for THIS provider with values of the right shape is `invalid`. A value
+ * here becomes an argv element, so the shapes are the argv rules.
+ */
+export function validateContinuePlan(provider: string, plan: unknown): AttachedContinuePlan | null | 'invalid' {
+  if (plan === undefined || plan === null) return null
+  if (typeof plan !== 'object' || Array.isArray(plan)) return 'invalid'
+  const row = plan as Record<string, unknown>
+  if (row.provider !== provider) return 'invalid'
+  if (provider === 'codex') {
+    if (typeof row.sandbox !== 'string' || !CODEX_SANDBOXES.has(row.sandbox)) return 'invalid'
+    if (row.model !== null && (typeof row.model !== 'string' || !MODEL_RE.test(row.model))) return 'invalid'
+    if (row.effort !== null && (typeof row.effort !== 'string' || !EFFORT_RE.test(row.effort))) return 'invalid'
+    if (row.networkAccess !== null && typeof row.networkAccess !== 'boolean') return 'invalid'
+    if (row.source !== 'session' && row.source !== 'fallback') return 'invalid'
+    // A fallback plan never carries more than the 6.61 sandbox.
+    if (row.source === 'fallback' && (row.sandbox === 'danger-full-access' || row.model !== null || row.effort !== null)) return 'invalid'
+    return plan as CodexContinuePlan
+  }
+  if (provider === 'cursor') {
+    if (row.mode !== 'force') return 'invalid'
+    if (typeof row.model !== 'string' || !MODEL_RE.test(row.model)) return 'invalid'
+    return plan as CursorContinuePlan
+  }
+  // Claude has no plan: its Continue is unchanged.
+  return 'invalid'
+}
+
+/**
+ * The ONE allowance for this plan, or undefined (the full ban). Built once per turn and
+ * passed to both checks. Only the two escalations D1 names exist.
+ */
+export function continueAllowanceFor(plan: AttachedContinuePlan | null | undefined): PermissionAllowance | undefined {
+  if (!plan) return undefined
+  if (plan.provider === 'cursor' && plan.mode === 'force') return { path: 'attached_continue', cursorForce: true }
+  if (plan.provider === 'codex' && plan.sandbox === 'danger-full-access') {
+    return { path: 'attached_continue', codexSandbox: 'danger-full-access' }
+  }
+  return undefined
+}
+
+export interface CursorPlanInput {
+  /** Flat slugs, most specific first (`cursorSlugCandidates`, or a CLI chat's own slug). */
+  candidates: readonly string[]
+  isKnown: (id: string) => boolean
+  label: (id: string) => string | null
+  /** COS created this CLI chat in Ask mode: a Run Everything Continue escalates it (W14). */
+  askModeChat: boolean
+}
+
+/** Run Everything on the session's model, validated against the full `agent models` list. */
+export function planCursorContinue(input: CursorPlanInput): CursorContinuePlan {
+  let model: string | null = null
+  for (const candidate of input.candidates) {
+    try {
+      if (MODEL_RE.test(candidate) && input.isKnown(candidate)) { model = candidate; break }
+    } catch {
+      model = null
+      break
+    }
+  }
+  const matched = model !== null
+  const chosen = model ?? CURSOR_CONTINUE_FALLBACK_MODEL
+  let label: string | null = null
+  try {
+    label = input.label(chosen)
+  } catch {
+    label = null
+  }
+  // The CLI's display name when the note stays short; else the slug itself (lens width).
+  const display = label || (matched ? null : 'Composer 2.5 Fast')
+  const note = input.askModeChat
+    ? fitModelNote(m => `Now Run Everything (was Ask), ${m}.`, display, chosen, 'Now Run Everything (was Ask).')
+    : matched
+      ? fitModelNote(m => `Run Everything on ${m}.`, display, chosen, 'Run Everything on this session\'s model.')
+      : fitModelNote(m => `Run Everything on ${m}; model unread.`, display, chosen, 'Run Everything; session model unread.')
+  return { provider: 'cursor', mode: 'force', model: chosen, matched, note }
+}
+
+/** The note when the kill switch is on, per provider. Claude has none: it never changed. */
+export function killSwitchNote(provider: string, codexFallbackSandbox: 'read-only' | 'workspace-write'): string | null {
+  if (provider === 'codex') {
+    return codexFallbackSandbox === 'workspace-write'
+      ? 'Workspace write: full permissions switched off.'
+      : 'Read-only: full permissions switched off.'
+  }
+  if (provider === 'cursor') return 'Ask mode: full permissions switched off.'
+  return null
+}
+
+/**
+ * 6.62.0 /qa (Q3): the request header by which a client says it SHOWS `continue_note`. Only
+ * then does a Cursor Continue run Run Everything: glasses 599 and older label Cursor Continue
+ * "Ask", and the server must not do more than the button said. Codex needs no gate (the old
+ * copy, "uses this session's settings", stays true). The kill switch still wins.
+ */
+export const CONTINUE_NOTE_HEADER = 'x-cos-continue-note'
+
+/** The header's value read strictly: exactly '1' (an array takes its first value). */
+export function continueNoteAcknowledged(value: unknown): boolean {
+  const first = Array.isArray(value) ? value[0] : value
+  return typeof first === 'string' && first.trim() === '1'
+}
+
+/** A Cursor Continue for a client that does not show the note: the 6.61 Ask posture, said so. */
+export const CURSOR_ASK_UNACKED_NOTE = 'Ask mode (read-only) for this app version.'
+
+/**
+ * 6.62.0 /qa (W9): the note a verdict carries when the read missed its budget, so a Cursor
+ * Continue never runs Run Everything without saying so. Claude has none (unchanged).
+ */
+export function fallbackContinueNote(
+  provider: string,
+  options: { noteAck: boolean; env?: NodeJS.ProcessEnv; codexFallbackSandbox?: 'read-only' | 'workspace-write' },
+): string | null {
+  if (provider !== 'codex' && provider !== 'cursor') return null
+  if (!continueFullPermissionsEnabled(options.env)) return killSwitchNote(provider, options.codexFallbackSandbox ?? 'read-only')
+  if (provider === 'codex') return 'This Codex session\'s own access.'
+  return options.noteAck ? 'Run Everything on this chat\'s model.' : CURSOR_ASK_UNACKED_NOTE
+}
+
+/** An IDE composer is not resumed from outside; a turn queued for it runs in Cursor. */
+export const CURSOR_COMPOSER_NOTE = 'Runs in Cursor\'s own chat with its settings.'
+
+/** Belt and braces for every note that reaches the wire (plan 3.12). */
+export function boundedContinueNote(note: unknown): string | null {
+  if (typeof note !== 'string') return null
+  const trimmed = note.replace(/\s+/g, ' ').trim()
+  if (trimmed.length === 0) return null
+  return trimmed.length <= CONTINUE_NOTE_MAX ? trimmed : null
+}

package/server/lib/continue-read-health.ts

@@ -0,0 +1,26 @@
+// The Continue side's own counters on /api/health (6.62.0 /qa W6): spawn isolation, Codex
+// posture reads and Cursor model reads. Until this they were counted and never read, so a
+// Mac whose isolation kept failing open looked exactly like one where it worked.
+
+import { cursorSpawnStats } from './cursor-spawn-env.js'
+import { postureReadStats } from './codex-session-posture.js'
+import { cursorModelReadStats } from './cursor-session-model.js'
+import { cursorChatHolderStats } from './occupancy-probes.js'
+
+export function continueReadHealthFields(): {
+  continueReads: {
+    cursorSpawn: typeof cursorSpawnStats
+    codexPosture: typeof postureReadStats
+    cursorModel: typeof cursorModelReadStats
+    cursorChatHolders: typeof cursorChatHolderStats
+  }
+} {
+  return {
+    continueReads: {
+      cursorSpawn: { ...cursorSpawnStats },
+      codexPosture: { ...postureReadStats },
+      cursorModel: { ...cursorModelReadStats },
+      cursorChatHolders: { ...cursorChatHolderStats },
+    },
+  }
+}

package/server/lib/cursor-bridge.ts

@@ -1,7 +1,7 @@
 // Cursor Agent CLI bridge — ask or full agent (`--force` + `--sandbox disabled`).
 // Fail-closed: never fall through to Claude.
 
-import { spawn } from 'node:child_process'
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
 import { logTokenAudit } from './token-audit.js'
 import { cleanupModelImageInputs, type ModelImageInput } from './model-image-input.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt } from './context-builder.js'
@@ -64,6 +64,8 @@ import {
 } from '../../shared/media-attachment.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { teeJobTrail } from './job-trail.js'
+import { cursorSpawnEnv, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
+import { applyTurnRequestEnv, createTurnRequestBinding, spawnWithTurnRequest } from './turn-request.js'
 
 const INACTIVITY_MS = 180_000
 const WALL_MAX_MS = 900_000
@@ -355,12 +357,24 @@ export async function callCursorStreaming(
   const env = { ...process.env }
   delete env.CLAUDECODE
   if (outputImagePublisher) Object.assign(env, outputImagePublisher.env)
+  const turnRequest = createTurnRequestBinding({ userText: query, prompt, turnId: options?.turnId })
+  applyTurnRequestEnv(env, turnRequest)
+  // 6.62.0 (plan 3.4): Messages and reviews pass `--model`; the child's own config dir keeps
+  // that from rewriting the person's CLI default (C9). Removed when the child exits.
+  const isolation = cursorSpawnEnv({ baseEnv: env })
 
-  const proc = spawn(agentBinary, args, {
-    stdio: ['pipe', 'pipe', 'pipe'],
-    env,
-    cwd: cursorCwd,
-  })
+  let proc: ChildProcessWithoutNullStreams
+  try {
+    proc = spawnWithTurnRequest(turnRequest, () => spawn(agentBinary, args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      env: isolation.env,
+      cwd: cursorCwd,
+    }))
+  } catch (error) {
+    isolation.release()
+    throw error
+  }
+  releaseCursorSpawnOnExit(proc, isolation)
 
   let fullText = ''
   let stderr = ''
@@ -606,12 +620,18 @@ export async function callCursorStreaming(
     }
   }, WALL_MAX_MS)
 
+  let nativeSessionAnnounced = false
   function handleEvent(event: any) {
     const nextSessionId = extractCursorSessionId(event)
     if (nextSessionId && nextSessionId !== cursorChatId) {
       cursorChatId = nextSessionId
       updateCursorRun(run.runId, { cursorChatId })
     }
+    // 6.62.0 (plan 3.9): the job links to its native chat at the first event naming it.
+    if (nextSessionId && !nativeSessionAnnounced) {
+      nativeSessionAnnounced = true
+      try { callbacks.onNativeSession?.({ provider: 'cursor', cliSessionId: nextSessionId }) } catch { /* best effort */ }
+    }
 
     if (event?.type === 'system' && event?.subtype === 'init') {
       callbacks.onToolStatus?.(

package/server/lib/cursor-fork-context.ts

@@ -0,0 +1,140 @@
+// "New session with this context" for Cursor (6.62.0, D4, plan 3.7, W9).
+//
+// Cursor's Agent CLI cannot fork a chat. So the Cursor Fork is a NEW read-only chat
+// (`fork-thread.ts` `buildCursorForkArgs`) whose first prompt carries a bounded bundle of
+// the source chat, then the person's message. Three things live here, all pure or bounded:
+//
+//   - the bundle (title, first request, the last turns), always under MAX_PROMPT_CHARS;
+//   - the workspace: the hook signal's cwd, else the IDE composer's own recorded folder
+//     (`composerData.workspaceIdentifier`), else the CLI chat's spawn spelling. IDE
+//     composers have no `spawnWorkspace`, which is why the 6.61 lookup refused them all;
+//   - the model: the session's own slug when the installed Cursor lists it, else the
+//     fork fallback.
+
+import type { SessionTurn } from './agent-session-turns.js'
+
+export const CURSOR_FORK_TURNS = 12
+const MAX_TURN_CHARS = 4_000
+const MAX_FIRST_PROMPT_CHARS = 1_500
+const MAX_TITLE_CHARS = 200
+
+export interface CursorForkPromptInput {
+  title: string | null
+  firstPrompt: string | null
+  turns: readonly SessionTurn[]
+  message: string
+  maxChars: number
+}
+
+function clip(text: string, max: number): string {
+  const clean = text.replace(/\r\n/g, '\n').trim()
+  return clean.length <= max ? clean : `${clean.slice(0, max - 1)}…`
+}
+
+/**
+ * The first prompt of the new chat. The message is always whole and always last; context
+ * is dropped oldest-first until the whole fits `maxChars`. A message that leaves no room
+ * goes alone.
+ */
+export function buildCursorForkPrompt(input: CursorForkPromptInput): string {
+  const message = input.message
+  const tail = `\n\nNew message:\n${message}`
+  // 6.62.0 /qa (W10): Cursor titles a chat by its first line, so the FIRST line is the source's
+  // title (else the person's message), never a fixed header every fork would share.
+  const titleLine = input.title && input.title.trim()
+    ? clip(input.title.split('\n')[0]!, MAX_TITLE_CHARS)
+    : clip(message.split('\n').find(line => line.trim()) ?? message, MAX_TITLE_CHARS)
+  const header = 'A new chat that carries on from an earlier Cursor chat. Its context, for reference only:'
+  const lines: string[] = [titleLine, '', header, '']
+  if (input.title && input.title.trim()) lines.push(`Title: ${clip(input.title, MAX_TITLE_CHARS)}`)
+  if (input.firstPrompt && input.firstPrompt.trim()) lines.push(`First request: ${clip(input.firstPrompt, MAX_FIRST_PROMPT_CHARS)}`)
+  const head = lines.join('\n')
+  const rendered = input.turns
+    .filter(turn => typeof turn?.text === 'string' && turn.text.trim())
+    .map(turn => `${turn.role === 'user' ? 'User' : 'Assistant'}: ${clip(turn.text, MAX_TURN_CHARS)}`)
+  const budget = input.maxChars - tail.length
+  if (budget <= head.length) return message.length <= input.maxChars ? message : message.slice(0, input.maxChars)
+  // Newest turns are kept; the oldest go first.
+  const kept: string[] = []
+  let used = head.length + '\n\nRecent conversation (oldest first):'.length
+  for (let i = rendered.length - 1; i >= 0; i--) {
+    const cost = rendered[i]!.length + 1
+    if (used + cost > budget) break
+    kept.unshift(rendered[i]!)
+    used += cost
+  }
+  const body = kept.length > 0 ? `${head}\n\nRecent conversation (oldest first):\n${kept.join('\n')}` : head
+  return `${body}${tail}`
+}
+
+export interface CursorForkWorkspaceDeps {
+  /** The hook signal's cwd for this session, or null. */
+  signalCwd: (threadId: string) => string | null
+  /** The IDE composer's recorded workspace folder, or null. */
+  composerWorkspace: (threadId: string) => Promise<string | null>
+  /** The CLI chat's spawn spelling (`spawnWorkspace`), or null. */
+  spawnWorkspace: (threadId: string) => string | null
+  /** MUST throw on "cannot tell"; false only for absent. */
+  dirExists: (path: string) => boolean
+}
+
+function usable(path: unknown, deps: CursorForkWorkspaceDeps): path is string {
+  if (typeof path !== 'string' || !path.startsWith('/') || path.includes('\0')) return false
+  try {
+    return deps.dirExists(path) === true
+  } catch {
+    return false
+  }
+}
+
+/** Where the new chat runs. Null refuses the fork: never the server's own cwd. */
+export async function resolveCursorForkWorkspace(threadId: string, deps: CursorForkWorkspaceDeps): Promise<string | null> {
+  let candidate: string | null = null
+  try { candidate = deps.signalCwd(threadId) } catch { candidate = null }
+  if (usable(candidate, deps)) return candidate
+  try { candidate = await deps.composerWorkspace(threadId) } catch { candidate = null }
+  if (usable(candidate, deps)) return candidate
+  try { candidate = deps.spawnWorkspace(threadId) } catch { candidate = null }
+  if (usable(candidate, deps)) return candidate
+  return null
+}
+
+export interface CursorForkPrepDeps {
+  transcriptPath: (threadId: string) => string | null
+  readTurns: (path: string, limit: number) => Promise<SessionTurn[]>
+  readTitle: (path: string, threadId: string) => Promise<{ title: string | null; firstPrompt: string | null }>
+  /** The session's own model as a slug the installed Cursor lists, or null. */
+  sessionModel: (threadId: string, path: string | null) => Promise<string | null>
+  maxChars: number
+}
+
+/**
+ * The prompt and model for one Cursor fork. A failed read costs context, never the fork:
+ * with nothing readable the new chat gets the message alone and the fallback model.
+ */
+export async function prepareCursorFork(
+  threadId: string,
+  message: string,
+  deps: CursorForkPrepDeps,
+): Promise<{ prompt: string; cursorModel: string | null }> {
+  let path: string | null = null
+  try { path = deps.transcriptPath(threadId) } catch { path = null }
+  let turns: SessionTurn[] = []
+  let title: string | null = null
+  let firstPrompt: string | null = null
+  // 6.62.0 /qa (W17): a fork that loses its context says so in the server log.
+  const lost: string[] = []
+  if (path) {
+    try { turns = await deps.readTurns(path, CURSOR_FORK_TURNS) } catch { turns = []; lost.push('turns') }
+    try { ({ title, firstPrompt } = await deps.readTitle(path, threadId)) } catch { title = null; firstPrompt = null; lost.push('title') }
+  } else {
+    lost.push('transcript')
+  }
+  let cursorModel: string | null = null
+  try { cursorModel = await deps.sessionModel(threadId, path) } catch { cursorModel = null; lost.push('model') }
+  if (lost.length > 0) console.warn(`[cursor-fork] context lost thread=${threadId.slice(0, 8)} missing=${lost.join(',')}`)
+  return {
+    prompt: buildCursorForkPrompt({ title, firstPrompt, turns, message, maxChars: deps.maxChars }),
+    cursorModel,
+  }
+}

package/server/lib/cursor-model-catalog.ts

@@ -3,10 +3,12 @@
 // Stable app slots (cursor-grok / cursor-composer) map to concrete CLI model
 // ids proven in Phase 0. `agent models` is text-only — parse + cache it.
 
-import { spawn } from 'node:child_process'
+import { spawn, type ChildProcessByStdio } from 'node:child_process'
+import type { Readable } from 'node:stream'
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { resolveProviderBinary } from './provider-binary.js'
+import { cursorSpawnEnv, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 import {
   CURSOR_COMPOSER_MODEL,
   CURSOR_GROK_MODEL,
@@ -187,6 +189,21 @@ function unavailableCatalog(refreshError?: string, agentBinary?: string): Cursor
   return buildCursorModelCatalog([], 'unavailable', new Date().toISOString(), agentBinary, refreshError)
 }
 
+function readDiskModels(): CursorCatalogModel[] {
+  const path = catalogCachePath()
+  if (!existsSync(path)) return []
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { models?: CursorCatalogModel[] }
+    return Array.isArray(parsed.models)
+      ? parsed.models
+        .filter(m => typeof m?.id === 'string' && m.id)
+        .map(m => ({ id: m.id, displayName: normalizeCursorDisplayName(typeof m.displayName === 'string' ? m.displayName : '') }))
+      : []
+  } catch {
+    return []
+  }
+}
+
 function readDiskCatalog(): CursorModelCatalog | null {
   const path = catalogCachePath()
   if (!existsSync(path)) return null
@@ -244,10 +261,19 @@ async function fetchCliModels(agentBinary: string): Promise<CursorCatalogModel[]
   return new Promise((resolveModels, reject) => {
     const env = { ...process.env }
     delete env.CLAUDECODE
-    const child = spawn(agentBinary, ['models'], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env,
-    })
+    // 6.62.0 (plan 3.4): every `agent` spawn runs on a config dir of its own.
+    const isolation = cursorSpawnEnv({ baseEnv: env })
+    let child: ChildProcessByStdio<null, Readable, Readable>
+    try {
+      child = spawn(agentBinary, ['models'], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: isolation.env,
+      })
+    } catch (error) {
+      isolation.release()
+      throw error
+    }
+    releaseCursorSpawnOnExit(child, isolation)
     let settled = false
     let stdout = ''
     let stderr = ''
@@ -283,6 +309,36 @@ async function fetchCliModels(agentBinary: string): Promise<CursorCatalogModel[]
 let catalogSnapshot = readDiskCatalog() ?? unavailableCatalog()
 let refreshPromise: Promise<CursorModelCatalog> | null = null
 
+/**
+ * 6.62.0 (plan 3.3, W17): EVERY model `agent models` listed, kept in memory beside the two
+ * slot `options`. The options stay two because the phone's slots read them
+ * (work-phone.ts); this list is what a Continue validates a session's own model against,
+ * so it can pass any model and modifier the installed Cursor offers.
+ */
+let fullModelList: CursorCatalogModel[] = readDiskModels()
+
+export function getFullCursorModelList(): readonly CursorCatalogModel[] {
+  return fullModelList
+}
+
+/** Exact, case-insensitive membership in the full list. */
+export function isKnownCursorModel(modelId: string): boolean {
+  const wanted = typeof modelId === 'string' ? modelId.trim().toLowerCase() : ''
+  return wanted.length > 0 && fullModelList.some(model => model.id.toLowerCase() === wanted)
+}
+
+/** The CLI's own display name for a listed model (normalized), or null. */
+export function cursorModelDisplayName(modelId: string): string | null {
+  const wanted = typeof modelId === 'string' ? modelId.trim().toLowerCase() : ''
+  const found = fullModelList.find(model => model.id.toLowerCase() === wanted)
+  return found ? normalizeCursorDisplayName(found.displayName) || null : null
+}
+
+/** Tests only. */
+export function __setFullCursorModelListForTests(models: CursorCatalogModel[]): void {
+  fullModelList = [...models]
+}
+
 export function getCursorModelCatalogSnapshot(): CursorModelCatalog {
   return catalogSnapshot
 }
@@ -332,6 +388,7 @@ export async function getCursorModelCatalog(forceRefresh = false): Promise<Curso
     try {
       const models = await fetchCliModels(agentBinary)
       catalogSnapshot = buildCursorModelCatalog(models, 'cli', new Date().toISOString(), agentBinary)
+      fullModelList = models
       writeDiskCatalog(models, agentBinary)
     } catch (err) {
       const refreshError = err instanceof Error ? err.message : 'Live Cursor model discovery unavailable.'