@gotcos/glasses-server 6.61.6 → 6.62.1

package/server/lib/fork-thread.ts

@@ -78,7 +78,6 @@ import {
   buildAttachedEnv,
   classifyStderr,
   extractNativeIdsFromLine,
-  isAttachedPermissionPolicy,
   resolveProviderBinary,
   type AttachedChildProcess,
   type AttachedSpawnRequest,
@@ -86,19 +85,34 @@ import {
   type BinaryResolution,
 } from './attached-provider-adapter.js'
 import { findBannedPermissionArg } from './banned-permission-args.js'
+import { PROVIDER_AUTH_RE, PROVIDER_OVERFLOW_RE, PROVIDER_QUOTA_RE } from './provider-failure-text.js'
+import { cursorIsolationUnavailableError, cursorSpawnEnv, isCursorIsolationUnavailable, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 
 /**
- * Providers that can be forked. A strict subset of the attached set.
+ * Providers that can be forked.
  *
- * Cursor can Continue (ask-mode resume) and cannot Fork: Agent CLI has no
- * `--fork-session` equivalent, and advertising Fork on Cursor would 404 the
- * only remaining write path for that row if Continue were also hidden.
+ * 6.62.0 (D4, plan 3.7): Cursor's Agent CLI has no `--fork-session`, so its "fork" is a
+ * NEW chat seeded with a bounded context bundle the caller built ("New session with this
+ * context"). It is read-only (`--mode ask`, never `--force`) and stays under the full ban,
+ * like every other fork (B3).
  */
 export type ForkProvider = ForkableProvider
 
-/** Same one-member policy as the attached path. An omitted policy is refused. */
+/** The model a Cursor fork runs when the caller names none (or one that is not a slug). */
+export const CURSOR_FORK_FALLBACK_MODEL = 'composer-2.5-fast'
+const CURSOR_SLUG_RE = /^[a-z0-9][a-z0-9._-]{0,99}$/i
+
+/**
+ * One member, and it stays `read_only` (plan v3, B3): D1 widened CONTINUE to the session's
+ * own posture, never Fork. Every fork, Cursor's included, is read-only. Its own predicate
+ * since 6.62.0, when the attached path's policy word became `session_posture`.
+ */
 export type ForkPermissionPolicy = 'read_only'
 
+export function isForkPermissionPolicy(value: unknown): value is ForkPermissionPolicy {
+  return value === 'read_only'
+}
+
 /** Terminal reason on failure. Never carries prompt, transcript or provider text. */
 export type ForkFailure =
   | 'invalid_provider'
@@ -192,6 +206,51 @@ export interface ForkFailureResult {
 
 export type ForkResult = ForkSuccess | ForkFailureResult
 
+/**
+ * Why the provider itself refused the turn, read from its own error event. An enum
+ * only: the provider's sentence never leaves this module. On 2026-10-05 a complete
+ * 14.8 MB copy's first turn was refused "Prompt is too long", and the route could
+ * only say "COS lost track of the copy": every refusal after the prompt was
+ * written looked the same.
+ */
+export type ForkProviderFailure = 'context_too_long' | 'provider_limit' | 'provider_auth'
+export const FORK_PROVIDER_FAILURES: readonly ForkProviderFailure[] = ['context_too_long', 'provider_limit', 'provider_auth']
+
+export function classifyProviderErrorText(text: string): ForkProviderFailure | null {
+  const sample = text.slice(0, 8_000)
+  // Overflow first: "Prompt is too long" can share a line with a usage hint.
+  if (PROVIDER_OVERFLOW_RE.test(sample)) return 'context_too_long'
+  if (PROVIDER_QUOTA_RE.test(sample)) return 'provider_limit'
+  if (PROVIDER_AUTH_RE.test(sample)) return 'provider_auth'
+  return null
+}
+
+/**
+ * One stdout line, judged only when it is an error carrier: Claude's stream-json
+ * `result` with `is_error`, an assistant event with `error` / `isApiErrorMessage`,
+ * or a Codex/Cursor `error` / `turn.failed` event. Ordinary assistant text that
+ * merely mentions a limit is never read.
+ */
+export function classifyProviderOutputLine(line: string): ForkProviderFailure | null {
+  if (!line || line.length > 2_000_000 || line[0] !== '{') return null
+  let j: any
+  try { j = JSON.parse(line) } catch { return null }
+  if (!j || typeof j !== 'object') return null
+  const carrier = (j.type === 'result' && j.is_error === true) || j.isApiErrorMessage === true
+    || typeof j.error === 'string' || j.type === 'error' || j.type === 'turn.failed'
+  if (!carrier) return null
+  if (j.error === 'rate_limit' || j.apiErrorStatus === 429) return 'provider_limit'
+  if (j.error === 'authentication_failed') return 'provider_auth'
+  const parts: string[] = []
+  const add = (v: unknown) => { if (typeof v === 'string') parts.push(v.slice(0, 2_000)) }
+  add(j.result); add(j.error); add(j.message)
+  if (j.error && typeof j.error === 'object') add(j.error.message)
+  const content = j.message && typeof j.message === 'object' ? j.message.content : null
+  if (typeof content === 'string') add(content)
+  else if (Array.isArray(content)) for (const c of content.slice(0, 8)) add(c?.text)
+  return classifyProviderErrorText(parts.join('\n'))
+}
+
 /**
  * Might this call have left a thread behind that nobody can name?
  *
@@ -251,6 +310,25 @@ export function buildClaudeForkArgs(nativeThreadId: string): string[] {
  * `--ephemeral` is deliberately absent: a fork that is not written to disk is not a
  * thread the user can go back to, which is the entire deliverable.
  */
+/**
+ * Cursor: `agent -p --mode ask --model <slug> --output-format stream-json --trust
+ * --workspace <ws>`, prompt (the context bundle, then the message) on stdin.
+ *
+ * NO `--resume`: there is nothing to resume into, the source chat is only read (by the
+ * caller, for the bundle). NO `--force`: a fork is read-only (B3). The new chat's id comes
+ * back as `session_id` on the stream, and the exactly-one-new-id rule below holds as is.
+ */
+export function buildCursorForkArgs(cwd: string, model: string): string[] {
+  return [
+    '-p',
+    '--mode', 'ask',
+    '--model', model,
+    '--output-format', 'stream-json',
+    '--trust',
+    '--workspace', cwd,
+  ]
+}
+
 export function buildCodexForkArgs(nativeThreadId: string, cwd: string): string[] {
   return [
     'exec',
@@ -274,10 +352,15 @@ export function buildCodexForkArgs(nativeThreadId: string, cwd: string): string[
  * model against the user's workspace, so it needs the same list the attached path
  * has — and needs it to keep being the same list after someone edits one of them.
  */
-function buildForkArgs(provider: ForkProvider, nativeThreadId: string, cwd: string): string[] {
-  const args = provider === 'claude'
-    ? buildClaudeForkArgs(nativeThreadId)
-    : buildCodexForkArgs(nativeThreadId, cwd)
+function buildForkArgs(provider: ForkProvider, nativeThreadId: string, cwd: string, cursorModel?: string): string[] {
+  // An explicit branch per provider: until 6.62.0 a ternary sent anything that was not
+  // Claude down the Codex path, which for Cursor would have been a `codex` argv.
+  let args: string[]
+  if (provider === 'claude') args = buildClaudeForkArgs(nativeThreadId)
+  else if (provider === 'codex') args = buildCodexForkArgs(nativeThreadId, cwd)
+  else if (provider === 'cursor') args = buildCursorForkArgs(cwd, cursorModel ?? CURSOR_FORK_FALLBACK_MODEL)
+  else throw new Error('fork argv: unknown provider')
+  // NO allowance, ever: every fork stays under the full ban.
   const banned = findBannedPermissionArg(args)
   if (banned !== null) {
     // The flag name only. Never the argv, which carries the thread id and the cwd.
@@ -395,7 +478,7 @@ export interface ForkDeps {
    * Exists ONLY so a test can hand back an argv carrying a banned permission flag
    * and prove the fork is refused with zero spawns. Production never sets it.
    */
-  buildArgs?: (provider: ForkProvider, nativeThreadId: string, cwd: string) => string[]
+  buildArgs?: (provider: ForkProvider, nativeThreadId: string, cwd: string, cursorModel?: string) => string[]
 }
 
 export interface ForkRequest {
@@ -404,6 +487,12 @@ export interface ForkRequest {
   prompt: unknown
   cwd: unknown
   policy: unknown
+  /**
+   * 6.62.0: the Cursor fork's model, a flat slug (the session's own, validated by the
+   * caller against the installed list). Ignored for Claude and Codex, whose forks keep
+   * their source's model. Absent or not a slug: `CURSOR_FORK_FALLBACK_MODEL`.
+   */
+  cursorModel?: unknown
   deps: ForkDeps
   /** Wall-clock budget for the provider run. Omitted uses the attached default. */
   timeoutMs?: number
@@ -541,7 +630,7 @@ async function run(request: ForkRequest, deps: ForkDeps, startedAt: number): Pro
 
   const base = { provider, sourceNativeThreadId }
 
-  if (!isAttachedPermissionPolicy(request.policy)) {
+  if (!isForkPermissionPolicy(request.policy)) {
     // Includes `undefined`. An omitted policy is not a request for the safest one;
     // it is a caller that has not decided.
     return fail('unsupported_policy', 'none', { ...base, durationMs: duration() })
@@ -602,9 +691,12 @@ async function run(request: ForkRequest, deps: ForkDeps, startedAt: number): Pro
   const watermarkBefore = readWatermark(deps, provider, sourceNativeThreadId)
 
   // --- 4. Spawn ---------------------------------------------------------------
+  const cursorModel = provider === 'cursor' && typeof request.cursorModel === 'string' && CURSOR_SLUG_RE.test(request.cursorModel)
+    ? request.cursorModel
+    : undefined
   let args: string[]
   try {
-    args = (deps.buildArgs ?? buildForkArgs)(provider, sourceNativeThreadId, cwd)
+    args = (deps.buildArgs ?? buildForkArgs)(provider, sourceNativeThreadId, cwd, cursorModel)
   } catch {
     return fail('unsupported_policy', 'none', { ...base, detail: 'argv_build_failed', durationMs: duration() })
   }
@@ -617,10 +709,11 @@ async function run(request: ForkRequest, deps: ForkDeps, startedAt: number): Pro
 
   let child: AttachedChildProcess
   try {
-    child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv() })
-  } catch {
+    child = deps.spawn({ binaryPath, args, cwd, env: buildAttachedEnv(), provider })
+  } catch (error) {
     // Includes ENOENT. No process exists, so no thread can have been created.
-    return fail('spawn_failed', 'none', { ...base, detail: 'threw', durationMs: duration() })
+    const detail = isCursorIsolationUnavailable(error) ? 'cursor_isolation_unavailable' : 'threw'
+    return fail('spawn_failed', 'none', { ...base, detail, durationMs: duration() })
   }
   if (!child || typeof child !== 'object' || typeof child.on !== 'function') {
     return fail('spawn_failed', 'none', { ...base, detail: 'no_child', durationMs: duration() })
@@ -730,6 +823,7 @@ function driveChild(input: DriveInput): Promise<ForkResult> {
     let stderrSample = ''
     let forkState: ForkState = 'none'
     let exitCode: number | null = null
+    let providerFailure: ForkProviderFailure | null = null
     let settled = false
     let timedOut = false
     let spawnErrored = false
@@ -779,6 +873,7 @@ function driveChild(input: DriveInput): Promise<ForkResult> {
           for (const id of extractNativeIdsFromLine(line)) {
             if (!observedIds.includes(id)) observedIds.push(id)
           }
+          providerFailure ??= classifyProviderOutputLine(line)
         }
         // Deliberately nothing else: no text, no tool calls, no transcript. This
         // module cannot leak what it never held.
@@ -805,12 +900,22 @@ function driveChild(input: DriveInput): Promise<ForkResult> {
         for (const id of extractNativeIdsFromLine(stdoutTail)) {
           if (!observedIds.includes(id)) observedIds.push(id)
         }
+        providerFailure ??= classifyProviderOutputLine(stdoutTail)
         stdoutTail = ''
       }
 
-      if (timedOut) return settleFailure('timeout')
+      // After the prompt was written a copy may exist. When the provider named exactly
+      // one new thread, carry it, so the route can point at the copy instead of
+      // telling the user it may exist somewhere (2026-10-05).
+      const copyId = (): string | null => {
+        if (forkState !== 'possible') return null
+        const verdict = selectForkedId(observedIds, sourceNativeThreadId)
+        return verdict.ok ? verdict.newNativeThreadId : null
+      }
+      const cause = (): string | null => providerFailure ?? classifyProviderErrorText(stderrSample)
+      if (timedOut) return settleFailure('timeout', { newNativeThreadId: copyId() })
       if (spawnErrored) return settleFailure('spawn_failed', { detail: 'child_error' })
-      if (exitCode !== 0) return settleFailure('provider_exit_nonzero')
+      if (exitCode !== 0) return settleFailure('provider_exit_nonzero', { newNativeThreadId: copyId(), detail: cause() })
 
       const verdict = selectForkedId(observedIds, sourceNativeThreadId)
       if (!verdict.ok) {
@@ -930,13 +1035,26 @@ export function realForkDeps(
   return {
     now: () => Date.now(),
     resolveBinary: provider => resolveProviderBinary(provider),
-    spawn: request => nodeSpawn(request.binaryPath, [...request.args], {
-      stdio: ['pipe', 'pipe', 'pipe'],
-      cwd: request.cwd,
-      env: request.env,
-      // Group leader, so the whole provider tree can be signalled on timeout.
-      detached: true,
-    }) as unknown as AttachedChildProcess,
+    spawn: request => {
+      // 6.62.0 (plan 3.4): the Cursor fork's `--model` must not rewrite the CLI default.
+      const isolation = request.provider === 'cursor' ? cursorSpawnEnv({ baseEnv: request.env }) : null
+      // 6.62.0 /qa (W6): a fork never falls back to the shared Cursor config.
+      if (isolation && !isolation.isolated) throw cursorIsolationUnavailableError()
+      try {
+        const child = nodeSpawn(request.binaryPath, [...request.args], {
+          stdio: ['pipe', 'pipe', 'pipe'],
+          cwd: request.cwd,
+          env: isolation ? isolation.env : request.env,
+          // Group leader, so the whole provider tree can be signalled on timeout.
+          detached: true,
+        })
+        if (isolation) releaseCursorSpawnOnExit(child, isolation)
+        return child as unknown as AttachedChildProcess
+      } catch (error) {
+        isolation?.release()
+        throw error
+      }
+    },
     processStartMs: pid => realProcessStartMs(pid),
     recordSpawn: (pid, startMs) => recordCosSpawn(pid, startMs),
     releaseSpawn: pid => releaseCosSpawn(pid),

package/server/lib/health-static-probes.ts

@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process'
+import { cursorSpawnEnv } from './cursor-spawn-env.js'
 import { resolveProviderBinary } from './provider-binary.js'
 import { PYTHON_BIN } from './python-bridge.js'
 import {
@@ -77,17 +78,26 @@ function cacheTtlMs(): number {
   return Number.isFinite(raw) && raw >= 0 ? Math.floor(raw) : DEFAULT_CACHE_TTL_MS
 }
 
-function execute(file: string, args: string[]): Promise<{ stdout: string; stderr: string }> {
+function execute(file: string, args: string[], options: { cursorIsolation?: boolean } = {}): Promise<{ stdout: string; stderr: string }> {
   return new Promise((resolve, reject) => {
-    execFile(file, args, {
-      encoding: 'utf8',
-      timeout: PROBE_TIMEOUT_MS,
-      maxBuffer: 256 * 1024,
-      killSignal: 'SIGKILL',
-    }, (error, stdout, stderr) => {
-      if (error) return reject(error)
-      resolve({ stdout: String(stdout), stderr: String(stderr) })
-    })
+    // 6.62.0 (plan 3.4): every `agent` spawn runs on a config dir of its own.
+    const isolation = options.cursorIsolation === true ? cursorSpawnEnv() : null
+    try {
+      execFile(file, args, {
+        encoding: 'utf8',
+        timeout: PROBE_TIMEOUT_MS,
+        maxBuffer: 256 * 1024,
+        killSignal: 'SIGKILL',
+        ...(isolation ? { env: isolation.env } : {}),
+      }, (error, stdout, stderr) => {
+        isolation?.release()
+        if (error) return reject(error)
+        resolve({ stdout: String(stdout), stderr: String(stderr) })
+      })
+    } catch (error) {
+      isolation?.release()
+      reject(error)
+    }
   })
 }
 
@@ -143,7 +153,7 @@ async function probeCursor(): Promise<{ value: string; available: boolean }> {
   const agentBinary = resolveAgentBinary()
   if (!agentBinary) return { value: 'error', available: false }
   try {
-    const result = await execute(agentBinary, ['about'])
+    const result = await execute(agentBinary, ['about'], { cursorIsolation: true })
     const combined = `${result.stdout}\n${result.stderr}`.trim()
     const version = parseCursorAboutVersion(combined)
     // Catalog discovery is authenticated downstream truth and can take up to

package/server/lib/lens-gist-engines.ts

@@ -18,7 +18,8 @@
 // dictation cleaner ships (no `--tools ""`) wrote a 26.5k-token cache of tool definitions.
 // Codex and Cursor carry 11 to 17k tokens of their own harness on every call.
 
-import { spawn } from 'node:child_process'
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
+import { cursorSpawnEnv, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
@@ -119,14 +120,24 @@ interface ProcessResult {
 export function runProcess(
   binary: string,
   args: string[],
-  opts: { stdin: string; cwd: string; timeoutMs: number; label: string },
+  opts: { stdin: string; cwd: string; timeoutMs: number; label: string; cursorIsolation?: boolean },
 ): Promise<ProcessResult> {
   return new Promise((resolve, reject) => {
     let stdout = ''
     let stderr = ''
     let settled = false
     let killTimer: NodeJS.Timeout | null = null
-    const proc = spawn(binary, args, { stdio: ['pipe', 'pipe', 'pipe'], env: lensGistChildEnv(binary), cwd: opts.cwd })
+    // 6.62.0 (plan 3.4): a Cursor child gets its own config dir, so `--model` cannot
+    // rewrite the person's CLI default (C9). Removed when the child exits.
+    const isolation = opts.cursorIsolation === true ? cursorSpawnEnv({ baseEnv: lensGistChildEnv(binary) }) : null
+    let proc: ChildProcessWithoutNullStreams
+    try {
+      proc = spawn(binary, args, { stdio: ['pipe', 'pipe', 'pipe'], env: isolation ? isolation.env : lensGistChildEnv(binary), cwd: opts.cwd })
+    } catch (error) {
+      isolation?.release()
+      throw error
+    }
+    if (isolation) releaseCursorSpawnOnExit(proc, isolation)
     const finish = (fn: () => void) => {
       if (settled) return
       settled = true
@@ -319,7 +330,7 @@ async function runCli(
 ): Promise<LensGistEngineRun> {
   const binary = binaryFor(provider)
   const result = await withScratchWorkspace(workspace =>
-    runProcess(binary, args(workspace), { stdin: prompt, cwd: workspace, timeoutMs: opts.timeoutMs, label: provider }))
+    runProcess(binary, args(workspace), { stdin: prompt, cwd: workspace, timeoutMs: opts.timeoutMs, label: provider, cursorIsolation: provider === 'cursor' }))
   const providerText = `${result.stdout}\n${result.stderr}`
   if (result.code !== 0) {
     // Codex reports its failure as a JSON event AND a non-zero exit; the event says why.

package/server/lib/lens-gist.ts

@@ -937,7 +937,7 @@ async function cursorGistModels(): Promise<string[]> {
   const binary = resolveProviderBinary('cursor')
   if (!binary.ok) return []
   try {
-    const result = await runProcess(binary.path, ['models'], { stdin: '', cwd: homedir(), timeoutMs: 15_000, label: 'cursor models' })
+    const result = await runProcess(binary.path, ['models'], { stdin: '', cwd: homedir(), timeoutMs: 15_000, label: 'cursor models', cursorIsolation: true })
     const ids = result.code === 0 ? parseAgentModelsText(result.stdout).map(m => m.id).filter(isLensGistModelName) : []
     if (ids.length) cursorModels = { at: Date.now(), ids }
     return ids

package/server/lib/live-cues-cursor.ts

@@ -13,6 +13,7 @@ import {
   extractCursorResponseText,
 } from './cursor-bridge.js'
 import { resolveAgentBinary } from './cursor-model-catalog.js'
+import { cursorSpawnEnv, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 import { classifyCursorError, getCursorExecutionCwd } from './cursor-run-ledger.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { terminateProviderProcess } from './provider-process-lifecycle.js'
@@ -70,12 +71,21 @@ export async function composerAsk(input: {
     // detached: the CLI gets its own process group so a timeout kill reaches
     // tool grandchildren. This is NEW relative to cursor-bridge (which spawns
     // attached) — the shutdown path in the engine must also kill this tree.
-    const proc = spawn(agentBinary, args, {
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env,
-      cwd: workspace,
-      detached: true,
-    })
+    // 6.62.0 (plan 3.4): `--model` here must not rewrite the person's CLI default (C9).
+    const isolation = cursorSpawnEnv({ baseEnv: env })
+    let proc: ReturnType<typeof spawn>
+    try {
+      proc = spawn(agentBinary, args, {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: isolation.env,
+        cwd: workspace,
+        detached: true,
+      })
+    } catch (error) {
+      isolation.release()
+      throw error
+    }
+    releaseCursorSpawnOnExit(proc, isolation)
     input.onProcess?.(proc)
 
     const finish = (result: ComposerAskResult) => {

package/server/lib/occupancy-probes.ts

@@ -53,7 +53,8 @@ import { basename, join, resolve } from 'node:path'
 import { NATIVE_THREAD_ID_RE } from './native-thread-id.js'
 import { transcriptPathFor, type NativeHeadDeps } from './native-head.js'
 import { parseProcStartUtcMs, type OccupancyDirs, type OccupancyProbes } from './thread-occupancy.js'
-import { resolveCursorAgentSession } from './cursor-agent-store.js'
+import { cursorTranscriptPath, resolveCursorAgentSession } from './cursor-agent-store.js'
+import { activeSqliteReaderPids, cliChatLastWriteMs } from './cursor-session-model.js'
 
 // Re-exported rather than reimplemented. `claudeSessionsDir` already encodes the
 // COS_CLAUDE_SESSIONS_DIR -> CLAUDE_CONFIG_DIR -> ~/.claude precedence AND is the
@@ -348,6 +349,39 @@ export function readFile(path: string): string | null {
  * other id validator (`SAFE_ID_RE`) permits `/` and `.`. If that validation is
  * ever dropped upstream, this refuses rather than probing an arbitrary path.
  */
+/**
+ * 6.62.0 /qa (W7): one bounded `lsof` on a Cursor CLI chat's `store.db`. A process that
+ * holds it open and is not COS (not the server, not a COS child, not one of COS's own
+ * short sqlite3 reads) is a run working that chat right now, at the desk or in a terminal
+ * `agent`, even when it has written nothing for 30 s. Null: lsof could not tell (timeout,
+ * missing, refused); the caller then falls back to the 30 s write rule and this logs it.
+ */
+export const CURSOR_CHAT_HOLDER_TIMEOUT_MS = 3_000
+export const cursorChatHolderStats = { probes: 0, held: 0, failed: 0 }
+
+export function cursorChatForeignHolder(
+  chatDir: string,
+  ownPids: () => Iterable<number>,
+  run: (bin: string, args: string[], timeoutMs: number) => ProbeOutcome = runProbe,
+): boolean | null {
+  if (typeof chatDir !== 'string' || !chatDir.startsWith('/') || chatDir.includes('\0')) return null
+  const path = join(chatDir, 'store.db')
+  cursorChatHolderStats.probes += 1
+  let pids: number[]
+  try {
+    pids = interpretLockHolders(run(LSOF_BIN, ['-w', '-t', '--', path], CURSOR_CHAT_HOLDER_TIMEOUT_MS), path)
+  } catch (error) {
+    cursorChatHolderStats.failed += 1
+    console.warn(`[occupancy-probes] cursor chat holder probe failed, the 30 s write rule decides: ${error instanceof Error ? error.message : error}`)
+    return null
+  }
+  const own = new Set<number>([process.pid])
+  try { for (const pid of ownPids()) own.add(pid) } catch { /* the ledger is advisory here */ }
+  const held = pids.some(pid => !own.has(pid))
+  if (held) cursorChatHolderStats.held += 1
+  return held
+}
+
 export function lockHolders(path: string): number[] {
   if (typeof path !== 'string' || path.length === 0 || path.includes('\0')) {
     throw new Error('lockHolders: refusing an unusable path')
@@ -728,6 +762,16 @@ export function realOccupancyProbes(ledger: SpawnLedgerAccessor): OccupancyProbe
     lockHolders,
     cosSpawnedPids: () => sanitizeLedger(ledger()),
     cursorAgentSession: (threadId, chatsDir) => resolveCursorAgentSession(threadId, chatsDir),
+    // 6.62.0 /qa (W7): positive evidence first: a non-COS process holding the chat open.
+    cursorChatForeignHolder: chatDir => cursorChatForeignHolder(chatDir, () => [
+      ...sanitizeLedger(ledger()).keys(),
+      ...activeSqliteReaderPids(),
+    ]),
+    // 6.62.0 (W14): the CLI chat busy window reads the chat's own files.
+    cursorChatLastWriteMs: (chatDir, threadId) => cliChatLastWriteMs(
+      chatDir,
+      cursorTranscriptPath(threadId, join(process.env.COS_AGENT_SESSIONS_HOME?.trim() || homedir(), '.cursor', 'projects')),
+    ),
     // transcriptMtimeMs is DELIBERATELY absent here. See `withTranscriptClock`.
   }
 }

package/server/lib/permission-broker.ts

@@ -112,7 +112,7 @@
 import { execFile } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { boundForRedaction } from './activity-preview.js'
-import { toolFingerprint, SESSION_ID_RE, type HookEnvelope } from './session-hook-events.js'
+import { inferHookProvider, toolFingerprint, SESSION_ID_RE, type HookEnvelope } from './session-hook-events.js'
 import { ASK_USER_QUESTION_TOOL, type SessionSignalStore } from './session-signal-store.js'
 
 // ---------------------------------------------------------------------------
@@ -302,6 +302,11 @@ export interface PermissionRequestFacts {
    * received it (its second argument). Null for an earlier script or block: `holdCeilingS`.
    */
   hookWaitS: number | null
+  /**
+   * 6.62.0 (plan 3.10): the engine that asked, from the envelope's stamp (the Codex command
+   * writes one) or the payload. Cursor never reaches here (`cursor` refusal above).
+   */
+  provider?: 'claude' | 'codex'
 }
 
 export type EnvelopeVerdict =
@@ -329,7 +334,7 @@ function readPermissionRequestEnvelope(body: unknown): EnvelopeRead {
   const hookWaitS = typeof wait === 'number' && Number.isInteger(wait) && wait > 0 && wait <= HOOK_WAIT_STAMP_MAX_S ? wait : null
   return {
     ok: true,
-    facts: { sessionId: p.session_id.toLowerCase(), toolName: p.tool_name, toolInput: p.tool_input, hookStartedAtMs: ts, hookWaitS },
+    facts: { sessionId: p.session_id.toLowerCase(), toolName: p.tool_name, toolInput: p.tool_input, hookStartedAtMs: ts, hookWaitS, provider: inferHookProvider(body.provider, p) === 'codex' ? 'codex' : 'claude' },
   }
 }
 
@@ -457,9 +462,16 @@ export const CANCEL_DENY_MESSAGE = 'Cancelled from COS'
  * 6.53.0: a held prompt whose run was cancelled from the lens. Deny with `interrupt: true`,
  * so Claude ends the RUN rather than trying something else in place of this tool. The one
  * case where a broker reply interrupts, and only ever from `cancelSession`.
+ *
+ * 6.62.0 (W20, C2): never for Codex. Its PermissionRequest refuses `interrupt` (it fails
+ * closed on the field), so a Codex prompt gets the plain deny; the halt marker stops the run
+ * at its next command.
  */
-export function cancelHookOutput(): Record<string, unknown> {
-  return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: { behavior: 'deny', message: CANCEL_DENY_MESSAGE, interrupt: true } } }
+export function cancelHookOutput(provider: 'claude' | 'codex' = 'claude'): Record<string, unknown> {
+  const decision = provider === 'codex'
+    ? { behavior: 'deny', message: CANCEL_DENY_MESSAGE }
+    : { behavior: 'deny', message: CANCEL_DENY_MESSAGE, interrupt: true }
+  return { hookSpecificOutput: { hookEventName: 'PermissionRequest', decision } }
 }
 
 /** A tool approval: allow once, or deny with the one message. Never a rule. */
@@ -819,6 +831,8 @@ type Chosen = { answers: Record<string, string[]> } | { decision: 'allow' | 'den
 interface BrokerItem {
   id: string
   sessionId: string
+  /** 6.62.0: the engine that asked (plan 3.10); every view says it. */
+  provider: 'claude' | 'codex'
   kind: BrokerItemKind
   toolName: string
   toolInput: Record<string, unknown>
@@ -849,7 +863,7 @@ interface BrokerItem {
 export interface SessionQuestionView {
   id: string
   sessionId: string
-  provider: 'claude'
+  provider: 'claude' | 'codex'
   kind: BrokerItemKind
   tool: string
   createdAt: string
@@ -872,7 +886,7 @@ export interface SessionQuestionView {
 export interface SettledQuestionView {
   id: string
   sessionId: string
-  provider: 'claude'
+  provider: 'claude' | 'codex'
   kind: BrokerItemKind
   tool: string
   createdAt: string
@@ -1213,6 +1227,7 @@ export class PermissionBroker {
     const item: BrokerItem = {
       id,
       sessionId: facts.sessionId,
+      provider: facts.provider ?? 'claude',
       kind: request.kind,
       toolName: facts.toolName,
       // Only a question needs its input again (the answer is built on it). An approval's
@@ -1289,7 +1304,7 @@ export class PermissionBroker {
       views.push({
         id: item.id,
         sessionId: item.sessionId,
-        provider: 'claude',
+        provider: item.provider,
         kind: item.kind,
         tool: item.toolName,
         createdAt: new Date(item.createdAt).toISOString(),
@@ -1321,7 +1336,7 @@ export class PermissionBroker {
     return listed.map(item => ({
       id: item.id,
       sessionId: item.sessionId,
-      provider: 'claude' as const,
+      provider: item.provider,
       kind: item.kind,
       tool: item.toolName,
       createdAt: new Date(item.createdAt).toISOString(),
@@ -1444,7 +1459,7 @@ export class PermissionBroker {
     let denied = 0
     for (const item of [...this.items.values()]) {
       if (item.state !== 'pending' || item.sessionId !== wanted) continue
-      if (!item.channel || !item.channel.writable() || !item.channel.reply(cancelHookOutput())) {
+      if (!item.channel || !item.channel.writable() || !item.channel.reply(cancelHookOutput(item.provider))) {
         this.settle(item, 'hook_gone')
         continue
       }