@gotcos/glasses-server 6.61.7 → 6.62.1

package/server/lib/continue-plan.ts

@@ -0,0 +1,180 @@
+// What one Continue runs with, per provider (6.62.0, plans 3.1-3.3 and 3.12, decision D1).
+//
+// D1 (Miles, binding): every Continue carries its session's full permissions.
+//   Claude  unchanged: `claude -p --resume` already runs as the session runs (APA:473-496),
+//           and keeps the session's model (canary C5).
+//   Codex   the session's own sandbox, model and effort, read from its rollout
+//           (`codex-session-posture.ts`), passed explicitly because resume takes the
+//           config defaults otherwise (C11). Full access only in a folder Codex trusts.
+//   Cursor  Run Everything (`--force`) on the session's own model (C4, C5), with every
+//           spawn isolated so `--model` cannot rewrite the user's CLI default (C9).
+//
+// THE PLAN IS DATA. The index shim resolves it, the adapter builds argv from it, and the
+// SAME plan names the one `PermissionAllowance` both of the adapter's ban checks receive.
+// A plan the adapter cannot validate is refused there, never widened.
+//
+// THE KILL SWITCH. `COS_CONTINUE_FULL_PERMISSIONS=0` in `~/.cos-glasses/.env` resolves NO
+// plan for Codex and Cursor, and the adapter then builds exactly the 6.61 argv (Codex
+// `getCodexTrustMode()`, Cursor `--mode ask` on composer-2.5-fast). Default on. Control
+// 0.5.254's provider allowlist does not carry the key, so it belongs in `.env`.
+
+import type { PermissionAllowance } from './banned-permission-args.js'
+import { CONTINUE_NOTE_MAX, fitModelNote, type CodexContinuePlan } from './codex-session-posture.js'
+import { CURSOR_CONTINUE_FALLBACK_MODEL } from './cursor-session-model.js'
+
+export type { CodexContinuePlan } from './codex-session-posture.js'
+
+export interface CursorContinuePlan {
+  provider: 'cursor'
+  /** `force` is Run Everything. The only mode a 6.62 plan carries; Ask is "no plan". */
+  mode: 'force'
+  /** A flat slug the installed Cursor lists, or the fallback. */
+  model: string
+  /** The session's own model was read AND listed. False means the fallback. */
+  matched: boolean
+  note: string
+}
+
+export type AttachedContinuePlan = CodexContinuePlan | CursorContinuePlan
+
+/** `COS_CONTINUE_FULL_PERMISSIONS`: ON unless exactly '0'. */
+export function continueFullPermissionsEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.COS_CONTINUE_FULL_PERMISSIONS !== '0'
+}
+
+const CODEX_SANDBOXES = new Set(['read-only', 'workspace-write', 'danger-full-access'])
+const MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/
+const EFFORT_RE = /^[a-z]{2,16}$/
+
+/**
+ * Is this a plan the adapter may build from? Structural, and total: anything that is not
+ * exactly a plan for THIS provider with values of the right shape is `invalid`. A value
+ * here becomes an argv element, so the shapes are the argv rules.
+ */
+export function validateContinuePlan(provider: string, plan: unknown): AttachedContinuePlan | null | 'invalid' {
+  if (plan === undefined || plan === null) return null
+  if (typeof plan !== 'object' || Array.isArray(plan)) return 'invalid'
+  const row = plan as Record<string, unknown>
+  if (row.provider !== provider) return 'invalid'
+  if (provider === 'codex') {
+    if (typeof row.sandbox !== 'string' || !CODEX_SANDBOXES.has(row.sandbox)) return 'invalid'
+    if (row.model !== null && (typeof row.model !== 'string' || !MODEL_RE.test(row.model))) return 'invalid'
+    if (row.effort !== null && (typeof row.effort !== 'string' || !EFFORT_RE.test(row.effort))) return 'invalid'
+    if (row.networkAccess !== null && typeof row.networkAccess !== 'boolean') return 'invalid'
+    if (row.source !== 'session' && row.source !== 'fallback') return 'invalid'
+    // A fallback plan never carries more than the 6.61 sandbox.
+    if (row.source === 'fallback' && (row.sandbox === 'danger-full-access' || row.model !== null || row.effort !== null)) return 'invalid'
+    return plan as CodexContinuePlan
+  }
+  if (provider === 'cursor') {
+    if (row.mode !== 'force') return 'invalid'
+    if (typeof row.model !== 'string' || !MODEL_RE.test(row.model)) return 'invalid'
+    return plan as CursorContinuePlan
+  }
+  // Claude has no plan: its Continue is unchanged.
+  return 'invalid'
+}
+
+/**
+ * The ONE allowance for this plan, or undefined (the full ban). Built once per turn and
+ * passed to both checks. Only the two escalations D1 names exist.
+ */
+export function continueAllowanceFor(plan: AttachedContinuePlan | null | undefined): PermissionAllowance | undefined {
+  if (!plan) return undefined
+  if (plan.provider === 'cursor' && plan.mode === 'force') return { path: 'attached_continue', cursorForce: true }
+  if (plan.provider === 'codex' && plan.sandbox === 'danger-full-access') {
+    return { path: 'attached_continue', codexSandbox: 'danger-full-access' }
+  }
+  return undefined
+}
+
+export interface CursorPlanInput {
+  /** Flat slugs, most specific first (`cursorSlugCandidates`, or a CLI chat's own slug). */
+  candidates: readonly string[]
+  isKnown: (id: string) => boolean
+  label: (id: string) => string | null
+  /** COS created this CLI chat in Ask mode: a Run Everything Continue escalates it (W14). */
+  askModeChat: boolean
+}
+
+/** Run Everything on the session's model, validated against the full `agent models` list. */
+export function planCursorContinue(input: CursorPlanInput): CursorContinuePlan {
+  let model: string | null = null
+  for (const candidate of input.candidates) {
+    try {
+      if (MODEL_RE.test(candidate) && input.isKnown(candidate)) { model = candidate; break }
+    } catch {
+      model = null
+      break
+    }
+  }
+  const matched = model !== null
+  const chosen = model ?? CURSOR_CONTINUE_FALLBACK_MODEL
+  let label: string | null = null
+  try {
+    label = input.label(chosen)
+  } catch {
+    label = null
+  }
+  // The CLI's display name when the note stays short; else the slug itself (lens width).
+  const display = label || (matched ? null : 'Composer 2.5 Fast')
+  const note = input.askModeChat
+    ? fitModelNote(m => `Now Run Everything (was Ask), ${m}.`, display, chosen, 'Now Run Everything (was Ask).')
+    : matched
+      ? fitModelNote(m => `Run Everything on ${m}.`, display, chosen, 'Run Everything on this session\'s model.')
+      : fitModelNote(m => `Run Everything on ${m}; model unread.`, display, chosen, 'Run Everything; session model unread.')
+  return { provider: 'cursor', mode: 'force', model: chosen, matched, note }
+}
+
+/** The note when the kill switch is on, per provider. Claude has none: it never changed. */
+export function killSwitchNote(provider: string, codexFallbackSandbox: 'read-only' | 'workspace-write'): string | null {
+  if (provider === 'codex') {
+    return codexFallbackSandbox === 'workspace-write'
+      ? 'Workspace write: full permissions switched off.'
+      : 'Read-only: full permissions switched off.'
+  }
+  if (provider === 'cursor') return 'Ask mode: full permissions switched off.'
+  return null
+}
+
+/**
+ * 6.62.0 /qa (Q3): the request header by which a client says it SHOWS `continue_note`. Only
+ * then does a Cursor Continue run Run Everything: glasses 599 and older label Cursor Continue
+ * "Ask", and the server must not do more than the button said. Codex needs no gate (the old
+ * copy, "uses this session's settings", stays true). The kill switch still wins.
+ */
+export const CONTINUE_NOTE_HEADER = 'x-cos-continue-note'
+
+/** The header's value read strictly: exactly '1' (an array takes its first value). */
+export function continueNoteAcknowledged(value: unknown): boolean {
+  const first = Array.isArray(value) ? value[0] : value
+  return typeof first === 'string' && first.trim() === '1'
+}
+
+/** A Cursor Continue for a client that does not show the note: the 6.61 Ask posture, said so. */
+export const CURSOR_ASK_UNACKED_NOTE = 'Ask mode (read-only) for this app version.'
+
+/**
+ * 6.62.0 /qa (W9): the note a verdict carries when the read missed its budget, so a Cursor
+ * Continue never runs Run Everything without saying so. Claude has none (unchanged).
+ */
+export function fallbackContinueNote(
+  provider: string,
+  options: { noteAck: boolean; env?: NodeJS.ProcessEnv; codexFallbackSandbox?: 'read-only' | 'workspace-write' },
+): string | null {
+  if (provider !== 'codex' && provider !== 'cursor') return null
+  if (!continueFullPermissionsEnabled(options.env)) return killSwitchNote(provider, options.codexFallbackSandbox ?? 'read-only')
+  if (provider === 'codex') return 'This Codex session\'s own access.'
+  return options.noteAck ? 'Run Everything on this chat\'s model.' : CURSOR_ASK_UNACKED_NOTE
+}
+
+/** An IDE composer is not resumed from outside; a turn queued for it runs in Cursor. */
+export const CURSOR_COMPOSER_NOTE = 'Runs in Cursor\'s own chat with its settings.'
+
+/** Belt and braces for every note that reaches the wire (plan 3.12). */
+export function boundedContinueNote(note: unknown): string | null {
+  if (typeof note !== 'string') return null
+  const trimmed = note.replace(/\s+/g, ' ').trim()
+  if (trimmed.length === 0) return null
+  return trimmed.length <= CONTINUE_NOTE_MAX ? trimmed : null
+}

package/server/lib/continue-read-health.ts

@@ -0,0 +1,26 @@
+// The Continue side's own counters on /api/health (6.62.0 /qa W6): spawn isolation, Codex
+// posture reads and Cursor model reads. Until this they were counted and never read, so a
+// Mac whose isolation kept failing open looked exactly like one where it worked.
+
+import { cursorSpawnStats } from './cursor-spawn-env.js'
+import { postureReadStats } from './codex-session-posture.js'
+import { cursorModelReadStats } from './cursor-session-model.js'
+import { cursorChatHolderStats } from './occupancy-probes.js'
+
+export function continueReadHealthFields(): {
+  continueReads: {
+    cursorSpawn: typeof cursorSpawnStats
+    codexPosture: typeof postureReadStats
+    cursorModel: typeof cursorModelReadStats
+    cursorChatHolders: typeof cursorChatHolderStats
+  }
+} {
+  return {
+    continueReads: {
+      cursorSpawn: { ...cursorSpawnStats },
+      codexPosture: { ...postureReadStats },
+      cursorModel: { ...cursorModelReadStats },
+      cursorChatHolders: { ...cursorChatHolderStats },
+    },
+  }
+}

package/server/lib/cursor-bridge.ts

@@ -1,7 +1,7 @@
 // Cursor Agent CLI bridge — ask or full agent (`--force` + `--sandbox disabled`).
 // Fail-closed: never fall through to Claude.
 
-import { spawn } from 'node:child_process'
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process'
 import { logTokenAudit } from './token-audit.js'
 import { cleanupModelImageInputs, type ModelImageInput } from './model-image-input.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt } from './context-builder.js'
@@ -64,6 +64,8 @@ import {
 } from '../../shared/media-attachment.js'
 import { terminalProviderAuthFailure } from './provider-terminal-error.js'
 import { teeJobTrail } from './job-trail.js'
+import { cursorSpawnEnv, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
+import { applyTurnRequestEnv, createTurnRequestBinding, spawnWithTurnRequest } from './turn-request.js'
 
 const INACTIVITY_MS = 180_000
 const WALL_MAX_MS = 900_000
@@ -355,12 +357,24 @@ export async function callCursorStreaming(
   const env = { ...process.env }
   delete env.CLAUDECODE
   if (outputImagePublisher) Object.assign(env, outputImagePublisher.env)
+  const turnRequest = createTurnRequestBinding({ userText: query, prompt, turnId: options?.turnId })
+  applyTurnRequestEnv(env, turnRequest)
+  // 6.62.0 (plan 3.4): Messages and reviews pass `--model`; the child's own config dir keeps
+  // that from rewriting the person's CLI default (C9). Removed when the child exits.
+  const isolation = cursorSpawnEnv({ baseEnv: env })
 
-  const proc = spawn(agentBinary, args, {
-    stdio: ['pipe', 'pipe', 'pipe'],
-    env,
-    cwd: cursorCwd,
-  })
+  let proc: ChildProcessWithoutNullStreams
+  try {
+    proc = spawnWithTurnRequest(turnRequest, () => spawn(agentBinary, args, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      env: isolation.env,
+      cwd: cursorCwd,
+    }))
+  } catch (error) {
+    isolation.release()
+    throw error
+  }
+  releaseCursorSpawnOnExit(proc, isolation)
 
   let fullText = ''
   let stderr = ''
@@ -606,12 +620,18 @@ export async function callCursorStreaming(
     }
   }, WALL_MAX_MS)
 
+  let nativeSessionAnnounced = false
   function handleEvent(event: any) {
     const nextSessionId = extractCursorSessionId(event)
     if (nextSessionId && nextSessionId !== cursorChatId) {
       cursorChatId = nextSessionId
       updateCursorRun(run.runId, { cursorChatId })
     }
+    // 6.62.0 (plan 3.9): the job links to its native chat at the first event naming it.
+    if (nextSessionId && !nativeSessionAnnounced) {
+      nativeSessionAnnounced = true
+      try { callbacks.onNativeSession?.({ provider: 'cursor', cliSessionId: nextSessionId }) } catch { /* best effort */ }
+    }
 
     if (event?.type === 'system' && event?.subtype === 'init') {
       callbacks.onToolStatus?.(

package/server/lib/cursor-fork-context.ts

@@ -0,0 +1,140 @@
+// "New session with this context" for Cursor (6.62.0, D4, plan 3.7, W9).
+//
+// Cursor's Agent CLI cannot fork a chat. So the Cursor Fork is a NEW read-only chat
+// (`fork-thread.ts` `buildCursorForkArgs`) whose first prompt carries a bounded bundle of
+// the source chat, then the person's message. Three things live here, all pure or bounded:
+//
+//   - the bundle (title, first request, the last turns), always under MAX_PROMPT_CHARS;
+//   - the workspace: the hook signal's cwd, else the IDE composer's own recorded folder
+//     (`composerData.workspaceIdentifier`), else the CLI chat's spawn spelling. IDE
+//     composers have no `spawnWorkspace`, which is why the 6.61 lookup refused them all;
+//   - the model: the session's own slug when the installed Cursor lists it, else the
+//     fork fallback.
+
+import type { SessionTurn } from './agent-session-turns.js'
+
+export const CURSOR_FORK_TURNS = 12
+const MAX_TURN_CHARS = 4_000
+const MAX_FIRST_PROMPT_CHARS = 1_500
+const MAX_TITLE_CHARS = 200
+
+export interface CursorForkPromptInput {
+  title: string | null
+  firstPrompt: string | null
+  turns: readonly SessionTurn[]
+  message: string
+  maxChars: number
+}
+
+function clip(text: string, max: number): string {
+  const clean = text.replace(/\r\n/g, '\n').trim()
+  return clean.length <= max ? clean : `${clean.slice(0, max - 1)}…`
+}
+
+/**
+ * The first prompt of the new chat. The message is always whole and always last; context
+ * is dropped oldest-first until the whole fits `maxChars`. A message that leaves no room
+ * goes alone.
+ */
+export function buildCursorForkPrompt(input: CursorForkPromptInput): string {
+  const message = input.message
+  const tail = `\n\nNew message:\n${message}`
+  // 6.62.0 /qa (W10): Cursor titles a chat by its first line, so the FIRST line is the source's
+  // title (else the person's message), never a fixed header every fork would share.
+  const titleLine = input.title && input.title.trim()
+    ? clip(input.title.split('\n')[0]!, MAX_TITLE_CHARS)
+    : clip(message.split('\n').find(line => line.trim()) ?? message, MAX_TITLE_CHARS)
+  const header = 'A new chat that carries on from an earlier Cursor chat. Its context, for reference only:'
+  const lines: string[] = [titleLine, '', header, '']
+  if (input.title && input.title.trim()) lines.push(`Title: ${clip(input.title, MAX_TITLE_CHARS)}`)
+  if (input.firstPrompt && input.firstPrompt.trim()) lines.push(`First request: ${clip(input.firstPrompt, MAX_FIRST_PROMPT_CHARS)}`)
+  const head = lines.join('\n')
+  const rendered = input.turns
+    .filter(turn => typeof turn?.text === 'string' && turn.text.trim())
+    .map(turn => `${turn.role === 'user' ? 'User' : 'Assistant'}: ${clip(turn.text, MAX_TURN_CHARS)}`)
+  const budget = input.maxChars - tail.length
+  if (budget <= head.length) return message.length <= input.maxChars ? message : message.slice(0, input.maxChars)
+  // Newest turns are kept; the oldest go first.
+  const kept: string[] = []
+  let used = head.length + '\n\nRecent conversation (oldest first):'.length
+  for (let i = rendered.length - 1; i >= 0; i--) {
+    const cost = rendered[i]!.length + 1
+    if (used + cost > budget) break
+    kept.unshift(rendered[i]!)
+    used += cost
+  }
+  const body = kept.length > 0 ? `${head}\n\nRecent conversation (oldest first):\n${kept.join('\n')}` : head
+  return `${body}${tail}`
+}
+
+export interface CursorForkWorkspaceDeps {
+  /** The hook signal's cwd for this session, or null. */
+  signalCwd: (threadId: string) => string | null
+  /** The IDE composer's recorded workspace folder, or null. */
+  composerWorkspace: (threadId: string) => Promise<string | null>
+  /** The CLI chat's spawn spelling (`spawnWorkspace`), or null. */
+  spawnWorkspace: (threadId: string) => string | null
+  /** MUST throw on "cannot tell"; false only for absent. */
+  dirExists: (path: string) => boolean
+}
+
+function usable(path: unknown, deps: CursorForkWorkspaceDeps): path is string {
+  if (typeof path !== 'string' || !path.startsWith('/') || path.includes('\0')) return false
+  try {
+    return deps.dirExists(path) === true
+  } catch {
+    return false
+  }
+}
+
+/** Where the new chat runs. Null refuses the fork: never the server's own cwd. */
+export async function resolveCursorForkWorkspace(threadId: string, deps: CursorForkWorkspaceDeps): Promise<string | null> {
+  let candidate: string | null = null
+  try { candidate = deps.signalCwd(threadId) } catch { candidate = null }
+  if (usable(candidate, deps)) return candidate
+  try { candidate = await deps.composerWorkspace(threadId) } catch { candidate = null }
+  if (usable(candidate, deps)) return candidate
+  try { candidate = deps.spawnWorkspace(threadId) } catch { candidate = null }
+  if (usable(candidate, deps)) return candidate
+  return null
+}
+
+export interface CursorForkPrepDeps {
+  transcriptPath: (threadId: string) => string | null
+  readTurns: (path: string, limit: number) => Promise<SessionTurn[]>
+  readTitle: (path: string, threadId: string) => Promise<{ title: string | null; firstPrompt: string | null }>
+  /** The session's own model as a slug the installed Cursor lists, or null. */
+  sessionModel: (threadId: string, path: string | null) => Promise<string | null>
+  maxChars: number
+}
+
+/**
+ * The prompt and model for one Cursor fork. A failed read costs context, never the fork:
+ * with nothing readable the new chat gets the message alone and the fallback model.
+ */
+export async function prepareCursorFork(
+  threadId: string,
+  message: string,
+  deps: CursorForkPrepDeps,
+): Promise<{ prompt: string; cursorModel: string | null }> {
+  let path: string | null = null
+  try { path = deps.transcriptPath(threadId) } catch { path = null }
+  let turns: SessionTurn[] = []
+  let title: string | null = null
+  let firstPrompt: string | null = null
+  // 6.62.0 /qa (W17): a fork that loses its context says so in the server log.
+  const lost: string[] = []
+  if (path) {
+    try { turns = await deps.readTurns(path, CURSOR_FORK_TURNS) } catch { turns = []; lost.push('turns') }
+    try { ({ title, firstPrompt } = await deps.readTitle(path, threadId)) } catch { title = null; firstPrompt = null; lost.push('title') }
+  } else {
+    lost.push('transcript')
+  }
+  let cursorModel: string | null = null
+  try { cursorModel = await deps.sessionModel(threadId, path) } catch { cursorModel = null; lost.push('model') }
+  if (lost.length > 0) console.warn(`[cursor-fork] context lost thread=${threadId.slice(0, 8)} missing=${lost.join(',')}`)
+  return {
+    prompt: buildCursorForkPrompt({ title, firstPrompt, turns, message, maxChars: deps.maxChars }),
+    cursorModel,
+  }
+}

package/server/lib/cursor-model-catalog.ts

@@ -3,10 +3,12 @@
 // Stable app slots (cursor-grok / cursor-composer) map to concrete CLI model
 // ids proven in Phase 0. `agent models` is text-only — parse + cache it.
 
-import { spawn } from 'node:child_process'
+import { spawn, type ChildProcessByStdio } from 'node:child_process'
+import type { Readable } from 'node:stream'
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { resolveProviderBinary } from './provider-binary.js'
+import { cursorSpawnEnv, releaseCursorSpawnOnExit } from './cursor-spawn-env.js'
 import {
   CURSOR_COMPOSER_MODEL,
   CURSOR_GROK_MODEL,
@@ -187,6 +189,21 @@ function unavailableCatalog(refreshError?: string, agentBinary?: string): Cursor
   return buildCursorModelCatalog([], 'unavailable', new Date().toISOString(), agentBinary, refreshError)
 }
 
+function readDiskModels(): CursorCatalogModel[] {
+  const path = catalogCachePath()
+  if (!existsSync(path)) return []
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8')) as { models?: CursorCatalogModel[] }
+    return Array.isArray(parsed.models)
+      ? parsed.models
+        .filter(m => typeof m?.id === 'string' && m.id)
+        .map(m => ({ id: m.id, displayName: normalizeCursorDisplayName(typeof m.displayName === 'string' ? m.displayName : '') }))
+      : []
+  } catch {
+    return []
+  }
+}
+
 function readDiskCatalog(): CursorModelCatalog | null {
   const path = catalogCachePath()
   if (!existsSync(path)) return null
@@ -244,10 +261,19 @@ async function fetchCliModels(agentBinary: string): Promise<CursorCatalogModel[]
   return new Promise((resolveModels, reject) => {
     const env = { ...process.env }
     delete env.CLAUDECODE
-    const child = spawn(agentBinary, ['models'], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env,
-    })
+    // 6.62.0 (plan 3.4): every `agent` spawn runs on a config dir of its own.
+    const isolation = cursorSpawnEnv({ baseEnv: env })
+    let child: ChildProcessByStdio<null, Readable, Readable>
+    try {
+      child = spawn(agentBinary, ['models'], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: isolation.env,
+      })
+    } catch (error) {
+      isolation.release()
+      throw error
+    }
+    releaseCursorSpawnOnExit(child, isolation)
     let settled = false
     let stdout = ''
     let stderr = ''
@@ -283,6 +309,36 @@ async function fetchCliModels(agentBinary: string): Promise<CursorCatalogModel[]
 let catalogSnapshot = readDiskCatalog() ?? unavailableCatalog()
 let refreshPromise: Promise<CursorModelCatalog> | null = null
 
+/**
+ * 6.62.0 (plan 3.3, W17): EVERY model `agent models` listed, kept in memory beside the two
+ * slot `options`. The options stay two because the phone's slots read them
+ * (work-phone.ts); this list is what a Continue validates a session's own model against,
+ * so it can pass any model and modifier the installed Cursor offers.
+ */
+let fullModelList: CursorCatalogModel[] = readDiskModels()
+
+export function getFullCursorModelList(): readonly CursorCatalogModel[] {
+  return fullModelList
+}
+
+/** Exact, case-insensitive membership in the full list. */
+export function isKnownCursorModel(modelId: string): boolean {
+  const wanted = typeof modelId === 'string' ? modelId.trim().toLowerCase() : ''
+  return wanted.length > 0 && fullModelList.some(model => model.id.toLowerCase() === wanted)
+}
+
+/** The CLI's own display name for a listed model (normalized), or null. */
+export function cursorModelDisplayName(modelId: string): string | null {
+  const wanted = typeof modelId === 'string' ? modelId.trim().toLowerCase() : ''
+  const found = fullModelList.find(model => model.id.toLowerCase() === wanted)
+  return found ? normalizeCursorDisplayName(found.displayName) || null : null
+}
+
+/** Tests only. */
+export function __setFullCursorModelListForTests(models: CursorCatalogModel[]): void {
+  fullModelList = [...models]
+}
+
 export function getCursorModelCatalogSnapshot(): CursorModelCatalog {
   return catalogSnapshot
 }
@@ -332,6 +388,7 @@ export async function getCursorModelCatalog(forceRefresh = false): Promise<Curso
     try {
       const models = await fetchCliModels(agentBinary)
       catalogSnapshot = buildCursorModelCatalog(models, 'cli', new Date().toISOString(), agentBinary)
+      fullModelList = models
       writeDiskCatalog(models, agentBinary)
     } catch (err) {
       const refreshError = err instanceof Error ? err.message : 'Live Cursor model discovery unavailable.'

package/server/lib/cursor-observer-installer.ts

@@ -1,26 +1,33 @@
-import { readFileSync, existsSync, lstatSync, mkdirSync, copyFileSync, chmodSync } from 'node:fs'
+import { readFileSync, existsSync, lstatSync, mkdirSync, copyFileSync, chmodSync, accessSync, statSync, constants } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { homedir } from 'node:os'
 import { fileURLToPath } from 'node:url'
 import { atomicWriteFileSync } from './atomic-fs.js'
 import { cosGlassesHome, hookSpoolDir } from './claude-hooks-installer.js'
-export const CURSOR_OBSERVER_EVENTS=['subagentStart','subagentStop','preCompact','postToolUse','afterAgentResponse','stop','sessionEnd'] as const
+// 6.62.0: `afterAgentThought` (the reasoning line, display only) joins the observer's events.
+export const CURSOR_OBSERVER_EVENTS=['subagentStart','subagentStop','preCompact','postToolUse','afterAgentResponse','stop','sessionEnd','afterAgentThought'] as const
 const quote=(s:string)=>"'"+s.replace(/'/g,"'\\''")+"'"
-export function installCursorObserver(options:{settingsPath?:string;scriptPath?:string;spool?:string;dryRun?:boolean;uninstall?:boolean}={}) {
- const settings=options.settingsPath??join(process.env.CURSOR_CONFIG_DIR??join(homedir(),'.cursor'),'hooks.json')
- const script=options.scriptPath??join(cosGlassesHome(),'bin','cos-cursor-observer.cjs')
+export const cursorHooksPath=()=>join(process.env.CURSOR_CONFIG_DIR??join(homedir(),'.cursor'),'hooks.json')
+export const cursorObserverScriptPath=()=>join(cosGlassesHome(),'bin','cos-cursor-observer.cjs')
+// 6.62.0 (W18): ours by the SCRIPT path, never by `process.execPath`. A brew upgrade moves node,
+// and keying on it made every observer hook foreign, so the next install appended duplicates.
+const oursFor=(script:string)=>(h:any)=>typeof h?.command==='string'&&h.command.includes(' '+quote(script)+' ')
+export function installCursorObserver(options:{settingsPath?:string;scriptPath?:string;spool?:string;dryRun?:boolean;uninstall?:boolean;nodePath?:string}={}) {
+ const settings=options.settingsPath??cursorHooksPath()
+ const script=options.scriptPath??cursorObserverScriptPath()
  const spool=options.spool??hookSpoolDir()
+ const node=options.nodePath??process.execPath
  try {
   if(existsSync(settings)&&lstatSync(settings).isSymbolicLink())throw new Error('symlinked Cursor settings')
   const old=existsSync(settings)?readFileSync(settings,'utf8'):'{}', config=JSON.parse(old)
   if(!config||typeof config!=='object'||Array.isArray(config)||(config.version!==undefined&&config.version!==1))throw new Error('unsupported Cursor config')
   if(config.hooks!==undefined&&(!config.hooks||typeof config.hooks!=='object'||Array.isArray(config.hooks)))throw new Error('invalid Cursor hooks')
   const hooks={...config.hooks}
+  const ours=oursFor(script)
   for(const event of CURSOR_OBSERVER_EVENTS){
    if(hooks[event]!==undefined&&!Array.isArray(hooks[event]))throw new Error('invalid Cursor hook list')
-   const ours=(h:any)=>typeof h?.command==='string'&&h.command.startsWith(quote(process.execPath)+' '+quote(script)+' ')
    hooks[event]=(hooks[event]??[]).filter((h:any)=>!ours(h))
-   if(!options.uninstall)hooks[event].push({command:[process.execPath,script,event,spool].map(quote).join(' '),timeout:5})
+   if(!options.uninstall)hooks[event].push({command:[node,script,event,spool].map(quote).join(' '),timeout:5})
    if(!hooks[event].length)delete hooks[event]
   }
   const next=JSON.stringify({...config,version:1,hooks},null,2)+'\n'
@@ -36,3 +43,37 @@ export function installCursorObserver(options:{settingsPath?:string;scriptPath?:
   return {ok:true,changed:next!==old,events:[...CURSOR_OBSERVER_EVENTS],dryRun:!!options.dryRun}
  }catch(error){return {ok:false,changed:false,reason:error instanceof Error?error.message:String(error)}}
 }
+/** The first single-quoted word of an observer command (`quote` above): the node binary it runs. */
+export function observerNodeOf(command:string):string|null{
+ if(command[0]!=="'")return null
+ let out='',i=0
+ for(;;){
+  const end=command.indexOf("'",i+1);if(end<0)return null
+  out+=command.slice(i+1,end);i=end+1
+  if(command.startsWith("\\''",i)){out+="'";i+=2}else break
+ }
+ return out||null
+}
+/**
+ * 6.62.0 health: `installed` when every observer event has exactly one hook of ours, and
+ * `nodeOk` when the node binary each of those commands names still exists (a brew upgrade can
+ * remove it, and Cursor then runs nothing). Never throws.
+ */
+export function cursorObserverStatus(options:{settingsPath?:string;scriptPath?:string}={}):{installed:boolean;nodeOk:boolean;events:number;reason:string|null}{
+ const settings=options.settingsPath??cursorHooksPath(),ours=oursFor(options.scriptPath??cursorObserverScriptPath())
+ try{
+  if(!existsSync(settings))return {installed:false,nodeOk:false,events:0,reason:'missing'}
+  if(lstatSync(settings).isSymbolicLink())return {installed:false,nodeOk:false,events:0,reason:'symlink'}
+  const hooks=JSON.parse(readFileSync(settings,'utf8'))?.hooks??{}
+  let events=0,nodeOk=true
+  for(const event of CURSOR_OBSERVER_EVENTS){
+   const mine=Array.isArray(hooks[event])?hooks[event].filter(ours):[]
+   if(mine.length===1)events++
+   for(const h of mine){
+    const node=observerNodeOf(h.command)
+    try{if(!node||!statSync(node).isFile())nodeOk=false;else accessSync(node,constants.X_OK)}catch{nodeOk=false}
+   }
+  }
+  return {installed:events===CURSOR_OBSERVER_EVENTS.length,nodeOk:events>0&&nodeOk,events,reason:null}
+ }catch{return {installed:false,nodeOk:false,events:0,reason:'unreadable'}}
+}