@oh-my-pi/pi-ai 17.2.11 → 17.2.13

package/src/dialect/owned-stream.ts

@@ -7,6 +7,7 @@ import type {
 } from "../types";
 import {
 	clearStreamingPartialJson,
+	copyCursorExecResolved,
 	getStreamingPartialJson,
 	type StreamingPartialJsonCarrier,
 	setStreamingPartialJson,
@@ -54,6 +55,7 @@ function cloneToolCall(source: StreamingToolCall): StreamingToolCall {
 	};
 	const partialJson = getStreamingPartialJson(source);
 	if (partialJson !== undefined) setStreamingPartialJson(block, partialJson);
+	copyCursorExecResolved(block, source);
 	return block;
 }
 
@@ -65,6 +67,7 @@ function syncToolCall(target: StreamingToolCall, source: StreamingToolCall): voi
 	const partialJson = getStreamingPartialJson(source);
 	if (partialJson === undefined) clearStreamingPartialJson(target);
 	else setStreamingPartialJson(target, partialJson);
+	copyCursorExecResolved(target, source);
 }
 
 function hasNamedNativeToolCall(source: StreamingToolCall | undefined): source is StreamingToolCall {

package/src/error/auth-classify.ts

@@ -1,5 +1,5 @@
 import { extractHttpStatusFromError } from "@oh-my-pi/pi-utils";
-import { isOAuthExpiry, isUsageLimit } from "./flags";
+import { isAccountPolicyError, isOAuthExpiry, isUsageLimit } from "./flags";
 import { isConcurrencyCapExclusion, isUsageLimitOutcome } from "./rate-limit";
 
 /**
@@ -27,15 +27,16 @@ export function isInvalidatedOAuthTokenError(error: unknown): boolean {
 /**
  * Whether an upstream failure should rotate to a sibling credential: a hard
  * `401`, a `403` (token valid but access denied — plan, model policy, or org
- * restriction a sibling account may not share), a body-classified usage limit
- * (Codex `usage_limit_reached`, Anthropic account rate-limit, Google
+ * restriction a sibling account may not share), an account-scoped policy
+ * denial such as Codex `cyber_policy`, a body-classified usage limit (Codex
+ * `usage_limit_reached`, Anthropic account rate-limit, Google
  * `resource_exhausted`, OpenAI `insufficient_quota`, …), or a bare `429`
- * whose payload did not preserve a richer quota code.
- * Transient 429s (`Too many requests`, per-minute caps) stay in the
- * upstream-backoff lane.
+ * whose payload did not preserve a richer quota code. Transient 429s
+ * (`Too many requests`, per-minute caps) stay in the upstream-backoff lane.
  */
 export function isAuthRetryableError(error: unknown): boolean {
 	if (isUsageLimit(error)) return true;
+	if (isAccountPolicyError(error)) return true;
 	if (isInvalidatedOAuthTokenError(error)) return true;
 	const httpStatus = extractHttpStatusFromError(error);
 	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;

package/src/error/aws.ts

@@ -13,7 +13,11 @@ export type AwsCredentialsErrorKind =
 	/** STS web-identity exchange failed or returned malformed credentials. */
 	| "web-identity"
 	/** ECS/container credential endpoint failed or returned malformed credentials. */
-	| "container";
+	| "container"
+	/** Shared-config role chain is misconfigured (cycle, missing source_profile, unsupported credential_source). */
+	| "profile"
+	/** STS `AssumeRole` call failed or returned malformed credentials. */
+	| "assume-role";
 
 /** A failure resolving AWS credentials for the Bedrock provider. */
 export class AwsCredentialsError extends Error {

package/src/error/flags.ts

@@ -25,6 +25,8 @@ export const Flag = {
 	MalformedFunctionCall: 0x0020_0000,
 	ProviderFinishError: 0x0040_0000,
 	ContentBlocked: 0x0000_8000,
+	/** Account-scoped provider policy denial that may succeed with another credential. */
+	AccountPolicy: 0x0000_4000,
 	ContextOverflow: 0x0080_0000,
 	AuthFailed: 0x0100_0000,
 	SilentAbort: 0x0200_0000,
@@ -49,6 +51,7 @@ const KIND_MASK =
 	Flag.MalformedFunctionCall |
 	Flag.ProviderFinishError |
 	Flag.ContentBlocked |
+	Flag.AccountPolicy |
 	Flag.ContextOverflow |
 	Flag.AuthFailed |
 	Flag.SilentAbort |
@@ -102,6 +105,7 @@ const AUTH_FAILURE_PATTERN =
 const MALFORMED_FUNCTION_CALL_PATTERN = /\bmalformed.?function.?call\b/i;
 const PROVIDER_FINISH_ERROR_PATTERN = /\bProvider (?:returned error finish_reason|finish_reason:\s*error)\b/i;
 const CONTENT_FILTER_PATTERN = /\b(?:incomplete:\s*)?content_filter\b/i;
+const ACCOUNT_POLICY_PATTERN = /\bcyber_policy\b|trusted access for cyber/i;
 const STALE_RESPONSE_ITEM_PATTERNS = [/\bItem with id ['"][^'"]+['"] not found\.?/i, /previous[ _]?response/i] as const;
 const STALE_RESPONSE_ITEM_DETAIL_PATTERN = /not[ _]?found|invalid|expired|stale|zero[ _-]?data[ _-]?retention/i;
 /**
@@ -194,6 +198,7 @@ const ERROR_KIND_LABELS: readonly [Flag, string][] = [
 	[Flag.MalformedFunctionCall, "malformed-function-call"],
 	[Flag.ProviderFinishError, "provider-finish-error"],
 	[Flag.ContentBlocked, "content-blocked"],
+	[Flag.AccountPolicy, "account-policy"],
 	[Flag.ContextOverflow, "context-overflow"],
 	[Flag.AuthFailed, "auth-failed"],
 	[Flag.SilentAbort, "silent-abort"],
@@ -336,6 +341,7 @@ function classifyText(errorMessage: string | undefined, errorStatus: number | un
 		if (isMalformedFunctionCallText(errorMessage)) kinds |= Flag.MalformedFunctionCall;
 		if (isProviderFinishErrorText(errorMessage)) kinds |= Flag.ProviderFinishError;
 		if (isContentBlockedText(errorMessage)) kinds |= Flag.ContentBlocked;
+		if (ACCOUNT_POLICY_PATTERN.test(errorMessage)) kinds |= Flag.AccountPolicy | Flag.ContentBlocked;
 		if (isAuthFailureText(errorMessage)) kinds |= Flag.AuthFailed;
 
 		const statusClean = errorStatus ? errorStatus : (status({ message: errorMessage }) ?? undefined);
@@ -398,6 +404,9 @@ export function classify(error: unknown, api?: Api): number {
 			if ("errorId" in link && typeof (link as { errorId: unknown }).errorId === "number") {
 				kinds |= (link as { errorId: number }).errorId & KIND_MASK;
 			}
+			if ("code" in link && typeof link.code === "string" && ACCOUNT_POLICY_PATTERN.test(link.code)) {
+				kinds |= Flag.AccountPolicy | Flag.ContentBlocked;
+			}
 		}
 
 		if (link instanceof AwsCredentialsError) {
@@ -475,6 +484,11 @@ export function isUsageLimit(error: unknown, api?: Api): boolean {
 	return is(classify(error, api), Flag.UsageLimit);
 }
 
+/** Whether an upstream rejection is an account-scoped policy denial worth retrying with a sibling credential. */
+export function isAccountPolicyError(error: unknown, api?: Api): boolean {
+	return is(classify(error, api), Flag.AccountPolicy);
+}
+
 /**
  * Strict-tool rejection: grammar too large, schema too complex, or structured
  * outputs unsupported by the model/endpoint.

package/src/providers/amazon-bedrock.ts

@@ -47,6 +47,19 @@ import { decodeEventStream } from "./aws-eventstream";
 import { signRequest } from "./aws-sigv4";
 import { transformMessages } from "./transform-messages";
 
+/**
+ * Headers SigV4 generates for itself. A caller cannot be allowed to supply these:
+ * `signRequest` would sign the caller's value but return its own, so the signature
+ * would not match what goes on the wire.
+ */
+const SIGNER_OWNED_HEADERS = new Set(["host", "x-amz-date", "x-amz-content-sha256", "x-amz-security-token"]);
+
+/** Headers the Bedrock request sets itself; a caller copy in any casing duplicates them. */
+// `content-length` included: the fetch layer recomputes it from the serialized
+// body, so a caller value would be signed but not sent, and AWS rejects the
+// mismatch.
+const BEDROCK_RESERVED_HEADERS = new Set(["content-type", "accept", "authorization", "content-length"]);
+
 export type BedrockThinkingDisplay = "summarized" | "omitted";
 
 export interface BedrockOptions extends StreamOptions {
@@ -356,7 +369,32 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 
 			const bodyText = JSON.stringify(commandInput);
 			const body = new TextEncoder().encode(bodyText);
+			// Caller headers are merged BEFORE signing, so SigV4 covers them and they
+			// reach the wire. Bedrock built its header map from scratch and ignored
+			// `options.headers` entirely, so tracing/attribution headers set by a
+			// caller (or by a `before_provider_headers` extension) were silently
+			// dropped here while working on every other provider. Content-type and
+			// accept stay last: the eventstream framing is not the caller's to change.
+			//
+			// The signer's OWN headers are dropped first, and that is load-bearing:
+			// `signRequest` lets a caller value overwrite `host`/`x-amz-*` in the map
+			// it signs, but always RETURNS the generated ones, which `requestHeaders`
+			// below then puts on the wire. A caller supplying any of them would sign
+			// one set of values and send another, and Bedrock would reject every
+			// request with a signature mismatch.
+			// Lower-cased, and names the request sets itself are dropped. Keeping a
+			// caller `Content-Type` beside the fixed `content-type` leaves TWO object
+			// keys: SigV4 signs one value while fetch canonicalizes both into a single
+			// comma-joined wire header, so AWS validates different bytes than were
+			// signed and rejects the request.
+			const callerHeaders: Record<string, string> = {};
+			for (const [name, value] of Object.entries(options?.headers ?? {})) {
+				const field = name.toLowerCase();
+				if (SIGNER_OWNED_HEADERS.has(field) || BEDROCK_RESERVED_HEADERS.has(field)) continue;
+				callerHeaders[field] = value;
+			}
 			const baseHeaders: Record<string, string> = {
+				...callerHeaders,
 				"content-type": "application/json",
 				accept: "application/vnd.amazon.eventstream",
 			};

package/src/providers/aws-credentials.ts

@@ -5,8 +5,9 @@
  *  1. Static credentials from the environment
  *     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
  *  2. Web identity (`AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`).
- *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
- *      - static keys, SSO, or `credential_process`.
+ *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO/roles):
+ *      - static keys, SSO, `credential_process`, or `role_arn` role chaining
+ *        (`source_profile` recursion, `web_identity_token_file`, `credential_source`).
  *  4. ECS/container credentials from `AWS_CONTAINER_CREDENTIALS_*`.
  *  5. EC2 IMDSv2 when metadata is enabled.
  *
@@ -29,7 +30,7 @@ import {
 	shouldLoadAwsSharedConfig,
 } from "../utils/aws-profile";
 import { isLocalOrMetadataHost } from "../utils/proxy";
-import type { AwsCredentials } from "./aws-sigv4";
+import { type AwsCredentials, signRequest } from "./aws-sigv4";
 
 export interface ResolvedCredentials extends AwsCredentials {
 	/** Absolute expiration timestamp in ms. `undefined` for non-expiring static creds. */
@@ -60,8 +61,8 @@ const SHARED_RESOLVE_TIMEOUT_MS = 30_000;
 
 function requireDynamicCredentialExpiration(
 	value: string | undefined,
-	source: "AWS web identity" | "AWS container credential",
-	kind: "web-identity" | "container",
+	source: string,
+	kind: AIError.AwsCredentialsErrorKind,
 ): number {
 	const expiresAt = value ? Date.parse(value) : Number.NaN;
 	if (Number.isFinite(expiresAt)) return expiresAt;
@@ -179,7 +180,16 @@ async function readIniFile(p: string): Promise<AwsIniFile | undefined> {
 	}
 }
 
-// ---------- Profile / SSO ----------
+// ---------- Profile / SSO / role chaining ----------
+
+/** Shared-config view and resolution context threaded through role-chain recursion. */
+interface ProfileResolveContext {
+	credentialsIni: AwsIniFile | undefined;
+	configIni: AwsIniFile | undefined;
+	region: string;
+	signal: AbortSignal | undefined;
+	fetchImpl: FetchImpl;
+}
 
 async function readProfileCredentials(
 	profile: string,
@@ -195,11 +205,36 @@ async function readProfileCredentials(
 	const credentialsIni = await readIniFile(credentialsPath);
 	const configIni = loadSharedConfig ? await readIniFile(configPath) : undefined;
 
-	// Static credentials live in ~/.aws/credentials; SSO config lives in
+	return resolveProfileChain(profile, { credentialsIni, configIni, region, signal, fetchImpl }, new Set());
+}
+
+/**
+ * Resolve one profile, following `role_arn` chains. A `role_arn` profile derives
+ * base credentials from `source_profile` (recursive), `web_identity_token_file`,
+ * or `credential_source`, then exchanges them via STS. Non-role profiles resolve
+ * directly from static keys, SSO, or `credential_process`. `seen` guards against
+ * `source_profile` cycles.
+ */
+async function resolveProfileChain(
+	profile: string,
+	ctx: ProfileResolveContext,
+	seen: Set<string>,
+): Promise<ResolvedCredentials | undefined> {
+	if (seen.has(profile)) {
+		throw new AIError.AwsCredentialsError(`AWS profile role chain contains a cycle at '${profile}'.`, "profile");
+	}
+	seen.add(profile);
+
+	// Static credentials live in ~/.aws/credentials; SSO/role config lives in
 	// ~/.aws/config under `[profile foo]`. Merge into a single view.
-	const merged: Record<string, string> = { ...(configIni?.[profile] ?? {}), ...(credentialsIni?.[profile] ?? {}) };
+	const merged: Record<string, string> = {
+		...(ctx.configIni?.[profile] ?? {}),
+		...(ctx.credentialsIni?.[profile] ?? {}),
+	};
 	if (Object.keys(merged).length === 0) return undefined;
 
+	if (merged.role_arn) return assumeRoleFromProfile(profile, merged, ctx, seen);
+
 	if (merged.aws_access_key_id && merged.aws_secret_access_key) {
 		const out: ResolvedCredentials = {
 			accessKeyId: merged.aws_access_key_id,
@@ -215,16 +250,158 @@ async function readProfileCredentials(
 	}
 
 	if (merged.sso_account_id && merged.sso_role_name) {
-		return readSsoCredentials(merged, configIni, region, signal, fetchImpl);
+		return readSsoCredentials(merged, ctx.configIni, ctx.region, ctx.signal, ctx.fetchImpl);
 	}
 
 	if (merged.credential_process) {
-		return readCredentialProcess(profile, merged.credential_process, signal);
+		return readCredentialProcess(profile, merged.credential_process, ctx.signal);
 	}
 
 	return undefined;
 }
 
+/**
+ * Resolve base credentials for a `role_arn` profile and exchange them for the
+ * target role. `web_identity_token_file` is a self-contained
+ * AssumeRoleWithWebIdentity; otherwise the base comes from `source_profile`
+ * (recursive) or `credential_source`, followed by an STS `AssumeRole`.
+ */
+async function assumeRoleFromProfile(
+	profile: string,
+	merged: Record<string, string>,
+	ctx: ProfileResolveContext,
+	seen: Set<string>,
+): Promise<ResolvedCredentials> {
+	const roleArn = merged.role_arn;
+	const region = ctx.region;
+
+	if (merged.web_identity_token_file) {
+		return assumeRoleWithWebIdentity(
+			{ roleArn, tokenFile: merged.web_identity_token_file, sessionName: merged.role_session_name },
+			region,
+			ctx.signal,
+			ctx.fetchImpl,
+		);
+	}
+
+	if (merged.mfa_serial) {
+		// MFA-gated roles need an interactive token code, which a non-interactive
+		// resolver cannot supply. Fail with a clear message instead of a confusing
+		// STS AccessDenied.
+		throw new AIError.AwsCredentialsError(
+			`AWS profile '${profile}' requires MFA (mfa_serial), which is not supported for non-interactive credential resolution.`,
+			"profile",
+		);
+	}
+
+	let base: ResolvedCredentials | undefined;
+	if (merged.source_profile) {
+		base = await resolveProfileChain(merged.source_profile, ctx, seen);
+		if (!base) {
+			throw new AIError.AwsCredentialsError(
+				`AWS profile '${profile}' references source_profile '${merged.source_profile}', which has no usable credentials.`,
+				"profile",
+			);
+		}
+	} else if (merged.credential_source) {
+		base = await resolveCredentialSource(merged.credential_source, region, ctx.signal, ctx.fetchImpl);
+		if (!base) {
+			throw new AIError.AwsCredentialsError(
+				`AWS profile '${profile}' credential_source '${merged.credential_source}' produced no credentials.`,
+				"profile",
+			);
+		}
+	} else {
+		throw new AIError.AwsCredentialsError(
+			`AWS profile '${profile}' sets role_arn without source_profile, credential_source, or web_identity_token_file.`,
+			"profile",
+		);
+	}
+
+	return stsAssumeRole(
+		base,
+		roleArn,
+		region,
+		{
+			sessionName: merged.role_session_name,
+			durationSeconds: merged.duration_seconds,
+			externalId: merged.external_id,
+		},
+		ctx.signal,
+		ctx.fetchImpl,
+	);
+}
+
+/** Resolve the base credentials named by a profile `credential_source` directive. */
+async function resolveCredentialSource(
+	source: string,
+	_region: string,
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials | undefined> {
+	switch (source) {
+		case "Environment":
+			return readEnvCredentials();
+		case "Ec2InstanceMetadata":
+			return $env.AWS_EC2_METADATA_DISABLED?.toLowerCase() === "true"
+				? undefined
+				: readImdsCredentials(signal, fetchImpl);
+		case "EcsContainer":
+			return readContainerCredentials(signal, fetchImpl);
+		default:
+			throw new AIError.AwsCredentialsError(`Unsupported AWS credential_source '${source}'.`, "profile");
+	}
+}
+
+/**
+ * Exchange base credentials for a target role via STS `AssumeRole`. The request
+ * is SigV4-signed with the base credentials.
+ */
+async function stsAssumeRole(
+	base: ResolvedCredentials,
+	roleArn: string,
+	region: string,
+	opts: { sessionName?: string; durationSeconds?: string; externalId?: string },
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials> {
+	const body = new URLSearchParams({
+		Action: "AssumeRole",
+		Version: "2011-06-15",
+		RoleArn: roleArn,
+		RoleSessionName: opts.sessionName || `omp-${process.pid}`,
+	});
+	if (opts.durationSeconds) body.set("DurationSeconds", opts.durationSeconds);
+	if (opts.externalId) body.set("ExternalId", opts.externalId);
+	const payload = new TextEncoder().encode(body.toString());
+	const endpoint = new URL(stsEndpoint(region));
+	const contentType = "application/x-www-form-urlencoded";
+	const signed = await signRequest({
+		method: "POST",
+		host: endpoint.host,
+		path: endpoint.pathname,
+		body: payload,
+		region,
+		service: "sts",
+		credentials: base,
+		headers: { "content-type": contentType },
+	});
+	const response = await fetchImpl(endpoint, {
+		method: "POST",
+		headers: { ...signed, "content-type": contentType },
+		body: payload,
+		signal,
+	});
+	const xml = await response.text();
+	if (!response.ok) {
+		throw new AIError.AwsCredentialsError(
+			`AWS AssumeRole failed: ${response.status} ${xmlTag(xml, "Message") ?? xml.slice(0, 200)}`,
+			"assume-role",
+		);
+	}
+	return parseStsCredentials(xml, "AWS AssumeRole", "assume-role");
+}
+
 interface SsoCachedToken {
 	accessToken?: string;
 	expiresAt?: string;
@@ -543,6 +720,18 @@ function stsEndpoint(region: string): string {
 	return `https://sts.${region}.${dnsSuffix}/`;
 }
 
+/** Parse `<Credentials>` from an STS AssumeRole/WithWebIdentity XML response. */
+function parseStsCredentials(xml: string, source: string, kind: AIError.AwsCredentialsErrorKind): ResolvedCredentials {
+	const accessKeyId = xmlTag(xml, "AccessKeyId");
+	const secretAccessKey = xmlTag(xml, "SecretAccessKey");
+	const sessionToken = xmlTag(xml, "SessionToken");
+	if (!accessKeyId || !secretAccessKey || !sessionToken) {
+		throw new AIError.AwsCredentialsError(`${source} response is missing credentials.`, kind);
+	}
+	const expiresAt = requireDynamicCredentialExpiration(xmlTag(xml, "Expiration"), source, kind);
+	return { accessKeyId, secretAccessKey, sessionToken, expiresAt };
+}
+
 async function readWebIdentityCredentials(
 	region: string,
 	signal: AbortSignal | undefined,
@@ -551,9 +740,28 @@ async function readWebIdentityCredentials(
 	const tokenFile = $env.AWS_WEB_IDENTITY_TOKEN_FILE;
 	const roleArn = $env.AWS_ROLE_ARN;
 	if (!tokenFile || !roleArn) return undefined;
+	return assumeRoleWithWebIdentity(
+		{ roleArn, tokenFile, sessionName: $env.AWS_ROLE_SESSION_NAME },
+		region,
+		signal,
+		fetchImpl,
+	);
+}
+
+/**
+ * Exchange a web-identity token file for role credentials via STS
+ * `AssumeRoleWithWebIdentity`. Used by the env chain (`AWS_WEB_IDENTITY_TOKEN_FILE`)
+ * and by `role_arn` + `web_identity_token_file` profiles.
+ */
+async function assumeRoleWithWebIdentity(
+	params: { roleArn: string; tokenFile: string; sessionName?: string },
+	region: string,
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials> {
 	let token: string;
 	try {
-		token = (await Bun.file(tokenFile).text()).trim();
+		token = (await Bun.file(params.tokenFile).text()).trim();
 	} catch (err) {
 		throw new AIError.AwsCredentialsError(
 			`Unable to read AWS web identity token file: ${String(err)}`,
@@ -569,8 +777,8 @@ async function readWebIdentityCredentials(
 	const body = new URLSearchParams({
 		Action: "AssumeRoleWithWebIdentity",
 		Version: "2011-06-15",
-		RoleArn: roleArn,
-		RoleSessionName: $env.AWS_ROLE_SESSION_NAME || `omp-${process.pid}`,
+		RoleArn: params.roleArn,
+		RoleSessionName: params.sessionName || `omp-${process.pid}`,
 		WebIdentityToken: token,
 	});
 	const response = await fetchImpl(stsEndpoint(region), {
@@ -586,22 +794,7 @@ async function readWebIdentityCredentials(
 			"web-identity",
 		);
 	}
-	const accessKeyId = xmlTag(xml, "AccessKeyId");
-	const secretAccessKey = xmlTag(xml, "SecretAccessKey");
-	const sessionToken = xmlTag(xml, "SessionToken");
-	if (!accessKeyId || !secretAccessKey || !sessionToken) {
-		throw new AIError.AwsCredentialsError(
-			"AWS AssumeRoleWithWebIdentity response is missing credentials.",
-			"web-identity",
-		);
-	}
-	const expiresAt = requireDynamicCredentialExpiration(xmlTag(xml, "Expiration"), "AWS web identity", "web-identity");
-	return {
-		accessKeyId,
-		secretAccessKey,
-		sessionToken,
-		expiresAt,
-	};
+	return parseStsCredentials(xml, "AWS web identity", "web-identity");
 }
 
 // ---------- ECS/container credentials ----------

package/src/providers/cursor/exec-modern.ts

@@ -74,6 +74,7 @@ import type { ToolResultMessage } from "../../types";
  * and their translation are consumed together.
  */
 export {
+	omitUndefinedArgs,
 	piEscapeRegexLiteral,
 	piGrepSkip,
 	piJoinPath,

package/src/providers/cursor-pi-args.ts

@@ -163,3 +163,25 @@ export function piLimit(limit: number | undefined): number | undefined {
 export function piTimeout(timeout: number | undefined): number | undefined {
 	return timeout !== undefined && timeout >= 0 ? timeout : undefined;
 }
+
+/**
+ * Drop keys whose value is `undefined` so optional local-tool kwargs stay
+ * absent rather than present-as-undefined.
+ *
+ * The Cursor exec bridge historically wrote forms like
+ * `cwd: workingDirectory || undefined` and
+ * `case: caseInsensitive === true ? false : undefined`. ArkType rejects a
+ * present `undefined` on an optional field (`was undefined`) even though
+ * omitting the key is valid — which flooded Cursor sessions with bash/grep
+ * validation errors for otherwise fine frames.
+ */
+export function omitUndefinedArgs<T extends Record<string, unknown>>(
+	args: T,
+): { [K in keyof T]?: Exclude<T[K], undefined> } {
+	const out: Record<string, unknown> = {};
+	for (const key of Object.keys(args)) {
+		const value = args[key];
+		if (value !== undefined) out[key] = value;
+	}
+	return out as { [K in keyof T]?: Exclude<T[K], undefined> };
+}

package/src/providers/cursor.ts

@@ -210,6 +210,7 @@ import {
 	buildPiWriteError,
 	buildPiWriteRejected,
 	buildPiWriteResult,
+	omitUndefinedArgs,
 	piEscapeRegexLiteral,
 	piGrepSkip,
 	piJoinPath,
@@ -223,6 +224,67 @@ import {
 export const CURSOR_API_URL = "https://api2.cursor.sh";
 export const CURSOR_CLIENT_VERSION = "cli-2026.07.23-e383d2b";
 
+/**
+ * HTTP/1 connection-specific headers that HTTP/2 forbids. Node's `http2.request()`
+ * throws `ERR_HTTP2_INVALID_CONNECTION_HEADERS` on these rather than dropping
+ * them, so a caller sending one would kill the request outright.
+ */
+const HTTP2_FORBIDDEN_HEADERS = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"upgrade",
+	"http2-settings",
+]);
+
+/**
+ * Header names the Cursor request sets for itself. A caller copy in ANY casing
+ * has to go: the spread below adds the fixed lower-case name regardless, and two
+ * spellings of one field are a duplicate rather than an override.
+ */
+const CURSOR_RESERVED_HEADERS = new Set([
+	"content-type",
+	"connect-protocol-version",
+	"te",
+	"authorization",
+	"x-ghost-mode",
+	"x-cursor-client-version",
+	"x-cursor-client-type",
+	"x-request-id",
+	// Transport-owned even though this request never sets it: node's http2 client
+	// suppresses the `:authority` it derives from the URL when a plain `host`
+	// header is present, so a caller value here silently retargets the request at
+	// a different virtual host.
+	"host",
+	// The Connect body is streamed after the headers (initial frame, heartbeats,
+	// tool responses), so no caller-supplied length can describe it and an HTTP/2
+	// peer resets the stream once the body diverges.
+	"content-length",
+]);
+
+/**
+ * Reduce caller-supplied headers to what this HTTP/2 request can legally carry.
+ *
+ * Everything is lower-cased, because HTTP/2 field names are lower-case and node
+ * compares them that way. A caller `Authorization` next to the fixed
+ * `authorization` does not lose to it, it DUPLICATES it, and node throws
+ * `ERR_HTTP2_HEADER_SINGLE_VALUE` before the request goes out. Same for a `TE`
+ * that is not `trailers`. Node throws on all three classes here rather than
+ * ignoring them, so a miss turns a harmless header into a dead request.
+ */
+function sanitizeCursorCallerHeaders(headers: Record<string, string> | undefined): Record<string, string> {
+	const sanitized: Record<string, string> = {};
+	for (const [name, value] of Object.entries(headers ?? {})) {
+		const field = name.toLowerCase();
+		if (field.startsWith(":")) continue;
+		if (HTTP2_FORBIDDEN_HEADERS.has(field)) continue;
+		if (CURSOR_RESERVED_HEADERS.has(field)) continue;
+		sanitized[field] = value;
+	}
+	return sanitized;
+}
+
 const CURSOR_PROXY_TUNNEL_TIMEOUT_MS = 30_000;
 
 /**
@@ -545,7 +607,22 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 
 			const baseUrl = model.baseUrl || CURSOR_API_URL;
 			const requestPath = "/agent.v1.AgentService/Run";
+			// Caller headers are additive, and are spread FIRST so the protocol
+			// framing, auth, and request id below always win. Cursor built this map
+			// from scratch and never read `options.headers`, so tracing/attribution
+			// headers set by a caller (or a `before_provider_headers` extension) were
+			// silently dropped here while working on other providers.
+			//
+			// Two classes are stripped because node's http2 client THROWS on them
+			// rather than ignoring them, which would turn a harmless header into a
+			// dead request: pseudo-headers, which belong to the transport, and the
+			// HTTP/1 connection-specific headers HTTP/2 forbids outright
+			// (ERR_HTTP2_INVALID_CONNECTION_HEADERS). `te` needs no filtering here —
+			// HTTP/2 allows it only as `trailers`, which is exactly what the fixed
+			// set below re-applies over anything a caller sent.
+			const callerHeaders = sanitizeCursorCallerHeaders(options?.headers);
 			const requestHeaders = {
+				...callerHeaders,
 				":method": "POST",
 				":path": requestPath,
 				"content-type": "application/connect+proto",
@@ -3592,11 +3669,14 @@ export function synthesizeCursorExecToolCall(
 ): void {
 	endCurrentTextBlock(output, stream, state);
 	endCurrentThinkingBlock(output, stream, state);
+	// Exec-frame translators often write `optional: value || undefined`. A
+	// present `undefined` fails ArkType optional-field validation; drop those
+	// keys so the transcript block matches what a model-native call would omit.
 	const block: ToolCallState = {
 		type: "toolCall",
 		id: toolCallId,
 		name: toolName,
-		arguments: args,
+		arguments: omitUndefinedArgs(args),
 		[kStreamingBlockIndex]: output.content.length,
 		[kStreamingBlockKind]: "cursor-exec",
 		[kCursorExecResolved]: true,