@rahularya01/pi-cursor 1.4.22 → 1.4.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +19 -0
  2. package/README.md +13 -11
  3. package/dist/index.js +31 -30
  4. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,24 @@
1
1
  # Changelog
2
2
 
3
+ ## [1.4.24] - 2026-08-20
4
+
5
+ ### Fixed
6
+
7
+ - **Unnamed InteractionQuery field 9 no longer kills the in-flight turn.** 1.4.23 fail-closed without sending an `InteractionResponse`, so Cursor parked and `processServerMessage` threw (`stopReason: error`). Field 9 is still rejected (not approved); we now answer with a reject-shaped response so the stream continues. Fixes [#10](https://github.com/Rahularya01/pi-cursor/issues/10).
8
+ - **Idle/transport restart after a tool pause matches Pi's in-flight turn, not the bridge suffix.** Multi-round chains and a second bridge loss in the same turn were dying with `pending_tool_call_mismatch` because recovery compared the last writeNativeStream round against every tool result Pi replayed. Resume planning now uses the parsed client turn; recovered streams carry a `ClientTranscript` so mid-pause snapshots stay keyed to Pi's history. Duplicate re-emitted exec ids are collapsed (last result wins). Ports the diagnoses from [#8](https://github.com/Rahularya01/pi-cursor/pull/8) and [#9](https://github.com/Rahularya01/pi-cursor/pull/9).
9
+ - **Blob store entry bound evicts oldest-first instead of failing the conversation.** Crossing 512 distinct blobs threw on every later turn. Eviction happens before the write is acked; an incoming blob that cannot fit even in an empty store is still rejected without punching holes. Inspired by [#11](https://github.com/Rahularya01/pi-cursor/pull/11).
10
+
11
+ ## [1.4.23] - 2026-08-19
12
+
13
+ ### Fixed
14
+
15
+ - **Tool continuation after an idle timeout no longer discards a valid checkpoint as `stale_checkpoint`.** Abort/idle persistence treated the in-flight turn as completed (`checkpointTurnCount + 1`) and cleared mid-pause metadata, so the next retry skipped recovery. In-flight checkpoints are now keyed to the completed-turn history only. Fixes [#5](https://github.com/Rahularya01/pi-cursor/issues/5).
16
+ - **`/login cursor` is no longer overridden by IDE/CLI credentials.** Cascade is now env → Pi OAuth → Keychain → IDE DB. Rotated OAuth refresh tokens are written back to `auth.json`.
17
+ - **WSL no longer reads every Windows user's Cursor `state.vscdb`.** Only the current Windows account (`USERPROFILE` / `USERNAME`) is considered.
18
+ - **Unknown Cursor exec messages fail closed** instead of sending a guessed empty MCP result.
19
+ - **Web/search InteractionQuery is rejected by default**; unnamed proto field 9 and Cursor mode-switches no longer auto-approve.
20
+ - Refresh error bodies and debug logs redact refresh tokens / JWTs. `security-check` also flags committed JWTs and session cookies. README engines match Node `>=22.19.0`.
21
+
3
22
  ## [1.4.22] - 2026-08-18
4
23
 
5
24
  ### Fixed
package/README.md CHANGED
@@ -28,11 +28,11 @@ or CLI, it just works — no setup beyond installing the package.
28
28
 
29
29
  ## Requirements
30
30
 
31
- | | |
32
- | --------------------------- | ------------------------------------------------------------------------------------ |
33
- | **Pi Coding Agent / Pi AI** | version `0.80.0` or later |
34
- | **Node.js** | version `22.0.0` or later (needed for native HTTP/2 streaming and credential lookup) |
35
- | **A Cursor account** | with model access — signed in via the Cursor app, Cursor CLI, or browser login below |
31
+ | | |
32
+ | --------------------------- | ------------------------------------------------------------------------------------- |
33
+ | **Pi Coding Agent / Pi AI** | version `0.80.0` or later |
34
+ | **Node.js** | version `22.19.0` or later (needed for native HTTP/2 streaming and credential lookup) |
35
+ | **A Cursor account** | with model access — signed in via the Cursor app, Cursor CLI, or browser login below |
36
36
 
37
37
  ## Install
38
38
 
@@ -86,16 +86,18 @@ pi update npm:@rahularya01/pi-cursor
86
86
 
87
87
  ```text
88
88
  1. CURSOR_ACCESS_TOKEN environment variable
89
- 2. Cursor CLI credentials in macOS Keychain (cursor-access-token / cursor-refresh-token)
90
- 3. Cursor IDE local state DB (globalStorage/state.vscdb on macOS, Windows, Linux, or WSL)
91
- 4. Pi OAuth credentials store (~/.pi/agent/auth.json via /login cursor)
89
+ 2. Pi OAuth credentials store (~/.pi/agent/auth.json via /login cursor)
90
+ 3. Cursor CLI credentials in macOS Keychain (cursor-access-token / cursor-refresh-token)
91
+ 4. Cursor IDE local state DB (globalStorage/state.vscdb on macOS, Windows, Linux, or WSL)
92
92
  ```
93
93
 
94
+ `/login cursor` is preferred over Keychain/IDE harvest so an explicit Pi login is not silently overridden by another Cursor app account on the machine.
95
+
94
96
  ### Automatic CLI & IDE login detection
95
97
 
96
98
  If you are logged into the Cursor desktop app or Cursor CLI (`cursor` / `agent`), `pi-cursor` automatically extracts your session credentials so you can start chatting immediately without manual browser login.
97
99
 
98
- On **WSL (Windows Subsystem for Linux)**, `pi-cursor` automatically scans Windows host user profiles (`/mnt/c/Users/*/AppData/...`) to detect and reuse your Windows Cursor app login.
100
+ On **WSL (Windows Subsystem for Linux)**, `pi-cursor` reuses the **current** Windows user's Cursor IDE login (`USERPROFILE` / `USERNAME` → `/mnt/c/Users/<you>/AppData/...`). It does not scan other Windows profiles.
99
101
 
100
102
  To **opt out** of Keychain / IDE / WSL credential reuse (OAuth or `CURSOR_ACCESS_TOKEN` only):
101
103
 
@@ -271,9 +273,9 @@ layer. Never hand-edit it — regenerate with `npm run proto:gen` (see
271
273
  - **Not logged in / 401:** Ensure Cursor CLI or app is logged in, or run `/login cursor` again. Check `/cursor.doctor` to verify your `tokenSource`. Tokens from CLI/IDE are re-resolved when near expiry; idle stream retries also force-refresh credentials.
272
274
  - **Empty / hung stream:** Cursor may have updated wire headers; verify network connectivity or bump `PI_CURSOR_CLIENT_VERSION`. `/cursor.doctor` prints the active `clientVersion`.
273
275
  - **Wire-protocol drift:** Cursor can change `agent.v1` at any time. Unrecognized server messages and unknown protobuf fields are no longer skipped silently — they are counted, written to the lifecycle log as `wire_drift`, appended to the failing turn's error message, and listed by `/cursor.doctor` under `wireDrift`. `wireDriftStranding=yes` means an unanswered message could have parked the turn, which is the difference between "our schema is a bit behind" and "this is why it hung". Run `CURSOR_ACCESS_TOKEN=... npm run smoke:wire` to check the handshake and schema against the live endpoint without starting a chat turn, then see [`proto/README.md`](proto/README.md) to resync the schema.
274
- - **Stuck / dies after a few minutes of work:** v1.2.2 answers all Cursor `InteractionQuery` permission prompts (web search / ask-question / etc.) that previously parked the stream. Inspect `$TMPDIR/pi-cursor-lifecycle.jsonl` for `interaction_query` / `bridge_close` events, and `/cursor.doctor` for `lastStreamEvent`. Full debug: `PI_CURSOR_PROVIDER_DEBUG=1`.
276
+ - **Stuck / dies after a few minutes of work:** Cursor `InteractionQuery` prompts are answered so the stream does not park. Web/search and unnamed proto fields are rejected (use Pi tools instead). Inspect `$TMPDIR/pi-cursor-lifecycle.jsonl` for `interaction_query` / `bridge_close` events, and `/cursor.doctor` for `lastStreamEvent`. Full debug: `PI_CURSOR_PROVIDER_DEBUG=1`.
275
277
  - **Tool continuation lost:** The provider now prefers full-history rebuild when checkpoints are stale/mismatched. If recovery still skips, `/cursor.doctor` shows `lastRecoverySkipReason`. Retry the turn or start a new chat.
276
- - **WSL credential detection:** Ensure your Windows user profile folder exists under `/mnt/c/Users/` and is readable from WSL. Disable with `PI_CURSOR_SYSTEM_CREDENTIALS=0` if undesired.
278
+ - **WSL credential detection:** Set `USERPROFILE` or `USERNAME` so the Windows home directory is known, and ensure `/mnt/c/Users/<you>/AppData/...` is readable. Disable with `PI_CURSOR_SYSTEM_CREDENTIALS=0` if undesired.
277
279
  - **Slow startup:** Activation should be a few milliseconds. `/cursor.doctor` reports `catalogCache` (`none(using bundled fallback)` means every launch is starting cold — check that `catalogCacheDir` is writable) and `unaryTransport`. A stale Cursor CLI keychain entry no longer blocks startup: a refresh token that fails is remembered for 10 minutes so it is not retried on the next launch, and any valid locally stored token is always preferred over a network exchange.
278
280
  - **Model list looks stale:** It is the last successfully discovered catalog. Open `/model` to trigger a background refresh, or delete `PI_CURSOR_CACHE_DIR` to force full rediscovery.
279
281