@runuai/host 0.9.166 → 0.9.167

package/images/standard/Dockerfile

@@ -32,9 +32,9 @@ ENV ASDF_VERSION=v0.14.1
 
 # Qualified agent builds. These are execution-contract pins: per-command env
 # freshness is requalified before any of them moves.
-ENV UAI_CODEX_CLI_VERSION=0.157.0
-ENV UAI_CURSOR_AGENT_VERSION=2026.08.25-3e8eec8
-ENV UAI_GROK_CLI_VERSION=1.0.67
+ENV UAI_CODEX_CLI_VERSION=0.164.0
+ENV UAI_CURSOR_AGENT_VERSION=2026.10.22-27dcf5f
+ENV UAI_GROK_CLI_VERSION=1.0.70
 
 # ---------------------------------------------------------------------------
 # 1. System packages.

package/lib/agents/codex.ts

@@ -56,11 +56,11 @@ import type {
 
 // The model list is host-agent/src/engine-models.ts (CODEX_MODELS).
 
-// gpt-5.6-sol is Codex's current frontier coding model (the CLI default).
+// gpt-6.1-sol is Codex's current workhorse coding model (the CLI default).
 // Update alongside CODEX_MODELS. When an agent's model is null the adapter
 // omits the override entirely and Codex uses the user's own configured
 // default.
-const CODEX_DEFAULT_MODEL = "gpt-5.6-sol";
+const CODEX_DEFAULT_MODEL = "gpt-6.1-sol";
 
 // Reasoning levels set via `-c model_reasoning_effort=<level>`. "xhigh" is
 // the picker's "Extra high"; gpt-5.6 added "max" and "ultra" (ultra =

package/lib/agents/cursor-period-usage.ts

@@ -0,0 +1,253 @@
+/**
+ * Cursor account room, read from the same dashboard calls the CLI's `/usage`
+ * screen uses. The headless stream does not report it.
+ *
+ * The CLI session access token (not the user API key, and not a team admin
+ * key) calls `aiserver.v1.DashboardService/GetPlanInfo` and
+ * `GetCurrentPeriodUsage` on api2.cursor.sh. A failure, a missing token, or a
+ * shape we do not recognise produces no report. Nothing here logs the token,
+ * an email, or a user id.
+ */
+
+import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
+import type { AgentAccountUsage } from "./types";
+
+/** Same lines Codex uses for a window that is full or close to full. */
+export const CURSOR_PERIOD_WARNING_PERCENT = 90;
+export const CURSOR_PERIOD_LIMITED_PERCENT = 100;
+
+/** One probe per leased credential, including a failed one. */
+export const CURSOR_PERIOD_PROBE_INTERVAL_MS = 5 * 60 * 1000;
+
+/** One bound for the whole probe: reading auth.json and both dashboard calls.
+ *  A hung read must not hold turn_complete after the CLI has finished. */
+export const CURSOR_PERIOD_PROBE_TIMEOUT_MS = 4_000;
+
+export const CURSOR_PERIOD_USAGE_LOG = "cursor period usage unavailable";
+
+export const CURSOR_AUTH_JSON = "/home/node/.config/cursor/auth.json";
+
+const DASHBOARD_ORIGIN = "https://api2.cursor.sh";
+const WEEKLY_PERIOD = "INCLUDED_USAGE_PERIOD_WEEKLY";
+const WEEK_MINUTES = 7 * 24 * 60;
+
+const probedAt = new Map<string, number>();
+
+/** Whether this credential may be probed at `now`. */
+export function cursorPeriodProbeDue(credentialId: string, now: number): boolean {
+  const at = probedAt.get(credentialId);
+  return at === undefined || now - at >= CURSOR_PERIOD_PROBE_INTERVAL_MS;
+}
+
+/** Count a probe, successful or not, so the next one waits out the interval. */
+export function markCursorPeriodProbed(credentialId: string, now: number): void {
+  probedAt.set(credentialId, now);
+}
+
+/** Test hook. Production never clears the gate except by process restart. */
+export function resetCursorPeriodProbes(): void {
+  probedAt.clear();
+}
+
+/** The CLI session access token from `auth.json`, or null. The raw file is not returned. */
+export function cursorAccessTokenFromAuthJson(text: string): string | null {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const token = (parsed as { accessToken?: unknown }).accessToken;
+    return typeof token === "string" && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+function isObj(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function epochMs(value: unknown): number | undefined {
+  const n =
+    typeof value === "number"
+      ? value
+      : typeof value === "string" && /^[0-9]+$/.test(value)
+        ? Number(value)
+        : Number.NaN;
+  return Number.isSafeInteger(n) && n > 0 ? n : undefined;
+}
+
+/** A 0–100 share, as the dashboard sends it. Anything else is not a window. */
+function percent(value: unknown): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 100) {
+    return undefined;
+  }
+  return value;
+}
+
+function onDemandSpend(period: Record<string, unknown>): boolean {
+  if (!isObj(period.spendLimitUsage)) return false;
+  for (const key of ["individualUsed", "pooledUsed", "totalSpend", "overallUsed"]) {
+    const value = period.spendLimitUsage[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Map a GetPlanInfo body and a GetCurrentPeriodUsage body into one account
+ * observation. Null when the percent fields are missing or not 0–100, so a
+ * schema change sends nothing.
+ */
+export function mapCursorPeriodUsage(
+  plan: unknown,
+  period: unknown,
+  observedAt: number,
+): AgentAccountUsage | null {
+  if (!isObj(period) || !isObj(period.planUsage)) return null;
+  const total = percent(period.planUsage.totalPercentUsed);
+  const api = percent(period.planUsage.apiPercentUsed);
+  if (total === undefined || api === undefined) return null;
+
+  const planInfo = isObj(plan) && isObj(plan.planInfo) ? plan.planInfo : {};
+  const weekly = planInfo.includedUsagePeriod === WEEKLY_PERIOD;
+  const resetsAt = epochMs(planInfo.includedUsageResetsAt);
+  const window = (name: string, usedPercent: number) => ({
+    window: name,
+    ...(weekly ? { windowMinutes: WEEK_MINUTES } : {}),
+    usedPercent,
+    ...(resetsAt === undefined ? {} : { resetsAt }),
+  });
+  const windows = [window("included", total), window("api", api)];
+  const limited = windows.filter((item) => item.usedPercent >= CURSOR_PERIOD_LIMITED_PERCENT);
+  const status =
+    limited.length > 0
+      ? "limited"
+      : windows.some((item) => item.usedPercent >= CURSOR_PERIOD_WARNING_PERCENT)
+        ? "warning"
+        : "allowed";
+  const limitedResets = limited
+    .map((item) => item.resetsAt)
+    .filter((reset): reset is number => reset !== undefined);
+  const usage: AgentAccountUsage = {
+    status,
+    ...(limitedResets.length > 0 ? { resetsAt: Math.max(...limitedResets) } : {}),
+    ...(onDemandSpend(period) ? { usingOverage: true } : {}),
+    windows,
+    source: "cursor-period-usage",
+    observedAt,
+    coverage: { kind: "all-windows" },
+  };
+  return usage;
+}
+
+export async function readCursorAuthFromEnvironment(
+  environment: TaskEnvironmentAgentSessionSurface,
+  signal?: AbortSignal,
+): Promise<string | null> {
+  if (signal?.aborted) return null;
+  let child: Awaited<ReturnType<TaskEnvironmentAgentSessionSurface["spawnSession"]>> | undefined;
+  const kill = (): void => {
+    if (!child) return;
+    void child.terminate("SIGKILL").catch(() => {});
+  };
+  signal?.addEventListener("abort", kill);
+  try {
+    child = await environment.spawnSession({
+      argv: ["cat", "--", CURSOR_AUTH_JSON],
+      user: "node",
+      projectEnvProfile: "task",
+      env: {},
+      maxOutputBytes: 32_768,
+    });
+    if (signal?.aborted) {
+      kill();
+      return null;
+    }
+    let text = "";
+    for await (const chunk of child.stdout) {
+      if (signal?.aborted) {
+        kill();
+        return null;
+      }
+      text += Buffer.from(chunk).toString("utf8");
+      if (text.length > 32_768) {
+        kill();
+        return null;
+      }
+    }
+    if (signal?.aborted) {
+      kill();
+      return null;
+    }
+    const exit = await child.completion;
+    return !signal?.aborted && exit.exitCode === 0 ? text : null;
+  } catch {
+    return null;
+  } finally {
+    signal?.removeEventListener("abort", kill);
+  }
+}
+
+async function postDashboard(
+  fetchImpl: typeof fetch,
+  token: string,
+  method: string,
+  signal: AbortSignal,
+): Promise<unknown | null> {
+  if (signal.aborted) return null;
+  try {
+    const response = await fetchImpl(
+      `${DASHBOARD_ORIGIN}/aiserver.v1.DashboardService/${method}`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "Connect-Protocol-Version": "1",
+        },
+        body: "{}",
+        signal,
+      },
+    );
+    if (response.status !== 200) return null;
+    return (await response.json()) as unknown;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read both dashboard methods and map them. Null on a non-200, a timeout, a
+ * bad body, or a shape we do not recognise. The token is sent only as the
+ * bearer for these two calls.
+ */
+export async function readCursorPeriodUsage(args: {
+  token: string;
+  fetchImpl?: typeof fetch;
+  timeoutMs?: number;
+  /** When set, this call does not start a second timer. The caller's deadline covers it. */
+  signal?: AbortSignal;
+  now?: number;
+}): Promise<AgentAccountUsage | null> {
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const owned = new AbortController();
+  const onParentAbort = (): void => owned.abort();
+  if (args.signal) {
+    if (args.signal.aborted) owned.abort();
+    else args.signal.addEventListener("abort", onParentAbort);
+  }
+  const timer =
+    args.signal === undefined
+      ? setTimeout(() => owned.abort(), args.timeoutMs ?? CURSOR_PERIOD_PROBE_TIMEOUT_MS)
+      : undefined;
+  try {
+    const [plan, period] = await Promise.all([
+      postDashboard(fetchImpl, args.token, "GetPlanInfo", owned.signal),
+      postDashboard(fetchImpl, args.token, "GetCurrentPeriodUsage", owned.signal),
+    ]);
+    if (owned.signal.aborted || plan === null || period === null) return null;
+    return mapCursorPeriodUsage(plan, period, args.now ?? Date.now());
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+    args.signal?.removeEventListener("abort", onParentAbort);
+  }
+}

package/lib/agents/cursor.ts

@@ -4,7 +4,7 @@
  *
  *   CURSOR_API_KEY=… /home/node/.local/bin/cursor-agent -p "<prompt>" \
  *     --output-format stream-json --stream-partial-output --force --trust \
- *     -m <model> [--resume <sessionId>]
+ *     --model <model> [--resume <sessionId>]
  *
  * One-shot per turn (like Kimi/Grok); sends serialized; continuity via
  * `--resume <sessionId>` captured from the stream. Cursor's stream-json is
@@ -26,6 +26,9 @@
  * `--trust` (skip the workspace-trust prompt). Cursor has no system-prompt
  * flag, so the briefing folds into the first turn's prompt.
  */
+import { stripVTControlCharacters } from "node:util";
+
+import { ENGINE_ACCOUNT_ENV } from "../credential-consumers/engine-anchor";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type {
   TaskEnvironmentAgentSessionSurface,
@@ -38,8 +41,19 @@ import {
   spawnEnvironmentProcess,
   type AgentEnvironmentProcess,
 } from "./proc";
+import {
+  CURSOR_PERIOD_PROBE_TIMEOUT_MS,
+  CURSOR_PERIOD_USAGE_LOG,
+  cursorAccessTokenFromAuthJson,
+  cursorPeriodProbeDue,
+  markCursorPeriodProbed,
+  readCursorAuthFromEnvironment,
+  readCursorPeriodUsage,
+} from "./cursor-period-usage";
+import { rateLimitErrorUsage } from "./rate-limit";
 import { extractResultUsage } from "./usage";
 import type {
+  AgentAccountUsage,
   AgentEvent,
   AgentEventHandler,
   AgentKind,
@@ -57,19 +71,25 @@ const CURSOR_BIN = "/home/node/.local/bin/cursor-agent";
 export const CURSOR_SANDBOX_ENV_RESTORE =
   ". /usr/local/share/uai/env-hook.sh; __uai_env_sync";
 
-// A curated slice of Cursor's ~32 models (full ids from `cursor-agent
-// --list-models`). `auto` lets Cursor pick; the rest are the frontier. The UI
-// also accepts any typed id (unverified round-trip). UPDATE as Cursor's lineup
-// changes.
-const CURSOR_MODELS = [
-  "auto",
+// A curated fallback slice of Cursor's signed-in 2026.10.22 catalog. The
+// newest version of each tier comes first; older known-good ids follow.
+export const CURSOR_MODELS = [
+  "grok-4.7-high",
+  "grok-4.7-high-fast",
   "composer-2.5",
-  "claude-opus-4-8-thinking-high",
+  "composer-2.5-fast",
+  "claude-opus-5-5-high",
+  "claude-fable-5-1-thinking-high",
+  "claude-sonnet-5-5-high",
   "gpt-5.6-sol-high",
+  "gemini-4-argon-high",
+  "kimi-k3-high",
+  "auto",
+  "claude-opus-4-8-thinking-high",
   "cursor-grok-4.5-high",
   "claude-fable-5-thinking-high",
 ];
-const CURSOR_DEFAULT_MODEL = "auto";
+const CURSOR_DEFAULT_MODEL = "grok-4.7-high";
 const CURSOR_EFFORTS: string[] = []; // effort is baked into the model id
 
 // ---------------------------------------------------------------------------
@@ -99,12 +119,30 @@ export interface MappedCursorLine {
   finalText?: string;
   sessionId?: string;
   errorText?: string;
-  /** Token/cost from the result envelope — Cursor uses the Claude-compatible
-   *  shape (usage + total_cost_usd + modelUsage). ADR-071 metering. */
+  /** This model needs paid Cursor credits; the account itself is still usable. */
+  creditRefusal?: boolean;
+  /** Set when `errorText` is a usage cap. Secret-free; source `error-text`. */
+  accountUsage?: AgentAccountUsage;
+  /** Tokens from the result envelope. Claude-shaped lines carry cost;
+   *  cursor-agent 2026.10.x carries camelCase counts and no cost. */
   usage?: AgentUsage;
 }
 
-export function mapCursorLine(line: string): MappedCursorLine {
+/** Cursor Premium can refuse one paid-credit model while the same account can
+ * still run Cursor's Grok and Composer models. This is not account exhaustion:
+ * keep it non-retryable so the orchestrator neither rotates nor cools the
+ * account, and give the person an actionable model-specific error. */
+export function cursorCreditsRequiredMessage(message: string): string | null {
+  const match = stripVTControlCharacters(message).match(
+    /(?:ActionRequiredError:\s*)?([^\r\n]+?)\s+is not included in your weekly usage\b/i,
+  );
+  const model = match?.[1]?.trim();
+  return model
+    ? `${model} needs Cursor credits on this plan; use a Grok or Composer model`
+    : null;
+}
+
+export function mapCursorLine(line: string, now: number = Date.now()): MappedCursorLine {
   const t = line.trim();
   if (!t.startsWith("{")) return {};
   let m: Record<string, unknown>;
@@ -141,15 +179,23 @@ export function mapCursorLine(line: string): MappedCursorLine {
   }
   if (m.type === "result") {
     const errored = m.is_error === true;
+    const rawErrorText = errored
+      ? typeof m.result === "string"
+        ? m.result
+        : "cursor turn failed"
+      : undefined;
+    const creditError = rawErrorText
+      ? cursorCreditsRequiredMessage(rawErrorText)
+      : null;
+    const errorText = creditError ?? rawErrorText;
+    const accountUsage = errorText ? rateLimitErrorUsage(errorText, now) : null;
     return {
       end: true,
       sessionId: typeof m.session_id === "string" ? m.session_id : undefined,
       finalText: typeof m.result === "string" ? m.result : undefined,
-      errorText: errored
-        ? typeof m.result === "string"
-          ? m.result
-          : "cursor turn failed"
-        : undefined,
+      errorText,
+      ...(creditError ? { creditRefusal: true } : {}),
+      ...(accountUsage ? { accountUsage } : {}),
       usage: extractResultUsage(m),
     };
   }
@@ -175,6 +221,9 @@ export class CursorSession implements AgentSession {
   private readonly agentEnv: Record<string, string>;
   private readonly spawner: Spawner;
   private readonly apiKey: string;
+  private readonly readAuthFile: (signal: AbortSignal) => Promise<string | null>;
+  private readonly fetchImpl: typeof fetch;
+  private readonly probeTimeoutMs: number;
 
   private readonly handlers = new Set<AgentEventHandler>();
   private sessionId: string | null = null;
@@ -191,6 +240,14 @@ export class CursorSession implements AgentSession {
     agentEnv?: Record<string, string>;
     spawner?: Spawner;
     apiKey?: string;
+    /** Reads the CLI's auth.json from the task environment. Tests inject this.
+     *  The signal aborts when the probe deadline passes; the default reader
+     *  kills the auth process. */
+    readAuthFile?: (signal: AbortSignal) => Promise<string | null>;
+    /** Dashboard fetch. Tests inject this. Production uses the host's fetch. */
+    fetchImpl?: typeof fetch;
+    /** Whole-probe bound, including the auth.json read. Tests shrink it. */
+    probeTimeoutMs?: number;
   }) {
     this.agentId = args.agent.id;
     this.environment = args.environment;
@@ -205,6 +262,68 @@ export class CursorSession implements AgentSession {
     // key is usually absent anyway.
     this.apiKey =
       args.apiKey ?? this.agentEnv.CURSOR_API_KEY ?? process.env.CURSOR_API_KEY ?? "";
+    this.readAuthFile =
+      args.readAuthFile ?? ((signal) => readCursorAuthFromEnvironment(this.environment, signal));
+    this.fetchImpl = args.fetchImpl ?? fetch;
+    this.probeTimeoutMs = args.probeTimeoutMs ?? CURSOR_PERIOD_PROBE_TIMEOUT_MS;
+  }
+
+  /**
+   * One dashboard probe for a leased account, overlapped with the turn. A
+   * missing lease, a probe still inside the five-minute gate, or any failure
+   * sends nothing. The token never leaves this method except as the bearer
+   * of the two dashboard calls.
+   *
+   * The credential is marked before the first await. Two sessions that start
+   * together must not both pass the gate.
+   */
+  private probePeriodUsage(): Promise<void> {
+    const credentialId = this.agentEnv[ENGINE_ACCOUNT_ENV];
+    if (!credentialId || this.closed) return Promise.resolve();
+    const now = Date.now();
+    if (!cursorPeriodProbeDue(credentialId, now)) return Promise.resolve();
+    markCursorPeriodProbed(credentialId, now);
+    return this.readPeriodUsage();
+  }
+
+  /** Auth read and both dashboard calls share one deadline. On expiry the
+   *  auth reader is aborted (the default reader kills its process) and this
+   *  promise settles so turn_complete is not held. */
+  private readPeriodUsage(): Promise<void> {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.probeTimeoutMs);
+    let finished = false;
+    const usagePromise = this.collectPeriodUsage(controller.signal);
+    return new Promise((resolve) => {
+      const finish = (usage: AgentAccountUsage | null): void => {
+        if (finished) return;
+        finished = true;
+        clearTimeout(timer);
+        if (!this.closed) {
+          if (!usage) console.warn(CURSOR_PERIOD_USAGE_LOG);
+          else this.emit({ type: "account_usage", usage });
+        }
+        resolve();
+      };
+      controller.signal.addEventListener("abort", () => finish(null));
+      void usagePromise.then(
+        (usage) => finish(controller.signal.aborted ? null : usage),
+        () => finish(null),
+      );
+    });
+  }
+
+  private async collectPeriodUsage(signal: AbortSignal): Promise<AgentAccountUsage | null> {
+    if (signal.aborted) return null;
+    const raw = await this.readAuthFile(signal);
+    if (signal.aborted) return null;
+    const token = raw ? cursorAccessTokenFromAuthJson(raw) : null;
+    if (!token) return null;
+    return readCursorPeriodUsage({
+      token,
+      fetchImpl: this.fetchImpl,
+      signal,
+    });
   }
 
   onEvent(handler: AgentEventHandler): () => void {
@@ -227,6 +346,7 @@ export class CursorSession implements AgentSession {
   private buildRequest(prompt: string): TaskEnvironmentSessionRequest {
     const argv = [
       CURSOR_BIN,
+      "--disable-auto-update",
       "-p",
       prompt,
       "--output-format",
@@ -236,7 +356,9 @@ export class CursorSession implements AgentSession {
       "--trust", // skip the workspace-trust prompt in headless
       "--approve-mcps", // load the gateway MCP servers from ~/.cursor/mcp.json (ADR-057)
     ];
-    if (this.model && this.model !== "auto") argv.push("-m", this.model);
+    // Long form only: the pinned CLI (2026.08.25) and its successors have no
+    // `-m` short flag and exit on it before the turn starts.
+    if (this.model && this.model !== "auto") argv.push("--model", this.model);
     if (this.sessionId) argv.push("--resume", this.sessionId);
     return {
       argv: argv as [string, ...string[]],
@@ -266,6 +388,7 @@ export class CursorSession implements AgentSession {
 
     const child = this.spawner(this.buildRequest(prompt));
     this.current = child;
+    const periodUsage = this.probePeriodUsage();
 
     let acc = "";
     let sawText = false;
@@ -273,6 +396,13 @@ export class CursorSession implements AgentSession {
     // Usage rides the result line but turn_complete fires on process exit;
     // capture it here and attach it below (ADR-071 metering).
     let turnUsage: AgentUsage | undefined;
+    // A result line that already explained the failure owns the error. The
+    // exit path must not add a second "cursor exited N" for the same turn.
+    // A usage cap is tracked on its own: a generic JSON error must not hide
+    // a cap that only shows up on stderr.
+    let sawError = false;
+    let reportedRateLimit = false;
+    let reportedCreditRefusal = false;
     const consume = (chunk: string): void => {
       buf += chunk;
       let nl: number;
@@ -318,7 +448,24 @@ export class CursorSession implements AgentSession {
         }
         if (m.end) {
           if (m.usage) turnUsage = m.usage;
-          if (m.errorText) this.emit({ type: "error", message: m.errorText });
+          if (m.errorText) {
+            sawError = true;
+            if (m.creditRefusal) reportedCreditRefusal = true;
+            if (m.accountUsage) {
+              reportedRateLimit = true;
+              this.emit({ type: "account_usage", usage: m.accountUsage });
+              this.emit({
+                type: "error",
+                message: m.errorText,
+                retryable: "rate_limit",
+                ...(m.accountUsage.resetsAt === undefined
+                  ? {}
+                  : { resetsAt: m.accountUsage.resetsAt }),
+              });
+            } else {
+              this.emit({ type: "error", message: m.errorText });
+            }
+          }
           const finalText = m.finalText ?? acc;
           if (sawText || finalText) {
             this.emit({ type: "message_complete", text: finalText });
@@ -340,18 +487,41 @@ export class CursorSession implements AgentSession {
         if (spawnErr) {
           this.emit({ type: "error", message: `cursor spawn failed: ${spawnErr}` });
         } else if (code !== 0) {
-          const tail = stderr.trim().slice(-500);
-          this.emit({
-            type: "error",
-            message: `cursor exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`,
-          });
+          // Some cursor-agent errors (e.g. an invalid key) are coloured; strip
+          // the escape codes so the cap check and the error a human sees are
+          // plain text. A generic result error must not skip this check.
+          const plain = stripVTControlCharacters(stderr);
+          const tail = plain.trim().slice(-500);
+          const creditRefusal = cursorCreditsRequiredMessage(plain);
+          const message =
+            creditRefusal ??
+            `cursor exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`;
+          const accountUsage = reportedRateLimit ? undefined : rateLimitErrorUsage(plain);
+          if (accountUsage) {
+            this.emit({ type: "account_usage", usage: accountUsage });
+          }
+          if (!sawError || (creditRefusal && !reportedCreditRefusal)) {
+            if (accountUsage) {
+              this.emit({
+                type: "error",
+                message,
+                retryable: "rate_limit",
+                ...(accountUsage.resetsAt === undefined
+                  ? {}
+                  : { resetsAt: accountUsage.resetsAt }),
+              });
+            } else {
+              this.emit({ type: "error", message });
+            }
+          }
         }
-        this.emit({ type: "turn_complete", usage: turnUsage });
         resolve();
       };
       child.on("exit", (code) => finish(code));
       child.on("error", (err) => finish(null, err.message));
     });
+    await periodUsage;
+    if (!this.closed) this.emit({ type: "turn_complete", usage: turnUsage });
   }
 
   async interrupt(): Promise<void> {

package/lib/agents/grok.ts

@@ -44,6 +44,7 @@ import {
   spawnEnvironmentProcess,
   type AgentEnvironmentProcess,
 } from "./proc";
+import { rateLimitErrorUsage } from "./rate-limit";
 import { register } from "./registry";
 import { GROK_MODELS } from "../../src/engine-models";
 import type {
@@ -58,10 +59,9 @@ import type {
 const GROK_BIN = "/home/node/.grok/bin/grok";
 export const GROK_LOADER_LOGIN_ENV = "0";
 
-// `grok models` lists what the account can run. grok-4.5 is the current
-// default; UPDATE WHEN xAI CHANGES the lineup.
-// The model list is host-agent/src/engine-models.ts (GROK_MODELS).
-const GROK_DEFAULT_MODEL = "grok-4.5";
+// Static fallback catalog verified against `grok models`; keep the shared list
+// in host-agent/src/engine-models.ts (GROK_MODELS) current with the pinned CLI.
+const GROK_DEFAULT_MODEL = "grok-4.7";
 // Grok has no per-invocation reasoning-effort flag.
 const GROK_EFFORTS: string[] = [];
 
@@ -313,10 +313,23 @@ export class GrokSession implements AgentSession {
           this.emit({ type: "error", message: `grok spawn failed: ${spawnErr}` });
         } else if (code !== 0) {
           const tail = stderr.trim().slice(-500);
-          this.emit({
-            type: "error",
-            message: `grok exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`,
-          });
+          const message = `grok exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`;
+          // Same path as Claude/Codex/OpenCode: a usage-cap / 429 error emits
+          // account_usage (source error-text) so the orchestrator can rotate.
+          const accountUsage = rateLimitErrorUsage(message);
+          if (accountUsage) {
+            this.emit({ type: "account_usage", usage: accountUsage });
+            this.emit({
+              type: "error",
+              message,
+              retryable: "rate_limit",
+              ...(accountUsage.resetsAt === undefined
+                ? {}
+                : { resetsAt: accountUsage.resetsAt }),
+            });
+          } else {
+            this.emit({ type: "error", message });
+          }
         }
         // Finalize the streamed message (no-op text if the turn produced none).
         if (sawText) this.emit({ type: "message_complete", text: acc });

package/lib/agents/registry.ts

@@ -144,25 +144,25 @@ export function capabilities(): AgentKindCapability[] {
         : (adapter.available?.() ?? true) || advertisementFallback(adapter.kind),
     )
     .map((adapter) => {
-    const out: AgentKindCapability = {
-      kind: adapter.kind,
-      label: adapter.label,
-      supportedModels: adapter.supportedModels(),
-      supportedEfforts: adapter.supportedEfforts(),
-    };
-    if (adapter.defaultModel !== undefined) {
-      out.defaultModel = adapter.defaultModel;
-    }
-    if (adapter.defaultEffort !== undefined) {
-      out.defaultEffort = adapter.defaultEffort;
-    }
-    if (adapter.executionProfiles && adapter.executionProfiles.length > 0) {
-      out.executionProfiles = adapter.executionProfiles.map((profile) => ({
-        ...profile,
-      }));
-    }
-    return out;
-  });
+      const out: AgentKindCapability = {
+        kind: adapter.kind,
+        label: adapter.label,
+        supportedModels: adapter.supportedModels(),
+        supportedEfforts: adapter.supportedEfforts(),
+      };
+      if (adapter.defaultModel !== undefined) {
+        out.defaultModel = adapter.defaultModel;
+      }
+      if (adapter.defaultEffort !== undefined) {
+        out.defaultEffort = adapter.defaultEffort;
+      }
+      if (adapter.executionProfiles && adapter.executionProfiles.length > 0) {
+        out.executionProfiles = adapter.executionProfiles.map((profile) => ({
+          ...profile,
+        }));
+      }
+      return out;
+    });
 }
 
 /**

package/lib/agents/types.ts

@@ -124,7 +124,7 @@ export interface AgentAccountUsage {
   resetsAt?: number;
   usingOverage?: boolean;
   windows: EngineUsageWindow[];
-  source: "claude-rate-limit-event" | "codex-rate-limits" | "error-text";
+  source: "claude-rate-limit-event" | "codex-rate-limits" | "error-text" | "cursor-period-usage";
   observedAt: number;
   /** Which provider capacity this reading can prove usable again. Claude emits
    * one event per named window; Codex snapshots cover every window. Internal

package/lib/agents/usage.ts

@@ -1,11 +1,12 @@
 /**
- * Shared token/cost extraction for the Claude-Code-compatible stream-json
- * `result` envelope (ADR-071 metering). Claude Code AND Cursor Agent both emit
- * this exact shape — `usage` token breakdown, an exact `total_cost_usd`, and
- * per-model `modelUsage` — so both engines share this one extractor.
+ * Shared token/cost extraction for a stream-json `result` envelope (ADR-071
+ * metering). Claude Code reports snake_case `usage` plus `total_cost_usd` and
+ * per-model `modelUsage`. cursor-agent 2026.10.x reports camelCase counts and
+ * no cost: `{inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens}`.
+ * Snake_case wins when a field is present, so Claude's path is unchanged.
  *
  * Codex (app-server protocol) and Kimi/Grok (plain text streams) report no
- * token/cost data, so they have no extractor.
+ * token/cost data through this extractor.
  */
 
 import type { AgentUsage } from "./types";
@@ -18,6 +19,12 @@ function num(v: unknown): number | undefined {
   return typeof v === "number" && Number.isFinite(v) ? v : undefined;
 }
 
+/** Claude's name when it is a number, otherwise Cursor 2026.10's. */
+function firstNum(claude: unknown, cursor: unknown): number | undefined {
+  const primary = num(claude);
+  return primary !== undefined ? primary : num(cursor);
+}
+
 /** Pull AgentUsage from a `result` line, or undefined when none is reported. */
 export function extractResultUsage(
   json: Record<string, unknown>,
@@ -26,10 +33,10 @@ export function extractResultUsage(
   const models = isObj(json.modelUsage) ? Object.keys(json.modelUsage) : [];
   const usage: AgentUsage = {
     model: models.length ? models.join(", ") : undefined,
-    inputTokens: num(u.input_tokens),
-    outputTokens: num(u.output_tokens),
-    cacheReadTokens: num(u.cache_read_input_tokens),
-    cacheCreateTokens: num(u.cache_creation_input_tokens),
+    inputTokens: firstNum(u.input_tokens, u.inputTokens),
+    outputTokens: firstNum(u.output_tokens, u.outputTokens),
+    cacheReadTokens: firstNum(u.cache_read_input_tokens, u.cacheReadTokens),
+    cacheCreateTokens: firstNum(u.cache_creation_input_tokens, u.cacheWriteTokens),
     costUsd: num(json.total_cost_usd),
   };
   // Nothing usable reported → omit rather than send an empty object.

package/lib/orchestrator.ts

@@ -5409,12 +5409,26 @@ export class Orchestrator {
         // ADR-076: a turn that completed means the current account is healthy —
         // reset its rotation budget so a LATER rate-limit gets a fresh failover.
         channel.rotations.delete(agentId);
+        // Name the leased AI account on the turn usage report so the cloud
+        // ledger can roll up observed spend per credential (host 0.9.167+).
+        // Only a cloud-leased account identity is reportable; runner-default
+        // and Managed Engine identities stay unnamed (same rule as account_usage).
+        const leasedIdentity = channel.leasedIdentityByAgent.get(agentId);
+        const usage =
+          event.usage === undefined
+            ? undefined
+            : {
+                ...event.usage,
+                ...(leasedIdentity?.subject === "account"
+                  ? { credentialId: leasedIdentity.credentialId }
+                  : {}),
+              };
         this.emitHost({
           kind: "agent.turn_complete",
           taskId: channel.taskId,
           agentId,
           aborted,
-          usage: event.usage,
+          usage,
         });
         if (remainingTurns === 0) {
           channel.lastPrompt.delete(agentId);
@@ -5487,7 +5501,12 @@ export class Orchestrator {
   /** An engine error can race a live launch edit after a partial turn. Keep
    * the obsolete adapter owned until the stale recycler closes it, but close
    * the cloud turn boundary immediately so restarting/ready cannot leave the
-   * crew UI stuck in a working state. */
+   * crew UI stuck in a working state.
+   *
+   * The error is still reported, as the exit notice every other engine error
+   * sends: whatever the agent was doing is lost, and without it nobody (the
+   * human, or a Secretary waiting on the agent) was told why. Sent before the
+   * reconcile below, so the cloud sees it ahead of the respawn's `restarting`. */
   private reconcileErroredRosterChange(
     channel: Channel,
     agentId: string,
@@ -5501,6 +5520,12 @@ export class Orchestrator {
       if (change) this.publishRosterChangeAbort(channel, agentId, change);
       else this.emitRetiredTurnAbort(channel, agentId);
     }
+    this.emitHost({
+      kind: "agent.exit",
+      taskId: channel.taskId,
+      agentId,
+      reason,
+    });
     void this.reconcileAfterRosterRefresh(channel).catch((err: unknown) => {
       console.warn(
         `[orchestrator] ${channel.taskId}/${agentId}: roster-change error (${reason}) reconcile failed: ${

package/lib/standard-image.ts

@@ -67,7 +67,7 @@ export const ASDF_DATA_VOLUME = "uai-asdf-data";
 export const STANDARD_DEFAULT_NODE_VERSION = "22.11.0";
 
 /** Exact Codex CLI release exposed to task runtimes through the shared volume. */
-export const STANDARD_CODEX_CLI_VERSION = "0.157.0";
+export const STANDARD_CODEX_CLI_VERSION = "0.164.0";
 
 /**
  * Runtimes the standard image's asdf plugins can satisfy, with a sensible set

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.166",
+  "version": "0.9.167",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/engine-models.ts

@@ -5,20 +5,21 @@
  * here has no guide entry. Pure data: no runtime imports.
  */
 
-// Claude Code's aliases, which follow its own model table (2.1.307:
+// Claude Code's aliases, which follow its own model table (2.1.310:
 // fable = Claude Fable 5.1, opus = Opus 5.5, sonnet = Sonnet 5.5,
 // haiku = Haiku 5.5). Update alongside the CLI.
 export const CLAUDE_MODELS: readonly string[] = ["fable", "opus", "sonnet", "haiku"];
 
-// Codex model slugs accepted via `-c model=<slug>`. Hardcoded: Codex has no
-// machine-readable "list models" command — the canonical list is the
-// interactive `codex` model picker (and `codex -m <slug>` / config.toml).
-// Sourced from that picker; UPDATE WHEN MODELS CHANGE. Order = display order
-// in the cloud picker. Legacy models remain reachable via config.toml.
+// Codex model slugs accepted via `-c model=<slug>`. Keep the newest version of
+// each tier first; older models remain available at the end.
 export const CODEX_MODELS: readonly string[] = [
   "gpt-6-astra",
-  "gpt-5.6-sol",
+  "gpt-6.1-sol",
+  // OpenAI has not released a GPT-6 Terra; 5.6 remains the balanced tier.
   "gpt-5.6-terra",
+  "gpt-6-luna",
+  "gpt-6-sol",
+  "gpt-5.6-sol",
   "gpt-5.6-luna",
   "gpt-5.5",
   "gpt-5.4",
@@ -28,4 +29,11 @@ export const CODEX_MODELS: readonly string[] = [
   "gpt-5.2",
 ];
 
-export const GROK_MODELS: readonly string[] = ["grok-4.5"];
+// Grok model slugs accepted via `-m <slug>`. Keep the current models
+// first and older working models at the end.
+export const GROK_MODELS: readonly string[] = [
+  "grok-4.7",
+  "grok-4.7-build-fast",
+  "grok-4.6",
+  "grok-4.5",
+];

package/src/protocol.ts

@@ -212,7 +212,7 @@ export interface EngineUsageFrame {
   usingOverage?: boolean;
   windows: EngineUsageWindow[];
   /** What the report was read from. */
-  source: "claude-rate-limit-event" | "codex-rate-limits" | "error-text";
+  source: "claude-rate-limit-event" | "codex-rate-limits" | "error-text" | "cursor-period-usage";
   /** When the engine said it, epoch ms (host clock). The cloud keeps the
    *  newest per account, so a late report never overwrites a newer one. */
   observedAt: number;
@@ -5059,7 +5059,9 @@ export type HostEvent =
       agentId: string;
       aborted?: boolean;
       /** Token/cost accounting for the turn, when the engine reports it
-       *  (ADR-071 usage metering — powers per-task cost + managed AI billing). */
+       *  (ADR-071 usage metering — powers per-task cost + managed AI billing).
+       *  `credentialId` is the leased AI account the turn ran on (host
+       *  0.9.167+); older runners omit it and the cloud stores null. */
       usage?: {
         model?: string;
         inputTokens?: number;
@@ -5067,6 +5069,7 @@ export type HostEvent =
         cacheReadTokens?: number;
         cacheCreateTokens?: number;
         costUsd?: number;
+        credentialId?: string;
       };
     }
   /**