@tt-a1i/openpi 0.6.0 → 0.6.1

package/README.md

@@ -130,7 +130,7 @@ OpenPI 把成熟 Coding Agent 的工作习惯做成 Pi-native 能力，但不复
 | 快捷工作流   | `/btw` 旁路提问（TUI）、`/lg` 浏览 Diff（TUI）、`/pr` 查 PR、`/copy-all`、`fd`、`rg`、只读 Git 工具       |
 | 人类决策     | `ask_user` 草稿与最终复核、parent-only `human_handoff`、Plan Ready 实施门禁                               |
 | 统一配置     | `/openpi-setup` 管理 OpenPI 自有模型、并发、Footer、输出密度与 Post-edit 偏好                             |
-| 模型授权     | `/login google-antigravity`；实验性的 `/login cursor`（仅聊天，不执行 Cursor 原生工具）                   |
+| 模型授权     | `/login google-antigravity`；实验性的 `/login cursor`（支持 Pi 工具，不执行 Cursor 原生工具）                   |
 
 OpenPI 采用 [MIT License](LICENSE)；第三方来源与保留声明见 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)。
 
@@ -196,23 +196,23 @@ subagent_spawn({
 每个 Subagent 都是新的进程内 Pi SDK Session：
 
 - 默认继承父会话的 Provider 与模型；用户可明确指定 Thinking Level，否则模型根据角色建议、任务难度与目标模型实际支持的档位选择；
-- 继承普通 child-safe 工具、Skills、项目说明与 Trust 决策；
+- 继承父会话当前启用且允许委派的工具、Skills 和项目说明；目标目录的项目扩展按其自身 Trust 决策加载；
 - 最多 4 个模型发起的 Subagent 并发运行，结束后自动回传；
 - 可 `check`、`wait`、`cancel`，也可用 `subagent_send` 继续同一子会话；
 - 输入框下方显示实时摘要，空输入时按 `↓` 聚焦，`Enter` 或 `→` 打开管理界面。
 
-内置角色由 Harness 强制工具边界，不靠 Prompt 自律：
+内置角色提供任务分工建议，普通模式下继承父会话当前启用且允许委派的工具，包括 Bash 和已启用的联网工具。角色名称本身不是只读权限边界；Plan Mode 与自定义角色的显式工具限制仍由 Harness 执行。
 
-| `agent_type`  | 适合             | 相对 effort 建议    | 强制能力                      |
-| ------------- | ---------------- | ------------------- | ----------------------------- |
-| `explorer`    | 代码追踪与探索   | 中等，难题可提高    | 只读发现工具                  |
-| `implementer` | 聚焦实现         | 中高，按范围与风险调整 | read / bash / edit / write 等 |
-| `reviewer`    | 正确性与回归审查 | 较高                | 只读发现工具                  |
-| `advisor`     | 深度技术建议     | 较高                | 只读发现工具                  |
+| `agent_type`  | 适合             | 相对 effort 建议 |
+| ------------- | ---------------- | ---------------- |
+| `explorer`    | 代码追踪与探索   | 中等，难题可提高 |
+| `implementer` | 聚焦实现         | 中高，按范围与风险调整 |
+| `reviewer`    | 正确性与回归审查 | 较高 |
+| `advisor`     | 深度技术建议     | 较高 |
 
 上述只是模型的相对选择提示，不会为内置角色写死具体档位。用户明确指定的 `reasoning_effort` 始终优先；否则模型结合任务难度，从目标模型实际支持的档位中选择。
 
-角色可由全局 `~/.pi/agent/agents/*.md` 或受信任项目 `.pi/agents/*.md` 覆盖。模型优先级是：显式调用 > Agent Type 文件 > `/openpi-setup` 角色模型 > 父模型继承。更高优先级定义损坏时会阻断 fallback，而不是悄悄退回更宽松的能力。
+角色可由全局 `~/.pi/agent/agents/*.md` 或受信任项目 `.pi/agents/*.md` 覆盖。模型优先级是：显式调用 > Agent Type 文件 > `/openpi-setup` 角色模型 > 父模型继承。更高优先级定义损坏时会阻断 fallback，而不是悄悄退回更宽松的能力。自定义角色省略 `tools` 时继承当前父工具；显式列表只能收窄，未在父会话启用的工具不会由委派自动激活。已有角色文件不会被升级覆盖；旧版 `explorer.md` 的只读列表仍然有效。工具可用性不等于文件系统沙箱；普通模式可使用绝对路径访问其他目录，目标仓库的执行 cwd 应通过 `working_dir` 指定。
 
 <details>
 <summary><strong>并行写文件时如何隔离 Worktree？</strong></summary>
@@ -275,7 +275,7 @@ return agent("Synthesize the verified findings", {
 | `pipeline()` | 每个 item 完成上阶段后立即进入下一阶段；多阶段 fan-out 的默认选择          |
 | `parallel()` | 并发 barrier；只在下一阶段确实需要全部结果时使用                           |
 
-Workflow 默认并发 8 个 Agent，单次最多 128 次调用；可配置到 64 和 1024。前台运行可实时查看，后台运行完成后自动回传；`/workflows` 展示阶段、Agent、Transcript、Graph、用量与产物。每个 Child Provider turn 必须在 45 秒内产生模型可见的 thinking、text、tool call 或完成事件，并在持续输出时按进展续期；空 stream start 与 transport heartbeat 不算进展。用户显式配置了更宽的 Pi `httpIdleTimeoutMs` 时沿用该上限。超时会 abort 当前 Child、保留已有 Transcript/usage/evidence，并让 sibling 与后续阶段继续结算。
+Workflow 默认并发 8 个 Agent，单次最多 128 次调用；可配置到 64 和 1024。前台运行可实时查看，后台运行完成后自动回传；`/workflows` 展示阶段、Agent、Transcript、Graph、用量与产物。普通子代理和 Workflow 都使用 Pi 原生传输超时与重试，不再用额外的 45 秒无可见输出计时器打断思考、排队或重试。显式取消和 Session 清理仍有界，原生 Provider 错误保留在 Child outcome 中。并发上限不代表账号的服务端速率额度；429 仍按 Pi 原生重试策略处理。
 
 ---
 
@@ -285,6 +285,8 @@ OpenPI 把一次调用拆成可以审计的生命周期，而不是把“进程
 
 ### Result Handoff 与派生 Graph
 
+`agent(prompt, { working_dir: "/path/to/repository" })` 显式选择子代理工作目录；相对路径以父会话 cwd 解析，并在模型调用前验证。目标目录影响 Git、资源加载、Trust、Worktree 和 Replay 身份；只在 Prompt 中写路径不会切换 cwd。普通继承工具的内置角色不使用只读 Replay；明确配置只读工具的自定义角色仍保留原有 Replay 仓库边界。
+
 成功调用返回同一 Run 内有效的 opaque `ref`。后续调用通过 `inputs: [previous.ref]` 显式接收上游结论；每个结论最多 16 KiB，合计最多 48 KiB，并标记为不可信数据。Artifacts 从这些引用派生只读 Graph，用来观察 lineage，不参与调度。
 
 ### Invocation Ledger

package/SETUP.md

@@ -16,7 +16,7 @@ Pi installs the package dependencies automatically. Restart Pi or run `/reload`
 
 ## fd, rg, and read-only git tools
 
-The `file-search` extension registers `fd` and `rg` as model tools, and `git-read` registers `git_show`, `git_diff`, and `git_log` (read-only git inspection). They stay outside an ordinary parent turn until the user explicitly asks to use `fd`/`rg`/git history, or structured file search, or the model loads the `search` group through `openpi_load_tools`. Entering or restoring Plan Mode is a runtime-safety exception: it loads `search` for that Session so diff investigation can use the structured Git boundary. The gateway is shown after an explicit OpenPI-capability request, or remains visible when the user opts into adaptive discovery; child sessions may still receive these tools through the reviewed child-safe allowlist (the read-only git tools let reviewer/advisor subagents inspect diffs, which a bash-free tool boundary otherwise excludes). No setup is normally needed: at startup `fd`/`rg` silently use a system-installed binary (`fd`/`fdfind` and `rg`) when available, or an existing binary in the agent's private managed bin directory (`~/.pi/agent/bin`). Only when neither exists does it download an official release binary (macOS/Linux, arm64/x64, over HTTPS) into that directory — a persistent cache that survives package updates — and show a one-time notification. If your platform is unsupported, install `fd` and `rg` with your package manager and restart Pi. The git tools require a system `git`.
+The `file-search` extension registers `fd` and `rg` as model tools, and `git-read` registers `git_show`, `git_diff`, and `git_log` (read-only git inspection). They stay outside an ordinary parent turn until the user explicitly asks to use `fd`/`rg`/git history, or structured file search, or the model loads the `search` group through `openpi_load_tools`. Entering or restoring Plan Mode is a runtime-safety exception: it loads `search` for that Session so diff investigation can use the structured Git boundary. The gateway is shown after an explicit OpenPI-capability request, or remains visible when the user opts into adaptive discovery; children receive these tools only when active in the parent and permitted by their role allowlist. No setup is normally needed: at startup `fd`/`rg` silently use a system-installed binary (`fd`/`fdfind` and `rg`) when available, or an existing binary in the agent's private managed bin directory (`~/.pi/agent/bin`). Only when neither exists does it download an official release binary (macOS/Linux, arm64/x64, over HTTPS) into that directory — a persistent cache that survives package updates — and show a one-time notification. If your platform is unsupported, install `fd` and `rg` with your package manager and restart Pi. The git tools require a system `git`.
 
 While Plan Mode is active, raw Bash `git diff`, `git show`, and `git whatchanged` are refused, as are diff-generating `git log` options such as `-p`, `--stat`, `--name-only`, and `-L`. Use `git_log` to find commits and `git_diff` / `git_show` to inspect changes; the latter commands always pass `--no-ext-diff --no-textconv --no-color`, so repository-configured `diff.external` and textconv drivers are not executed. This guarantee is scoped to the Git diff-driver boundary rather than every possible hostile Git configuration; the remaining allowlisted Git investigation commands still run inside Pi's existing project Trust boundary.
 
@@ -60,7 +60,7 @@ Use the single canonical package-owned command. `/my-pi-setup` remains a compati
 /openpi-setup 清除 explorer 的模型，让它继承父模型
 ```
 
-Capability discovery defaults to `explicit`, preserving the zero-resident OpenPI tool surface until the user asks for a capability. The case-insensitive English words `subagent` and `workflow` are reserved authorization words: entering either word is sufficient to load its capability group, and the interactive editor shows it in Claude Code-style lavender before submission, with a darker purple fallback for light themes. This makes discussion that contains either English word an intentional opt-in tradeoff; conditional and negated clauses remain inert, while Chinese capability names still require a recognized action request. `adaptive` is an explicit opt-in that keeps only `openpi_load_tools` visible and allows the model to load a useful group on its own; because this can start Subagents, Workflows, or background processes, normal permission and configured concurrency/call limits still apply. Changing the setting updates the current Session immediately, while already loaded groups remain stable for that Session. Accepted Suggestion text is classified only after it becomes real editor input. The visual feedback and runtime activation share one fail-closed intent classifier. Next-action suggestions default to off. Run `/openpi-setup` to explicitly choose an available model and reasoning level. After a fully settled main-agent run, one suggestion may appear as dim inline text on the first row of an empty editor; reserved cells at the row end keep CJK IME preedit from overwriting it. `Right` accepts it into the editor without submitting, while any other editor input dismisses it. Suggestions are ephemeral and never enter session history or model context. Workflows default to 8 concurrent agents and 128 total agent calls per run; configurable hard maxima are 64 and 1024. The large decorative header defaults off and the custom dashboard footer defaults on with a one-line plain layout (`model context |flex| git pr cwd`; `thinking`, `cache`, `cost`, and `throughput` remain opt-in metrics). Footer presets are `powerline`, `powerline-mono`, and `compact`; style can also be set independently to `plain`, `powerline`, or `powerline-mono`. Custom layouts use a 2D `footerLines` array with at most one `flex` per row for left/right alignment. Nerd Font affects powerline separator glyphs (``) and adds Codex-style outline icons to compact read, terminal, edit, search, and directory activity rows; all accompanying text remains readable without it. Footer metrics use one Codicon outline family (`` model, `` context, and `` directory) plus `⎇` for the branch. A Nerd Font containing Codicons renders them as designed; without one, the text labels remain readable even if an icon falls back to an empty box. Footer changes apply immediately in the active TUI session. Subagent results default to a compact status summary; full mode remains available as a per-user setting, and `app.tools.expand` (`Ctrl+O` by default) reveals the available child report. Ordinary `read`, `grep`, `find`, and `ls` operations render as one-line semantic activity summaries. Bash and Write/Edit default to the same activity-row projection, showing the target, running/success/failure state, and useful line or diff counts without replaying stdout or previews. Select full independently for Bash or Write/Edit to keep Pi's native rendering expanded. `app.tools.expand` temporarily restores the native arguments, output, errors, diff, timing, images, truncation notices, and full-output metadata; it never changes Session history or model context. An optional post-edit command is off by default: set one (for example `npm run format`, maximum 500 characters) and it runs once in the background after each interactive-TUI turn with successful Write/Edit operations, with failures reported as a notification. It deliberately does not guess whether arbitrary Bash commands changed files. Built-in Agent roles `explorer`, `implementer`, `reviewer`, and `advisor` are shared by `subagent_spawn.agent_type` and Workflow `agent(..., { agent_type })`; all inherit the parent model by default. `/openpi-setup` may assign a currently available Registry model to any subset; clearing one returns it to inheritance and omitted roles stay unchanged. Model precedence is explicit call > selected role-file model > setup assignment > parent inheritance; effort is explicit call > selected role > parent. A trusted project `.pi/agents/<role>.md` overrides global `~/.pi/agent/agents/<role>.md`, which overrides the complete built-in role definition; overrides are diagnosed. Role-model changes apply to the next spawn or Workflow agent call without reload. Configuration is stored privately at `~/.pi/agent/my-pi-setup.json`.
+Capability discovery defaults to `explicit`, preserving the zero-resident OpenPI tool surface until the user asks for a capability. The case-insensitive English words `subagent` and `workflow` are reserved authorization words: entering either word is sufficient to load its capability group, and the interactive editor shows it in Claude Code-style lavender before submission, with a darker purple fallback for light themes. This makes discussion that contains either English word an intentional opt-in tradeoff; conditional and negated clauses remain inert, while Chinese capability names still require a recognized action request. `adaptive` is an explicit opt-in that keeps only `openpi_load_tools` visible and allows the model to load a useful group on its own; because this can start Subagents, Workflows, or background processes, normal permission and configured concurrency/call limits still apply. Changing the setting updates the current Session immediately, while already loaded groups remain stable for that Session. Accepted Suggestion text is classified only after it becomes real editor input. The visual feedback and runtime activation share one fail-closed intent classifier. Next-action suggestions default to off. Run `/openpi-setup` to explicitly choose an available model and reasoning level. After a fully settled main-agent run, one suggestion may appear as dim inline text on the first row of an empty editor; reserved cells at the row end keep CJK IME preedit from overwriting it. `Right` accepts it into the editor without submitting, while any other editor input dismisses it. Suggestions are ephemeral and never enter session history or model context. Workflows default to 8 concurrent agents and 128 total agent calls per run; configurable hard maxima are 64 and 1024. The large decorative header defaults off and the custom dashboard footer defaults on with a one-line plain layout (`model context |flex| git pr cwd`; `thinking`, `cache`, `cost`, and `throughput` remain opt-in metrics). Footer presets are `powerline`, `powerline-mono`, and `compact`; style can also be set independently to `plain`, `powerline`, or `powerline-mono`. Custom layouts use a 2D `footerLines` array with at most one `flex` per row for left/right alignment. Nerd Font affects powerline separator glyphs (``) and adds Codex-style outline icons to compact read, terminal, edit, search, and directory activity rows; all accompanying text remains readable without it. Footer metrics use one Codicon outline family (`` model, `` context, and `` directory) plus `⎇` for the branch. A Nerd Font containing Codicons renders them as designed; without one, the text labels remain readable even if an icon falls back to an empty box. Footer changes apply immediately in the active TUI session. Subagent results default to a compact status summary; full mode remains available as a per-user setting, and `app.tools.expand` (`Ctrl+O` by default) reveals the available child report. Ordinary `read`, `grep`, `find`, and `ls` operations render as one-line semantic activity summaries. Bash and Write/Edit default to the same activity-row projection, showing the target, running/success/failure state, and useful line or diff counts without replaying stdout or previews. Select full independently for Bash or Write/Edit to keep Pi's native rendering expanded. `app.tools.expand` temporarily restores the native arguments, output, errors, diff, timing, images, truncation notices, and full-output metadata; it never changes Session history or model context. An optional post-edit command is off by default: set one (for example `npm run format`, maximum 500 characters) and it runs once in the background after each interactive-TUI turn with successful Write/Edit operations, with failures reported as a notification. It deliberately does not guess whether arbitrary Bash commands changed files. Built-in Agent roles `explorer`, `implementer`, `reviewer`, and `advisor` are shared by `subagent_spawn.agent_type` and Workflow `agent(..., { agent_type })`; all inherit the parent model and currently active child-eligible tools by default. Explicit custom role `tools` lists narrow that surface; omitted lists inherit it. Built-in investigator roles suggest read-only work but do not impose a read-only tool boundary outside Plan Mode. Existing role files are preserved, so an old global `explorer.md` allowlist continues to exclude Bash/network tools until deliberately edited. `/openpi-setup` may assign a currently available Registry model to any subset; clearing one returns it to inheritance and omitted roles stay unchanged. Model precedence is explicit call > selected role-file model > setup assignment > parent inheritance; effort is explicit call > selected role > parent. A trusted project `.pi/agents/<role>.md` overrides global `~/.pi/agent/agents/<role>.md`, which overrides the complete built-in role definition; overrides are diagnosed. Role-model changes apply to the next spawn or Workflow agent call without reload. Configuration is stored privately at `~/.pi/agent/my-pi-setup.json`.
 
 OpenPI Web theme defaults to `system`; `light` and `dark` are explicit canonical setup choices, and the browser consumes them from each authoritative snapshot without writing a competing local preference.
 

package/extensions/ai-providers/README.md

@@ -4,10 +4,12 @@ This extension registers two opt-in model providers backed by account OAuth:
 
 - `google-antigravity` uses Google Cloud Code Assist and supports ordinary Pi
   tool calls.
-- `cursor` uses Cursor AgentService and is experimental, chat-only support.
-  It does not advertise or execute Cursor-native coding tools. If the server
-  requests one, the request fails explicitly instead of bypassing Pi's tool and
-  permission lifecycle.
+- `cursor` uses Cursor AgentService with an experimental Pi tool bridge.
+  The active Pi tools are advertised as MCP tools. A complete invocation returns
+  to Pi for permission checks and execution; the next provider turn replays the
+  paired result. Cursor-native shell, editing, web, task, and interaction tools
+  remain unsupported and fail explicitly. The provider never executes tools
+  inside its transport or widens a child session's effective tool set.
 
 After installing OpenPI, restart Pi or run `/reload`, then authenticate and
 select a model:
@@ -43,8 +45,12 @@ When Cursor is selected, a supported PNG/JPEG/GIF/WebP path at the start of an
 interactive prompt is converted into an actual image attachment (up to 10 MiB)
 before the request is sent. The absolute path is not exposed to the model.
 
-The provider also adds an explicit chat-only rule so the normal Pi coding
-system prompt cannot cause Cursor to attempt unavailable read or shell tools.
+When Pi supplies tools, the provider directs Cursor to the advertised Pi MCP
+catalog. Without tools it uses an explicit chat-only rule. Partial tool previews
+and approval-only probes never execute a tool; unknown or malformed invocations
+fail explicitly. Local HTTP/2 tests exercise a normal Pi tool lifecycle and
+result replay, but account/model-specific compatibility still requires a live
+smoke test. Cursor's native execution protocol is intentionally not enabled.
 
 Cursor's token delta describes generated output only, so the provider does not
 publish it as complete context usage. Pi 0.84.3+ can estimate an all-Cursor

package/extensions/ai-providers/cursor/input-images.ts

@@ -1,11 +1,11 @@
 import { readFile, stat } from "node:fs/promises";
 import { basename, isAbsolute } from "node:path";
+import type { ImageContent } from "@earendil-works/pi-ai/compat";
 import type {
   ExtensionContext,
   InputEvent,
   InputEventResult,
 } from "@earendil-works/pi-coding-agent";
-import type { ImageContent } from "@earendil-works/pi-ai/compat";
 
 const MAX_IMAGE_BYTES = 10 * 1024 * 1024;
 
@@ -58,8 +58,7 @@ function detectImageMimeType(
 
 /**
  * Pi's TUI represents a clipboard image as a leading local path. Cursor's
- * chat-only provider cannot ask a native read-file tool to resolve that path,
- * so convert an explicit leading image path into the same ImageContent shape
+ * provider does not execute Cursor-native read-file tools, so convert an explicit leading image path into the same ImageContent shape
  * used by CLI/RPC attachments before the agent turn starts.
  */
 export async function transformCursorImageInput(

package/extensions/ai-providers/cursor/proto.ts

@@ -3,8 +3,8 @@
  *
  * The field numbers and message names are vendored from
  * oh-my-pi@eab72e88e4, packages/catalog/src/discovery/cursor-proto.ts
- * (MIT). Only the chat, image, model-discovery, and exec-rejection messages
- * used by this chat-only provider are retained. Unknown fields are skipped by
+ * (MIT). Only the chat, image, model-discovery, and Pi MCP bridge messages
+ * used by this provider are retained. Unknown fields are skipped by
  * the local protobuf codec so newer Cursor messages remain forward-compatible.
  */
 
@@ -297,7 +297,8 @@ export interface ConversationStep extends ProtoMessage {
   message:
     | { case: undefined; value?: undefined }
     | { case: "assistantMessage"; value: AssistantMessage }
-    | { case: "thinkingMessage"; value: ThinkingMessage };
+    | { case: "thinkingMessage"; value: ThinkingMessage }
+    | { case: "toolCall"; value: CursorToolCall };
 }
 
 export const ConversationStepSchema: MessageCodec<ConversationStep> =
@@ -306,6 +307,12 @@ export const ConversationStepSchema: MessageCodec<ConversationStep> =
       kind: "oneof",
       name: "message",
       variants: [
+        {
+          no: 2,
+          name: "toolCall",
+          kind: "message",
+          T: () => CursorToolCallSchema,
+        },
         {
           no: 1,
           name: "assistantMessage",
@@ -556,11 +563,77 @@ export const CursorRuleSchema: MessageCodec<CursorRule> = pb<CursorRule>(
   ],
 );
 
-/** Empty definitions deliberately make the request-context tool list empty. */
-export interface McpToolDefinition extends ProtoMessage {}
+export interface McpToolDefinition extends ProtoMessage {
+  name: string;
+  providerIdentifier: string;
+  toolName: string;
+  description: string;
+  inputSchema: Uint8Array;
+  inputSchemaJson?: string;
+}
 
 export const McpToolDefinitionSchema: MessageCodec<McpToolDefinition> =
-  pb<McpToolDefinition>("agent.v1.McpToolDefinition", []);
+  pb<McpToolDefinition>("agent.v1.McpToolDefinition", [
+    { no: 1, name: "name", kind: "string" },
+    { no: 4, name: "providerIdentifier", kind: "string" },
+    { no: 5, name: "toolName", kind: "string" },
+    { no: 2, name: "description", kind: "string" },
+    { no: 3, name: "inputSchema", kind: "bytes" },
+    { no: 6, name: "inputSchemaJson", kind: "string", optional: true },
+  ]);
+
+export interface McpArgs extends ProtoMessage {
+  name: string;
+  args: Record<string, Uint8Array>;
+  toolCallId: string;
+  providerIdentifier: string;
+  toolName: string;
+  smartModeApprovalOnly: boolean;
+  skipApproval: boolean;
+  serverIdentifier: string;
+}
+
+export const McpArgsSchema: MessageCodec<McpArgs> = pb<McpArgs>(
+  "agent.v1.McpArgs",
+  [
+    { no: 1, name: "name", kind: "string" },
+    { no: 2, name: "args", kind: "map", K: "string", V: "bytes" },
+    { no: 3, name: "toolCallId", kind: "string" },
+    { no: 4, name: "providerIdentifier", kind: "string" },
+    { no: 5, name: "toolName", kind: "string" },
+    { no: 7, name: "smartModeApprovalOnly", kind: "bool" },
+    { no: 8, name: "skipApproval", kind: "bool" },
+    { no: 9, name: "serverIdentifier", kind: "string" },
+  ],
+);
+
+export interface McpRejected extends ProtoMessage {
+  reason: string;
+  isReadonly: boolean;
+}
+
+export const McpRejectedSchema: MessageCodec<McpRejected> = pb<McpRejected>(
+  "agent.v1.McpRejected",
+  [
+    { no: 1, name: "reason", kind: "string" },
+    { no: 2, name: "isReadonly", kind: "bool" },
+  ],
+);
+
+export interface McpToolCall extends ProtoMessage {
+  result?: McpToolResult;
+  args?: McpArgs;
+  description?: string;
+}
+
+export const McpToolCallSchema: MessageCodec<McpToolCall> = pb<McpToolCall>(
+  "agent.v1.McpToolCall",
+  [
+    { no: 2, name: "result", kind: "message", T: () => McpToolResultSchema },
+    { no: 1, name: "args", kind: "message", T: () => McpArgsSchema },
+    { no: 3, name: "description", kind: "string", optional: true },
+  ],
+);
 
 export interface RequestContext extends ProtoMessage {
   rules: CursorRule[];
@@ -677,7 +750,8 @@ export interface ExecClientMessage extends ProtoMessage {
   execId: string;
   message:
     | { case: undefined; value?: undefined }
-    | { case: "requestContextResult"; value: RequestContextResult };
+    | { case: "requestContextResult"; value: RequestContextResult }
+    | { case: "mcpResult"; value: McpResult };
 }
 
 export const ExecClientMessageSchema: MessageCodec<ExecClientMessage> =
@@ -688,6 +762,12 @@ export const ExecClientMessageSchema: MessageCodec<ExecClientMessage> =
       kind: "oneof",
       name: "message",
       variants: [
+        {
+          no: 11,
+          name: "mcpResult",
+          kind: "message",
+          T: () => McpResultSchema,
+        },
         {
           no: 10,
           name: "requestContextResult",
@@ -756,7 +836,8 @@ export interface ExecServerMessage extends ProtoMessage {
   execId: string;
   message:
     | { case: undefined; value?: undefined }
-    | { case: "requestContextArgs"; value: RequestContextArgs };
+    | { case: "requestContextArgs"; value: RequestContextArgs }
+    | { case: "mcpArgs"; value: McpArgs };
 }
 
 export const ExecServerMessageSchema: MessageCodec<ExecServerMessage> =
@@ -767,6 +848,7 @@ export const ExecServerMessageSchema: MessageCodec<ExecServerMessage> =
       kind: "oneof",
       name: "message",
       variants: [
+        { no: 11, name: "mcpArgs", kind: "message", T: () => McpArgsSchema },
         {
           no: 10,
           name: "requestContextArgs",
@@ -940,7 +1022,7 @@ export const InteractionUpdateSchema: MessageCodec<InteractionUpdate> =
           no: 15,
           name: "toolCallDelta",
           kind: "message",
-          T: () => ToolInteractionUpdateSchema,
+          T: () => InteractionQueryPayloadSchema,
         },
         {
           no: 2,
@@ -988,10 +1070,57 @@ export const InteractionUpdateSchema: MessageCodec<InteractionUpdate> =
     },
   ]);
 
-export interface ToolInteractionUpdate extends ProtoMessage {}
+export interface ToolInteractionUpdate extends ProtoMessage {
+  callId?: string;
+  toolCall?: CursorToolCall;
+  argsTextDelta?: string;
+}
 
 export const ToolInteractionUpdateSchema: MessageCodec<ToolInteractionUpdate> =
-  pb<ToolInteractionUpdate>("agent.v1.ToolInteractionUpdate", []);
+  pb<ToolInteractionUpdate>("agent.v1.ToolInteractionUpdate", [
+    { no: 1, name: "callId", kind: "string" },
+    { no: 2, name: "toolCall", kind: "message", T: () => CursorToolCallSchema },
+    { no: 3, name: "argsTextDelta", kind: "string" },
+  ]);
+
+// Only the MCP branch is supported. Unknown native tool variants remain unknown
+// and are rejected by the provider rather than executed outside Pi.
+export interface CursorToolCall extends ProtoMessage {
+  toolCallId?: string;
+  tool:
+    | { case: undefined; value?: undefined }
+    | { case: "mcpToolCall"; value: McpToolCall };
+}
+export const CursorToolCallSchema = pb<CursorToolCall>("agent.v1.ToolCall", [
+  { no: 57, name: "toolCallId", kind: "string", optional: true },
+  {
+    kind: "oneof",
+    name: "tool",
+    variants: [
+      {
+        no: 15,
+        name: "mcpToolCall",
+        kind: "message",
+        T: () => McpToolCallSchema,
+      },
+    ],
+  },
+]);
+
+export interface McpResult extends ProtoMessage {
+  result:
+    | { case: undefined; value?: undefined }
+    | { case: "rejected"; value: McpRejected };
+}
+export const McpResultSchema = pb<McpResult>("agent.v1.McpResult", [
+  {
+    kind: "oneof",
+    name: "result",
+    variants: [
+      { no: 3, name: "rejected", kind: "message", T: () => McpRejectedSchema },
+    ],
+  },
+]);
 
 export interface TextDeltaUpdate extends ProtoMessage {
   text: string;
@@ -1062,3 +1191,81 @@ export const GetUsableModelsResponseSchema: MessageCodec<GetUsableModelsResponse
       repeat: true,
     },
   ]);
+
+export interface McpSuccess extends ProtoMessage {
+  content: McpToolResultContentItem[];
+  isError: boolean;
+}
+
+export const McpSuccessSchema: MessageCodec<McpSuccess> = pb<McpSuccess>(
+  "agent.v1.McpSuccess",
+  [
+    {
+      no: 1,
+      name: "content",
+      kind: "message",
+      T: () => McpToolResultContentItemSchema,
+      repeat: true,
+    },
+    { no: 2, name: "isError", kind: "bool" },
+  ],
+);
+
+export interface McpTextContent extends ProtoMessage {
+  text: string;
+}
+
+export const McpTextContentSchema: MessageCodec<McpTextContent> =
+  pb<McpTextContent>("agent.v1.McpTextContent", [
+    { no: 1, name: "text", kind: "string" },
+  ]);
+
+export interface McpImageContent extends ProtoMessage {
+  data: Uint8Array;
+  mimeType: string;
+}
+
+export const McpImageContentSchema: MessageCodec<McpImageContent> =
+  pb<McpImageContent>("agent.v1.McpImageContent", [
+    { no: 1, name: "data", kind: "bytes" },
+    { no: 2, name: "mimeType", kind: "string" },
+  ]);
+
+export interface McpToolResultContentItem extends ProtoMessage {
+  content:
+    | { case: undefined; value?: undefined }
+    | { case: "text"; value: McpTextContent }
+    | { case: "image"; value: McpImageContent };
+}
+
+export const McpToolResultContentItemSchema: MessageCodec<McpToolResultContentItem> =
+  pb<McpToolResultContentItem>("agent.v1.McpToolResultContentItem", [
+    {
+      kind: "oneof",
+      name: "content",
+      variants: [
+        { no: 1, name: "text", kind: "message", T: () => McpTextContentSchema },
+        {
+          no: 2,
+          name: "image",
+          kind: "message",
+          T: () => McpImageContentSchema,
+        },
+      ],
+    },
+  ]);
+
+export interface McpToolResult extends ProtoMessage {
+  result:
+    | { case: undefined; value?: undefined }
+    | { case: "success"; value: McpSuccess };
+}
+export const McpToolResultSchema = pb<McpToolResult>("agent.v1.McpToolResult", [
+  {
+    kind: "oneof",
+    name: "result",
+    variants: [
+      { no: 1, name: "success", kind: "message", T: () => McpSuccessSchema },
+    ],
+  },
+]);

package/extensions/ai-providers/cursor/protobuf.ts

@@ -472,7 +472,12 @@ function compileMapField(desc: MapFieldDesc): CompiledField {
         }
       }
 
-      target[entryKey] = entryValue;
+      Object.defineProperty(target, entryKey, {
+        value: entryValue,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+      });
     },
     toJson(message, output) {
       const input = Reflect.get(message, name);
@@ -1143,7 +1148,12 @@ function readJsonStruct(reader: Reader): { [key: string]: JsonValue } {
           entryReader.skip(entryWire);
         }
       }
-      output[entryKey] = entryVal;
+      Object.defineProperty(output, entryKey, {
+        value: entryVal,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+      });
     } else {
       reader.skip(wireType);
     }