@vidit19sharma/opencode-cursor-auth 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 0.3.4 — 2026-10-16
+
+### Fixed
+
+- A run waiting for a tool result held a concurrency slot until its continuation or the 10-minute timer, so a Cursor parent parked on a Cursor sub-agent could deadlock at the cap and Esc pinned a slot for 10 minutes. Parked runs now release their slot; continuations re-acquire one through a priority queue. Esc (session idle) releases that session's parked runs immediately; a second continuation for the same tool call gets 409 `continuation_in_progress`.
+- A parallel tool call that arrived after the 300 ms batch window was never delivered and the run hung until the idle timer. It is now delivered on the next segment.
+- A tool result for a run that is gone (Esc, idle release, sleep, restart) returned 400 `tool_call_expired`. It now replays the conversation into a fresh agent, with tool results attributed by name and the earlier calls marked as already made.
+- After a tool loop, opencode's context meter and auto-compaction saw Cursor's summed usage for every model call in the run (2–4× the real context). The bridge now reports an upper-bound estimate of the last call's prompt, remembering the previous turn's prompt per agent, and keeps `cached_tokens` ≤ `prompt_tokens` (Cursor's `inputTokens` already includes cache).
+- Errors are classified by Cursor's backend error code before the SDK class or message: `BAD_API_KEY` / `BAD_USER_API_KEY` → 401, `MODEL_BLOCKED` → 403, and a spent plan (`FREE_USER_USAGE_LIMIT` / `PRO_USER_USAGE_LIMIT`) → new 402 `insufficient_quota`, which is never retried. A 429 carries `retry-after` when Cursor's message names a wait; aborts are never retried. Local system errors (e.g. `EACCES` writing `AGENTS.md`) are 502 and never mark a model blocked. (from #1 by @Dakuaisu)
+- An unwritable or full cache dir made `sessions.json` writes throw, failing turns and throwing from the tool-flush timer; session persistence is now best effort and atomic (temp file, fsync, rename), and workspace removal no longer throws. A failed `AGENTS.md` write now fails the request normally instead of leaking the concurrency slot. A stale model catalog is served immediately and refreshed in the background; a first run with no cache waits at most 15 s. (from #1 by @Dakuaisu)
+- opencode aborted requests after 5 minutes without response headers or between chunks, which a queued request, silent reasoning or a large tool argument could exceed. `headerTimeout` and `chunkTimeout` now default to 30 minutes for the cursor provider (user-set `provider.cursor.options` win). (from #1 by @Dakuaisu)
+- Session resume after a tool-using turn never worked for `cursor/claude-*` models: opencode's `cache_control` tags changed how tool calls serialized a turn later, so every such turn replayed the whole history into a new agent. Tool calls now hash by id, name and arguments. Existing session keys change once. (from #1 by @Dakuaisu)
+- Cursor agents were never deleted: every conversation left an agent plus its store and transcript under `~/.cursor/projects/<workspace>`. When a workspace is released, the bridge now deletes the agent (after any cancel settles) and removes Cursor's project dir along with the workspace; deletion is limited to the bridge's own `opencode-cursor-XXXXXX` temp workspaces. (from #1 by @Dakuaisu)
+
 ## 0.3.3 — 2026-10-16
 
 ### Added

package/README.md

@@ -14,7 +14,7 @@ The plugin bridges opencode's OpenAI-style chat requests to the official [`@curs
 - **System prompts** — delivered via `AGENTS.md` in a per-session workspace (the `--system-prompt` flag is server-gated by Cursor)
 - **Dynamic model list with variants** — fetched live from `Cursor.models.list()`, cached 24h; one id per model, with every reasoning-effort / thinking / fast / context variant on opencode's Ctrl+T variant picker
 - **Context limits** — each model publishes the context window of Cursor's default variant, so opencode's auto-compaction and context indicator work
-- **Real error statuses** — 400 / 401 / 403 / 429 / 502 instead of a 200 stream carrying an error
+- **Real error statuses** — 400 / 401 / 402 / 403 / 429 / 502 instead of a 200 stream carrying an error
 - **Cancellation** — Esc or a sub-agent timeout cancels the Cursor run and closes the agent
 - **Concurrency cap and retry** — at most 4 Cursor runs at once (configurable); transient failures retried before the first byte
 - **Usage** — prompt, completion, cached-read, and reasoning tokens reported to opencode
@@ -117,7 +117,7 @@ opencode models | grep cursor/
 - **Blocked models**: Cursor's catalog has no per-account entitlement info. If Cursor rejects a model as "Model Blocked" (e.g. a team admin disabled it), the request fails with 403 `permission_error` carrying Cursor's message, and that model and all its variants are hidden from the list. Using a hidden id explicitly still sends it to Cursor. Blocked flags persist across catalog refreshes; delete `~/.cache/opencode-cursor-auth/models.json` to re-check.
 - **Offline / logged out**: the stale cache is used if present, otherwise only `cursor/auto`.
 
-The catalog is cached for 24h at `~/.cache/opencode-cursor-auth/models.json`; delete it to force a refresh.
+The catalog is cached for 24h at `~/.cache/opencode-cursor-auth/models.json`; delete it to force a refresh. An expired catalog is still used at startup and refreshed in the background, so new models appear on the next start; only a first run with no cache waits for Cursor (at most 15 s).
 
 ### Migrating from 0.2.0
 
@@ -131,12 +131,14 @@ The models cache is refetched once on upgrade.
 | --- | --- | --- |
 | `OPENCODE_CURSOR_MAX_ACTIVE` | `4` | Max Cursor runs active at once; extra requests queue FIFO |
 | `CURSOR_API_KEY` | unset | Use this key instead of the stored SDK key |
+| `provider.cursor.options.headerTimeout` / `chunkTimeout` (opencode config) | 30 min | How long opencode waits for a reply to start / between chunks before aborting (opencode's own default is 5 min) |
 
 | Path | Contents |
 | --- | --- |
 | `~/.cursor/sdk/auth.json` | 90-day SDK key from browser login (written by `@cursor/sdk`) |
 | `~/.cache/opencode-cursor-auth/models.json` | Model catalog, 24h TTL, blocked-model flags |
 | `~/.cache/opencode-cursor-auth/sessions.json` | Conversation → Cursor agent map, 7-day TTL |
+| `~/.cursor/projects/<workspace>` | Cursor's agent store and transcript for each bridge workspace (written by `@cursor/sdk`); removed with the workspace |
 
 ## How it works
 
@@ -148,7 +150,7 @@ opencode ──(OpenAI chat JSON)──> plugin fetch() ──> @cursor/sdk Agen
 - opencode calls the provider's `fetch` — the plugin intercepts it in-process; `http://cursor.local/v1` is a dummy URL that never resolves.
 - Each opencode tool is registered as a Cursor **custom tool** whose `execute()` parks a promise, emits an OpenAI `tool_calls` chunk, and resumes the *same* Cursor run when opencode sends the tool result back.
 - Conversation prefixes, plus the opencode session id (sent via the `chat.headers` hook), are hashed → mapped to Cursor agent IDs, so follow-up turns use `Agent.resume` instead of replaying history. The map persists at `~/.cache/opencode-cursor-auth/sessions.json`.
-- System messages are written to `AGENTS.md` in a per-session temp workspace and loaded via Cursor's project rules (`settingSources: ["project"]`). Workspaces are removed once no session references them.
+- System messages are written to `AGENTS.md` in a per-session temp workspace and loaded via Cursor's project rules (`settingSources: ["project"]`). Once no session references a workspace, the bridge deletes its Cursor agent (`Agent.delete`), Cursor's store and transcript for it under `~/.cursor/projects`, and the workspace itself.
 - The selected variant reaches the plugin as `providerOptions.cursor`; `@ai-sdk/openai-compatible` puts it in the request body as top-level `cursor_params: [{ id, value }, …]`, which the bridge validates and maps to Cursor `ModelSelection.params`.
 - New turns take a slot from a FIFO semaphore (`OPENCODE_CURSOR_MAX_ACTIVE`); tool-result continuations reuse their run's slot. `Agent.create` / `Agent.resume` / `send` are attempted up to 3 times with jittered exponential backoff on 429, 5xx, and network errors, never after the first byte.
 - The HTTP reply opens on the first text or thinking delta, so failures before any content become real HTTP errors.
@@ -160,8 +162,9 @@ opencode ──(OpenAI chat JSON)──> plugin fetch() ──> @cursor/sdk Agen
 | --- | --- |
 | 400 | Unknown model or bad argument (Cursor's message), unknown variant param; also an expired tool-call continuation |
 | 401 | SDK key missing/expired, or Cursor rejects the key |
+| 402 | Plan usage limit reached (`insufficient_quota`); not retried, waiting won't help |
 | 403 | Model blocked for your account (`permission_error`) |
-| 429 | Cursor rate limit |
+| 429 | Cursor rate limit; carries `retry-after` when Cursor's message names a wait |
 | 502 | Anything else |
 
 These are JSON error responses when the failure happens before the first byte; mid-stream failures emit an SSE `error` frame and close the stream without `[DONE]`.
@@ -177,7 +180,7 @@ bun run test:cli     # exercises the npx setup command against temp config dirs
 bun run smoke        # packs the plugin and loads it in a pristine HOME (startup, auth login, first request before login)
 ```
 
-The test suite runs 13 scenarios: plain streaming, a full tool loop on one held run, in-memory and disk-persisted session resume, AGENTS.md system-prompt delivery, mid-stream abort, error statuses, session scoping, context limits and key checks, model variants, the concurrency cap, retry semantics, and blocked models.
+The e2e suite (Tests 0-21) covers plain streaming, a full tool loop on one held run, in-memory and disk-persisted session resume, AGENTS.md system-prompt delivery, mid-stream abort, error statuses, session scoping, context limits and key checks, model variants, the concurrency cap, retry semantics, blocked models, parked-run slot and expiry handling, and token-usage estimation for tool loops.
 
 ## Known limitations
 

package/dist/bridge.d.ts

@@ -30,10 +30,30 @@ type OaBody = {
     stream?: boolean;
     cursor_params?: unknown;
 };
+type Usage = {
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+    prompt_tokens_details?: {
+        cached_tokens: number;
+    };
+    completion_tokens_details?: {
+        reasoning_tokens: number;
+    };
+};
 export declare function isTransient(err: unknown): boolean;
 export declare function withRetry<T>(fn: () => Promise<T>, signal?: AbortSignal, baseDelayMs?: number, retryable?: typeof isTransient): Promise<T>;
+export declare function _setBatchSettleMs(ms: number): void;
 export declare function _setMaxActive(n: number): void;
 export declare function errorResponse(err: unknown, status?: number): Response;
+export declare function mapUsage(u?: {
+    inputTokens?: number;
+    outputTokens?: number;
+    cacheReadTokens?: number;
+    reasoningTokens?: number;
+}, n?: number, L?: number): Usage | undefined;
+/** opencode session went idle (Esc during a tool call): drop its parked runs now, not in 10 min. */
+export declare function releaseParked(scope: string): void;
 export declare function _resetForTest(): void;
 export declare function _failAfterFirstDelta(message: string | null): void;
 export declare function _stats(): {

package/dist/bridge.js

@@ -10,10 +10,10 @@
  */
 import { Agent, AuthenticationError, ConfigurationError, NetworkError, RateLimitError } from "@cursor/sdk";
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeSync } from "node:fs";
 import { mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { markBlocked, resolveVariant } from "./models.js";
 // @cursor/sdk has no log-level switch: it prints "HH:MM:SS.mmm INFO ..." through
 // whatever console.* is installed at call time, ANSI-coloured when stdout is a
@@ -44,15 +44,27 @@ function textOf(content) {
         return "";
     return content.map((p) => p.text ?? "").join("");
 }
+// err.code is Cursor's backend error name (MODEL_BLOCKED, PRO_USER_USAGE_LIMIT, ...) when the SDK has
+// one. The SDK files a bad key under ConfigurationError and a spent plan under RateLimitError, so the
+// code decides those before the class does.
+const KEY_CODES = new Set(["BAD_API_KEY", "BAD_USER_API_KEY", "unauthenticated"]);
+const USAGE_LIMIT_CODES = new Set(["FREE_USER_USAGE_LIMIT", "PRO_USER_USAGE_LIMIT"]);
 function statusFor(err) {
     const e = (typeof err === "object" && err !== null ? err : {});
+    // a local failure (EACCES writing AGENTS.md says "permission denied") is not Cursor's verdict on the
+    // model, and a 403 would mark the model blocked
+    if (typeof e.syscall === "string")
+        return 502;
     const msg = String(e.message ?? err ?? "");
     const code = typeof e.code === "string" ? e.code : "";
-    if (err instanceof AuthenticationError || e.status === 401 || code === "unauthenticated" || /invalid user api key/i.test(msg))
+    if (err instanceof AuthenticationError || e.status === 401 || KEY_CODES.has(code) || /invalid user api key/i.test(msg))
         return 401;
+    // 402, not 429: opencode retries a 429, and waiting does not refill a plan's included usage
+    if (USAGE_LIMIT_CODES.has(code))
+        return 402;
     if (err instanceof RateLimitError || e.status === 429 || code === "resource_exhausted" || /rate limit/i.test(msg))
         return 429;
-    if (code === "permission_denied" || /model blocked|permission denied|forbidden/i.test(msg))
+    if (code === "MODEL_BLOCKED" || code === "permission_denied" || /model blocked|permission denied|forbidden/i.test(msg))
         return 403;
     if (err instanceof ConfigurationError || code === "invalid_argument" || code === "not_found" || /cannot use this model|unknown model/i.test(msg))
         return 400;
@@ -61,9 +73,19 @@ function statusFor(err) {
 const ERROR_TYPE = {
     400: "invalid_request_error",
     401: "authentication_error",
+    402: "insufficient_quota",
     403: "permission_error",
     429: "rate_limit_error",
 };
+// "try again in 30 seconds" / "resets in 2h": tell opencode how long to wait instead of letting it guess
+function retryAfterSeconds(msg) {
+    const m = msg.match(/\b(?:in|after)\s+(\d+(?:\.\d+)?)\s*(ms|s|secs?|seconds?|m|mins?|minutes?|h|hrs?|hours?)\b/i);
+    if (!m)
+        return undefined;
+    const unit = m[2].toLowerCase();
+    const factor = unit === "ms" ? 0.001 : unit.startsWith("s") ? 1 : unit.startsWith("m") ? 60 : 3600;
+    return Math.max(1, Math.ceil(Number(m[1]) * factor));
+}
 function errorBody(err, status = statusFor(err)) {
     const e = (typeof err === "object" && err !== null ? err : {});
     return {
@@ -78,14 +100,16 @@ const abortError = () => new DOMException("aborted", "AbortError");
 const isAbort = (err) => err?.name === "AbortError";
 export function isTransient(err) {
     const e = (typeof err === "object" && err !== null ? err : {});
-    if (e.name === "AbortError")
+    // the SDK marks aborts isRetryable:true; an abort is never worth retrying
+    if (e.name === "AbortError" || e.code === "ABORT_ERR")
         return false;
     const status = statusFor(err);
     if (status === 429)
         return true;
-    if (status === 400 || status === 401 || status === 403 || e.status === 404)
+    if (status === 400 || status === 401 || status === 402 || status === 403 || e.status === 404)
         return false;
-    if (err instanceof NetworkError || (typeof e.status === "number" && e.status >= 500))
+    // isRetryable is the backend's own flag; the SDK defaults it to false when none was sent, so only true counts
+    if (e.isRetryable === true || err instanceof NetworkError || (typeof e.status === "number" && e.status >= 500))
         return true;
     return /unavailable|deadline_exceeded|ECONNRESET|ETIMEDOUT|fetch failed/i.test(`${e.code ?? ""} ${e.message ?? ""}`);
 }
@@ -109,28 +133,31 @@ export async function withRetry(fn, signal, baseDelayMs = 1000, retryable = isTr
         }
     }
 }
-// ponytail: global semaphore, slot held across parked tool loops; per-session fairness if it ever matters
+// ponytail: global semaphore over generating segments only (a parked run gives its slot back, a
+// continuation re-acquires ahead of new turns); per-session fairness if it ever matters
 let maxActive = Number(process.env.OPENCODE_CURSOR_MAX_ACTIVE) || 4;
 let active = 0;
 const waiters = [];
+const priorityWaiters = [];
 function pump() {
-    while (active < maxActive && waiters.length) {
+    while (active < maxActive && (priorityWaiters.length || waiters.length)) {
         active++;
-        waiters.shift()();
+        (priorityWaiters.shift() ?? waiters.shift())();
     }
 }
-function acquireSlot(signal) {
+function acquireSlot(signal, priority = false) {
     if (signal?.aborted)
         return Promise.reject(abortError());
-    if (active < maxActive && !waiters.length) {
+    const queue = priority ? priorityWaiters : waiters;
+    if (active < maxActive && !priorityWaiters.length && (priority || !waiters.length)) {
         active++;
         return Promise.resolve();
     }
     return new Promise((resolve, reject) => {
         const onAbort = () => {
-            const i = waiters.indexOf(go);
+            const i = queue.indexOf(go);
             if (i >= 0)
-                waiters.splice(i, 1);
+                queue.splice(i, 1);
             reject(abortError());
         };
         const go = () => {
@@ -138,19 +165,24 @@ function acquireSlot(signal) {
             resolve();
         };
         signal?.addEventListener("abort", onAbort, { once: true });
-        waiters.push(go);
+        queue.push(go);
     });
 }
 function releaseSlot() {
     active--;
     pump();
 }
+export function _setBatchSettleMs(ms) {
+    batchSettleMs = ms;
+}
 export function _setMaxActive(n) {
     maxActive = n;
     pump();
 }
 export function errorResponse(err, status = statusFor(err)) {
-    return Response.json(errorBody(err, status), { status });
+    const body = errorBody(err, status);
+    const wait = status === 429 ? retryAfterSeconds(body.error.message) : undefined;
+    return Response.json(body, { status, ...(wait ? { headers: { "retry-after": String(wait) } } : {}) });
 }
 function chunk(id, model, delta, finish, usage) {
     return {
@@ -276,7 +308,7 @@ function deferred() {
     });
     return { promise, resolve, reject };
 }
-const BATCH_SETTLE_MS = 300;
+let batchSettleMs = 300;
 const TOOL_RESULT_TIMEOUT_MS = 10 * 60 * 1000;
 const SESSION_TTL_MS = 30 * 60 * 1000;
 const DISK_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -290,9 +322,23 @@ const heldByAgent = new Map();
 const agentByToolCallId = new Map();
 let diskSessions = new Map();
 let sessionsLoaded = false;
+// Where @cursor/sdk keeps a workspace's agent store and transcripts. The slug mirrors the SDK's
+// utils/workspace-paths; transcripts honour CURSOR_DATA_DIR (used untrimmed, as the SDK does) while the
+// agent store always lives under ~/.cursor. Only ever called for our own tmp workspaces (releaseCwd guard).
+function cursorProjectDirs(cwd) {
+    const slug = cwd.replace(/[^a-zA-Z0-9]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+    const dataDir = process.env.CURSOR_DATA_DIR;
+    const home = join(homedir(), ".cursor");
+    return [...new Set([join(dataDir?.trim() ? dataDir : home, "projects", slug), join(home, "projects", slug)])];
+}
+// a workspace this process could have made with mkdtemp(TMP_CWD_PREFIX), nothing else
+const isOwnWorkspace = (cwd) => resolve(cwd) === cwd && dirname(cwd) === tmpdir() && /^opencode-cursor-[A-Za-z0-9]{6}$/.test(basename(cwd));
 // ponytail: no orphan sweep, other opencode instances may own those dirs
-function releaseCwd(cwd) {
-    if (!cwd.startsWith(TMP_CWD_PREFIX))
+// Once nothing references a workspace, nothing can resume its agent either: delete the agent (after
+// its cancel settles, the SDK refuses while a run is live), Cursor's store and transcript for it, and
+// the workspace.
+function releaseCwd(cwd, agentId, settled) {
+    if (!isOwnWorkspace(cwd))
         return;
     for (const v of sessions.values())
         if (v.cwd === cwd)
@@ -303,12 +349,23 @@ function releaseCwd(cwd) {
     for (const h of heldByAgent.values())
         if (h.cwd === cwd)
             return;
-    rmSync(cwd, { recursive: true, force: true });
+    void Promise.resolve(settled)
+        .then(() => (agentId ? Agent.delete(agentId, { cwd }) : undefined))
+        .catch(() => { })
+        .finally(() => {
+        for (const dir of [...cursorProjectDirs(cwd), cwd])
+            try {
+                rmSync(dir, { recursive: true, force: true });
+            }
+            catch { }
+    });
 }
 // scope (opencode session id) is folded in so identical histories from
-// different sessions (e.g. parallel sub-agents) never share a Cursor agent
+// different sessions (e.g. parallel sub-agents) never share a Cursor agent.
+// Tool calls hash by id/name/arguments only: opencode tags the last two messages with
+// cache_control for claude-* ids, so the same call serializes differently a turn later.
 function hashMessages(messages, scope) {
-    const norm = messages.map((m) => [m.role, textOf(m.content), m.tool_call_id ?? "", JSON.stringify(m.tool_calls ?? null)]);
+    const norm = messages.map((m) => [m.role, textOf(m.content), m.tool_call_id ?? "", (m.tool_calls ?? []).map((c) => [c.id, c.function?.name, c.function?.arguments])]);
     if (scope)
         norm.unshift(["scope", scope]);
     return createHash("sha256").update(JSON.stringify(norm)).digest("hex");
@@ -338,13 +395,37 @@ async function loadSessions() {
         }
         for (const v of Object.values(raw.entries))
             if (now - v.lastUsedAt > DISK_SESSION_TTL_MS)
-                releaseCwd(v.cwd);
+                releaseCwd(v.cwd, v.agentId);
     }
     catch { }
 }
+let warnedSave = false;
+// Best effort: a read-only or full cache dir must never fail or hang a request, it only costs resume
+// after a restart. Written via rename so a crash mid-write can't leave torn JSON behind.
 function saveSessions() {
-    mkdirSync(SESSION_STORE_DIR, { recursive: true });
-    writeFileSync(SESSION_STORE_PATH, JSON.stringify({ version: 1, entries: collectDiskEntries() }));
+    const tmp = `${SESSION_STORE_PATH}.${randomUUID()}.tmp`;
+    try {
+        mkdirSync(SESSION_STORE_DIR, { recursive: true });
+        const fd = openSync(tmp, "w");
+        try {
+            writeSync(fd, JSON.stringify({ version: 1, entries: collectDiskEntries() }));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, SESSION_STORE_PATH);
+    }
+    catch (err) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch { }
+        if (!warnedSave) {
+            warnedSave = true;
+            console.error(`[opencode-cursor-auth] could not save ${SESSION_STORE_PATH}, sessions resume only until restart: ${err.message}`);
+        }
+    }
 }
 function sweepSessions(save = true) {
     const now = Date.now();
@@ -352,12 +433,12 @@ function sweepSessions(save = true) {
     for (const [k, v] of diskSessions)
         if (now - v.lastUsedAt > DISK_SESSION_TTL_MS) {
             diskSessions.delete(k);
-            evicted.push(v.cwd);
+            evicted.push(v);
         }
     for (const [k, v] of sessions)
         if (now - v.lastUsedAt > SESSION_TTL_MS) {
             sessions.delete(k);
-            evicted.push(v.cwd);
+            evicted.push(v);
         }
     while (sessions.size > MAX_SESSIONS) {
         let oldestKey = "";
@@ -367,11 +448,11 @@ function sweepSessions(save = true) {
                 oldest = v.lastUsedAt;
                 oldestKey = k;
             }
-        evicted.push(sessions.get(oldestKey).cwd);
+        evicted.push(sessions.get(oldestKey));
         sessions.delete(oldestKey);
     }
-    for (const cwd of evicted)
-        releaseCwd(cwd);
+    for (const v of evicted)
+        releaseCwd(v.cwd, v.agentId);
     if (save)
         saveSessions();
 }
@@ -393,13 +474,14 @@ function rememberSession(held, toolCalls) {
         agentId: held.agent.agentId,
         cwd: held.cwd,
         lastUsedAt: Date.now(),
+        ...(held.lastPrompt ? { lastPrompt: held.lastPrompt } : {}),
     };
     const displaced = sessions.get(key) ?? diskSessions.get(key);
     sessions.set(key, entry);
     diskSessions.set(key, entry);
     sweepSessions();
     if (displaced && displaced.cwd !== entry.cwd)
-        releaseCwd(displaced.cwd);
+        releaseCwd(displaced.cwd, displaced.agentId);
 }
 async function syncAgentsMd(cwd, messages) {
     mkdirSync(cwd, { recursive: true });
@@ -414,14 +496,19 @@ async function syncAgentsMd(cwd, messages) {
     else if (existsSync(path))
         rmSync(path);
 }
-function mapUsage(u) {
+// turn-ended usage sums every model call in the run (n calls, previous turn's prompt L). Prompts only
+// grow within a run, so the last call's prompt is at most S - (n-1)*L: an upper-bound estimate, clamped to [S/n, S].
+export function mapUsage(u, n = 1, L = 0) {
     if (!u)
         return undefined;
-    const prompt = u.inputTokens ?? 0;
+    const S = u.inputTokens ?? 0;
+    const prompt = n <= 1 ? S : Math.min(S, Math.max(Math.ceil(S / n), S - (n - 1) * L));
     const completion = u.outputTokens ?? 0;
     const usage = { prompt_tokens: prompt, completion_tokens: completion, total_tokens: prompt + completion };
-    if (u.cacheReadTokens)
-        usage.prompt_tokens_details = { cached_tokens: u.cacheReadTokens };
+    // inputTokens already includes cache; opencode subtracts cached from prompt, so keep it <= prompt
+    const cached = Math.min(u.cacheReadTokens ?? 0, prompt);
+    if (cached > 0)
+        usage.prompt_tokens_details = { cached_tokens: cached };
     if (u.reasoningTokens)
         usage.completion_tokens_details = { reasoning_tokens: u.reasoningTokens };
     return usage;
@@ -447,6 +534,26 @@ function attachSink(held, sink) {
     for (const b of held.buffer)
         (b.kind === "text" ? sink.text : sink.reasoning)(b.t);
     held.buffer = [];
+    // a parallel call that missed the previous flush goes out on this segment
+    if (held.pendingCalls.length)
+        scheduleFlush(held);
+}
+function scheduleFlush(held) {
+    if (held.flushTimer)
+        clearTimeout(held.flushTimer);
+    held.flushTimer = setTimeout(() => flushToolCalls(held), batchSettleMs);
+}
+function armIdle(held) {
+    if (held.idleTimer)
+        clearTimeout(held.idleTimer);
+    held.idleTimer = setTimeout(() => abortHeld(held), TOOL_RESULT_TIMEOUT_MS);
+    held.idleTimer.unref?.();
+}
+function releaseHeldSlot(held) {
+    if (!held.slot)
+        return;
+    held.slot = false;
+    releaseSlot();
 }
 function attachSignal(held, signal) {
     held.detachSignal?.();
@@ -468,10 +575,7 @@ function closeAgent(held) {
 }
 function teardownHeld(held) {
     held.done = true;
-    if (held.slot) {
-        held.slot = false;
-        releaseSlot();
-    }
+    releaseHeldSlot(held);
     held.detachSignal?.();
     held.detachSignal = null;
     if (held.flushTimer)
@@ -486,7 +590,7 @@ function failHeld(held, err) {
     if (isAbort(err))
         return abortHeld(held);
     teardownHeld(held);
-    held.run?.cancel().catch(() => { });
+    const cancelled = held.run?.cancel().catch(() => { });
     if (statusFor(err) === 403)
         markBlocked(held.model);
     if (held.response && !held.opened) {
@@ -498,22 +602,23 @@ function failHeld(held, err) {
         held.sink?.fail(err);
     }
     closeAgent(held);
-    releaseCwd(held.cwd);
+    releaseCwd(held.cwd, held.agent.agentId, cancelled);
 }
 function abortHeld(held) {
     if (held.done)
         return;
     teardownHeld(held);
-    held.run?.cancel().catch(() => { });
+    const cancelled = held.run?.cancel().catch(() => { });
     closeAgent(held);
     held.sink?.close();
     held.reply.reject(new DOMException("aborted", "AbortError"));
-    releaseCwd(held.cwd);
+    releaseCwd(held.cwd, held.agent.agentId, cancelled);
 }
 /** Model requested tools: emit tool_calls, end this HTTP segment, park the run. */
 function flushToolCalls(held) {
     held.flushTimer = null;
-    if (held.done || !held.pendingCalls.length)
+    // no sink: the calls stay pending until the next continuation attaches one
+    if (held.done || !held.sink || !held.pendingCalls.length)
         return;
     const calls = held.pendingCalls;
     held.pendingCalls = [];
@@ -529,8 +634,15 @@ function flushToolCalls(held) {
     sink?.toolCalls(calls);
     sink?.finish("tool_calls");
     rememberSession(held, calls);
-    held.idleTimer = setTimeout(() => abortHeld(held), TOOL_RESULT_TIMEOUT_MS);
-    held.idleTimer.unref?.();
+    releaseHeldSlot(held);
+    armIdle(held);
+}
+/** opencode session went idle (Esc during a tool call): drop its parked runs now, not in 10 min. */
+export function releaseParked(scope) {
+    for (const held of [...heldByAgent.values()]) {
+        if (held.scope === scope && !held.done && !held.sink && !held.claimed)
+            abortHeld(held);
+    }
 }
 async function wireRunCompletion(held) {
     if (held.wired || !held.run)
@@ -551,7 +663,9 @@ async function wireRunCompletion(held) {
         return abortHeld(held);
     if (result.status === "error")
         return failHeld(held, result.error ?? new Error("cursor run failed"));
-    const usage = mapUsage(result.usage) ?? held.usage;
+    const usage = mapUsage(result.usage, held.calls + 1, held.lastPrompt) ?? held.usage;
+    if (usage)
+        held.lastPrompt = usage.prompt_tokens;
     teardownHeld(held);
     rememberSession(held, []);
     openReply(held);
@@ -576,7 +690,7 @@ export function _stats() {
         disk: diskSessions.size,
         agentIds: [...sessions.values()].map((v) => v.agentId).sort(),
         active,
-        waiting: waiters.length,
+        waiting: waiters.length + priorityWaiters.length,
     };
 }
 export async function handleChatCompletion(body, apiKey, signal, scope) {
@@ -591,14 +705,38 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
     const sink = sse?.sink ?? jsonCollector(body.model, reply.resolve);
     // continuation: trailing tool results for a parked run
     const lastMsg = body.messages[body.messages.length - 1];
-    if (lastMsg?.role === "tool" && lastMsg.tool_call_id) {
-        const agentId = agentByToolCallId.get(lastMsg.tool_call_id);
-        held = agentId ? heldByAgent.get(agentId) : undefined;
-        if (!held || held.done) {
-            return Response.json({ error: { message: "cursor run for this tool call expired — please retry", type: "invalid_request_error", code: "tool_call_expired" } }, { status: 400 });
-        }
+    let replay = false;
+    const parked = lastMsg?.role === "tool" && lastMsg.tool_call_id ? heldByAgent.get(agentByToolCallId.get(lastMsg.tool_call_id) ?? "") : undefined;
+    if (parked && !parked.done && (parked.sink || parked.claimed)) {
+        return Response.json({ error: { message: "continuation already in progress for this tool call", type: "invalid_request_error", code: "continuation_in_progress" } }, { status: 409 });
+    }
+    if (parked && !parked.done) {
+        held = parked;
+        held.claimed = true;
         if (held.idleTimer)
             clearTimeout(held.idleTimer);
+        try {
+            await acquireSlot(signal, true);
+        }
+        catch (err) {
+            held.claimed = false;
+            if (!held.done)
+                armIdle(held);
+            throw err;
+        }
+        held.claimed = false;
+        if (held.done) {
+            // torn down while queued (run failed): replay as a fresh turn below
+            releaseSlot();
+            held = undefined;
+            replay = true;
+        }
+        else
+            held.slot = true;
+    }
+    else if (lastMsg?.role === "tool")
+        replay = true;
+    if (held) {
         held.messages = body.messages;
         held.textAcc = "";
         held.reply = reply;
@@ -628,10 +766,19 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
     const prefix = body.messages.slice(0, -1);
     const key = hashMessages(prefix, scope);
     await acquireSlot(signal);
-    const entry = sessions.get(key) ?? diskSessions.get(key);
+    // expired tool call: its run is gone, so a fresh agent gets the whole history (tool results included)
+    let entry = sessions.get(key) ?? diskSessions.get(key);
+    if (entry && replay) {
+        sessions.delete(key);
+        diskSessions.delete(key);
+        saveSessions();
+        releaseCwd(entry.cwd, entry.agentId);
+        entry = undefined;
+    }
     let agent;
     let cwd;
     let newSuffix = body.messages;
+    const lastPrompt = entry?.lastPrompt;
     const agentOptions = (cwd) => ({
         model,
         tools: ["mcp"],
@@ -644,7 +791,7 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
         cwd = entry.cwd;
         agent = await withRetry(() => Agent.resume(entry.agentId, agentOptions(cwd)), signal).catch(() => {
             saveSessions();
-            releaseCwd(entry.cwd);
+            releaseCwd(entry.cwd, entry.agentId);
             return undefined;
         });
         if (agent)
@@ -681,9 +828,12 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
         parked: new Map(),
         flushTimer: null,
         idleTimer: null,
+        calls: 0,
+        lastPrompt,
         wired: false,
         done: false,
         slot: true,
+        claimed: false,
     };
     const self = held;
     heldByAgent.set(agent.agentId, held);
@@ -699,23 +849,36 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
             execute: (args, ctx) => {
                 const id = (ctx.toolCallId ?? `call_${randomUUID()}`).replace(/\s+/g, "_");
                 self.pendingCalls.push({ id, name: t.function.name, argumentsJson: JSON.stringify(args ?? {}) });
-                if (self.flushTimer)
-                    clearTimeout(self.flushTimer);
-                self.flushTimer = setTimeout(() => flushToolCalls(self), BATCH_SETTLE_MS);
+                if (self.sink)
+                    scheduleFlush(self);
                 return new Promise((resolve) => self.parked.set(id, resolve));
             },
         };
     }
-    await syncAgentsMd(cwd, body.messages).catch((err) => {
+    try {
+        await syncAgentsMd(cwd, body.messages);
+    }
+    catch (err) {
+        // through failHeld so the slot, the held run and the workspace are released
         if (!self.done)
-            throw err;
-    });
+            failHeld(self, err);
+        return reply.promise;
+    }
     if (self.done)
         return reply.promise;
+    const toolNames = new Map(newSuffix.flatMap((m) => (m.tool_calls ?? []).map((c) => [c.id, c.function?.name])));
     const prompt = newSuffix
         .filter((m) => m.role !== "system")
-        .map((m) => (m.role === "user" ? textOf(m.content) : `${m.role.toUpperCase()}: ${textOf(m.content)}`))
+        .map((m) => {
+        if (m.role === "user")
+            return textOf(m.content);
+        if (m.role === "tool")
+            return `TOOL(${toolNames.get(m.tool_call_id ?? "") ?? m.tool_call_id}): ${textOf(m.content)}`;
+        const calls = (m.tool_calls ?? []).map((c) => `\n[already called ${c.function?.name}(${c.function?.arguments ?? ""})]`).join("");
+        return `${m.role.toUpperCase()}: ${textOf(m.content)}${calls}`;
+    })
         .filter(Boolean)
+        .concat(newSuffix.at(-1)?.role === "tool" ? ["(The tool calls above already ran and their results are shown. Do not call them again; continue from these results.)"] : [])
         .join("\n\n") || "(empty message)";
     let run;
     try {
@@ -737,8 +900,12 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
                     openReply(self);
                     emit(self, "reasoning", update.text);
                 }
+                else if (update.type === "tool-requests-listed") {
+                    // ponytail: empirical (6/6 live probes), model calls = listed + 1; no per-step usage event exists
+                    self.calls++;
+                }
                 else if (update.type === "turn-ended") {
-                    self.usage = mapUsage(update.usage);
+                    self.usage = mapUsage(update.usage, self.calls + 1, self.lastPrompt);
                 }
             },
             local: { customTools: customTools },

package/dist/models.js

@@ -5,6 +5,8 @@ import { join } from "node:path";
 const CACHE_DIR = join(homedir(), ".cache", "opencode-cursor-auth");
 const MODELS_CACHE_PATH = join(CACHE_DIR, "models.json");
 const MODELS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const MODELS_FETCH_TIMEOUT_MS = 15_000;
+const MODELS_RETRY_MS = 5 * 60 * 1000;
 let catalog = {};
 let fetchedAt = 0;
 function saveCatalog() {
@@ -68,31 +70,56 @@ function loadCachedModels() {
     }
     return undefined;
 }
-// Live model list from Cursor, cached 24h to keep opencode startup fast.
-// Offline/logged-out: stale cache if present, else just "auto" (Cursor's universal alias).
+let refreshing;
+let lastAttempt = 0;
+function refreshCatalog() {
+    lastAttempt = Date.now();
+    refreshing ??= (async () => {
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("timed out")), MODELS_FETCH_TIMEOUT_MS);
+            // never keep `opencode run` alive just for a catalog refresh
+            timer.unref?.();
+        });
+        try {
+            const fresh = buildCatalog(await Promise.race([Cursor.models.list(), timeout]));
+            for (const [id, m] of Object.entries(catalog))
+                if (m.blocked && fresh[id])
+                    fresh[id].blocked = true;
+            catalog = fresh;
+            fetchedAt = Date.now();
+            try {
+                saveCatalog();
+            }
+            catch {
+                // cache dir unwritable — the fresh list still serves this process
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    })()
+        .catch(() => { })
+        .finally(() => (refreshing = undefined));
+}
+// Live model list from Cursor, cached 24h. A stale cache is served as is and refreshed in the
+// background (new models show up on the next start), so opencode's startup never waits on Cursor;
+// only a first run with no cache does, for at most MODELS_FETCH_TIMEOUT_MS.
+// Offline/logged-out with no cache: just "auto" (Cursor's universal alias).
 // Models Cursor has rejected with "Model Blocked" for this account are hidden
 // until the cache file is deleted (the catalog itself carries no entitlement info).
 export async function currentModels() {
     const cached = loadCachedModels();
-    if (cached && Date.now() - cached.fetchedAt <= MODELS_CACHE_TTL_MS) {
+    if (cached && cached.fetchedAt >= fetchedAt) {
         catalog = cached.models;
         fetchedAt = cached.fetchedAt;
     }
-    else {
-        try {
-            catalog = buildCatalog(await Cursor.models.list());
-            for (const [id, m] of Object.entries(cached?.models ?? {}))
-                if (m.blocked && catalog[id])
-                    catalog[id].blocked = true;
-            fetchedAt = Date.now();
-            saveCatalog();
-        }
-        catch {
-            catalog = cached?.models ?? { auto: { name: "Auto" } };
-            fetchedAt = cached?.fetchedAt ?? 0;
-        }
-    }
-    return Object.fromEntries(Object.entries(catalog).filter(([, m]) => !m.blocked));
+    if (Date.now() - fetchedAt > MODELS_CACHE_TTL_MS && Date.now() - lastAttempt > MODELS_RETRY_MS)
+        refreshCatalog();
+    if (!Object.keys(catalog).length)
+        await refreshing;
+    const models = Object.keys(catalog).length ? catalog : { auto: { name: "Auto" } };
+    return Object.fromEntries(Object.entries(models).filter(([, m]) => !m.blocked));
 }
 function loadCatalog() {
     if (Object.keys(catalog).length)

package/dist/plugin.js

@@ -1,11 +1,15 @@
 import { Cursor } from "@cursor/sdk";
-import { errorResponse, handleChatCompletion } from "./bridge.js";
+import { errorResponse, handleChatCompletion, releaseParked } from "./bridge.js";
 import { currentModels } from "./models.js";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 export { parseContext } from "./models.js";
 const BASE_URL = "http://cursor.local/v1";
+// opencode aborts a request after 5 min without response headers, or between chunks. A Cursor turn can
+// sit longer: queued for a slot, reasoning silently, or writing a large tool argument (sent only once
+// complete). Set provider.cursor.options to override.
+const STREAM_TIMEOUT_MS = 30 * 60 * 1000;
 // Cursor publishes no output limit and the bridge never passes max_tokens to Cursor, so output is only an accounting reserve for opencode.
 const DEFAULT_CONTEXT = 200_000;
 const DEFAULT_OUTPUT = 32_000;
@@ -94,7 +98,7 @@ export const CursorAuthPlugin = async (input) => {
             const cursor = (providers["cursor"] ??= { models: {} });
             cursor.npm ??= "@ai-sdk/openai-compatible";
             cursor.name ??= "Cursor";
-            cursor.options = { ...cursor.options, baseURL: BASE_URL };
+            cursor.options = { headerTimeout: STREAM_TIMEOUT_MS, chunkTimeout: STREAM_TIMEOUT_MS, ...cursor.options, baseURL: BASE_URL };
             cursor.models ??= {};
             for (const [id, { name, context, variants }] of Object.entries(await currentModels())) {
                 cursor.models[id] ??= { name };
@@ -105,6 +109,11 @@ export const CursorAuthPlugin = async (input) => {
                     model.variants ??= Object.fromEntries(Object.entries(variants).map(([n, v]) => [n, { cursor_params: v.params }]));
             }
         },
+        // Esc during a tool call: the session goes idle and nothing will continue its parked Cursor run
+        event: async ({ event }) => {
+            if (event.type === "session.idle" || (event.type === "session.status" && event.properties.status.type === "idle"))
+                releaseParked(event.properties.sessionID);
+        },
         "chat.headers": async (input, output) => {
             if (input.model.providerID === "cursor")
                 output.headers["x-opencode-session"] = input.sessionID;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vidit19sharma/opencode-cursor-auth",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "OpenCode plugin that uses your Cursor subscription via the official @cursor/sdk — no proxy server, no separate login.",
   "type": "module",
   "main": "dist/index.js",