@yansigit/opencodex 2.32.0 → 2.33.1

package/src/adapters/cursor/native-exec-shell.ts

@@ -19,6 +19,8 @@ import {
   type ExecServerMessage,
 } from "./gen/agent_pb";
 import { errorText, execBytes, execStreamCloseBytes } from "./native-exec-common";
+export { nativeShellDisabledMessage, type CursorNativeExecPolicyContext } from "./native-exec-policy";
+import { nativeShellDisabledMessage, type CursorNativeExecPolicyContext } from "./native-exec-policy";
 import {
   createAdmissionGate,
   type AdmissionLease,
@@ -81,21 +83,7 @@ let absoluteTerminations = 0;
 let unresolvedKills = 0;
 let killFailures = 0;
 
-/** Rejection text when Cursor-native shell is denied by policy (issue #604). */
-export function nativeShellDisabledMessage(): string {
-  // Do not insist on "the same command" — that steers models into replaying bash/CMD
-  // idioms through the Codex bridge on Windows PowerShell 5.1 and looping (#604).
-  // Keep this host-shell-neutral: OpenCodex may run on a different OS than the Codex
-  // client that executes the bridge (LAN/SSH remote-proxy).
-  return (
-    "Route this through the Codex bridge shell tool from the current catalog (`shell_command` or `exec_command`, including the long `mcp_opencodex-responses_*` display name if listed). "
-    + "Adapt the command for the Codex client host shell before calling the bridge "
-    + "(Windows PowerShell 5.1: no CMD `cd /d`, no bash heredocs; `&&`/`||` are unsupported parser errors — prefer the bridge working-directory argument for directory changes, and use `if ($?) { ... }` for success-gated follow-up steps; do not treat `;` as a substitute for `&&`). "
-    + "Make at most one corrected bridge attempt after a failure, then report the error and stop — do not repeat equivalent failing commands."
-  );
-}
-
-function rejectedShellResult(command: string, cwd: string, started: number) {
+function rejectedShellResult(command: string, cwd: string, started: number, opts: CursorNativeExecPolicyContext = {}) {
   return create(ShellResultSchema, {
     result: {
       case: "failure",
@@ -105,7 +93,7 @@ function rejectedShellResult(command: string, cwd: string, started: number) {
         exitCode: 1,
         signal: "",
         stdout: "",
-        stderr: nativeShellDisabledMessage(),
+        stderr: nativeShellDisabledMessage(opts),
         executionTime: Date.now() - started,
         aborted: true,
       }),
@@ -113,10 +101,10 @@ function rejectedShellResult(command: string, cwd: string, started: number) {
   });
 }
 
-export function rejectShellExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
+export function rejectShellExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array {
   if (execMsg.message.case !== "shellArgs") throw new Error("invalid shell exec");
   const args = execMsg.message.value;
-  return execBytes(execMsg, "shellResult", rejectedShellResult(args.command, resolve(args.workingDirectory || process.cwd()), Date.now()));
+  return execBytes(execMsg, "shellResult", rejectedShellResult(args.command, resolve(args.workingDirectory || process.cwd()), Date.now(), opts));
 }
 
 export function shellExec(execMsg: ExecServerMessage): Uint8Array {
@@ -154,7 +142,7 @@ export function shellExec(execMsg: ExecServerMessage): Uint8Array {
   }));
 }
 
-export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage): Uint8Array[] {
+export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array[] {
   if (execMsg.message.case !== "shellStreamArgs") throw new Error("invalid shell stream exec");
   const args = execMsg.message.value;
   const cwd = resolve(args.workingDirectory || process.cwd());
@@ -164,12 +152,12 @@ export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage): Uint
       event: { case: "start", value: create(ShellStreamStartSchema, { sandboxPolicy: args.requestedSandboxPolicy }) },
     })),
     execBytes(execMsg, "shellStream", create(ShellStreamSchema, {
-      event: { case: "stderr", value: create(ShellStreamStderrSchema, { data: nativeShellDisabledMessage() }) },
+      event: { case: "stderr", value: create(ShellStreamStderrSchema, { data: nativeShellDisabledMessage(opts) }) },
     })),
     execBytes(execMsg, "shellStream", create(ShellStreamSchema, {
       event: { case: "exit", value: create(ShellStreamExitSchema, { code: 1, cwd, aborted: true }) },
     })),
-    execBytes(execMsg, "shellResult", rejectedShellResult(args.command, cwd, started)),
+    execBytes(execMsg, "shellResult", rejectedShellResult(args.command, cwd, started, opts)),
     execStreamCloseBytes(execMsg),
   ];
 }
@@ -260,12 +248,12 @@ export async function shellStreamExec(execMsg: ExecServerMessage): Promise<Uint8
   return replies;
 }
 
-export function rejectBackgroundShellSpawnExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
+export function rejectBackgroundShellSpawnExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array {
   if (execMsg.message.case !== "backgroundShellSpawnArgs") throw new Error("invalid background shell exec");
   const args = execMsg.message.value;
   const cwd = resolve(args.workingDirectory || process.cwd());
   return execBytes(execMsg, "backgroundShellSpawnResult", create(BackgroundShellSpawnResultSchema, {
-    result: { case: "error", value: create(BackgroundShellSpawnErrorSchema, { command: args.command, workingDirectory: cwd, error: nativeShellDisabledMessage() }) },
+    result: { case: "error", value: create(BackgroundShellSpawnErrorSchema, { command: args.command, workingDirectory: cwd, error: nativeShellDisabledMessage(opts) }) },
   }));
 }
 
@@ -517,10 +505,10 @@ export function backgroundShellSpawnExec(execMsg: ExecServerMessage, sessionId:
   }
 }
 
-export function rejectWriteShellStdinExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
+export function rejectWriteShellStdinExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array {
   if (execMsg.message.case !== "writeShellStdinArgs") throw new Error("invalid shell stdin exec");
   return execBytes(execMsg, "writeShellStdinResult", create(WriteShellStdinResultSchema, {
-    result: { case: "error", value: create(WriteShellStdinErrorSchema, { error: nativeShellDisabledMessage() }) },
+    result: { case: "error", value: create(WriteShellStdinErrorSchema, { error: nativeShellDisabledMessage(opts) }) },
   }));
 }
 

package/src/adapters/cursor/native-exec.ts

@@ -51,6 +51,7 @@ import {
   type CursorNativeToolDeps,
 } from "./native-exec-tools";
 import { clientBytes, execBytes, execStreamCloseBytes, execThrowBytes } from "./native-exec-common";
+import { type CursorNativeExecPolicyContext } from "./native-exec-policy";
 import type { McpToolDefinition } from "./gen/agent_pb";
 import { OCX_RESPONSES_TOOL_PROVIDER } from "./tool-definitions";
 
@@ -72,12 +73,18 @@ export interface CursorNativeExecContext extends CursorNativeExecDeps {
   rejectNativeFileMutations?: boolean;
   /** The synthetic exact-match edit tools (edit_file / multi_edit) are advertised this request. */
   structuredEditAvailable?: boolean;
+  /** Codex code mode advertises one freeform exec tool; native rejections must steer to nested helpers. */
+  codeMode?: boolean;
 }
 
 export function cursorUnsafeNativeLocalExecEnabled(input: Pick<CursorNativeExecContext, "unsafeAllowNativeLocalExec"> = {}): boolean {
   return input.unsafeAllowNativeLocalExec === true;
 }
 
+function nativeExecPolicyContext(deps: CursorNativeExecContext): CursorNativeExecPolicyContext {
+  return deps.codeMode === true ? { codeMode: true } : {};
+}
+
 /**
  * Content-addressed blob store shared across streams. Bounded: without eviction a long-running
  * proxy accumulates every conversation's prompt blobs forever (unbounded memory) and any stale
@@ -556,16 +563,17 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
     }))];
   }
   if (!cursorUnsafeNativeLocalExecEnabled(deps)) {
-    if (execCase === "readArgs") return [rejectReadExecForPolicy(execMsg)];
-    if (execCase === "writeArgs") return [rejectWriteExecForPolicy(execMsg)];
-    if (execCase === "deleteArgs") return [rejectDeleteExecForPolicy(execMsg)];
-    if (execCase === "lsArgs") return [rejectLsExecForPolicy(execMsg)];
-    if (execCase === "grepArgs") return [rejectGrepExecForPolicy(execMsg)];
-    if (execCase === "shellArgs") return [rejectShellExecForPolicy(execMsg)];
-    if (execCase === "shellStreamArgs") return rejectShellStreamExecForPolicy(execMsg);
-    if (execCase === "backgroundShellSpawnArgs") return [rejectBackgroundShellSpawnExecForPolicy(execMsg)];
-    if (execCase === "writeShellStdinArgs") return [rejectWriteShellStdinExecForPolicy(execMsg)];
-    if (execCase === "fetchArgs") return [rejectFetchExecForPolicy(execMsg)];
+    const policy = nativeExecPolicyContext(deps);
+    if (execCase === "readArgs") return [rejectReadExecForPolicy(execMsg, policy)];
+    if (execCase === "writeArgs") return [rejectWriteExecForPolicy(execMsg, policy)];
+    if (execCase === "deleteArgs") return [rejectDeleteExecForPolicy(execMsg, policy)];
+    if (execCase === "lsArgs") return [rejectLsExecForPolicy(execMsg, policy)];
+    if (execCase === "grepArgs") return [rejectGrepExecForPolicy(execMsg, policy)];
+    if (execCase === "shellArgs") return [rejectShellExecForPolicy(execMsg, policy)];
+    if (execCase === "shellStreamArgs") return rejectShellStreamExecForPolicy(execMsg, policy);
+    if (execCase === "backgroundShellSpawnArgs") return [rejectBackgroundShellSpawnExecForPolicy(execMsg, policy)];
+    if (execCase === "writeShellStdinArgs") return [rejectWriteShellStdinExecForPolicy(execMsg, policy)];
+    if (execCase === "fetchArgs") return [rejectFetchExecForPolicy(execMsg, policy)];
   }
   if (execCase === "readArgs") return [readExec(execMsg)];
   if (execCase === "writeArgs") return [deps.rejectNativeFileMutations ? rejectWriteExecForApplyPatch(execMsg, deps.structuredEditAvailable === true) : writeExec(execMsg)];

package/src/adapters/cursor/protobuf-events.ts

@@ -176,6 +176,7 @@ export interface CursorProtobufEventState {
    */
   syntheticStructuredEditToolNames?: ReadonlySet<string>;
   translatorBudget?: TranslatorBudget;
+  textToolCallBuffer?: string;
 }
 
 
@@ -329,7 +330,7 @@ function isCompleteJson(text: string): boolean {
 
 /** Schema-normalize a JSON-text argument blob for a named tool, if a schema is known. */
 function normalizeJsonText(text: string, toolName: string | undefined, state: CursorProtobufEventState): string {
-  const schema = toolSchemaForWireName(state, toolName);
+  const schema = toolSchemaForWireName(state, toolName) ?? (toolName ? defaultShellBridgeArgNormalizeSchema(toolName) : undefined);
   if (!schema) return text;
   try {
     const parsed = JSON.parse(text);
@@ -1135,6 +1136,31 @@ function cursorFreeformWrapperValid(args: string): boolean {
   }
 }
 
+/**
+ * Cursor sometimes sends a freeform body as a JSON string or as a one-key object instead of the
+ * advertised `{input: string}` wrapper. Preserve incomplete JSON for the late native-args path,
+ * but wrap complete/raw bodies before the Responses bridge validates them.
+ */
+function normalizeFreeformArgs(args: string): string {
+  if (args.length === 0) return args;
+  try {
+    const parsed = JSON.parse(args) as unknown;
+    if (typeof parsed === "string") return JSON.stringify({ input: parsed });
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const object = parsed as Record<string, unknown>;
+      if ("input" in object || Object.keys(object).length === 0) return args;
+      const values = Object.values(object);
+      const input = values.length === 1 && typeof values[0] === "string" ? values[0] : JSON.stringify(object);
+      return JSON.stringify({ input });
+    }
+    return args;
+  } catch {
+    return args.trimStart().startsWith("{") || args.trimStart().startsWith("[")
+      ? args
+      : JSON.stringify({ input: args });
+  }
+}
+
 function dropInvalidFreeformCall(state: CursorProtobufEventState, callId: string, toolName: string): CursorServerMessage[] {
   state.openToolCalls.delete(callId);
   state.translatorBudget?.closeCall(callId);
@@ -1161,6 +1187,7 @@ function dropStructuredEditCall(state: CursorProtobufEventState, callId: string,
 function commitToolCall(state: CursorProtobufEventState, callId: string, finalArgs: string): CursorServerMessage[] {
   const open = state.openToolCalls.get(callId);
   if (!open) return [];
+  if (state.freeformToolNames?.has(open.name)) finalArgs = normalizeFreeformArgs(finalArgs);
   if (state.freeformToolNames?.has(open.name) && !cursorFreeformWrapperValid(finalArgs)) {
     return dropInvalidFreeformCall(state, callId, open.name);
   }
@@ -1240,14 +1267,159 @@ export function mapCursorProtobufServerMessage(
     return [];
   }
 
+const TOOL_CALL_START_PREFIX = "[TOOL_CALL]";
+const TOOL_CALL_ARGS_MARKER = "[ARGS]";
+
+function findPotentialMarkerPrefix(text: string): number {
+  for (let len = Math.min(TOOL_CALL_START_PREFIX.length - 1, text.length); len >= 1; len--) {
+    const candidate = text.slice(text.length - len);
+    if (TOOL_CALL_START_PREFIX.startsWith(candidate)) {
+      return text.length - len;
+    }
+  }
+  return -1;
+}
+
+function parseCursorTextToolCalls(text: string, state: CursorProtobufEventState): CursorServerMessage[] {
+  if (!state.clientToolNames) {
+    return text ? [{ type: "text", text: normalizeCursorTextToolMarkers(text) }] : [];
+  }
+
+  let remaining = (state.textToolCallBuffer ?? "") + text;
+  state.textToolCallBuffer = undefined;
+
+  if (!remaining) return [];
+
+  const out: CursorServerMessage[] = [];
+
+  while (remaining.length > 0) {
+    const startIndex = remaining.indexOf(TOOL_CALL_START_PREFIX);
+    if (startIndex === -1) {
+      const partialIndex = findPotentialMarkerPrefix(remaining);
+      if (partialIndex !== -1) {
+        if (partialIndex > 0) {
+          out.push({ type: "text", text: normalizeCursorTextToolMarkers(remaining.slice(0, partialIndex)) });
+        }
+        state.textToolCallBuffer = remaining.slice(partialIndex);
+        break;
+      }
+      out.push({ type: "text", text: normalizeCursorTextToolMarkers(remaining) });
+      break;
+    }
+
+    // Check if the candidate at startIndex is actually a tool call
+    const candidateAfter = remaining.slice(startIndex + TOOL_CALL_START_PREFIX.length);
+    const argsPos = candidateAfter.indexOf(TOOL_CALL_ARGS_MARKER);
+    const namePart = argsPos !== -1 ? candidateAfter.slice(0, argsPos).trim() : candidateAfter;
+    const isCandidateValid = namePart.length > 0 && namePart.length <= 64 && /^[a-zA-Z0-9_-]+$/.test(namePart);
+
+    if (!isCandidateValid && argsPos === -1) {
+      // Not a valid tool call and no [ARGS]; treat as plain text
+      out.push({ type: "text", text: normalizeCursorTextToolMarkers(remaining) });
+      break;
+    }
+
+    if (startIndex > 0) {
+      out.push({ type: "text", text: normalizeCursorTextToolMarkers(remaining.slice(0, startIndex)) });
+      remaining = remaining.slice(startIndex);
+      continue;
+    }
+
+    const argsMarkerIndex = remaining.indexOf(TOOL_CALL_ARGS_MARKER, TOOL_CALL_START_PREFIX.length);
+    if (argsMarkerIndex === -1) {
+      const nameCandidate = remaining.slice(TOOL_CALL_START_PREFIX.length);
+      if (nameCandidate.length > 64 || /[^a-zA-Z0-9_-]/.test(nameCandidate)) {
+        out.push({ type: "text", text: normalizeCursorTextToolMarkers(remaining) });
+        break;
+      }
+      state.textToolCallBuffer = remaining;
+      break;
+    }
+
+    const rawName = remaining.slice(TOOL_CALL_START_PREFIX.length, argsMarkerIndex).trim();
+    const wireName = normalizeCursorWireName(rawName);
+    const advertisedName = resolveAdvertisedClientToolName(state, wireName);
+
+    if (!advertisedName) {
+      const endOfMarker = argsMarkerIndex + TOOL_CALL_ARGS_MARKER.length;
+      out.push({ type: "text", text: normalizeCursorTextToolMarkers(remaining.slice(0, endOfMarker)) });
+      remaining = remaining.slice(endOfMarker);
+      continue;
+    }
+
+    const argsStart = argsMarkerIndex + TOOL_CALL_ARGS_MARKER.length;
+    let argsEnd = -1;
+    const trimmedOffset = remaining.slice(argsStart).search(/\S/);
+    if (trimmedOffset !== -1 && remaining[argsStart + trimmedOffset] === "{") {
+      let depth = 0;
+      let inString = false;
+      let escape = false;
+      const jsonStart = argsStart + trimmedOffset;
+      for (let i = jsonStart; i < remaining.length; i++) {
+        const char = remaining[i];
+        if (escape) {
+          escape = false;
+          continue;
+        }
+        if (char === "\\") {
+          escape = true;
+          continue;
+        }
+        if (char === '"') {
+          inString = !inString;
+          continue;
+        }
+        if (!inString) {
+          if (char === "{") depth++;
+          else if (char === "}") {
+            depth--;
+            if (depth === 0) {
+              argsEnd = i + 1;
+              break;
+            }
+          }
+        }
+      }
+    }
+
+    if (argsEnd === -1) {
+      state.textToolCallBuffer = remaining;
+      break;
+    }
+
+    const argsJson = remaining.slice(argsStart, argsEnd).trim();
+    const toolCallId = `call_${crypto.randomUUID().replace(/-/g, "").slice(0, 16)}`;
+
+    const recordEvents = recordToolCall(state, toolCallId, wireName);
+    out.push(...recordEvents);
+    if (!recordEvents.some(e => e.type === "error")) {
+      const open = state.openToolCalls.get(toolCallId);
+      if (open) open.args = argsJson;
+      let finalArgs = normalizeJsonText(argsJson, wireName, state);
+      if (state.freeformToolNames?.has(open?.name ?? "") && !cursorFreeformWrapperValid(finalArgs)) {
+        try {
+          const parsed = JSON.parse(finalArgs) as unknown;
+          if (typeof parsed === "string") {
+            finalArgs = JSON.stringify({ input: parsed });
+          }
+        } catch {
+          finalArgs = JSON.stringify({ input: finalArgs });
+        }
+      }
+      out.push(...commitToolCall(state, toolCallId, finalArgs));
+    }
+
+    remaining = remaining.slice(argsEnd);
+  }
+
+  return out;
+}
+
   if (serverMessage.message.case !== "interactionUpdate") return [];
   const update = serverMessage.message.value.message;
   switch (update.case) {
     case "textDelta":
-      // #2305: fold Cursor display aliases inside textual pseudo tool-call markers back to
-      // the advertised wire name before any client sees the text. Real frames are already
-      // normalized structurally (mcpWireNameFromArgs above).
-      return update.value.text ? [{ type: "text", text: normalizeCursorTextToolMarkers(update.value.text) }] : [];
+      return update.value.text ? parseCursorTextToolCalls(update.value.text, state) : [];
     case "thinkingDelta":
       return update.value.text ? [{ type: "thinking", thinking: update.value.text }] : [];
     case "toolCallStarted": {
@@ -1290,7 +1462,7 @@ export function mapCursorProtobufServerMessage(
         && (
           (name !== undefined && openBeforeStart.args.length === 0)
           || (state.freeformToolNames?.has(openBeforeStart.name) === true
-            && !cursorFreeformWrapperValid(openBeforeStart.args)
+            && !cursorFreeformWrapperValid(normalizeFreeformArgs(openBeforeStart.args))
           )
         )
       ) {
@@ -1314,7 +1486,7 @@ export function mapCursorProtobufServerMessage(
       if (
         !openBeforeStart && open && !hasMcpArgBytes(args)
         && state.freeformToolNames?.has(open.name) === true
-        && !cursorFreeformWrapperValid(open.args)
+        && !cursorFreeformWrapperValid(normalizeFreeformArgs(open.args))
       ) {
         open.awaitingNativeArgs = true;
         return [];
@@ -1364,18 +1536,23 @@ export function resolvedTurnUsage(state: CursorProtobufEventState): OcxUsage {
  */
 export function finalizeTurnEvents(state: CursorProtobufEventState): CursorServerMessage[] {
   state.terminated = true;
+  const prefixEvents: CursorServerMessage[] = [];
+  if (state.textToolCallBuffer) {
+    prefixEvents.push({ type: "text", text: normalizeCursorTextToolMarkers(state.textToolCallBuffer) });
+    state.textToolCallBuffer = undefined;
+  }
   if (state.openToolCalls.size > 0) {
     const openCallIds = [...state.openToolCalls.keys()];
     const openIds = openCallIds.join(", ");
     // Clear so a second turnEnded (should not happen, but defensive) doesn't re-emit.
     for (const callId of openCallIds) state.translatorBudget?.closeCall(callId);
     state.openToolCalls.clear();
-    return [{ type: "error", message: `Cursor stream ended with incomplete tool call(s): ${openIds}. Arguments may be truncated; the call was not committed.` }];
+    return [...prefixEvents, { type: "error", message: `Cursor stream ended with incomplete tool call(s): ${openIds}. Arguments may be truncated; the call was not committed.` }];
   }
   // Surface the absolute context size (when Cursor reported a checkpoint) as both totalTokens and
   // the estimated input side of Codex's visible `input + output` counter. Codex status lines can
   // render the additive pair instead of total_tokens, so leaving inputTokens at 0 makes a 16k-context
   // first turn display as "9 used". Keep outputTokens as the per-turn delta and clamp the inferred
   // input to 0 in case Cursor reports a checkpoint smaller than the streamed output delta.
-  return [{ type: "done", usage: resolvedTurnUsage(state) }];
+  return [...prefixEvents, { type: "done", usage: resolvedTurnUsage(state) }];
 }

package/src/adapters/cursor/protobuf-request.ts

@@ -1,7 +1,7 @@
 import { create, fromBinary, toBinary, toJson } from "@bufbuild/protobuf";
 import { fromJson, type JsonValue } from "@bufbuild/protobuf";
 import { ValueSchema } from "@bufbuild/protobuf/wkt";
-import type { OcxAssistantContentPart, OcxMessage, OcxToolResultMessage } from "../../types";
+import type { OcxAssistantContentPart, OcxMessage, OcxRequestOptions, OcxToolResultMessage } from "../../types";
 import { namespacedToolName } from "../../types";
 import type { CursorRunRequest } from "./types";
 import { cursorNeedsExternalToolContinuation, isCursorExternalWireModel } from "./discovery";
@@ -77,7 +77,22 @@ export const CURSOR_EXTERNAL_ROOT_BYTE_LIMIT = 512 * 1024;
  * results already stored in history blobs are visible without a ResumeAction.
  */
 export const CURSOR_EXTERNAL_TOOL_CONTINUATION_TEXT =
-  "Continue: the requested tool results are provided in the conversation history above.";
+  "Continue: the requested tool results are provided in the conversation history above. Answer the user request or proceed with the next step directly without repeating status summaries or greetings.";
+
+export function externalToolContinuationText(rawMessages?: readonly OcxMessage[]): string {
+  const last = rawMessages?.at(-1);
+  if (last?.role === "toolResult") {
+    const raw = typeof last.content === "string" ? last.content : JSON.stringify(last.content ?? "");
+    const trimmed = raw.trim();
+    if (
+      (last.toolName?.includes("list_agents") || last.toolName?.includes("search"))
+      && (trimmed === "[]" || trimmed === "" || trimmed === "{}" || trimmed === "null")
+    ) {
+      return `${CURSOR_EXTERNAL_TOOL_CONTINUATION_TEXT} If a prior discovery or list tool returned empty results (e.g. no sub-agents currently active), proceed directly with your next concrete action using available tools.`;
+    }
+  }
+  return CURSOR_EXTERNAL_TOOL_CONTINUATION_TEXT;
+}
 
 /** Runtime timezone for protobuf RequestContextEnv (dynamic, never hardcoded). */
 function runtimeTimeZone(): string {
@@ -165,9 +180,26 @@ function truncateToolResultBlob(entry: RootBlobCandidate, maxBytes: number): Roo
   return markerOnly.byteLength <= maxBytes ? markerOnly : null;
 }
 
+function structuredOutputPrompt(textFormat: OcxRequestOptions["textFormat"]): string | undefined {
+  if (!textFormat) return undefined;
+  if (textFormat.type === "json_schema" && textFormat.schema) {
+    return [
+      "Your response must be a single valid JSON object strictly conforming to this JSON schema:",
+      JSON.stringify(textFormat.schema),
+      "Do not include any surrounding markdown fences, preamble, or commentary; return raw JSON only.",
+    ].join("\n");
+  }
+  if (textFormat.type === "json_object") {
+    return "Your response must be a single valid JSON object. Do not include any markdown fences or commentary; return raw JSON only.";
+  }
+  return undefined;
+}
+
 function systemPromptBlobs(request: CursorRunRequest): RootBlobCandidate[] {
   const prompts = request.system.length > 0 ? [...request.system] : ["You are a helpful assistant."];
   if (cursorRequestHasShellAlias(request.tools)) prompts.push(CURSOR_SHELL_ALIAS_SYSTEM_NOTE);
+  const structuredPrompt = structuredOutputPrompt(request.textFormat);
+  if (structuredPrompt) prompts.push(structuredPrompt);
   const cursorToolGuidance = buildCursorToolGuidanceSystemNote(
     cursorToolsForActivePrompt(request.tools, activePromptText(request), request.toolChoice),
     request.toolChoice,
@@ -190,10 +222,11 @@ function assistantRootText(
 // Cursor builds the actual model prompt from rootPromptMessagesJson (turns[] is UI/display metadata),
 // so prior history must be replayed here or a ResumeAction has nothing model-visible to continue from.
 // The active user message is excluded because it travels in the action. When the continuation cannot
-// rely on native MCP turn state, tool results stay assistant-role text with a [Tool Result] /
-// [Tool Error] marker so Cursor does not wrap them as `<user_query>` (#1992). Native resume models
-// already carry the paired MCP result on turns[], so that marker is omitted from root replay — Auto
-// few-shot-mimics it as chat text otherwise. Each entry is a SHA-256 blob ID.
+// rely on native MCP turn state, tool results stay assistant-role text so Cursor does not wrap them
+// as `<user_query>` (#1992). External replay uses a neutral "Tool output" label; protocol markers
+// such as [Tool Result] are reserved for native wire encoding because external models echo them.
+// Native resume models already carry the paired MCP result on turns[], so it is omitted from root
+// replay. Each entry is a SHA-256 blob ID.
 function rootPromptMessages(request: CursorRunRequest, requestScope: CursorBlobRequestScopeToken): {
   ids: Uint8Array[];
   byteLength: number;
@@ -246,14 +279,10 @@ function rootPromptMessages(request: CursorRunRequest, requestScope: CursorBlobR
       }
       // Assistant tool CALLS are intentionally NOT replayed as visible "[Tool Call]" text here.
     } else if (message.role === "toolResult") {
-      // Native resume models already receive the paired MCP result through turns[]. Replaying
-      // the same payload as assistant-role "[Tool Result]" / "[tool_result]" text teaches Auto
-      // to echo that envelope as chat instead of continuing from the structured result.
+      // Native resume models already receive the paired MCP result through turns[]. External
+      // replay uses neutral text here so models do not echo protocol envelopes as chat.
       if (!echoToolResultInRoot) continue;
-      // #1920: the prefix must reflect the NORMALIZED error state (an empty
-      // node_repl result is an error even when the runtime said isError=false).
-      const prefix = normalizedToolResult(message, contentToText(message.content)).isError ? "[Tool Error]" : "[Tool Result]";
-      const text = `${prefix}\n${toolResultToText(message)}`;
+      const text = externalToolResultToText(message);
       entries.push(rootBlobCandidate(
         toolResultRootPayload(text),
         "toolResult",
@@ -538,6 +567,12 @@ function toolResultToText(message: OcxToolResultMessage): string {
   ].join("\n");
 }
 
+function externalToolResultToText(message: OcxToolResultMessage): string {
+  const normalized = normalizedToolResult(message, contentToText(message.content));
+  const label = normalized.isError ? "Tool error" : "Tool output";
+  return `${label} for ${namespacedToolName(message.toolNamespace, message.toolName)} (call_id: ${message.toolCallId}, is_error: ${normalized.isError}):\n${normalized.text}`;
+}
+
 /**
  * Shared #1920 normalization entry: pure-text results only. Image-bearing or
  * encrypted results pass through untouched (their content is not plain text).
@@ -721,12 +756,10 @@ function conversationTurns(
         // #1920/#1866: this external-replay site bypasses toolResultToText, so it
         // must consume the normalizer directly — cursor/grok-4.6 is the exact
         // reported repro path for empty Computer Use results.
-        const normalized = normalizedToolResult(message, contentToText(message.content));
-        const prefix = normalized.isError ? "[Tool Error]" : "[Tool Result]";
         current.steps.push(storeCursorBlob(toBinary(ConversationStepSchema, create(ConversationStepSchema, {
           message: {
             case: "assistantMessage",
-            value: create(AssistantMessageSchema, { text: `${prefix}\n${normalized.text}` }),
+            value: create(AssistantMessageSchema, { text: externalToolResultToText(message) }),
           },
         })), requestScope));
         continue;
@@ -837,8 +870,10 @@ function buildPreparedCursorRunRequest(
     ? "userMessageAction"
     : "resumeAction";
   const actionText = externalToolContinuation
-    ? CURSOR_EXTERNAL_TOOL_CONTINUATION_TEXT
-    : text;
+    ? (request.echoRetryContinuationText ?? externalToolContinuationText(request.rawMessages))
+    : request.echoRetryContinuationText
+      ? `${text}\n\n[correction] ${request.echoRetryContinuationText}`
+      : text;
   const action = create(ConversationActionSchema, {
     action: actionCase === "userMessageAction"
       ? {

package/src/adapters/cursor/request-builder.ts

@@ -202,6 +202,13 @@ function normalizeCursorModelId(modelId: string, reasoning?: string): {
       ],
     };
   }
+  if (id === "composer-2.5") {
+    return {
+      ...selection,
+      modelId: id,
+      requestedModelParameters: [{ id: "fast", value: "false" }],
+    };
+  }
   return { ...selection, modelId: suffix ? cursorRequestWireModelIdWithEffort(id, suffix) : id };
 }
 
@@ -442,9 +449,10 @@ export function createCursorRequest(
     rawMessages: parsed.context.messages,
     ...(parsed._compactionRequest === true || parsed._contextCompactionBoundary === true ? { contextUsageReset: true } : {}),
     ...(parsed._compactionRequest === true ? { contextUsageStoreCheckpoints: false } : {}),
-    ...(budget.tools.length ? { tools: budget.tools } : {}),
-    ...(parsed.options.toolChoice ? { toolChoice: parsed.options.toolChoice } : {}),
-    ...(parsed.options.parallelToolCalls !== undefined ? { parallelToolCalls: parsed.options.parallelToolCalls } : {}),
+   ...(budget.tools.length ? { tools: budget.tools } : {}),
+   ...(parsed.options.toolChoice ? { toolChoice: parsed.options.toolChoice } : {}),
+    ...(parsed.options.textFormat ? { textFormat: parsed.options.textFormat } : {}),
+   ...(parsed.options.parallelToolCalls !== undefined ? { parallelToolCalls: parsed.options.parallelToolCalls } : {}),
   };
   const resolved = resolveCursorCheckpoint(parsed, request, options);
   if ("reason" in resolved) {