@yansigit/opencodex 2.33.0 → 2.35.0

package/src/adapters/cursor/native-exec-shell.ts

@@ -1,4 +1,4 @@
-import { spawn, spawnSync, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { execFileSync, spawn, spawnSync, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { resolve } from "node:path";
 import { create } from "@bufbuild/protobuf";
 import {
@@ -19,6 +19,9 @@ import {
   type ExecServerMessage,
 } from "./gen/agent_pb";
 import { errorText, execBytes, execStreamCloseBytes } from "./native-exec-common";
+import { resolveTrustedWindowsTaskkillExe } from "../../lib/windows-elevation";
+export { nativeShellDisabledMessage, type CursorNativeExecPolicyContext } from "./native-exec-policy";
+import { nativeShellDisabledMessage, type CursorNativeExecPolicyContext } from "./native-exec-policy";
 import {
   createAdmissionGate,
   type AdmissionLease,
@@ -32,6 +35,7 @@ export const CURSOR_BACKGROUND_SHELL_TERM_GRACE_MS = 2_000;
 
 type BackgroundShellTerminationReason = "session_close" | "idle" | "absolute" | "shutdown";
 type BackgroundShellTimer = ReturnType<typeof setTimeout>;
+type ProcessGroupLiveness = "alive" | "gone" | "unknown";
 
 export interface BackgroundShellTerminationReport {
   attempted: number;
@@ -42,10 +46,14 @@ export interface BackgroundShellTerminationReport {
 
 export interface BackgroundShellRuntime {
   spawn: typeof spawn;
+  platform: NodeJS.Platform;
   now(): number;
   setTimer(callback: () => void, delayMs: number): BackgroundShellTimer;
   clearTimer(timer: BackgroundShellTimer): void;
   kill(child: ChildProcessWithoutNullStreams, signal?: NodeJS.Signals): boolean;
+  killProcessGroup(pid: number, signal?: NodeJS.Signals): boolean;
+  isProcessGroupAlive(pid: number): ProcessGroupLiveness;
+  killTree(child: ChildProcessWithoutNullStreams): boolean;
 }
 
 interface BackgroundShellEntry {
@@ -65,10 +73,30 @@ interface BackgroundShellEntry {
 
 const defaultBackgroundShellRuntime: BackgroundShellRuntime = {
   spawn,
+  platform: process.platform,
   now: () => Date.now(),
   setTimer: (callback, delayMs) => setTimeout(callback, delayMs),
   clearTimer: timer => clearTimeout(timer),
   kill: (child, signal) => child.kill(signal),
+  killProcessGroup: (pid, signal) => {
+    process.kill(-pid, signal);
+    return true;
+  },
+  isProcessGroupAlive: pid => {
+    try {
+      process.kill(-pid, 0);
+      return "alive";
+    } catch (error) {
+      return (error as NodeJS.ErrnoException).code === "ESRCH" ? "gone" : "unknown";
+    }
+  },
+  killTree: child => {
+    execFileSync(resolveTrustedWindowsTaskkillExe(), ["/PID", String(child.pid), "/T", "/F"], {
+      stdio: "pipe",
+      windowsHide: true,
+    });
+    return true;
+  },
 };
 
 let backgroundShellRuntime = defaultBackgroundShellRuntime;
@@ -81,21 +109,7 @@ let absoluteTerminations = 0;
 let unresolvedKills = 0;
 let killFailures = 0;
 
-/** Rejection text when Cursor-native shell is denied by policy (issue #604). */
-export function nativeShellDisabledMessage(): string {
-  // Do not insist on "the same command" — that steers models into replaying bash/CMD
-  // idioms through the Codex bridge on Windows PowerShell 5.1 and looping (#604).
-  // Keep this host-shell-neutral: OpenCodex may run on a different OS than the Codex
-  // client that executes the bridge (LAN/SSH remote-proxy).
-  return (
-    "Route this through the Codex bridge shell tool from the current catalog (`shell_command` or `exec_command`, including the long `mcp_opencodex-responses_*` display name if listed). "
-    + "Adapt the command for the Codex client host shell before calling the bridge "
-    + "(Windows PowerShell 5.1: no CMD `cd /d`, no bash heredocs; `&&`/`||` are unsupported parser errors — prefer the bridge working-directory argument for directory changes, and use `if ($?) { ... }` for success-gated follow-up steps; do not treat `;` as a substitute for `&&`). "
-    + "Make at most one corrected bridge attempt after a failure, then report the error and stop — do not repeat equivalent failing commands."
-  );
-}
-
-function rejectedShellResult(command: string, cwd: string, started: number) {
+function rejectedShellResult(command: string, cwd: string, started: number, opts: CursorNativeExecPolicyContext = {}) {
   return create(ShellResultSchema, {
     result: {
       case: "failure",
@@ -105,7 +119,7 @@ function rejectedShellResult(command: string, cwd: string, started: number) {
         exitCode: 1,
         signal: "",
         stdout: "",
-        stderr: nativeShellDisabledMessage(),
+        stderr: nativeShellDisabledMessage(opts),
         executionTime: Date.now() - started,
         aborted: true,
       }),
@@ -113,10 +127,10 @@ function rejectedShellResult(command: string, cwd: string, started: number) {
   });
 }
 
-export function rejectShellExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
+export function rejectShellExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array {
   if (execMsg.message.case !== "shellArgs") throw new Error("invalid shell exec");
   const args = execMsg.message.value;
-  return execBytes(execMsg, "shellResult", rejectedShellResult(args.command, resolve(args.workingDirectory || process.cwd()), Date.now()));
+  return execBytes(execMsg, "shellResult", rejectedShellResult(args.command, resolve(args.workingDirectory || process.cwd()), Date.now(), opts));
 }
 
 export function shellExec(execMsg: ExecServerMessage): Uint8Array {
@@ -154,7 +168,7 @@ export function shellExec(execMsg: ExecServerMessage): Uint8Array {
   }));
 }
 
-export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage): Uint8Array[] {
+export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array[] {
   if (execMsg.message.case !== "shellStreamArgs") throw new Error("invalid shell stream exec");
   const args = execMsg.message.value;
   const cwd = resolve(args.workingDirectory || process.cwd());
@@ -164,12 +178,12 @@ export function rejectShellStreamExecForPolicy(execMsg: ExecServerMessage): Uint
       event: { case: "start", value: create(ShellStreamStartSchema, { sandboxPolicy: args.requestedSandboxPolicy }) },
     })),
     execBytes(execMsg, "shellStream", create(ShellStreamSchema, {
-      event: { case: "stderr", value: create(ShellStreamStderrSchema, { data: nativeShellDisabledMessage() }) },
+      event: { case: "stderr", value: create(ShellStreamStderrSchema, { data: nativeShellDisabledMessage(opts) }) },
     })),
     execBytes(execMsg, "shellStream", create(ShellStreamSchema, {
       event: { case: "exit", value: create(ShellStreamExitSchema, { code: 1, cwd, aborted: true }) },
     })),
-    execBytes(execMsg, "shellResult", rejectedShellResult(args.command, cwd, started)),
+    execBytes(execMsg, "shellResult", rejectedShellResult(args.command, cwd, started, opts)),
     execStreamCloseBytes(execMsg),
   ];
 }
@@ -260,12 +274,12 @@ export async function shellStreamExec(execMsg: ExecServerMessage): Promise<Uint8
   return replies;
 }
 
-export function rejectBackgroundShellSpawnExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
+export function rejectBackgroundShellSpawnExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array {
   if (execMsg.message.case !== "backgroundShellSpawnArgs") throw new Error("invalid background shell exec");
   const args = execMsg.message.value;
   const cwd = resolve(args.workingDirectory || process.cwd());
   return execBytes(execMsg, "backgroundShellSpawnResult", create(BackgroundShellSpawnResultSchema, {
-    result: { case: "error", value: create(BackgroundShellSpawnErrorSchema, { command: args.command, workingDirectory: cwd, error: nativeShellDisabledMessage() }) },
+    result: { case: "error", value: create(BackgroundShellSpawnErrorSchema, { command: args.command, workingDirectory: cwd, error: nativeShellDisabledMessage(opts) }) },
   }));
 }
 
@@ -355,6 +369,13 @@ function waitForBackgroundShellClose(entry: BackgroundShellEntry): Promise<boole
   });
 }
 
+function waitForBackgroundShellGrace(): Promise<void> {
+  return new Promise(resolveWait => {
+    const timer = backgroundShellRuntime.setTimer(resolveWait, CURSOR_BACKGROUND_SHELL_TERM_GRACE_MS);
+    void timer;
+  });
+}
+
 function tryKillBackgroundShell(entry: BackgroundShellEntry, signal?: NodeJS.Signals): boolean {
   try {
     return backgroundShellRuntime.kill(entry.child, signal);
@@ -363,6 +384,34 @@ function tryKillBackgroundShell(entry: BackgroundShellEntry, signal?: NodeJS.Sig
   }
 }
 
+function tryKillBackgroundShellProcessGroup(entry: BackgroundShellEntry, signal?: NodeJS.Signals): boolean {
+  const pid = entry.child.pid;
+  if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    return backgroundShellRuntime.killProcessGroup(pid, signal);
+  } catch {
+    return false;
+  }
+}
+
+function tryKillBackgroundShellTree(entry: BackgroundShellEntry): boolean {
+  try {
+    return backgroundShellRuntime.killTree(entry.child);
+  } catch {
+    return false;
+  }
+}
+
+function isBackgroundShellProcessGroupAlive(entry: BackgroundShellEntry): ProcessGroupLiveness {
+  const pid = entry.child.pid;
+  if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) return "unknown";
+  try {
+    return backgroundShellRuntime.isProcessGroupAlive(pid);
+  } catch {
+    return "unknown";
+  }
+}
+
 async function terminateBackgroundShell(
   entry: BackgroundShellEntry,
   reason: BackgroundShellTerminationReason,
@@ -380,11 +429,43 @@ async function terminateBackgroundShell(
     try { entry.child.stderr.resume(); } catch { /* keep draining when supported */ }
 
     let attemptKillFailures = 0;
-    if (!tryKillBackgroundShell(entry)) attemptKillFailures += 1;
-    let closed = await waitForBackgroundShellClose(entry);
+    let treeTerminationStarted = false;
+    let processGroupTerminationStarted = false;
+    let processGroupTerminationAttempted = false;
+    let treeTerminationFailed = false;
+    if (backgroundShellRuntime.platform === "win32") {
+      treeTerminationStarted = tryKillBackgroundShellTree(entry);
+      if (!treeTerminationStarted) {
+        treeTerminationFailed = true;
+        attemptKillFailures += 1;
+        if (!tryKillBackgroundShell(entry)) attemptKillFailures += 1;
+      }
+    } else {
+      processGroupTerminationAttempted = true;
+      if (tryKillBackgroundShellProcessGroup(entry, "SIGTERM")) {
+        processGroupTerminationStarted = true;
+      } else {
+        attemptKillFailures += 1;
+        if (!tryKillBackgroundShell(entry)) attemptKillFailures += 1;
+      }
+    }
+    let closed = processGroupTerminationStarted ? false : await waitForBackgroundShellClose(entry);
     if (!closed && backgroundShells.get(entry.shellId) !== entry) closed = true;
-    if (!closed) {
-      if (!tryKillBackgroundShell(entry, "SIGKILL")) attemptKillFailures += 1;
+    if (processGroupTerminationStarted) {
+      await waitForBackgroundShellGrace();
+      if (isBackgroundShellProcessGroupAlive(entry) !== "gone" && !tryKillBackgroundShellProcessGroup(entry, "SIGKILL")) {
+        attemptKillFailures += 1;
+      }
+      closed = backgroundShells.get(entry.shellId) !== entry;
+    }
+    if ((!closed || treeTerminationFailed || processGroupTerminationAttempted && !processGroupTerminationStarted)
+      && !treeTerminationStarted && !processGroupTerminationStarted) {
+      if (backgroundShellRuntime.platform === "win32") {
+        if (!tryKillBackgroundShell(entry, "SIGKILL")) attemptKillFailures += 1;
+      } else if (!tryKillBackgroundShellProcessGroup(entry, "SIGKILL")) {
+        attemptKillFailures += 1;
+        if (!closed && !tryKillBackgroundShell(entry, "SIGKILL")) attemptKillFailures += 1;
+      }
       closed = await waitForBackgroundShellClose(entry);
       if (!closed && backgroundShells.get(entry.shellId) !== entry) closed = true;
     }
@@ -471,7 +552,11 @@ export function backgroundShellSpawnExec(execMsg: ExecServerMessage, sessionId:
   if (!admissionLease) return backgroundShellSpawnError(execMsg, args.command, cwd, "background shell limit reached");
   let child: ChildProcessWithoutNullStreams;
   try {
-    child = backgroundShellRuntime.spawn(args.command, { cwd, shell: true });
+    child = backgroundShellRuntime.spawn(args.command, {
+      cwd,
+      shell: true,
+      ...(backgroundShellRuntime.platform === "win32" ? {} : { detached: true }),
+    });
   } catch (err) {
     admissionLease.release();
     return backgroundShellSpawnError(execMsg, args.command, cwd, errorText(err));
@@ -517,10 +602,10 @@ export function backgroundShellSpawnExec(execMsg: ExecServerMessage, sessionId:
   }
 }
 
-export function rejectWriteShellStdinExecForPolicy(execMsg: ExecServerMessage): Uint8Array {
+export function rejectWriteShellStdinExecForPolicy(execMsg: ExecServerMessage, opts: CursorNativeExecPolicyContext = {}): Uint8Array {
   if (execMsg.message.case !== "writeShellStdinArgs") throw new Error("invalid shell stdin exec");
   return execBytes(execMsg, "writeShellStdinResult", create(WriteShellStdinResultSchema, {
-    result: { case: "error", value: create(WriteShellStdinErrorSchema, { error: nativeShellDisabledMessage() }) },
+    result: { case: "error", value: create(WriteShellStdinErrorSchema, { error: nativeShellDisabledMessage(opts) }) },
   }));
 }
 

package/src/adapters/cursor/native-exec.ts

@@ -51,6 +51,7 @@ import {
   type CursorNativeToolDeps,
 } from "./native-exec-tools";
 import { clientBytes, execBytes, execStreamCloseBytes, execThrowBytes } from "./native-exec-common";
+import { type CursorNativeExecPolicyContext } from "./native-exec-policy";
 import type { McpToolDefinition } from "./gen/agent_pb";
 import { OCX_RESPONSES_TOOL_PROVIDER } from "./tool-definitions";
 
@@ -72,12 +73,18 @@ export interface CursorNativeExecContext extends CursorNativeExecDeps {
   rejectNativeFileMutations?: boolean;
   /** The synthetic exact-match edit tools (edit_file / multi_edit) are advertised this request. */
   structuredEditAvailable?: boolean;
+  /** Codex code mode advertises one freeform exec tool; native rejections must steer to nested helpers. */
+  codeMode?: boolean;
 }
 
 export function cursorUnsafeNativeLocalExecEnabled(input: Pick<CursorNativeExecContext, "unsafeAllowNativeLocalExec"> = {}): boolean {
   return input.unsafeAllowNativeLocalExec === true;
 }
 
+function nativeExecPolicyContext(deps: CursorNativeExecContext): CursorNativeExecPolicyContext {
+  return deps.codeMode === true ? { codeMode: true } : {};
+}
+
 /**
  * Content-addressed blob store shared across streams. Bounded: without eviction a long-running
  * proxy accumulates every conversation's prompt blobs forever (unbounded memory) and any stale
@@ -403,6 +410,19 @@ export function storeCursorBlob(data: Uint8Array, requestScope?: CursorBlobReque
   return blobId;
 }
 
+/**
+ * Serve-time integrity for content-addressed blobs (devlog 260826_cursor_responses_gap 080):
+ * a raw 32-byte blob id IS the SHA-256 of its bytes, so served data whose digest mismatches
+ * the id means in-store corruption — the splice signature behind garbled replayed tool
+ * results. Ids longer than 32 bytes (digested-key namespace) and server-minted ids are not
+ * content-addressed and always pass.
+ */
+export function cursorBlobServeIntegrityOk(blobId: Uint8Array, served: Uint8Array): boolean {
+  if (blobId.byteLength !== 32) return true;
+  const digest = createHash("sha256").update(served).digest();
+  return digest.equals(Buffer.from(blobId));
+}
+
 /**
  * Long-lived pin for blobs referenced by an active Cursor conversation checkpoint.
  * Unlike a request scope, this lease is not sealed and is not released by getBlob hydration.
@@ -556,16 +576,17 @@ export async function handleCursorNativeExec(execMsg: ExecServerMessage, deps: C
     }))];
   }
   if (!cursorUnsafeNativeLocalExecEnabled(deps)) {
-    if (execCase === "readArgs") return [rejectReadExecForPolicy(execMsg)];
-    if (execCase === "writeArgs") return [rejectWriteExecForPolicy(execMsg)];
-    if (execCase === "deleteArgs") return [rejectDeleteExecForPolicy(execMsg)];
-    if (execCase === "lsArgs") return [rejectLsExecForPolicy(execMsg)];
-    if (execCase === "grepArgs") return [rejectGrepExecForPolicy(execMsg)];
-    if (execCase === "shellArgs") return [rejectShellExecForPolicy(execMsg)];
-    if (execCase === "shellStreamArgs") return rejectShellStreamExecForPolicy(execMsg);
-    if (execCase === "backgroundShellSpawnArgs") return [rejectBackgroundShellSpawnExecForPolicy(execMsg)];
-    if (execCase === "writeShellStdinArgs") return [rejectWriteShellStdinExecForPolicy(execMsg)];
-    if (execCase === "fetchArgs") return [rejectFetchExecForPolicy(execMsg)];
+    const policy = nativeExecPolicyContext(deps);
+    if (execCase === "readArgs") return [rejectReadExecForPolicy(execMsg, policy)];
+    if (execCase === "writeArgs") return [rejectWriteExecForPolicy(execMsg, policy)];
+    if (execCase === "deleteArgs") return [rejectDeleteExecForPolicy(execMsg, policy)];
+    if (execCase === "lsArgs") return [rejectLsExecForPolicy(execMsg, policy)];
+    if (execCase === "grepArgs") return [rejectGrepExecForPolicy(execMsg, policy)];
+    if (execCase === "shellArgs") return [rejectShellExecForPolicy(execMsg, policy)];
+    if (execCase === "shellStreamArgs") return rejectShellStreamExecForPolicy(execMsg, policy);
+    if (execCase === "backgroundShellSpawnArgs") return [rejectBackgroundShellSpawnExecForPolicy(execMsg, policy)];
+    if (execCase === "writeShellStdinArgs") return [rejectWriteShellStdinExecForPolicy(execMsg, policy)];
+    if (execCase === "fetchArgs") return [rejectFetchExecForPolicy(execMsg, policy)];
   }
   if (execCase === "readArgs") return [readExec(execMsg)];
   if (execCase === "writeArgs") return [deps.rejectNativeFileMutations ? rejectWriteExecForApplyPatch(execMsg, deps.structuredEditAvailable === true) : writeExec(execMsg)];
@@ -622,6 +643,13 @@ export function handleCursorNativeKv(
   if (kvMsg.message.case === "getBlobArgs") {
     const blobKey = key(kvMsg.message.value.blobId);
     const blobData = getBlob(blobKey);
+    // Splice-class corruption guard (devlog 260826 080): diagnostic only, never blocks serving.
+    if (blobData && !cursorBlobServeIntegrityOk(kvMsg.message.value.blobId, blobData)) {
+      debugProviderDiagnostic("cursor", "blob-integrity-mismatch", {
+        blobKey: blobKey.slice(0, 18),
+        servedBytes: blobData.byteLength,
+      });
+    }
     if (blobData && requestScope && blobRequestScopes.get(requestScope)?.kind === "request") {
       releaseHydratedBlob(blobKey, requestScope);
     }

package/src/adapters/cursor/protobuf-events.ts

@@ -1136,6 +1136,31 @@ function cursorFreeformWrapperValid(args: string): boolean {
   }
 }
 
+/**
+ * Cursor sometimes sends a freeform body as a JSON string or as a one-key object instead of the
+ * advertised `{input: string}` wrapper. Preserve incomplete JSON for the late native-args path,
+ * but wrap complete/raw bodies before the Responses bridge validates them.
+ */
+function normalizeFreeformArgs(args: string): string {
+  if (args.length === 0) return args;
+  try {
+    const parsed = JSON.parse(args) as unknown;
+    if (typeof parsed === "string") return JSON.stringify({ input: parsed });
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const object = parsed as Record<string, unknown>;
+      if ("input" in object || Object.keys(object).length === 0) return args;
+      const values = Object.values(object);
+      const input = values.length === 1 && typeof values[0] === "string" ? values[0] : JSON.stringify(object);
+      return JSON.stringify({ input });
+    }
+    return args;
+  } catch {
+    return args.trimStart().startsWith("{") || args.trimStart().startsWith("[")
+      ? args
+      : JSON.stringify({ input: args });
+  }
+}
+
 function dropInvalidFreeformCall(state: CursorProtobufEventState, callId: string, toolName: string): CursorServerMessage[] {
   state.openToolCalls.delete(callId);
   state.translatorBudget?.closeCall(callId);
@@ -1162,6 +1187,7 @@ function dropStructuredEditCall(state: CursorProtobufEventState, callId: string,
 function commitToolCall(state: CursorProtobufEventState, callId: string, finalArgs: string): CursorServerMessage[] {
   const open = state.openToolCalls.get(callId);
   if (!open) return [];
+  if (state.freeformToolNames?.has(open.name)) finalArgs = normalizeFreeformArgs(finalArgs);
   if (state.freeformToolNames?.has(open.name) && !cursorFreeformWrapperValid(finalArgs)) {
     return dropInvalidFreeformCall(state, callId, open.name);
   }
@@ -1436,7 +1462,7 @@ function parseCursorTextToolCalls(text: string, state: CursorProtobufEventState)
         && (
           (name !== undefined && openBeforeStart.args.length === 0)
           || (state.freeformToolNames?.has(openBeforeStart.name) === true
-            && !cursorFreeformWrapperValid(openBeforeStart.args)
+            && !cursorFreeformWrapperValid(normalizeFreeformArgs(openBeforeStart.args))
           )
         )
       ) {
@@ -1460,7 +1486,7 @@ function parseCursorTextToolCalls(text: string, state: CursorProtobufEventState)
       if (
         !openBeforeStart && open && !hasMcpArgBytes(args)
         && state.freeformToolNames?.has(open.name) === true
-        && !cursorFreeformWrapperValid(open.args)
+        && !cursorFreeformWrapperValid(normalizeFreeformArgs(open.args))
       ) {
         open.awaitingNativeArgs = true;
         return [];