@yansigit/opencodex 2.36.1-dev.20260829.48 → 2.36.1

package/src/adapters/cursor/discovery.ts

@@ -5,6 +5,7 @@ import {
   cursorWireModelIdWithEffort,
   CURSOR_THINKING_MODEL_IDS,
 } from "./effort-map";
+import { parseCursorVariantId } from "./catalog";
 
 export interface CursorModelInfo {
   id: string;
@@ -76,9 +77,16 @@ function stripCursorWirePrefix(id: string): string {
  * ordinary `{base}-{effort}` form, or Cursor's current `{base-without-fast}-{effort}-fast` form.
  */
 export function isCursorModelAvailableForAccount(modelId: string, liveIds: readonly string[]): boolean {
+  // Umbrella matching (devlog 260828_cursor_umbrella_catalog): a live suffix
+  // id counts toward its BASE — any variant dimension (thinking/fast/effort)
+  // proves the account can reach the umbrella. Unknown ids fall back to the
+  // legacy exact/suffix comparison so non-cataloged rows keep matching.
+  const parsedTarget = parseCursorVariantId(modelId);
   return liveIds.some(raw => {
     const id = stripCursorWirePrefix(raw);
     if (id === modelId) return true;
+    const parsedLive = parseCursorVariantId(id);
+    if (parsedLive.known && parsedTarget.known && parsedLive.baseId === parsedTarget.baseId) return true;
     for (const effort of CANONICAL_EFFORT_SUFFIXES) {
       if (
         id === `${modelId}-${effort}` ||
@@ -244,15 +252,13 @@ export function filterCursorConfiguredModelsByLiveDiscovery<T extends { id: stri
 
 /**
  * Models GetUsableModels advertises but whose every Run returns not_found (catalog honesty,
- * devlog 260826_cursor_responses_gap 060). Live probes 2026-08-26: cursor/claude-opus-5 failed
- * 100% ("Cursor Connect error not_found") while its -fast and -thinking siblings — separate
- * wire families — succeed. Quarantined here, in the shared filter, so live, cached, stale, and
- * static serving paths all agree. Custom user provider overrides are not routed through this
- * canonical seed and stay untouched.
+ * devlog 260826_cursor_responses_gap 060). The claude-opus-5 REGULAR wire family is the known
+ * case (probes 2026-08-26: 100% not_found while -fast/-thinking succeed) — under the umbrella
+ * catalog (devlog 260828) that quarantine moved to the RESOLVER level: the capability marks the
+ * regular VARIANT quarantined, the bare slug routes the healthy thinking variant, and the base
+ * row stays in the seed. This row-level set stays for future whole-base quarantines.
  */
-export const CURSOR_KNOWN_UNCALLABLE_MODEL_IDS: ReadonlySet<string> = new Set([
-  "claude-opus-5",
-]);
+export const CURSOR_KNOWN_UNCALLABLE_MODEL_IDS: ReadonlySet<string> = new Set([]);
 
 export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorModels([
   // Context windows and the model lineup mirror Cursor's public models/pricing docs plus the jawcode
@@ -265,26 +271,26 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   // gemini/grok/kimi-k2.7/gpt-5-mini are reasoning models in the SOT but are sent bare (no tier picker).
   ...CURSOR_ROUTER_MODEL_IDS.map(id => ({ id, contextWindow: CONTEXT_200K, supportsReasoningEffort: false })),
 
-  { id: "claude-sonnet-5", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
+  // Umbrella seed (devlog 260828_cursor_umbrella_catalog): one row per BASE
+  // model. Thinking merges into the base (the resolver routes the thinking
+  // variant); fast / thinking-fast / -1m stay routable as aliases but add no
+  // rows. Windows follow CURSOR_CAPABILITIES where the base is cataloged.
+  { id: "claude-sonnet-5", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
   { id: "claude-4-sonnet", contextWindow: CONTEXT_200K },
   { id: "claude-4-sonnet-1m", contextWindow: CONTEXT_1M },
   { id: "claude-4.5-haiku", contextWindow: CONTEXT_200K },
   { id: "claude-4.5-sonnet", contextWindow: CONTEXT_200K },
   { id: "claude-4.5-opus", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-4.6-opus", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-4.6-sonnet", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-opus-4-7", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  // Opus Fast families: live GetUsableModels (260822) lists ONLY effort-suffixed wire ids
-  // ({base-without-fast}-{effort}-fast; the bare id returns not_found), so every entry
-  // carries a tier picker. Live-verified: claude-opus-4-8-high-fast completed a turn.
-  // Tiers per the 260822 dump (devlog 260822_senpi_cursor_transfer/300).
-  { id: "claude-opus-4-7-fast", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-opus-4-8-fast", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-opus-4-8", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  // claude-opus-5 (bare) removed from the seed: GetUsableModels lists it but every Run returns
-  // not_found (quarantined via CURSOR_KNOWN_UNCALLABLE_MODEL_IDS; -fast/-thinking families stay).
-  { id: "claude-opus-5-fast", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
-  { id: "claude-fable-5", contextWindow: CONTEXT_200K, supportsReasoningEffort: true },
+  { id: "claude-4.6-opus", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
+  { id: "claude-4.6-sonnet", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
+  { id: "claude-opus-4-7", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
+  { id: "claude-opus-4-8", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
+  // claude-opus-5: regular variant is quarantined (not_found on every Run) but
+  // the umbrella row routes the THINKING variant, which is live — so the base
+  // row returns to the seed under the umbrella (resolver never sends the
+  // quarantined regular wire id for the bare slug).
+  { id: "claude-opus-5", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
+  { id: "claude-fable-5", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
 
   { id: "composer-1", contextWindow: CONTEXT_200K },
   { id: "composer-2.5", contextWindow: CONTEXT_200K },
@@ -301,17 +307,6 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   { id: "gemini-3.6-flash", contextWindow: CONTEXT_GEMINI, supportsReasoningEffort: true },
   { id: "gemini-3.7-flash", contextWindow: CONTEXT_GEMINI, supportsReasoningEffort: true },
 
-  // Explicit-thinking variants (260825 live roster). Exposed as first-class ids the same way the
-  // Opus Fast families were in 831810c13: `isCursorModelAvailableForAccount` matches a base id
-  // against `{base}`, `{base}-{effort}` and the family's wire form, and none of those ever
-  // matched a `-thinking` id, so every one of these was invisible in the routed catalog.
-  // Suffix ORDER differs per family; `cursorWireModelIdWithEffort` owns that mapping.
-  ...CURSOR_THINKING_MODEL_IDS.map(id => ({
-    id,
-    contextWindow: CONTEXT_200K,
-    supportsReasoningEffort: cursorModelHasEffortTiers(id),
-  })),
-
   { id: "gpt-5-codex", contextWindow: CONTEXT_272K },
   { id: "gpt-5-fast", contextWindow: CONTEXT_272K },
   { id: "gpt-5-mini", contextWindow: CONTEXT_272K },
@@ -344,17 +339,15 @@ export const CURSOR_STATIC_MODELS: readonly CursorModelInfo[] = normalizeCursorM
   { id: "kimi-k2.7-code", contextWindow: CONTEXT_262K },
   // kimi-k3: cursor.com/docs/models/kimi-k3; account-verified via GetUsableModels (2026-07-28) —
   // ships only as effort-suffixed kimi-k3-{low,high,max}, so the tier picker is exposed.
-  { id: "kimi-k3", contextWindow: CONTEXT_262K, supportsReasoningEffort: true },
-  // kimi-k3-1m: synthetic ultra/Max-Mode picker variant (CURSOR_ULTRA_1M_MODEL_IDS) — wire sends
-  // kimi-k3-<effort> with maxMode=true; 1M context user-verified live on the Ultra plan
-  // (devlog 260826_cursor_responses_gap/025). inferCursorContextWindow maps "1m" ids to 1M.
-  { id: "kimi-k3-1m", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
+  // kimi-k3 folds the old synthetic kimi-k3-1m row into the umbrella: the base
+  // is maxModeVerified (user-verified 1M on the Ultra plan, devlog 260826/025),
+  // so the ultra effort rung arms Max Mode on the wire and the separate picker
+  // row is gone. cursor/kimi-k3-1m stays routable as an alias.
+  { id: "kimi-k3", contextWindow: CONTEXT_1M, supportsReasoningEffort: true },
 
   { id: "grok-4.5", contextWindow: 500_000, supportsReasoningEffort: true },
-  { id: "grok-4.5-fast", contextWindow: 500_000, supportsReasoningEffort: true },
   // 260813 preemptive: grok-4.6 seeded ahead of Cursor's lineup update (mirrors grok-4.5).
   { id: "grok-4.6", contextWindow: 500_000, supportsReasoningEffort: true },
-  { id: "grok-4.6-fast", contextWindow: 500_000, supportsReasoningEffort: true },
 ]);
 
 export function cursorModelIds(models: readonly CursorModelInfo[] = CURSOR_STATIC_MODELS): string[] {

package/src/adapters/cursor/envelope-echo.ts

@@ -14,6 +14,14 @@
 
 const ECHO_MARKERS = ["[Tool Result]", "[Tool Error]", "[tool_result]"] as const;
 const MAX_SNIFF_BYTES = 40;
+/** Mid-stream observer: max leading whitespace on a line before matching disarms. */
+const MAX_MIDSTREAM_LINE_INDENT = 128;
+/** Mid-stream observer: post-marker window watched for call-id corruption. */
+const MIDSTREAM_CORRUPTION_WINDOW = 512;
+/** Mid-stream observer: cumulative scan cap (UTF-16 code units, checked between feeds). */
+export const MAX_MIDSTREAM_SCAN_LENGTH = 512 * 1024;
+/** Mid-stream observer: findings retained per turn. */
+const MAX_MIDSTREAM_FINDINGS = 8;
 const MAX_ROUTING_COMMENTARY_BYTES = 512;
 /** Aggregate quarantine cap: past this, flush and disarm. */
 const MAX_HOLD_BYTES = 8 * 1024;
@@ -43,6 +51,126 @@ export type EchoSnifferDecision =
   | { kind: "flush" }
   | { kind: "echo"; marker: string };
 
+export interface MidstreamEchoFinding {
+  marker: string;
+  /** UTF-16 offset of the marker's line start within the turn's full text. */
+  offset: number;
+  callIdCorrupt: boolean;
+}
+
+/**
+ * Diagnostic-only mid-stream envelope-echo observer (devlog 260828 F1/F2).
+ *
+ * The prefix sniffer only watches the first ~40 bytes of a turn, but live
+ * probing caught grok-4.6 echoing "[Tool Result]" envelope blocks in the
+ * MIDDLE of an agent message — after legitimate leading text — one of them
+ * carrying a whitespace-spliced call-id ("fc_x mar-y" instead of "fc_x-y").
+ * Deltas at that point have already reached the client, so this observer
+ * never throws and never withholds output: it records findings so the
+ * adapter can emit a structured diagnostic at turn end. Only fixed marker
+ * enums, numeric offsets, and corruption booleans are retained — never
+ * content bytes.
+ */
+export class CursorMidstreamEchoObserver {
+  private lineBuffer = "";
+  private lineStartOffset = 0;
+  private totalLength = 0;
+  private disarmed = false;
+  private lineDisarmed = false;
+  private corruptionWatch: { finding: MidstreamEchoFinding; remaining: number; window: string } | undefined;
+  private readonly recorded: MidstreamEchoFinding[] = [];
+
+  feed(textDelta: string): void {
+    if (this.disarmed && !this.corruptionWatch) return;
+    let index = 0;
+    while (index < textDelta.length) {
+      const newline = textDelta.indexOf("\n", index);
+      const segment = newline === -1 ? textDelta.slice(index) : textDelta.slice(index, newline);
+      if (this.corruptionWatch) this.watchCorruption(segment + (newline === -1 ? "" : "\n"));
+      if (!this.disarmed && !this.lineDisarmed && segment.length > 0) {
+        this.lineBuffer += segment;
+        if (this.lineBuffer.length > MAX_MIDSTREAM_LINE_INDENT + 32) {
+          // Bound per-line work: nothing beyond the indent cap + longest marker can match.
+          this.lineDisarmed = !this.lineMatchesPrefixSoFar();
+          this.lineBuffer = this.lineBuffer.slice(0, MAX_MIDSTREAM_LINE_INDENT + 32);
+        }
+        this.checkLine();
+      }
+      if (newline === -1) break;
+      this.lineBuffer = "";
+      this.lineDisarmed = false;
+      this.lineStartOffset = this.totalLength + newline + 1;
+      index = newline + 1;
+    }
+    this.totalLength += textDelta.length;
+    if (this.totalLength > MAX_MIDSTREAM_SCAN_LENGTH) this.disarmed = true;
+  }
+
+  findings(): readonly MidstreamEchoFinding[] {
+    if (this.corruptionWatch) {
+      this.settleCorruption();
+    }
+    return this.recorded;
+  }
+
+  private lineMatchesPrefixSoFar(): boolean {
+    const probe = this.lineBuffer.replace(/^[ \t]*/, "");
+    return ECHO_MARKERS.some(marker => probe.startsWith(marker) || marker.startsWith(probe));
+  }
+
+  private checkLine(): void {
+    const indentMatch = /^[ \t]*/.exec(this.lineBuffer);
+    const indent = indentMatch ? indentMatch[0].length : 0;
+    if (indent > MAX_MIDSTREAM_LINE_INDENT) {
+      this.lineDisarmed = true;
+      return;
+    }
+    const probe = this.lineBuffer.slice(indent);
+    for (const marker of ECHO_MARKERS) {
+      if (probe.startsWith(marker)) {
+        // The prefix sniffer owns the very start of the turn; only offsets past
+        // its window count as mid-stream.
+        if (this.lineStartOffset === 0) {
+          this.lineDisarmed = true;
+          return;
+        }
+        const finding: MidstreamEchoFinding = {
+          marker,
+          offset: this.lineStartOffset,
+          callIdCorrupt: false,
+        };
+        this.corruptionWatch = { finding, remaining: MIDSTREAM_CORRUPTION_WINDOW, window: "" };
+        this.lineDisarmed = true;
+        return;
+      }
+    }
+    if (!ECHO_MARKERS.some(marker => marker.startsWith(probe)) && probe.length > 0) {
+      this.lineDisarmed = true;
+    }
+  }
+
+  private watchCorruption(text: string): void {
+    const watch = this.corruptionWatch;
+    if (!watch) return;
+    const take = Math.min(watch.remaining, text.length);
+    watch.window += text.slice(0, take);
+    watch.remaining -= take;
+    if (watch.remaining <= 0) this.settleCorruption();
+  }
+
+  private settleCorruption(): void {
+    const watch = this.corruptionWatch;
+    if (!watch) return;
+    const window = watch.window;
+    watch.finding.callIdCorrupt =
+      /fc_[0-9a-f]+[ \t]+mar-/.test(window)
+      || /call_id: \S+[ \t]+\S+_0\b/.test(window);
+    if (this.recorded.length < MAX_MIDSTREAM_FINDINGS) this.recorded.push(watch.finding);
+    // Window text is discarded here; only booleans/offsets survive.
+    this.corruptionWatch = undefined;
+  }
+}
+
 /**
  * Incremental envelope-prefix sniffer. Leading whitespace is tolerated so a
  * marker copied after a newline is still caught.

package/src/adapters/cursor/request-builder.ts

@@ -12,7 +12,7 @@ import type { CursorRequestMessage, CursorRequestedModelParameter, CursorRunRequ
 import { cursorCheckpointModelAffinityId, cursorWireModelSelection, type CursorRoutingLevel } from "./discovery";
 import { cursorUltraBaseModelId } from "./discovery";
 import { decodeCursorCallId } from "./call-id";
-import { cursorEffortSuffix, cursorRequestWireModelIdWithEffort } from "./effort-map";
+import { cursorGrokFastSelection, resolveCursorSelection } from "./catalog";
 import {
   cursorMcpToolEncodedSize,
   cursorMcpToolsEncodedSize,
@@ -192,20 +192,22 @@ function normalizeCursorModelId(modelId: string, reasoning?: string): {
   routingLevel?: CursorRoutingLevel;
   maxMode?: boolean;
 } {
-  // Synthetic ultra (-1m) picker rows resolve to their wire base with Max Mode on
-  // (devlog 260826 070); the marker never reaches the wire.
-  const ultraBase = cursorUltraBaseModelId(modelId);
-  const selection = cursorWireModelSelection(ultraBase ?? modelId);
-  const maxMode = ultraBase !== undefined ? { maxMode: true } : {};
+  // Router ids (auto / auto-<level>) keep their dedicated wire selection.
+  const selection = cursorWireModelSelection(modelId);
+  if (selection.routingLevel !== undefined || selection.modelId === "default") return selection;
+  // Umbrella catalog resolution (devlog 260828_cursor_umbrella_catalog): one
+  // resolver owns effort composition, variant dimensions, the synthetic -1m
+  // marker (ultra -> Max Mode, evidence-gated), and the cursor- wire prefix.
   const id = selection.modelId;
-  const suffix = cursorEffortSuffix(id, reasoning);
-  if ((id === "grok-4.5-fast" || id === "grok-4.6-fast") && suffix) {
+  // Grok Fast stays parameterized: current Cursor clients send the base id
+  // plus effort/fast parameters instead of the flattened -fast id.
+  const grokFast = cursorGrokFastSelection(id, reasoning);
+  if (grokFast) {
     return {
       ...selection,
-      ...maxMode,
-      modelId: id.slice(0, -"-fast".length),
+      modelId: grokFast.wireBaseId,
       requestedModelParameters: [
-        { id: "effort", value: suffix },
+        { id: "effort", value: grokFast.effort },
         { id: "fast", value: "true" },
       ],
     };
@@ -217,7 +219,12 @@ function normalizeCursorModelId(modelId: string, reasoning?: string): {
       requestedModelParameters: [{ id: "fast", value: "false" }],
     };
   }
-  return { ...selection, ...maxMode, modelId: suffix ? cursorRequestWireModelIdWithEffort(id, suffix) : id };
+  const resolved = resolveCursorSelection(id, reasoning);
+  return {
+    ...selection,
+    ...(resolved.maxMode ? { maxMode: true } : {}),
+    modelId: resolved.wireId,
+  };
 }
 
 function contentPartToText(part: OcxContentPart | OcxAssistantContentPart): string | undefined {

package/src/adapters/cursor/tool-definitions.ts

@@ -3,6 +3,7 @@ import { ValueSchema } from "@bufbuild/protobuf/wkt";
 import type { OcxRequestOptions, OcxTool } from "../../types";
 import { namespacedToolName, toolChoiceAliases } from "../../types";
 import { McpToolDefinitionSchema, McpToolsSchema, type McpToolDefinition } from "./gen/agent_pb";
+import { CODE_MODE_RESULT_ECHO_SENTENCE } from "../exec-tool-result-normalize";
 
 export const OCX_RESPONSES_TOOL_PROVIDER = "opencodex-responses";
 export const CODEX_EXEC_COMMAND_TOOL = "exec_command";
@@ -685,7 +686,7 @@ export function buildCursorToolGuidanceSystemNote(
       ? `\`${CODEX_UNIFIED_EXEC_TOOL}\` is Codex code mode: its body is JavaScript evaluated in a V8 isolate, not a shell command and not Node. Shell, file edits, and MCP are nested helpers called INSIDE that body as \`await tools.<name>(...)\`, for example \`await tools.exec_command({cmd: \"ls\"})\`. Read the tool description and the isolate global \`ALL_TOOLS\` (not \`tools.ALL_TOOLS\`) for helpers this turn provides; absence from the top-level catalog or from \`exec\`'s description is not absence. Those nested helpers are not themselves top-level tools, so do not call \`exec_command\` or \`shell_command\` at the top level here${codeModeOtherTopLevelNames.length > 0 ? `; every other tool this turn lists, including ${quotedNames(codeModeOtherTopLevelNames)}, remains callable at the top level as usual` : ""}. Nested \`tools.apply_patch(input)\` is host-executed: the string must begin exactly with \`*** Begin Patch\` and end with \`*** End Patch\` (no trailing \`***\` on those lines). OpenCodex does not rewrite JavaScript inside exec, so a decorated \`*** Begin Patch ***\` envelope is rejected by Codex before the file is touched.`
       : undefined,
     codeMode
-      ? "In code mode the isolate returns nothing on its own: call `text(...)` (or `notify(...)`) on any value you need to see, or the call completes with empty output. There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers."
+      ? CODE_MODE_RESULT_ECHO_SENTENCE + " There is no `require`, no `module`, and no filesystem or network globals; reach the host only through the nested helpers."
       : undefined,
     codeMode
       ? 'When commands require network access, file writes outside workspace, or fail due to sandbox/permission restrictions, pass `sandbox_permissions: "require_escalated"` and a clear `justification: "..."` to `tools.exec_command`.'

package/src/adapters/cursor/tool-result-normalize.ts

@@ -9,6 +9,23 @@
  * dropping images oldest-first — see toolCallStep in protobuf-request.ts).
  */
 
+import {
+  EMPTY_EXEC_OUTPUT_MESSAGE,
+  EMPTY_EXEC_OUTPUT_REGEX,
+  FAILED_EXEC_OUTPUT_MESSAGE,
+  FAILED_EXEC_OUTPUT_REGEX,
+  isCodexExecBridgeTool,
+} from "../exec-tool-result-normalize";
+
+/**
+ * Cursor treats a failed-but-empty wrapper as an empty result too (its Computer Use branch marks
+ * such results `isError` separately). The shared success regex deliberately excludes
+ * `Script failed`, so restore that arm here rather than widening the shared one.
+ */
+function isEmptyOrFailedExecWrapper(text: string): boolean {
+  return EMPTY_EXEC_OUTPUT_REGEX.test(text) || FAILED_EXEC_OUTPUT_REGEX.test(text);
+}
+
 const COMPUTER_USE_TOOL_NAMES = new Set([
   "node_repl",
   "node_repl__js",
@@ -29,31 +46,6 @@ function isNodeReplOrComputerUseTool(toolName?: string, toolNamespace?: string):
   return lower.startsWith("mcp__node_repl") || lower.startsWith("mcp__computer_use");
 }
 
-/**
- * Codex exec / shell-bridge tool names (flat and MCP-prefixed display aliases). An empty result
- * here is almost always a code-mode cell that never called text()/notify() — the cursor model
- * reads the blank [tool_result], concludes prior results were lost, and spirals into
- * re-orientation retries (devlog 260826_cursor_responses_gap, live subagent transcripts).
- */
-function isCodexExecBridgeTool(toolName?: string, toolNamespace?: string): boolean {
-  if (toolNamespace && toolNamespace.includes("opencodex-responses")) return true;
-  if (!toolName) return false;
-  const lower = toolName.toLowerCase();
-  return (
-    lower === "exec"
-    || lower === "exec_command"
-    || lower === "shell_command"
-    // Codex CLI/desktop native tool names: the multi-round "이전 출력이 비어 있어 처음부터"
-    // restart loop reproduced via codex exec because `shell` was not in this set
-    // (devlog 260826 gap-8 QA round 2).
-    || lower === "shell"
-    || lower === "local_shell"
-    || lower === "container.exec"
-    || lower.startsWith("mcp_opencodex-responses_")
-    || lower.startsWith("mcp__opencodex-responses__")
-  );
-}
-
 /** Failure states the Computer Use / node_repl runtime reports as PLAIN TEXT inside a non-error result. */
 const RUNTIME_FAILURE_GUIDANCE: ReadonlyArray<{ marker: string; guidance: string }> = [
   {
@@ -90,9 +82,6 @@ const RUNTIME_FAILURE_GUIDANCE: ReadonlyArray<{ marker: string; guidance: string
   },
 ];
 
-/** Matches exec wrappers whose only payload is an empty-output marker. */
-const EMPTY_EXEC_OUTPUT_REGEX = /^(?:(?:Script completed|Script failed|Command finished|Execution finished)[^\n]*\n+)?(?:Wall time[^\n]*\n+)?(?:Output:\s*)?(?:<empty>)?\s*$/;
-
 export interface NormalizedToolResultText {
   text: string;
   isError: boolean;
@@ -114,16 +103,19 @@ export function normalizeCursorToolResultText(
 ): NormalizedToolResultText {
   const isError = options.isError === true;
   const computerUse = isNodeReplOrComputerUseTool(options.toolName, options.toolNamespace);
-  if (computerUse && EMPTY_EXEC_OUTPUT_REGEX.test(text.trim())) {
+  if (computerUse && isEmptyOrFailedExecWrapper(text.trim())) {
     return {
       text: "[empty output: the tool ran but produced no stdout or return value. Verify application state with get_app_state, or make the script emit output.]",
       isError: true,
       changed: true,
     };
   }
-  if (isCodexExecBridgeTool(options.toolName, options.toolNamespace) && EMPTY_EXEC_OUTPUT_REGEX.test(text.trim())) {
+  if (isCodexExecBridgeTool(options.toolName, options.toolNamespace) && isEmptyOrFailedExecWrapper(text.trim())) {
     return {
-      text: "[empty output: the exec cell completed but emitted nothing. This is NOT lost context and NOT a blocked tool — in code mode call text(...) or notify(...) on any value you need to see (a bare await tools.exec_command(...) is not echoed automatically); in shell mode the command simply printed nothing. Do not re-run the same call expecting different output.]",
+      // A `Script failed` wrapper is empty but NOT a success: reporting it as an empty success
+      // would erase the only failure signal. Text classification stays separate from Cursor's
+      // isError policy, which the Computer Use branch above owns.
+      text: FAILED_EXEC_OUTPUT_REGEX.test(text.trim()) ? FAILED_EXEC_OUTPUT_MESSAGE : EMPTY_EXEC_OUTPUT_MESSAGE,
       isError: false,
       changed: true,
     };

package/src/adapters/cursor.ts

@@ -41,6 +41,7 @@ import {
   CURSOR_ECHO_RETRY_CONTINUATION_TEXT,
   CURSOR_ROUTING_COMMENTARY_RETRY_TEXT,
   CursorEnvelopeEchoSniffer,
+  CursorMidstreamEchoObserver,
   CursorRoutingCommentaryError,
   CursorRoutingCommentarySniffer,
   CursorToolResultEchoError,
@@ -256,6 +257,9 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             isCursorExternalWireModel(activeRequest.modelId)
             && (_parsed.context.messages ?? []).some(message => message.role === "toolResult");
           const echoSniffer = armEchoSniffer ? new CursorEnvelopeEchoSniffer() : undefined;
+          // Mid-stream observer (devlog 260828 F1/F2): diagnostic-only; armed with the
+          // prefix sniffer because both fire on flattened tool-result replay priming.
+          const midstreamObserver = armEchoSniffer ? new CursorMidstreamEchoObserver() : undefined;
           const armRoutingCommentarySniffer =
             isCursorExternalWireModel(activeRequest.modelId)
             && (
@@ -266,10 +270,16 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             ? new CursorRoutingCommentarySniffer()
             : undefined;
           let guardHeld: AdapterEvent[] = [];
+          // Exactly-once observation: every client-bound text delta passes through here
+          // exactly once — held deltas only on release, ordinary deltas at emit time.
+          const emitTextObserved = (event: AdapterEvent): void => {
+            if (event.type === "text_delta") midstreamObserver?.feed(event.text);
+            emit(event);
+          };
           const releaseGuardHeld = () => {
             for (const held of guardHeld) {
               if (held.type !== "heartbeat") emittedOutput = true;
-              emit(held);
+              emitTextObserved(held);
             }
             guardHeld = [];
           };
@@ -348,6 +358,15 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
                 }
                 if (event.type !== "heartbeat") emittedOutput = true;
                 if (event.type === "done") {
+                  for (const finding of midstreamObserver?.findings() ?? []) {
+                    debugProviderDiagnostic("cursor", "midstream-envelope-echo", {
+                      wireModel: activeRequest.modelId,
+                      conversationHash: activeRequest.conversationId.slice(0, 16),
+                      marker: finding.marker,
+                      offset: finding.offset,
+                      callIdCorrupt: finding.callIdCorrupt,
+                    });
+                  }
                   commitCapturedCheckpoint(activeRequest);
                   const inheritedCursor = _parsed._providerContinuation?.cursor;
                   const isolatedOrCompaction =
@@ -367,7 +386,7 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
                     : undefined;
                   emit(providerState ? { ...event, providerState } : event);
                 } else {
-                  emit(event);
+                  emitTextObserved(event);
                 }
               }
             },

package/src/adapters/exec-tool-result-normalize.ts

@@ -0,0 +1,99 @@
+/**
+ * Provider-neutral empty-exec-output normalization.
+ *
+ * A code-mode `exec` cell that never calls `text()`/`notify()` returns nothing: the last
+ * expression value is NOT echoed automatically. The routed model reads a blank tool result,
+ * concludes its earlier output was lost, and burns turns re-running the same call or restarting
+ * the task from scratch. Naming that state explicitly is what breaks the loop.
+ *
+ * This module owns the shared detection so every adapter reports the same thing. Cursor keeps its
+ * own wrapper (`normalizeCursorToolResultText`) for Computer Use precedence and isError policy;
+ * Kiro consumes this helper directly.
+ */
+
+/**
+ * Matches exec wrappers whose only payload is an empty-output marker.
+ *
+ * `Script failed` is deliberately NOT in this set. A failed cell with no captured output is still
+ * a FAILURE, and the success guidance below ("not a blocked tool", "do not re-run") would erase the
+ * only signal that anything went wrong — reachable through Responses history, where
+ * `function_call_output` is parsed with `isError: false`. Cursor keeps its own broader regex for
+ * Computer Use, where a failed wrapper is separately marked `isError`.
+ */
+export const EMPTY_EXEC_OUTPUT_REGEX = /^(?:(?:Script completed|Command finished|Execution finished)[^\n]*\n+)?(?:Wall time[^\n]*\n+)?(?:Output:\s*)?(?:<empty>)?\s*$/;
+
+/** Wrapper for a cell that FAILED without emitting output: empty, but not a success. */
+export const FAILED_EXEC_OUTPUT_REGEX = /^Script failed[^\n]*\n*(?:Wall time[^\n]*\n*)?(?:Output:\s*)?(?:<empty>)?\s*$/;
+
+/** Guidance for a failed cell whose output was empty: the failure must survive normalization. */
+export const FAILED_EXEC_OUTPUT_MESSAGE =
+  "[exec failed with no captured output: the cell raised before emitting anything. This is a real failure, not an empty success — inspect the call for a thrown error or syntax problem before retrying.]";
+
+/**
+ * The guidance itself. Worded to close all three wrong conclusions a model draws from a blank
+ * result: that context was lost, that the tool is blocked, and that retrying will differ.
+ */
+export const EMPTY_EXEC_OUTPUT_MESSAGE =
+  "[empty output: the exec cell completed but emitted nothing. This is NOT lost context and NOT a blocked tool — in code mode call text(...) or notify(...) on any value you need to see (a bare await tools.exec_command(...) is not echoed automatically); in shell mode the command simply printed nothing. Do not re-run the same call expecting different output.]";
+
+/**
+ * The SAME rule stated BEFORE the first call, for the code-mode tool-catalog nudge.
+ *
+ * `EMPTY_EXEC_OUTPUT_MESSAGE` above is a repair: it fires only after a model has already spent a
+ * call and read a blank result. That recovers the turn but cannot prevent the wasted round trip,
+ * and the model still has to guess whether its command failed or its output was merely dropped.
+ * Stating the echo rule up front removes the failure instead of explaining it afterwards.
+ *
+ * Kept beside the recovery text on purpose: the two are one pair guarding one defect, and wording
+ * that drifts apart is how a model gets told two different things about the same isolate.
+ */
+export const CODE_MODE_RESULT_ECHO_SENTENCE =
+  "Nothing in the isolate is echoed automatically: a bare trailing `await tools.<name>(...)` or final expression value is DISCARDED, and the cell reports empty output. Pass anything you need to read to `text(...)` (or `notify(...)`) in the same cell — for example `text(JSON.stringify(await tools.exec_command({cmd: \"ls\"})))` — and treat an empty result as your own missing `text(...)` call rather than a failed command or lost context.";
+
+/**
+ * Codex exec / shell-bridge tool names (flat and MCP-prefixed display aliases). An empty result
+ * here is almost always a code-mode cell that never called text()/notify().
+ */
+export function isCodexExecBridgeTool(toolName?: string, toolNamespace?: string): boolean {
+  if (toolNamespace && toolNamespace.includes("opencodex-responses")) return true;
+  if (!toolName) return false;
+  const lower = toolName.toLowerCase();
+  return (
+    lower === "exec"
+    || lower === "exec_command"
+    || lower === "shell_command"
+    // Codex CLI/desktop native tool names: the multi-round "이전 출력이 비어 있어 처음부터"
+    // restart loop reproduced via codex exec because `shell` was not in this set
+    // (devlog 260826 gap-8 QA round 2).
+    || lower === "shell"
+    || lower === "local_shell"
+    || lower === "container.exec"
+    || lower.startsWith("mcp_opencodex-responses_")
+    || lower.startsWith("mcp__opencodex-responses__")
+  );
+}
+
+/** True when this result is an exec-bridge call that produced no usable output. */
+export function isEmptyExecToolResult(
+  text: string,
+  options: { toolName?: string; toolNamespace?: string } = {},
+): boolean {
+  return isCodexExecBridgeTool(options.toolName, options.toolNamespace)
+    && EMPTY_EXEC_OUTPUT_REGEX.test(text.trim());
+}
+
+/**
+ * Returns the guidance text when this is an empty exec-bridge result, else `undefined` so the
+ * caller keeps its own fallback. Undefined rather than the original text: an adapter must be able
+ * to tell "not my case" from "normalized to the same string".
+ */
+export function normalizeEmptyExecToolResultText(
+  text: string,
+  options: { toolName?: string; toolNamespace?: string } = {},
+): string | undefined {
+  if (!isCodexExecBridgeTool(options.toolName, options.toolNamespace)) return undefined;
+  const trimmed = text.trim();
+  // Failure first: a failed wrapper must never be described as an empty success.
+  if (FAILED_EXEC_OUTPUT_REGEX.test(trimmed)) return FAILED_EXEC_OUTPUT_MESSAGE;
+  return EMPTY_EXEC_OUTPUT_REGEX.test(trimmed) ? EMPTY_EXEC_OUTPUT_MESSAGE : undefined;
+}