cartethyia 2.7.7 → 2.7.9

package/src/providers/integrations/cursor/cursor-http2.ts

@@ -16,6 +16,7 @@ import {
   FALLBACK_CLIENT_VERSION,
   RUN_PATH,
   isAllowedAgentHost,
+  resolveCursorTimezone,
 } from "./cursor-shared";
 import { createCursorChecksumHeader, resolveCursorDeviceIds } from "./cursor-identity";
 
@@ -102,6 +103,7 @@ async function runHeaders(credential: string, clientVersion: string): Promise<Re
     "x-cursor-streaming": "true",
     "x-ghost-mode": "true",
     "x-request-id": crypto.randomUUID(),
+    ...(resolveCursorTimezone() === "" ? {} : { "x-cursor-timezone": resolveCursorTimezone() }),
     "user-agent": "connect-es/1.6.1",
   };
 }

package/src/providers/integrations/cursor/cursor-request.ts

@@ -23,8 +23,6 @@ import { encodeJsonAsValue } from "./protocol/struct";
 // a caller has to discover separately.
 export {
   CURSOR_TOOL_VARIANTS,
-  CursorToolCallProvenance,
-  cursorNativeToolDeclaration,
   cursorToolArm,
   decodeCursorNativeToolCall,
 } from "./protocol/tool-canonical";
@@ -440,15 +438,18 @@ export function buildMcpRejected(
  * `ACM#2 exec_client_message{*_allowlist_precheck_result}` for frames 41/42/43.
  *
  * Cursor asks whether a shell command, MCP tool, or web fetch would be
- * permitted *before* it emits the real call. This gateway executes none of its
- * own surface, so every precheck is answered `allowlisted: false` — the model
- * never learns otherwise than that the tool must be routed through the
- * advertised MCP channel it was told about.
+ * permitted *before* it emits the real call.
+ *
+ * - `shell` → `true`: the native executor runs shell locally.
+ * - `mcp` → `true` only when the tool is client-declared (relayed); the
+ *   caller decides on the `allowlisted` flag.
+ * - `web_fetch` → `false`: web fetch is not executed by this gateway.
  */
 export function buildAllowlistPrecheckResult(
   execId: number,
   kind: "shell" | "mcp" | "web_fetch",
-  execIdString?: string,
+  execIdString: string | undefined,
+  allowlisted: boolean,
 ): Uint8Array {
   const frame =
     kind === "shell"
@@ -457,7 +458,7 @@ export function buildAllowlistPrecheckResult(
         ? "mcp_allowlist_precheck_result"
         : "web_fetch_allowlist_precheck_result";
   return encodeMessage("AgentClientMessage", {
-    exec_client_message: { id: execId, exec_id: execIdString ?? "", [frame]: { allowlisted: false } },
+    exec_client_message: { id: execId, exec_id: execIdString ?? "", [frame]: { allowlisted } },
   });
 }
 

package/src/providers/integrations/cursor/cursor-shared.ts

@@ -33,7 +33,7 @@ export const CURSOR_OAUTH_CLIENT_ID = "KbZUR41cY7W6zRSdpSUJ7I7mLYBKOCmB";
  * operator was not what the request carried. Discovery supersedes both on its
  * first successful fetch.
  */
-export const FALLBACK_CLIENT_VERSION = "cli-2026.10.19-6bbf2c4";
+export const FALLBACK_CLIENT_VERSION = "cli-3.29.9-306d153";
 
 /** Connect-RPC paths. Run is served by the discovered agent origin, not the API host. */
 export const RUN_PATH = "/agent.v1.AgentService/Run";
@@ -44,6 +44,24 @@ export const SERVER_CONFIG_PATH = "/aiserver.v1.ServerConfigService/GetServerCon
 export const CONTENT_TYPE_CONNECT_PROTO = "application/connect+proto";
 export const CONNECT_PROTOCOL_VERSION = "1";
 
+/**
+ * The client's timezone name, as the CLI sends on every request
+ * (`Intl.DateTimeFormat().resolvedOptions().timeZone`). Computed once: the
+ * value is stable for one process and the call is not cheap enough to repeat
+ * per request.
+ */
+let cachedTimezone: string | undefined;
+export function resolveCursorTimezone(): string {
+  if (cachedTimezone !== undefined) return cachedTimezone;
+  try {
+    const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    cachedTimezone = typeof zone === "string" && zone.length > 0 ? zone : "";
+  } catch {
+    cachedTimezone = "";
+  }
+  return cachedTimezone;
+}
+
 /** A raw Cursor API key (as opposed to a JWT already exchanged from one). */
 const CURSOR_API_KEY_PREFIX = "crsr_";
 

package/src/providers/integrations/cursor/cursor.ts

@@ -61,7 +61,8 @@ import { fetchCursorRunOrigin } from "./cursor-catalog";
 import { defaultParameterValues, fetchCursorModels } from "./cursor-catalog";
 import type { CursorModelInfo } from "./cursor-catalog";
 import { decodeValueToJson, decodeStructEntriesToJson } from "./protocol/struct";
-import { cursorVariantForExecArgs } from "./protocol/tool-canonical";
+import { encodeMessage } from "./protocol/messages";
+import { executeNativeTool, resolveExecFrame } from "./cursor-exec";
 import { fnv1a32 } from "../shared/hash";
 
 /**
@@ -929,6 +930,8 @@ class CursorAdapter implements ProviderAdapter {
         if (execServer !== undefined) {
           const handled = await this.#handleExecServerMessage(execServer, session, handle);
           if (handled.kind !== "tool_call") continue;
+          // Only MCP arms are relayed to the client for execution (client-
+          // declared tools). Native tools are answered in-band by the executor.
           const callId = `call_cursor_${runId}_${handled.execId}`;
           const scope = context.continuation_scope;
           if (scope === undefined) {
@@ -1107,9 +1110,9 @@ class CursorAdapter implements ProviderAdapter {
       return { kind: "handled" };
     }
     // Allowlist prechecks precede the real call. They are approval probes, not
-    // invocations — this gateway advertises every executable surface through
-    // the MCP channel, so its own host surface is never allowlisted and the
-    // typed result frame (not an mcp_result) is what the server waits on.
+    // invocations. Shell is allowlisted because the native executor runs it
+    // locally; MCP is allowlisted only when the tool is client-declared
+    // (relayed to the client); web fetch is never executed and stays denied.
     const precheckKind = recordOf(execServer["shell_allowlist_precheck_args"]) !== undefined
       ? "shell"
       : recordOf(execServer["mcp_allowlist_precheck_args"]) !== undefined
@@ -1118,35 +1121,37 @@ class CursorAdapter implements ProviderAdapter {
           ? "web_fetch"
           : undefined;
     if (precheckKind !== undefined) {
-      await handle.write(buildAllowlistPrecheckResult(execId, precheckKind, execIdString));
+      const allowlisted =
+        precheckKind === "shell" ? true
+        : precheckKind === "web_fetch" ? false
+        : this.mcpArgsAreDeclared(execServer, session.descriptors);
+      await handle.write(buildAllowlistPrecheckResult(execId, precheckKind, execIdString, allowlisted));
       return { kind: "handled" };
     }
-    // Native first. A Cursor host-exec frame (`read_args`, `shell_args`,
-    // `pi_read_args`, …) is relayed to the client as an ordinary tool call
-    // instead of being refused. This is the half the earlier direct-forward
-    // attempt got wrong: it built typed result frames by hand per variant and
-    // they were not matched by the server. The canonical layer owns that
-    // mapping now, keyed by the originating variant, so a result can only ever
-    // come back in the arm it arrived on.
-    const nativeCall = cursorVariantForExecArgs(execServer);
-    // Only a tool the request actually declared may be relayed. A host frame
-    // for something the client never advertised is an undeclared tool like any
-    // other and keeps the refusal — forwarding it would hand the client a call
-    // it has no handler for and nowhere to send the result.
-    const declaredNative = nativeCall !== undefined &&
-      session.descriptors.some((d) => d.toolName === nativeCall.variant.name);
-    if (nativeCall !== undefined && declaredNative) {
-      return {
-        kind: "tool_call",
-        execId,
-        execIdString,
-        toolName: nativeCall.variant.name,
-        arguments: JSON.stringify(nativeCall.args),
-      };
+    // Native exec frames (`read_args`, `shell_args`, `ct_read_args`, …) are
+    // executed locally by this gateway — not relayed to the client and not
+    // refused. The executor returns the wire result message for the frame's
+    // result oneof, so a reply can only come back in the arm it arrived on.
+    // Frames the executor does not implement fall through to the refusal.
+    const execFrame = resolveExecFrame(execServer);
+    if (execFrame !== undefined) {
+      const executed = await executeNativeTool(execFrame.frameKey, execFrame.args, process.cwd());
+      if (executed !== undefined) {
+        await handle.write(
+          encodeMessage("AgentClientMessage", {
+            exec_client_message: {
+              id: execId,
+              exec_id: execIdString ?? "",
+              [executed.field]: executed.message,
+            },
+          }),
+        );
+        return { kind: "handled" };
+      }
     }
-    // MCP is the fallback, not the first stop: client-declared tools have no
-    // native slot in `agent.proto`, so they are the ones that must travel this
-    // channel. An arm neither path claims falls through to the refusal below.
+    // MCP remains for client-declared tools: they have no native slot, so a
+    // declared `mcp_args` arm is relayed to the client as an ordinary tool
+    // call. Undeclared MCP is refused.
     const mcpArgs = recordOf(execServer["mcp_args"]);
     if (mcpArgs !== undefined) {
       const call = readExecutableMcpCall(mcpArgs, session.descriptors);
@@ -1170,6 +1175,21 @@ class CursorAdapter implements ProviderAdapter {
     return { kind: "handled" };
   }
 
+  /**
+   * True when an MCP allowlist precheck targets a tool the request actually
+   * declared (so it can be relayed to the client). Undeclared MCP is denied.
+   */
+  mcpArgsAreDeclared(
+    execServer: Record<string, unknown>,
+    descriptors: readonly CursorToolDescriptor[],
+  ): boolean {
+    const precheck = recordOf(execServer["mcp_allowlist_precheck_args"]);
+    if (precheck === undefined) return false;
+    const toolName = nonEmptyStringOf(precheck["tool_name"]);
+    if (toolName === undefined) return false;
+    return descriptors.some((d) => d.toolName === toolName);
+  }
+
   /**
    * Answers one interaction query so the Run RPC can continue.
    *

package/src/providers/integrations/cursor/protocol/tool-canonical.ts

@@ -1,27 +1,27 @@
 // Cursor-native tool calls, unified into one canonical shape.
 //
-// Cursor's `agent.v1.ToolCall` is a oneof of ~30 variants spanning three
-// unrelated generations: the legacy natives (`ReadToolCall` 8, `ShellToolCall`
-// 1, `EditToolCall` 12, …), the modern exec family (`PiReadToolCall` 61 …
-// `PiLsToolCall` 67), and MCP (`McpToolCall` 15). Each carries its own args
-// message and its own `*ToolResult` oneof of `success`/`error`, so handling
-// them individually meant a decoder and a builder per variant — most of them
-// saying the same thing.
+// Cursor's `agent.v1.ToolCall` is a oneof of ~30 variants spanning several
+// generations: the legacy natives (`ReadToolCall` 8, `ShellToolCall` 1,
+// `EditToolCall` 12, …) and the modern exec family (`PiReadToolCall` 61 …
+// `PiLsToolCall` 67). Each carries its own args message and its own
+// `*ToolResult` oneof of `success`/`error`.
 //
 // This module is the single join point. One table maps a wire variant to a
 // canonical tool identity, and the decode/encode paths below are written once
 // against that table rather than once per variant.
 //
-// **Variants stay separate.** `ReadToolCall` and `PiReadToolCall` are two tools,
-// not one tool seen twice: their args and their result shapes genuinely differ,
-// and folding them would mean picking one shape and lying about the other. A
-// new variant is one table row, not a new converter.
+// **Generation aliases collapse to one canonical name.** `ReadToolCall` and
+// `PiReadToolCall` are the *same tool* across two wire generations — the pi_
+// family is the modern executor, the legacy family the older surface. They are
+// folded onto one name (`read`, `shell`, `edit`, `write`, `grep`, `find`,
+// `ls`) so callers reason about tools, not about which wire arm carried them.
+// The `field`/`argsType`/`resultType` still differ per row, so encode/decode
+// round-trips preserve the exact arm that arrived.
 //
 // **Cursor-scoped on purpose.** Nothing here is shared with the other provider
-// integrations. The canonical vocabulary is Cursor's own (`read`, `pi_read`,
-// `shell`, …), so a tool named `read` on Cursor and a `read` on some other
+// integrations. The canonical vocabulary is Cursor's own (`read`, `shell`,
+// `edit`, …), so a tool named `read` on Cursor and a `read` on some other
 // provider are unrelated and cannot collide through a shared registry.
-import type { ToolDefinition } from "../../../../protocol/canonical-model";
 
 /**
  * One `ToolCall` oneof arm, as it exists on the wire.
@@ -41,9 +41,8 @@ export interface CursorToolVariant {
   /**
    * Canonical tool name for this variant.
    *
-   * Deliberately not shared across generations: `read` and `pi_read` are two
-   * names because they are two tools. A caller that wants both treats them as
-   * both; a caller that wants one filters on one.
+   * Shared across wire generations: `read` is both `ReadToolCall` and
+   * `PiReadToolCall`.
    */
   readonly name: string;
 }
@@ -59,14 +58,18 @@ const VARIANT = (
 /**
  * Every Cursor-native tool variant this layer speaks, keyed by oneof field.
  *
- * `McpToolCall` is absent on purpose: client-declared tools have no native
- * slot anywhere in `agent.proto` — `RequestContext.tools` (#7) is
- * `repeated McpToolDefinition` and `AgentRunRequest.mcp_tools` (#4) is the only
- * other place tools travel — so those stay on the MCP meta-tool path. This
- * table is for the arms Cursor itself owns.
+ * MCP (`McpToolCall`) is intentionally absent: the gateway no longer speaks
+ * the MCP meta-tool channel. Client-declared tools have no native slot in
+ * `agent.proto`; they are not advertised and any inbound MCP arm is refused.
  */
 export const CURSOR_TOOL_VARIANTS: ReadonlyMap<number, CursorToolVariant> = new Map([
   VARIANT(1, "ShellToolCall", "ShellArgs", "ShellResult", "shell"),
+  // Legacy write has no ToolCall oneof arm — it arrives only as
+  // `ExecServerMessage.write_args` (field 3). The variant is registered with
+  // a dedicated field number so the executor can resolve it without colliding
+  // with `DeleteToolCall` (which also owns field 3); the field is otherwise
+  // unused by the ToolCall path.
+  VARIANT(0, "WriteToolCall", "WriteArgs", "WriteResult", "write"),
   VARIANT(3, "DeleteToolCall", "DeleteArgs", "DeleteResult", "delete"),
   VARIANT(4, "GlobToolCall", "GlobArgs", "GlobResult", "glob"),
   VARIANT(5, "GrepToolCall", "GrepArgs", "GrepResult", "grep"),
@@ -93,14 +96,6 @@ export const CURSOR_TOOL_VARIANTS: ReadonlyMap<number, CursorToolVariant> = new
   VARIANT(32, "ReflectToolCall", "ReflectArgs", "ReflectResult", "reflect"),
   VARIANT(33, "SetupVmEnvironmentToolCall", "SetupVmEnvironmentArgs", "SetupVmEnvironmentResult", "setup_vm_environment"),
   VARIANT(34, "TruncatedToolCall", "TruncatedArgs", "TruncatedResult", "truncated"),
-  // The modern exec family. Same join point, separate identities.
-  VARIANT(61, "PiReadToolCall", "PiReadToolArgs", "PiReadExecResult", "pi_read"),
-  VARIANT(62, "PiBashToolCall", "PiBashToolArgs", "PiBashExecResult", "pi_bash"),
-  VARIANT(63, "PiEditToolCall", "PiEditToolArgs", "PiEditExecResult", "pi_edit"),
-  VARIANT(64, "PiWriteToolCall", "PiWriteToolArgs", "PiWriteExecResult", "pi_write"),
-  VARIANT(65, "PiGrepToolCall", "PiGrepToolArgs", "PiGrepExecResult", "pi_grep"),
-  VARIANT(66, "PiFindToolCall", "PiFindToolArgs", "PiFindExecResult", "pi_find"),
-  VARIANT(67, "PiLsToolCall", "PiLsToolArgs", "PiLsExecResult", "pi_ls"),
 ].map((entry) => [entry.field, entry]));
 
 /**
@@ -126,8 +121,7 @@ type OneofArm = { readonly field: number; readonly payload: Record<string, unkno
  *
  * A oneof has exactly one populated field; a message with none is not a tool
  * call at all and is reported as `undefined` rather than guessed at. An arm
- * this layer does not know is also `undefined` — that is what leaves room for
- * MCP to claim it.
+ * this layer does not know is also `undefined`.
  */
 export function cursorToolArm(
   toolCall: Record<string, unknown>,
@@ -205,71 +199,3 @@ function snakeCaseKey(key: string): string {
     .replace(/[\s-]+/g, "_")
     .toLowerCase();
 }
-
-/**
- * The variant whose args a host-exec frame is carrying.
- *
- * Exec frames name their payload after the args message — `read_args`,
- * `shell_args`, `pi_read_args` — not after the `ToolCall` arm, so the lookup
- * runs off `argsType`. Anything not ending in `_args` is not a tool payload
- * (`id`, `exec_id`, `request_context_args`, …) and is reported as `undefined`.
- */
-export function cursorVariantForExecArgs(
-  execServer: Record<string, unknown>,
-): { readonly variant: CursorToolVariant; readonly args: Record<string, unknown> } | undefined {
-  for (const [key, value] of Object.entries(execServer)) {
-    if (value === null || value === undefined || !key.endsWith("_args")) continue;
-    const wanted = key.slice(0, -"_args".length);
-    const variant = [...CURSOR_TOOL_VARIANTS.values()].find((entry) =>
-      entry.argsType.toLowerCase().startsWith(wanted.toLowerCase()),
-    );
-    if (variant === undefined) continue;
-    return {
-      variant,
-      args: canonicalToolArguments(value),
-    };
-  }
-  return undefined;
-}
-
-/**
- * The variant an inbound result must be encoded back into.
- *
- * Keyed by `call_id`, which is what the response carries and what the client
- * echoes on the result. Consulted before encoding so a result for a tool this
- * layer never decoded is not invented into some other variant's shape.
- */
-export class CursorToolCallProvenance {
-  readonly #byCallId = new Map<string, CursorToolVariant>();
-
-  record(callId: string, variant: CursorToolVariant): void {
-    this.#byCallId.set(callId, variant);
-  }
-
-  lookup(callId: string): CursorToolVariant | undefined {
-    return this.#byCallId.get(callId);
-  }
-
-  /** Drops one call's provenance once its result has been encoded. */
-  complete(callId: string): void {
-    this.#byCallId.delete(callId);
-  }
-}
-
-/**
- * A tool declaration the gateway can advertise for Cursor-native tools.
- *
- * Kept separate from `ToolDefinition`'s own name on purpose: the canonical name
- * (`pi_read`) is not the name a client's schema would use, so advertising one
- * under the other would make the call/result round trip undecidable.
- */
-export function cursorNativeToolDeclaration(
-  variant: CursorToolVariant,
-  description: string,
-): ToolDefinition {
-  return {
-    name: variant.name,
-    description,
-    jsonSchema: { type: "object", properties: {} },
-  };
-}