cartethyia 2.7.8 → 2.8.0

package/src/providers/integrations/cursor/cursor-http2.ts

@@ -16,6 +16,7 @@ import {
   FALLBACK_CLIENT_VERSION,
   RUN_PATH,
   isAllowedAgentHost,
+  resolveCursorTimezone,
 } from "./cursor-shared";
 import { createCursorChecksumHeader, resolveCursorDeviceIds } from "./cursor-identity";
 
@@ -102,6 +103,7 @@ async function runHeaders(credential: string, clientVersion: string): Promise<Re
     "x-cursor-streaming": "true",
     "x-ghost-mode": "true",
     "x-request-id": crypto.randomUUID(),
+    ...(resolveCursorTimezone() === "" ? {} : { "x-cursor-timezone": resolveCursorTimezone() }),
     "user-agent": "connect-es/1.6.1",
   };
 }

package/src/providers/integrations/cursor/cursor-request.ts

@@ -23,8 +23,6 @@ import { encodeJsonAsValue } from "./protocol/struct";
 // a caller has to discover separately.
 export {
   CURSOR_TOOL_VARIANTS,
-  CursorToolCallProvenance,
-  cursorNativeToolDeclaration,
   cursorToolArm,
   decodeCursorNativeToolCall,
 } from "./protocol/tool-canonical";
@@ -221,7 +219,9 @@ export function systemPromptFrom(request: CanonicalRequest): string | undefined
  */
 export function historyFromRequest(request: CanonicalRequest): CursorHistoryEntry[] {
   const entries: CursorHistoryEntry[] = [];
-  for (const message of request.messages) {
+  const liveIndex = lastLiveUserMessageIndex(request);
+  for (const [index, message] of request.messages.entries()) {
+    if (index === liveIndex) continue;
     const text = messageText(message);
     if (text.trim().length === 0) continue;
     if (message.role === "assistant") entries.push({ role: "assistant", content: text });
@@ -237,9 +237,6 @@ export function buildRunRequest(input: {
   readonly text: string;
   readonly modelId: string;
   readonly conversationId: string;
-  /** Stable parent group; unlike the conversation id it survives a rebase. */
-  readonly conversationGroupId?: string;
-  readonly runId?: string;
   readonly messageId?: string;
   readonly history?: readonly CursorHistoryEntry[];
   /** Cursor-declared parameter tuple (effort/context/fast) for this model. */
@@ -279,12 +276,17 @@ export function buildRunRequest(input: {
   userMessageAction["request_context"] = requestContext;
   const runRequest: Record<string, unknown> = {
     conversation_id: input.conversationId,
-    conversation_group_id: input.conversationGroupId ?? input.conversationId,
-    run_id: input.runId ?? messageId,
     action:
       input.action === "resume"
         ? { resume_action: { request_context: requestContext } }
         : { user_message_action: userMessageAction },
+    // `model_details` (#3) carries the safe wire id; `requested_model` (#9)
+    // carries the parameter tuple. Matches `agent.proto` exactly — the old
+    // schema invented extra fields that have no wire meaning.
+    model_details: {
+      model_id: input.modelId,
+      max_mode: input.maxMode ?? false,
+    },
     requested_model: {
       model_id: input.modelId,
       max_mode: input.maxMode ?? false,
@@ -292,8 +294,6 @@ export function buildRunRequest(input: {
     },
     conversation_state: seeded ? buildSeedConversationState() : input.conversationState,
     mcp_tools: { mcp_tools: [] },
-    unknown_flag: 0,
-    field_12: 0,
   };
   return encodeMessage("AgentClientMessage", { run_request: runRequest });
 }
@@ -311,9 +311,12 @@ export function buildExecStreamClose(execId: number, execIdString?: string): Uin
 }
 
 /** Stops the live Run, as Cursor CLI does before closing the stream. */
-export function buildCancelAction(reason: string): Uint8Array {
+export function buildCancelAction(_reason: string): Uint8Array {
+  // `agent.proto` CancelAction is empty — the oneof presence is the signal,
+  // and the reason travels out-of-band (stream close). Sending a `reason`
+  // field would encode bytes the server does not expect.
   return encodeMessage("AgentClientMessage", {
-    conversation_action: { cancel_action: { reason } },
+    conversation_action: { cancel_action: {} },
   });
 }
 
@@ -440,15 +443,18 @@ export function buildMcpRejected(
  * `ACM#2 exec_client_message{*_allowlist_precheck_result}` for frames 41/42/43.
  *
  * Cursor asks whether a shell command, MCP tool, or web fetch would be
- * permitted *before* it emits the real call. This gateway executes none of its
- * own surface, so every precheck is answered `allowlisted: false` — the model
- * never learns otherwise than that the tool must be routed through the
- * advertised MCP channel it was told about.
+ * permitted *before* it emits the real call.
+ *
+ * - `shell` → `true`: the native executor runs shell locally.
+ * - `mcp` → `true` only when the tool is client-declared (relayed); the
+ *   caller decides on the `allowlisted` flag.
+ * - `web_fetch` → `false`: web fetch is not executed by this gateway.
  */
 export function buildAllowlistPrecheckResult(
   execId: number,
   kind: "shell" | "mcp" | "web_fetch",
-  execIdString?: string,
+  execIdString: string | undefined,
+  allowlisted: boolean,
 ): Uint8Array {
   const frame =
     kind === "shell"
@@ -457,7 +463,7 @@ export function buildAllowlistPrecheckResult(
         ? "mcp_allowlist_precheck_result"
         : "web_fetch_allowlist_precheck_result";
   return encodeMessage("AgentClientMessage", {
-    exec_client_message: { id: execId, exec_id: execIdString ?? "", [frame]: { allowlisted: false } },
+    exec_client_message: { id: execId, exec_id: execIdString ?? "", [frame]: { allowlisted } },
   });
 }
 
@@ -529,12 +535,21 @@ function toolResultText(part: Extract<ContentPart, { kind: "toolResult" }>): str
  * only the current prompt.
  */
 export function liveUserText(request: CanonicalRequest): string {
+  const index = lastLiveUserMessageIndex(request);
+  if (index === -1) return "";
+  const message = request.messages[index];
+  if (message === undefined) return "";
+  return messageText(message);
+}
+
+/** Index of the current user/tool turn Cursor should send as the live prompt. */
+function lastLiveUserMessageIndex(request: CanonicalRequest): number {
   for (let index = request.messages.length - 1; index >= 0; index -= 1) {
     const message = request.messages[index];
     if (message === undefined) continue;
     if (message.role !== "user" && message.role !== "tool") continue;
     const text = messageText(message);
-    if (text.trim().length > 0) return text;
+    if (text.trim().length > 0) return index;
   }
-  return "";
+  return -1;
 }

package/src/providers/integrations/cursor/cursor-shared.ts

@@ -33,7 +33,7 @@ export const CURSOR_OAUTH_CLIENT_ID = "KbZUR41cY7W6zRSdpSUJ7I7mLYBKOCmB";
  * operator was not what the request carried. Discovery supersedes both on its
  * first successful fetch.
  */
-export const FALLBACK_CLIENT_VERSION = "cli-2026.10.19-6bbf2c4";
+export const FALLBACK_CLIENT_VERSION = "cli-3.29.9-306d153";
 
 /** Connect-RPC paths. Run is served by the discovered agent origin, not the API host. */
 export const RUN_PATH = "/agent.v1.AgentService/Run";
@@ -44,6 +44,24 @@ export const SERVER_CONFIG_PATH = "/aiserver.v1.ServerConfigService/GetServerCon
 export const CONTENT_TYPE_CONNECT_PROTO = "application/connect+proto";
 export const CONNECT_PROTOCOL_VERSION = "1";
 
+/**
+ * The client's timezone name, as the CLI sends on every request
+ * (`Intl.DateTimeFormat().resolvedOptions().timeZone`). Computed once: the
+ * value is stable for one process and the call is not cheap enough to repeat
+ * per request.
+ */
+let cachedTimezone: string | undefined;
+export function resolveCursorTimezone(): string {
+  if (cachedTimezone !== undefined) return cachedTimezone;
+  try {
+    const zone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    cachedTimezone = typeof zone === "string" && zone.length > 0 ? zone : "";
+  } catch {
+    cachedTimezone = "";
+  }
+  return cachedTimezone;
+}
+
 /** A raw Cursor API key (as opposed to a JWT already exchanged from one). */
 const CURSOR_API_KEY_PREFIX = "crsr_";
 
@@ -65,11 +83,14 @@ export const SESSION_REFRESH_TIMEOUT_MS = 20_000;
 
 /**
  * How long a live Cursor Run is held open waiting for the client's next
- * tool-result request. Matches the donor's continuation default: a tool round
- * the client never answers must not hold an HTTP/2 stream, an account lease, or
- * a pool slot for the life of the process.
+ * tool-result request. Matches the donor's relay hold (`CURSOR_RELAY_IDLE_
+ * TIMEOUT_MS` in oh-my-pi: 30 minutes): a tool round the client never answers
+ * must not hold an HTTP/2 stream, an account lease, or a pool slot for the life
+ * of the process, but a human-approved tool round often takes longer than ten
+ * minutes — a shorter TTL expired the Run mid-approval and forced the client to
+ * resend the whole conversation.
  */
-export const RUN_IDLE_TTL_MS = 10 * 60_000;
+export const RUN_IDLE_TTL_MS = 30 * 60_000;
 
 /**
  * Any HTTPS subdomain of `cursor.sh` is an acceptable Run host: the region

package/src/providers/integrations/cursor/cursor.ts

@@ -61,8 +61,10 @@ import { fetchCursorRunOrigin } from "./cursor-catalog";
 import { defaultParameterValues, fetchCursorModels } from "./cursor-catalog";
 import type { CursorModelInfo } from "./cursor-catalog";
 import { decodeValueToJson, decodeStructEntriesToJson } from "./protocol/struct";
-import { cursorVariantForExecArgs } from "./protocol/tool-canonical";
+import { encodeMessage } from "./protocol/messages";
+import { executeNativeTool, resolveExecFrame } from "./cursor-exec";
 import { fnv1a32 } from "../shared/hash";
+import { TtlCache } from "../../../persistence/ttl-cache";
 
 /**
  * Client-heartbeat cadence for every Cursor Run.
@@ -83,25 +85,25 @@ const CURSOR_HEARTBEAT_INTERVAL_MS = 5_000;
  */
 const CURSOR_ROSTER_TTL_MS = 300_000;
 /**
- * credential → { roster, fetchedAt } for the parameter lookup.
+ * credential → roster for the parameter lookup.
  *
  * Keyed by an FNV-1a digest of the credential rather than the raw token so a
  * long-lived map does not hold live credentials as keys. Bounded by
- * `ROSTER_CACHE_MAX` with oldest-first eviction: the TTL is only checked on
- * read, so without a cap rotated tokens would grow the map without bound.
+ * `ROSTER_CACHE_MAX` with LRU eviction: the TTL is only checked on read, so
+ * without a cap rotated tokens would grow the map without bound. Implemented
+ * by the canonical `TtlCache` in LRU mode — re-setting moves the entry to the
+ * newest position, and the cap evicts the least-recently-used entry.
  */
 const ROSTER_CACHE_MAX = 1024;
-const rosterCache = new Map<string, { roster: readonly CursorModelInfo[]; fetchedAt: number }>();
+const rosterCache = new TtlCache<{ roster: readonly CursorModelInfo[] }>({
+  ttlMs: CURSOR_ROSTER_TTL_MS,
+  maxEntries: ROSTER_CACHE_MAX,
+  lru: true,
+});
 
 function rosterCacheSet(credential: string, roster: readonly CursorModelInfo[]): void {
   const key = String(fnv1a32(credential));
-  rosterCache.delete(key); // re-set moves the entry to newest position
-  rosterCache.set(key, { roster, fetchedAt: Date.now() });
-  while (rosterCache.size > ROSTER_CACHE_MAX) {
-    const oldest = rosterCache.keys().next().value;
-    if (oldest === undefined) break;
-    rosterCache.delete(oldest);
-  }
+  rosterCache.set(key, { roster });
 }
 
 /**
@@ -111,7 +113,7 @@ function rosterCacheSet(credential: string, roster: readonly CursorModelInfo[]):
 export const rosterCacheForTests = {
   size: (): number => rosterCache.size,
   set: rosterCacheSet,
-  get: (credential: string): { roster: readonly CursorModelInfo[]; fetchedAt: number } | undefined =>
+  get: (credential: string): { roster: readonly CursorModelInfo[] } | undefined =>
     rosterCache.get(String(fnv1a32(credential))),
 };
 /** Client-heartbeat cadence the Cursor edge expects (donor `heartbeatMs`). */
@@ -538,26 +540,56 @@ class CursorAdapter implements ProviderAdapter {
       );
     }
     const resolvedAll = pending.map((item) => cursorRunSessions.resolveCall(item.callId, scope));
-    // Results previous legs already answered resolve nothing: the replayed
-    // conversation carries them as history, not as an unanswered call. When
-    // *no* call resolves AND the call id live nowhere in this process — a
-    // gateway restart between legs, an evicted idle Run, then — the request is
-    // by definition a complete replay (every answered call is present in the
-    // conversation), and the fresh-turn path rebases it into a new Run.
-    // A call id that is live under another scope keeps the strict refusal:
-    // adopting that conversation would surface another tenant's Run under
-    // this caller.
-    if (
-      resolvedAll.every((entry) => entry === undefined) &&
-      isCompleteToolHistoryReplay(request, pending) &&
-      pending.every((item) => !cursorRunSessions.hasAnyCall(item.callId))
-    ) {
+    const resolved = resolvedAll.filter((entry) => entry !== undefined);
+    const allSameRun =
+      resolved.length === pending.length && new Set(resolved.map((entry) => entry.session.runId)).size === 1;
+    // A call id that is live in this process but resolves to nothing under this
+    // caller's scope belongs to another tenant's Run. Rebasing over it would
+    // surface that conversation under this caller — always a hard refusal.
+    const foreignLive = pending.some(
+      (item) =>
+        cursorRunSessions.resolveCall(item.callId, scope) === undefined &&
+        cursorRunSessions.hasAnyCall(item.callId),
+    );
+    // Complete-replay rebase (donor / oh-my-pi behavior): when the request is
+    // the full transcript — every `call_cursor_*` result it carries is paired
+    // with a `toolCall` in the same conversation — and no foreign-live call is
+    // involved, cancel whatever live Runs its ids still touch and rebuild a
+    // fresh Run from history. This covers the cases the old code refused with
+    // a hard 400: a replay mixing results of an already-answered leg with a
+    // live one ("mixes live Cursor tool results"), and results spanning
+    // multiple live Runs. A hard refusal there is what stalled the client loop
+    // every time Cursor replays a superseded transcript; the donor instead
+    // closes the parked runs and answers with a fresh turn.
+    if (!allSameRun && !foreignLive && isCompleteToolHistoryReplay(request, pending)) {
+      for (const entry of resolved) {
+        cursorRunSessions.terminate(entry.session.runId, "Cursor Run superseded by a rebase");
+        this.#handles.delete(entry.session.runId);
+        this.cleanupReader(entry.session.runId);
+      }
       yield* this.#startRun(request, candidate, context);
       return;
     }
-    const resolved = resolvedAll.filter((entry) => entry !== undefined);
     const runId = resolved[0]?.session.runId;
-    if (runId === undefined) {
+    if (!allSameRun) {
+      // Not a safe rebase. Two distinct cases:
+      // 1. A partial tail — a result whose `toolCall` is absent from the sent
+      //    conversation. That is not a complete replay, so there is nothing
+      //    safe to rebase; name the missing ids so the client can resend the
+      //    whole transcript.
+      // 2. A complete replay that still resolves to mixed runs — either a call
+      //    id live under another scope (foreignLive, hard refusal) or results
+      //    spanning more than one live Run with a transcript that is not a
+      //    complete replay. Both stay refused rather than partially applied.
+      const missing = missingToolCallIds(request, pending);
+      if (missing.length > 0) {
+        throw new GatewayError(
+          "invalid_request",
+          400,
+          "This tool result has no matching tool call in the sent conversation (request {requestId}); resend the complete conversation. The session went cold — reconnect or resend 🔌",
+          { callIds: missing },
+        );
+      }
       throw new GatewayError(
         "invalid_request",
         400,
@@ -565,12 +597,10 @@ class CursorAdapter implements ProviderAdapter {
         { callIds: pending.map((item) => item.callId) },
       );
     }
-    if (resolved.some((entry) => entry?.session.runId !== runId)) {
-      throw new GatewayError(
-        "invalid_request",
-        400,
-        "These tool results belong to different Cursor Runs (request {requestId}); resend them one Run at a time. The session went cold — reconnect or resend 🔌",
-      );
+    if (runId === undefined) {
+      // Unreachable: every path that leaves `allSameRun` false throws above or
+      // rebases. This keeps the non-null narrowing legible for the rest.
+      throw new GatewayError("invalid_request", 400, "Cursor Run is no longer live (request {requestId}). The session went cold — reconnect or resend 🔌");
     }
     const session = cursorRunSessions.get(runId);
     if (session === undefined) {
@@ -703,7 +733,6 @@ class CursorAdapter implements ProviderAdapter {
           text: liveUserText(request),
           modelId,
           conversationId,
-          runId,
           ...(images.length > 0 ? { images } : {}),
           ...(descriptors.length > 0 ? { descriptors } : {}),
           ...(systemPrompt === undefined ? {} : { systemPrompt }),
@@ -878,10 +907,11 @@ class CursorAdapter implements ProviderAdapter {
     context: ProviderDispatchContext,
   ): Promise<readonly CursorModelInfo[]> {
     const key = String(fnv1a32(credential));
+    // Peek first: `get` deletes expired entries, but the stale roster must
+    // survive as the fallback when the refetch fails (see the catch below).
+    const stale = rosterCache.peek(key);
     const cached = rosterCache.get(key);
-    if (cached !== undefined && Date.now() - cached.fetchedAt < CURSOR_ROSTER_TTL_MS) {
-      return cached.roster;
-    }
+    if (cached !== undefined) return cached.roster;
     try {
       const roster = await fetchCursorModels({
         credential,
@@ -893,7 +923,7 @@ class CursorAdapter implements ProviderAdapter {
       rosterCacheSet(credential, roster);
       return roster;
     } catch {
-      return cached?.roster ?? [];
+      return stale?.roster ?? [];
     }
   }
 
@@ -929,6 +959,8 @@ class CursorAdapter implements ProviderAdapter {
         if (execServer !== undefined) {
           const handled = await this.#handleExecServerMessage(execServer, session, handle);
           if (handled.kind !== "tool_call") continue;
+          // Only MCP arms are relayed to the client for execution (client-
+          // declared tools). Native tools are answered in-band by the executor.
           const callId = `call_cursor_${runId}_${handled.execId}`;
           const scope = context.continuation_scope;
           if (scope === undefined) {
@@ -1107,9 +1139,9 @@ class CursorAdapter implements ProviderAdapter {
       return { kind: "handled" };
     }
     // Allowlist prechecks precede the real call. They are approval probes, not
-    // invocations — this gateway advertises every executable surface through
-    // the MCP channel, so its own host surface is never allowlisted and the
-    // typed result frame (not an mcp_result) is what the server waits on.
+    // invocations. Shell is allowlisted because the native executor runs it
+    // locally; MCP is allowlisted only when the tool is client-declared
+    // (relayed to the client); web fetch is never executed and stays denied.
     const precheckKind = recordOf(execServer["shell_allowlist_precheck_args"]) !== undefined
       ? "shell"
       : recordOf(execServer["mcp_allowlist_precheck_args"]) !== undefined
@@ -1118,35 +1150,37 @@ class CursorAdapter implements ProviderAdapter {
           ? "web_fetch"
           : undefined;
     if (precheckKind !== undefined) {
-      await handle.write(buildAllowlistPrecheckResult(execId, precheckKind, execIdString));
+      const allowlisted =
+        precheckKind === "shell" ? true
+        : precheckKind === "web_fetch" ? false
+        : this.mcpArgsAreDeclared(execServer, session.descriptors);
+      await handle.write(buildAllowlistPrecheckResult(execId, precheckKind, execIdString, allowlisted));
       return { kind: "handled" };
     }
-    // Native first. A Cursor host-exec frame (`read_args`, `shell_args`,
-    // `pi_read_args`, …) is relayed to the client as an ordinary tool call
-    // instead of being refused. This is the half the earlier direct-forward
-    // attempt got wrong: it built typed result frames by hand per variant and
-    // they were not matched by the server. The canonical layer owns that
-    // mapping now, keyed by the originating variant, so a result can only ever
-    // come back in the arm it arrived on.
-    const nativeCall = cursorVariantForExecArgs(execServer);
-    // Only a tool the request actually declared may be relayed. A host frame
-    // for something the client never advertised is an undeclared tool like any
-    // other and keeps the refusal — forwarding it would hand the client a call
-    // it has no handler for and nowhere to send the result.
-    const declaredNative = nativeCall !== undefined &&
-      session.descriptors.some((d) => d.toolName === nativeCall.variant.name);
-    if (nativeCall !== undefined && declaredNative) {
-      return {
-        kind: "tool_call",
-        execId,
-        execIdString,
-        toolName: nativeCall.variant.name,
-        arguments: JSON.stringify(nativeCall.args),
-      };
+    // Native exec frames (`read_args`, `shell_args`, `ct_read_args`, …) are
+    // executed locally by this gateway — not relayed to the client and not
+    // refused. The executor returns the wire result message for the frame's
+    // result oneof, so a reply can only come back in the arm it arrived on.
+    // Frames the executor does not implement fall through to the refusal.
+    const execFrame = resolveExecFrame(execServer);
+    if (execFrame !== undefined) {
+      const executed = await executeNativeTool(execFrame.frameKey, execFrame.args, process.cwd());
+      if (executed !== undefined) {
+        await handle.write(
+          encodeMessage("AgentClientMessage", {
+            exec_client_message: {
+              id: execId,
+              exec_id: execIdString ?? "",
+              [executed.field]: executed.message,
+            },
+          }),
+        );
+        return { kind: "handled" };
+      }
     }
-    // MCP is the fallback, not the first stop: client-declared tools have no
-    // native slot in `agent.proto`, so they are the ones that must travel this
-    // channel. An arm neither path claims falls through to the refusal below.
+    // MCP remains for client-declared tools: they have no native slot, so a
+    // declared `mcp_args` arm is relayed to the client as an ordinary tool
+    // call. Undeclared MCP is refused.
     const mcpArgs = recordOf(execServer["mcp_args"]);
     if (mcpArgs !== undefined) {
       const call = readExecutableMcpCall(mcpArgs, session.descriptors);
@@ -1170,6 +1204,21 @@ class CursorAdapter implements ProviderAdapter {
     return { kind: "handled" };
   }
 
+  /**
+   * True when an MCP allowlist precheck targets a tool the request actually
+   * declared (so it can be relayed to the client). Undeclared MCP is denied.
+   */
+  mcpArgsAreDeclared(
+    execServer: Record<string, unknown>,
+    descriptors: readonly CursorToolDescriptor[],
+  ): boolean {
+    const precheck = recordOf(execServer["mcp_allowlist_precheck_args"]);
+    if (precheck === undefined) return false;
+    const toolName = nonEmptyStringOf(precheck["tool_name"]);
+    if (toolName === undefined) return false;
+    return descriptors.some((d) => d.toolName === toolName);
+  }
+
   /**
    * Answers one interaction query so the Run RPC can continue.
    *
@@ -1343,6 +1392,13 @@ function readPendingToolResult(
  * when it resends its recorded transcript — a gateway restart between legs or
  * an evicted Run — and the only shape safe to rebase into a fresh Run, where
  * the recorded exchange travels as history.
+ *
+ * The matching `toolCall` may live anywhere in the conversation, not only in
+ * the trailing assistant turn: Claude Code resends the full transcript, which
+ * contains several earlier `call_cursor_*` rounds. A scan that accepted only
+ * one trailing assistant/tool pair refused those complete replays with
+ * "no longer pending" even though every result was paired and none was live
+ * (mirrors `isCompleteContinuationReplay` in the preparer).
  */
 function isCompleteToolHistoryReplay(
   request: CanonicalRequest,
@@ -1357,6 +1413,20 @@ function isCompleteToolHistoryReplay(
   return pending.every((item) => calledIds.has(item.callId));
 }
 
+/** The `call_cursor_*` result ids with no matching `toolCall` in the conversation. */
+function missingToolCallIds(
+  request: CanonicalRequest,
+  pending: readonly PendingToolResult[],
+): string[] {
+  const calledIds = new Set<string>();
+  for (const message of request.messages) {
+    for (const part of message.content) {
+      if (part.kind === "toolCall") calledIds.add(part.call_id);
+    }
+  }
+  return pending.filter((item) => !calledIds.has(item.callId)).map((item) => item.callId);
+}
+
 /** Reconstructs one tool result's text and images for the adapter's tests. */
 export { decodeStructEntriesToJson, decodeValueToJson };
 
@@ -1374,4 +1444,3 @@ function resolveCursorWireModelId(rawModelId: string): string {
   if (id === "auto") return "default";
   return rawModelId;
 }
-

package/src/providers/integrations/cursor/protocol/messages.ts

@@ -25,28 +25,7 @@
  */
 
 import protobuf from "protobufjs"
-
-// ── Helper: create a root and add a Type with fields ──
-
-type FieldDef = { id: number; name: string; type: string; repeated?: boolean }
-type OneofDef = { name: string; fields: string[] }
-
-function addType(
-  root: protobuf.Root,
-  name: string,
-  fields: FieldDef[],
-  oneofs?: OneofDef[],
-): protobuf.Type {
-  const t = new protobuf.Type(name)
-  for (const f of fields) {
-    t.add(new protobuf.Field(f.name, f.id, f.type, f.repeated ? "repeated" : undefined))
-  }
-  for (const o of oneofs ?? []) {
-    t.add(new protobuf.OneOf(o.name, o.fields))
-  }
-  root.add(t)
-  return t
-}
+import { addType } from "./protobuf-schema"
 
 // ── Utility messages ──
 
@@ -1809,8 +1788,8 @@ export function createMessageTypes(): protobuf.Root {
   ])
 
   addType(root, "CancelAction", [
-    // Cursor CLI CancelAction field #1 is the interruption reason, not an id.
-    { id: 1, name: "reason", type: "string" },
+    // `agent.proto` declares CancelAction empty (oneof presence is the signal);
+    // the reason travels on the stream, not in the message.
   ])
 
   // Deferred answers for an AskQuestion the client already replied to with
@@ -1922,8 +1901,24 @@ export function createMessageTypes(): protobuf.Root {
     { id: 8, name: "turns", type: "ConversationTurn", repeated: true },
   ])
 
+  // `agent.proto` ModelDetails.thinking_details — empty in the current build;
+  // declared for wire-shape completeness.
+  addType(root, "ThinkingDetails", [])
+
+  // `agent.proto` AgentRunRequest.skill_options (deprecated upstream; kept for
+  // wire-shape completeness).
+  addType(root, "SkillOptions", [
+    { id: 1, name: "skill_descriptors", type: "SkillDescriptor", repeated: true },
+  ])
+
   addType(root, "ModelDetails", [
     { id: 1, name: "model_id", type: "string" },
+    { id: 2, name: "thinking_details", type: "ThinkingDetails" },
+    { id: 3, name: "display_model_id", type: "string" },
+    { id: 4, name: "display_name", type: "string" },
+    { id: 5, name: "display_name_short", type: "string" },
+    { id: 6, name: "aliases", type: "string", repeated: true },
+    { id: 7, name: "max_mode", type: "bool" },
   ])
 
   addType(root, "McpTools", [
@@ -1933,15 +1928,13 @@ export function createMessageTypes(): protobuf.Root {
   addType(root, "AgentRunRequest", [
     { id: 1, name: "conversation_state", type: "bytes" },
     { id: 2, name: "action", type: "ConversationAction" },
+    { id: 3, name: "model_details", type: "ModelDetails" },
     { id: 4, name: "mcp_tools", type: "McpTools" },
     { id: 5, name: "conversation_id", type: "string" },
+    { id: 6, name: "mcp_file_system_options", type: "McpFileSystemOptions" },
+    { id: 7, name: "skill_options", type: "SkillOptions" },
     { id: 8, name: "custom_system_prompt", type: "string" },
     { id: 9, name: "requested_model", type: "RequestedModel" },
-    { id: 10, name: "unknown_flag", type: "uint32" },
-    { id: 12, name: "field_12", type: "uint32" },
-    { id: 14, name: "selected_subagent_models", type: "RequestedModel", repeated: true },
-    { id: 16, name: "conversation_group_id", type: "string" },
-    { id: 25, name: "run_id", type: "string" },
   ])
 
   // ── Client heartbeat ──

package/src/providers/integrations/cursor/protocol/protobuf-schema.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared protobufjs schema-builder helpers.
+ *
+ * Extracted verbatim from the vendored protocol modules that each carried the
+ * same implementation: `cursor/protocol/messages.ts` (vendored from
+ * `cursor-opencode-provider`, MIT) and `devin/protocol/devin-proto.ts`
+ * (vendored from `oh-my-pi`, MIT). The original license texts remain in those
+ * files; this module exists so future schema additions have one place to fix.
+ */
+
+import protobuf from "protobufjs";
+
+export type FieldDef = { id: number; name: string; type: string; repeated?: boolean };
+export type OneofDef = { name: string; fields: string[] };
+
+/** Create a root Type with fields and optional oneofs, and register it. */
+export function addType(
+  root: protobuf.Root,
+  name: string,
+  fields: FieldDef[],
+  oneofs?: OneofDef[],
+): protobuf.Type {
+  const t = new protobuf.Type(name);
+  for (const f of fields) {
+    t.add(new protobuf.Field(f.name, f.id, f.type, f.repeated ? "repeated" : undefined));
+  }
+  for (const o of oneofs ?? []) {
+    t.add(new protobuf.OneOf(o.name, o.fields));
+  }
+  root.add(t);
+  return t;
+}
+
+/** Register an enum on the root. */
+export function addEnum(root: protobuf.Root, name: string, values: Record<string, number>): void {
+  root.add(new protobuf.Enum(name, values));
+}