claude-overnight 1.25.35 → 1.25.37

package/dist/_version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "1.25.35";
+export declare const VERSION = "1.25.37";

package/dist/_version.js

@@ -1,2 +1,2 @@
 // Auto-generated by build — do not edit manually.
-export const VERSION = "1.25.35";
+export const VERSION = "1.25.37";

package/dist/index.js

@@ -839,8 +839,10 @@ async function main() {
                 statusLineActive = false;
             }
         };
-        /** Cursor agent cold start + thinking-variant model latency can exceed 20s; API providers stay tight. */
-        const preflightMs = (p) => isCursorProxyProvider(p) ? 60_000 : 20_000;
+        /** Cursor agent cold start + thinking-variant model latency can exceed 20s, and the cursor
+         *  preflight now also runs a write-capability probe (see probeCursorWriteCapability) that
+         *  asks cursor to Bash a marker file — so the total budget must cover auth ping + write turn. */
+        const preflightMs = (p) => isCursorProxyProvider(p) ? 90_000 : 20_000;
         const results = await Promise.all(pending.map(async ([role, p]) => {
             statuses.set(role, "connecting…");
             renderStatus();

package/dist/planner-query.js

@@ -454,9 +454,9 @@ async function runPlannerQueryOnce(prompt, opts, onLog) {
 export function postProcess(raw, budget, onLog) {
     let tasks = raw;
     const before = tasks.length;
-    tasks = tasks.filter((t) => t.prompt && t.prompt.trim().split(/\s+/).length >= 3);
+    tasks = tasks.filter((t) => t.prompt && t.prompt.trim().length >= 1);
     if (tasks.length < before)
-        onLog(`Filtered ${before - tasks.length} task(s) with fewer than 3 words`);
+        onLog(`Filtered ${before - tasks.length} task(s) with empty prompt`);
     // Read-only tasks (verify/audit/user-test) shouldn't get a worktree: they
     // don't change files, so they'd just create empty swarm branches that show
     // up as "0 files changed" noise. Run them in the real project directory so

package/dist/providers.js

@@ -1,4 +1,5 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, realpathSync, openSync, statSync, readSync, closeSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, realpathSync, openSync, statSync, readSync, closeSync, unlinkSync } from "fs";
+import { tmpdir } from "node:os";
 import { createRequire } from "node:module";
 import { homedir } from "os";
 import { join, dirname } from "path";
@@ -147,10 +148,10 @@ export function envFor(p) {
         // SDK replaces env for subprocesses — force these so nothing inherits a bad CI / skip flag.
         base.CI = "true";
         base.CURSOR_SKIP_KEYCHAIN = "1";
-        // Bridge mode controls the agent behavior: "plan" enables tool use (Read,
-        // Glob, Grep, Write, Bash), "ask" gives a chat-only assistant. Planner
-        // agents and workers must use "plan" so they actually interact with the codebase.
-        base.CURSOR_BRIDGE_MODE = "plan";
+        // "agent" omits --mode so cursor-agent runs full agentic mode (Read,
+        // Glob, Grep, Write, Bash). Passing --mode plan or ask forces read-only —
+        // Write/Bash tool calls are silently dropped, exit 0, empty stdout.
+        base.CURSOR_BRIDGE_MODE = "agent";
         // Use system Node.js for agent subprocess to avoid macOS segfaults with
         // bundled Node.js. Resolve lazily.
         if (!_cachedAgentNode || !_cachedAgentScript) {
@@ -382,6 +383,10 @@ async function preflightCursorProxyViaHttp(p, timeoutMs, opts) {
     const headers = { "content-type": "application/json" };
     if (key)
         headers["authorization"] = `Bearer ${key}`;
+    // Shared deadline: auth ping + write probe split the total timeout budget.
+    const overallDeadlineAt = Date.now() + timeoutMs;
+    const remaining = () => Math.max(1_000, overallDeadlineAt - Date.now());
+    const authBudget = Math.max(5_000, Math.floor(timeoutMs / 2));
     const controller = new AbortController();
     let elapsed = 0;
     const PROGRESS_INTERVAL_MS = 3_000;
@@ -389,7 +394,7 @@ async function preflightCursorProxyViaHttp(p, timeoutMs, opts) {
         elapsed += PROGRESS_INTERVAL_MS;
         opts?.onProgress?.(`still waiting… (${(elapsed / 1000).toFixed(1)}s)`);
     }, PROGRESS_INTERVAL_MS);
-    const deadline = setTimeout(() => controller.abort(), timeoutMs);
+    const deadline = setTimeout(() => controller.abort(), authBudget);
     try {
         // max_tokens must accommodate thinking tokens for `*-thinking-*` variants —
         // 1 token leaves zero reasoning budget and crashes the cursor-agent subprocess
@@ -410,7 +415,6 @@ async function preflightCursorProxyViaHttp(p, timeoutMs, opts) {
         }
         // Drain body so the connection closes cleanly; we don't care about content.
         await res.text().catch(() => "");
-        return { ok: true };
     }
     catch (err) {
         if (err?.name === "AbortError") {
@@ -422,6 +426,82 @@ async function preflightCursorProxyViaHttp(p, timeoutMs, opts) {
         clearTimeout(deadline);
         clearInterval(progressTimer);
     }
+    // Write-capability probe — catches the --mode plan / ask regression where
+    // the proxy silently swallows Write/Bash tool calls (exit 0, empty body,
+    // no file changes). Ask cursor to write a unique marker file; fail if the
+    // file doesn't appear. Keeps the first wave from silently burning budget.
+    opts?.onProgress?.(`probing write capability…`);
+    const probeErr = await probeCursorWriteCapability(baseURL, key, p.model, remaining(), opts);
+    if (probeErr)
+        return { ok: false, error: probeErr };
+    return { ok: true };
+}
+/**
+ * Ask the proxy to create a unique marker file via its Bash tool; verify the
+ * file appeared on disk. Returns an error string on failure, null on success.
+ *
+ * Failure modes caught:
+ * - `CURSOR_BRIDGE_MODE=plan|ask` silently drops Write/Bash (regression fixed in
+ *   cursor-composer-in-claude 0.9.3; this keeps older proxy versions actionable).
+ * - Workspace is untrusted or agent is otherwise nonfunctional — exit 0 with
+ *   no side effects.
+ */
+async function probeCursorWriteCapability(baseURL, key, model, timeoutMs, opts) {
+    const marker = `co-probe-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    const probeFile = join(tmpdir(), `${marker}.txt`);
+    try {
+        unlinkSync(probeFile);
+    }
+    catch { }
+    const prompt = `Run this exact shell command via your Bash tool, then reply with only the word DONE:\n` +
+        `printf 'ok' > ${probeFile}`;
+    const controller = new AbortController();
+    let elapsed = 0;
+    const PROGRESS_INTERVAL_MS = 3_000;
+    const progressTimer = setInterval(() => {
+        elapsed += PROGRESS_INTERVAL_MS;
+        opts?.onProgress?.(`write probe… (${(elapsed / 1000).toFixed(1)}s)`);
+    }, PROGRESS_INTERVAL_MS);
+    const deadline = setTimeout(() => controller.abort(), timeoutMs);
+    const headers = { "content-type": "application/json" };
+    if (key)
+        headers["authorization"] = `Bearer ${key}`;
+    try {
+        const res = await fetch(`${baseURL}/v1/messages`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+                model,
+                max_tokens: 4096,
+                messages: [{ role: "user", content: prompt }],
+            }),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            return `write probe: HTTP ${res.status}: ${text.slice(0, 200)}`;
+        }
+        await res.text().catch(() => "");
+    }
+    catch (err) {
+        if (err?.name === "AbortError")
+            return `write probe: timeout after ${Math.round(timeoutMs / 1000)}s`;
+        return `write probe: ${String(err?.message || err).slice(0, 200)}`;
+    }
+    finally {
+        clearTimeout(deadline);
+        clearInterval(progressTimer);
+    }
+    if (!existsSync(probeFile)) {
+        return (`write probe: cursor returned without creating the marker file. ` +
+            `Most likely cause: CURSOR_BRIDGE_MODE=plan|ask (silent read-only mode). ` +
+            `Upgrade cursor-composer-in-claude to ≥0.9.3 and set CURSOR_BRIDGE_MODE=agent (or unset).`);
+    }
+    try {
+        unlinkSync(probeFile);
+    }
+    catch { }
+    return null;
 }
 // ── Cursor API Proxy ──
 export const PROXY_DEFAULT_URL = "http://127.0.0.1:8765";
@@ -924,9 +1004,10 @@ async function startProxyProcess(baseUrl, url, port) {
         // the CLI path injects keychain-shim-inject.js via NODE_OPTIONS which no-ops
         // /usr/bin/security calls on macOS (cursor-composer/dist/lib/process.js).
         CURSOR_BRIDGE_USE_ACP: "0",
-        // Default bridge mode: "plan" enables tool use (Read, Glob, Grep, Write, Bash).
-        // "ask" gives a chat-only assistant that doesn't interact with the codebase.
-        CURSOR_BRIDGE_MODE: "plan",
+        // "agent" omits --mode so cursor-agent runs full agentic mode with
+        // Read/Glob/Grep/Write/Bash. --mode plan and --mode ask are both strictly
+        // read-only — Write/Bash calls exit 0 with empty stdout.
+        CURSOR_BRIDGE_MODE: "agent",
         // cursor-composer chat-only mode fakes HOME to a temp dir; on macOS the agent still waits on
         // Keychain (~30s) for `cursor-user` despite CURSOR_API_KEY. Use the real workspace profile.
         CURSOR_BRIDGE_CHAT_ONLY_WORKSPACE: "false",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-overnight",
-  "version": "1.25.35",
+  "version": "1.25.37",
   "description": "Parallel Claude agents in git worktrees with a usage cap that reserves headroom for your interactive Claude Code. Crash-safe resume. Provider-agnostic model catalog (Anthropic, Cursor, OpenAI, Gemini, DeepSeek, Llama, Qwen) with capability-based task scoping.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.92",
     "chalk": "^5.4.1",
-    "cursor-composer-in-claude": "0.9.2",
+    "cursor-composer-in-claude": "0.9.3",
     "jsonwebtoken": "^9.0.2"
   },
   "devDependencies": {

package/plugins/claude-overnight/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-overnight",
-  "version": "1.25.35",
+  "version": "1.25.37",
   "description": "Claude Code skill for understanding, installing, and inspecting claude-overnight runs  -- parallel Claude agents in git worktrees with thinking waves, multi-wave steering, and crash-safe resume. Supports Cursor API Proxy, Qwen, OpenRouter.",
   "author": {
     "name": "Francesco Fornace"