cursor-opencode-provider 0.1.4 → 0.1.5

package/README.md

@@ -18,7 +18,7 @@ OpenCode driving a Cursor-routed Grok model through this provider:
 - **Authentication** — browser OAuth (PKCE), or API key from [cursor.com/settings](https://cursor.com/settings)
 - **Model discovery** — fetches available models from Cursor's API and caches them locally
 - **Streaming** — bidirectional Connect-RPC stream for agent runs
-- **Tool calls** — maps Cursor exec-server messages to AI SDK tool-call parts
+- **Tool calls** — maps Cursor exec-server messages to AI SDK tool-call parts; strips OpenCode's `read` XML envelope (`<path>`/`<content>` + `N:` prefixes) before returning content to Cursor so the model cannot echo the wrapper into writes
 - **Thinking / reasoning** — surfaces extended-thinking deltas where the model supports it
 
 ## Requirements
@@ -47,7 +47,7 @@ Add the package name to OpenCode config. OpenCode installs npm plugins with Bun
 }
 ```
 
-Pin a version if you want: `"cursor-opencode-provider@0.1.4"`.
+Pin a version if you want: `"cursor-opencode-provider@0.1.5"`.
 
 ### From a local clone
 
@@ -181,6 +181,7 @@ OpenCode
 | `src/index.ts` | `createCursor` factory; default export is `CursorPlugin` |
 | `src/language-model.ts` | AI SDK `LanguageModelV3` adapter (`doStream`, `doGenerate`) |
 | `src/session.ts` | Held-open agent Run session and pending exec correlation |
+| `src/debug.ts` | Opt-in wire-level debug logging (`CURSOR_PROVIDER_DEBUG`) |
 | `src/auth.ts` | PKCE OAuth, API key exchange, JWT refresh |
 | `src/models.ts` | `AvailableModels` fetch and `cursor-models.json` cache |
 | `src/agent-url.ts` | `GetServerConfig` fetch + in-process memo (region-specific Run host) |
@@ -218,4 +219,4 @@ OpenCode
 
 ## License
 
-MIT
+MIT

package/dist/agent-url.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { fetchAgentUrl, trace } from "./transport/connect.js";
+import { fetchAgentUrl } from "./transport/connect.js";
+import { trace } from "./debug.js";
 import { CURSOR_API_HOST } from "./shared.js";
 const DEFAULT_API_BASE = `https://${CURSOR_API_HOST}`;
 // In-process memo of the region-specific Run stream origin (agentnUrl). Resolved

package/dist/debug.d.ts

@@ -0,0 +1 @@
+export declare function trace(msg: string): void;

package/dist/debug.js

@@ -0,0 +1,22 @@
+import fs from "node:fs";
+// Wire-level diagnostics. Opt in with CURSOR_PROVIDER_DEBUG=1 (or "true").
+// Writes to CURSOR_PROVIDER_DEBUG_FILE (default /tmp/cursor-provider-debug.log).
+// Truncated once per process. Tokens / checksums should be redacted by callers.
+const DEBUG_ENABLED = process.env.CURSOR_PROVIDER_DEBUG === "1" ||
+    process.env.CURSOR_PROVIDER_DEBUG === "true";
+const DEBUG_FILE = process.env.CURSOR_PROVIDER_DEBUG_FILE || "/tmp/cursor-provider-debug.log";
+let _traceInitialized = false;
+export function trace(msg) {
+    if (!DEBUG_ENABLED)
+        return;
+    try {
+        if (!_traceInitialized) {
+            _traceInitialized = true;
+            fs.writeFileSync(DEBUG_FILE, `--- cursor-provider debug (pid ${process.pid}) ${new Date().toISOString()} ---\n`);
+        }
+        fs.appendFileSync(DEBUG_FILE, `[${new Date().toISOString()}] ${msg}\n`);
+    }
+    catch {
+        /* ignore */
+    }
+}

package/dist/language-model.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import { createHash } from "node:crypto";
-import { bidiRunStream, normalizeAgentRunOrigin, trace } from "./transport/connect.js";
+import { bidiRunStream, normalizeAgentRunOrigin } from "./transport/connect.js";
+import { trace } from "./debug.js";
 import { buildRunRequest, buildHeartbeat } from "./protocol/request.js";
 import { decodeFramePayload } from "./protocol/framing.js";
 import { decodeMessage } from "./protocol/messages.js";
@@ -78,6 +79,7 @@ async function doStreamImpl(modelId, options, callOptions) {
                     resultField: pending.resultField,
                     output: r.output,
                     error: r.error,
+                    toolName: pending.toolName ?? r.toolName,
                 })) {
                     session.stream.write(frame);
                 }
@@ -575,6 +577,7 @@ async function pump(session, controller, ids, abortSignal) {
                                     resultField: parsed.resultField,
                                     output: "",
                                     error: reason,
+                                    toolName: parsed.toolName,
                                 })) {
                                     session.stream.write(frame);
                                 }
@@ -586,7 +589,7 @@ async function pump(session, controller, ids, abortSignal) {
                         }
                         const tc = buildToolCallPart(parsed, session.sessionId);
                         // Keep the stream open; the result arrives on the next doStream call.
-                        sessionManager.registerPending(parsed.id, session, parsed.resultField);
+                        sessionManager.registerPending(parsed.id, session, parsed.resultField, parsed.toolName);
                         // tc.input is already a JSON string (LanguageModelV3ToolCall.input).
                         trace(`exec: EMITTED tool-call toolCallId=${tc.toolCallId} toolName=${tc.toolName} inputLen=${tc.input.length}`);
                         // Close open text/reasoning spans before tool-call (required by AI SDK V3).

package/dist/protocol/tools.d.ts

@@ -53,6 +53,12 @@ export type ToolResultInput = {
     output: string;
     error?: string;
     executionTimeMs?: number;
+    /**
+     * Resolved opencode tool name (read/write/grep/…). Gates read-envelope
+     * unwrapping on the mcp_result path so non-read MCP output is never
+     * rewritten. read_result is always a read, so it unwraps regardless.
+     */
+    toolName?: string;
 };
 /**
  * Build one or more ExecClientMessage frames for a tool result.
@@ -64,12 +70,33 @@ export type ToolResultInput = {
 export declare function buildExecClientMessages(input: ToolResultInput): Uint8Array[];
 /** ACM #5 exec_client_control_message { stream_close { id } }. */
 export declare function buildExecStreamClose(execId: number): Uint8Array;
+/**
+ * Strip opencode's `read` envelope, leaving raw file content.
+ *
+ * opencode's read tool (opencode `tool/read.ts`) wraps content in an XML-ish
+ * envelope its own models are trained on, but Cursor's are not:
+ *   <path>{abs}</path>\n<type>file</type>\n<content>\n{N}: {line}\n…\n\n{footer}\n</content>
+ * Forwarding that envelope verbatim made Cursor's model treat the wrapper as
+ * literal file content and write `<path>`/`<content>` tags + `N:` line prefixes
+ * back into files (silent corruption — the write still reports success; seen
+ * across 8+ sessions, e.g. language-model.ts rewritten starting with
+ * `<path>…</path>\n<type>file</type>\n<content>\n1: import fs…`).
+ *
+ * Returns the raw file body (line numbers + footer + `<system-reminder>` dropped).
+ *
+ * Deliberately exception-safe: if the expected envelope is absent — non-read
+ * output, already-raw text, or a future opencode format change — it returns the
+ * input unchanged, so a result is never broken and we never throw mid-turn.
+ * Callers must still gate `mcp_result` on `toolName === "read"`; this helper
+ * alone is not a tool-identity check.
+ */
+export declare function unwrapReadOutput(output: string): string;
 /**
  * Map OpenCode tool text into the agent.v1 result oneof for each exec variant.
  * OpenCode returns free-form text; we wrap it in the minimal success shape the
  * server accepts (verified against agent.v1 wire captures).
  */
-export declare function buildTypedExecResult(resultField: string, output: string, error?: string): Record<string, unknown>;
+export declare function buildTypedExecResult(resultField: string, output: string, error?: string, toolName?: string): Record<string, unknown>;
 export declare function buildToolCallPart(execMsg: ParsedExecRequest, sessionId: string): {
     toolCallId: string;
     toolName: string;

package/dist/protocol/tools.js

@@ -1,5 +1,6 @@
 import { encodeMessage } from "./messages.js";
 import { encodeJsonAsValue, decodeStructEntriesToJson, readAllFields } from "./struct.js";
+import { trace } from "../debug.js";
 // Exec variant field number whose reply is the server-initiated request_context
 // probe (ExecServerMessage #10 → ExecClientMessage #10). request/result share a
 // field number for every exec variant, so this is also the result field.
@@ -394,7 +395,7 @@ export function buildExecClientMessages(input) {
             id: input.execId,
             local_execution_time_ms: input.executionTimeMs ?? 0,
         };
-        clientMsg[resultField] = buildTypedExecResult(resultField, input.output, input.error);
+        clientMsg[resultField] = buildTypedExecResult(resultField, input.output, input.error, input.toolName);
         frames.push(encodeMessage("AgentClientMessage", {
             exec_client_message: clientMsg,
         }));
@@ -411,21 +412,90 @@ export function buildExecStreamClose(execId) {
         },
     });
 }
+/**
+ * Strip opencode's `read` envelope, leaving raw file content.
+ *
+ * opencode's read tool (opencode `tool/read.ts`) wraps content in an XML-ish
+ * envelope its own models are trained on, but Cursor's are not:
+ *   <path>{abs}</path>\n<type>file</type>\n<content>\n{N}: {line}\n…\n\n{footer}\n</content>
+ * Forwarding that envelope verbatim made Cursor's model treat the wrapper as
+ * literal file content and write `<path>`/`<content>` tags + `N:` line prefixes
+ * back into files (silent corruption — the write still reports success; seen
+ * across 8+ sessions, e.g. language-model.ts rewritten starting with
+ * `<path>…</path>\n<type>file</type>\n<content>\n1: import fs…`).
+ *
+ * Returns the raw file body (line numbers + footer + `<system-reminder>` dropped).
+ *
+ * Deliberately exception-safe: if the expected envelope is absent — non-read
+ * output, already-raw text, or a future opencode format change — it returns the
+ * input unchanged, so a result is never broken and we never throw mid-turn.
+ * Callers must still gate `mcp_result` on `toolName === "read"`; this helper
+ * alone is not a tool-identity check.
+ */
+export function unwrapReadOutput(output) {
+    if (typeof output !== "string" || output.length === 0)
+        return output;
+    // Require the full opencode read-envelope skeleton *before* `<content>`
+    // (read.ts opens with <path>…</path>, <type>file</type>, <content>) so a
+    // stray "<content>" later in tool chatter can't trigger unwrapping just
+    // because path/type tags appear elsewhere in the payload.
+    const contentHeaderIdx = output.indexOf("<content>");
+    if (contentHeaderIdx === -1)
+        return output;
+    const header = output.slice(0, contentHeaderIdx);
+    const hasSkeleton = header.indexOf("<path>") !== -1 &&
+        header.indexOf("<type>file</type>") !== -1;
+    if (!hasSkeleton) {
+        // Saw "<content>" but not the read skeleton ahead of it — almost certainly
+        // a non-read payload, or an opencode format drift. Surface it so drift
+        // can't silently resurrect the wrapper-corruption bug, but still fail
+        // safe (no mutate).
+        trace("unwrapReadOutput: <content> present without leading <path>/<type>file> skeleton — leaving output unchanged (possible non-read payload or opencode read format drift)");
+        return output;
+    }
+    // Body starts right after "<content>\n". opencode emits one numbered line per
+    // file line ("N: <line>"), then a blank, a "(…)" footer, and a standalone
+    // "</content>". The body is a *contiguous run* of /^N: / lines — so we stop at
+    // the first non-numbered line. Critically we do NOT search for a closing
+    // "</content>" substring: a file line that literally contains "</content>"
+    // is rendered as "N: </content>" (a body line), and a raw indexOf would
+    // truncate the read there.
+    let rest = output.slice(contentHeaderIdx + "<content>".length);
+    if (rest.startsWith("\n"))
+        rest = rest.slice(1);
+    const raw = [];
+    for (const line of rest.split("\n")) {
+        const m = /^(\d+):[ \t]?(.*)$/.exec(line);
+        if (!m)
+            break; // blank / "(footer)" / "</content>" → end of body run
+        // Strip only the leading "N: " prefix; a line that itself begins with
+        // digits+colon keeps its content (we remove just the first match). Blank
+        // file lines render as "N: " and are preserved (capture group is "").
+        raw.push(m[2]);
+    }
+    // Envelope confirmed but no numbered body → empty file. Return "" rather
+    // than the envelope (the envelope is exactly what Cursor echoes into writes).
+    return raw.join("\n");
+}
 /**
  * Map OpenCode tool text into the agent.v1 result oneof for each exec variant.
  * OpenCode returns free-form text; we wrap it in the minimal success shape the
  * server accepts (verified against agent.v1 wire captures).
  */
-export function buildTypedExecResult(resultField, output, error) {
+export function buildTypedExecResult(resultField, output, error, toolName) {
     switch (resultField) {
         case "read_result":
             if (error)
                 return { error: { path: "", error } };
+            // Strip opencode's <path>/<content> envelope so Cursor's model receives
+            // raw file content and can't echo the wrapper into subsequent writes.
+            // reads route here only for native read_args; most arrive via mcp_result.
+            const content = unwrapReadOutput(output);
             return {
                 success: {
                     path: extractPathTag(output) ?? "",
-                    content: output,
-                    total_lines: countLines(output),
+                    content,
+                    total_lines: countLines(content),
                 },
             };
         case "grep_result": {
@@ -492,9 +562,15 @@ export function buildTypedExecResult(resultField, output, error) {
         case "mcp_result":
             if (error)
                 return { error: { error } };
+            // opencode built-ins (read/write/grep/…) are advertised as MCP tools, so
+            // a read call returns through mcp_result. Scope the unwrap to toolName
+            // "read" so a non-read MCP tool whose output merely contains a
+            // "<content>"-like block is never rewritten.
             return {
                 success: {
-                    content: [{ text: { text: output } }],
+                    content: [
+                        { text: { text: toolName === "read" ? unwrapReadOutput(output) : output } },
+                    ],
                     is_error: false,
                 },
             };

package/dist/session.d.ts

@@ -14,6 +14,11 @@ export type Frame = {
 export type PendingExec = {
     /** ExecClientMessage result field to reply with (matches the request variant). */
     resultField: string;
+    /**
+     * Resolved opencode tool name (read/write/grep/…). Used on continuation so
+     * mcp_result can unwrap read envelopes even if the prompt omits toolName.
+     */
+    toolName?: string;
 };
 export type CursorSession = {
     /**
@@ -58,7 +63,7 @@ export declare class SessionManager {
     constructor(idleTimeoutMs?: number);
     touch(session: CursorSession): void;
     /** Register that `session` is awaiting a result for `execId`. */
-    registerPending(execId: number, session: CursorSession, resultField: string): void;
+    registerPending(execId: number, session: CursorSession, resultField: string, toolName?: string): void;
     /** The pending exec info for an id on a specific session, if still awaiting it. */
     pendingFor(sessionId: string, execId: number): PendingExec | undefined;
     /** Find the live session awaiting one of the given exec ids. */

package/dist/session.js

@@ -1,4 +1,4 @@
-import { trace } from "./transport/connect.js";
+import { trace } from "./debug.js";
 export class SessionManager {
     // Composite key `${sessionId}:${execId}` → owning session. Composite keying
     // means two Run streams that both register an execId of 1 (Cursor resets
@@ -12,8 +12,8 @@ export class SessionManager {
         session.expiresAt = Date.now() + this.idleTimeoutMs;
     }
     /** Register that `session` is awaiting a result for `execId`. */
-    registerPending(execId, session, resultField) {
-        session.pending.set(execId, { resultField });
+    registerPending(execId, session, resultField, toolName) {
+        session.pending.set(execId, { resultField, toolName });
         this.byExecId.set(this.key(session.sessionId, execId), session);
         this.touch(session);
     }

package/dist/transport/connect.d.ts

@@ -1,4 +1,3 @@
-export declare function trace(msg: string): void;
 export declare function buildBaseHeaders(token: string, clientVersion: string, extra?: Record<string, string>): Record<string, string>;
 export declare function unaryAvailableModels(token: string, options?: {
     apiBaseURL?: string;

package/dist/transport/connect.js

@@ -3,32 +3,12 @@ import { encodeFrame, streamFrames } from "../protocol/framing.js";
 import { createCursorChecksumHeader } from "../protocol/checksum.js";
 import { getDeviceIds } from "../protocol/device-id.js";
 import { resolveClientVersion } from "../protocol/client-version.js";
+import { trace } from "../debug.js";
 import http2 from "node:http2";
-import fs from "node:fs";
 const API_BASE = `https://${CURSOR_API_HOST}`;
 function resolveApiBaseURL(options) {
     return new URL(options.apiBaseURL ?? options.baseURL ?? API_BASE).origin;
 }
-// Wire-level diagnostics. Opt in with CURSOR_PROVIDER_DEBUG=1 (or "true").
-// Writes to CURSOR_PROVIDER_DEBUG_FILE (default /tmp/cursor-provider-debug.log).
-// Truncated once per process. Captures h2 response status, parsed frames, and
-// stream errors. Tokens / checksums are redacted in header dumps.
-const DEBUG_ENABLED = process.env.CURSOR_PROVIDER_DEBUG === "1" ||
-    process.env.CURSOR_PROVIDER_DEBUG === "true";
-const DEBUG_FILE = process.env.CURSOR_PROVIDER_DEBUG_FILE || "/tmp/cursor-provider-debug.log";
-let _traceInitialized = false;
-export function trace(msg) {
-    if (!DEBUG_ENABLED)
-        return;
-    try {
-        if (!_traceInitialized) {
-            _traceInitialized = true;
-            fs.writeFileSync(DEBUG_FILE, `--- cursor-provider debug (pid ${process.pid}) ${new Date().toISOString()} ---\n`);
-        }
-        fs.appendFileSync(DEBUG_FILE, `[${new Date().toISOString()}] ${msg}\n`);
-    }
-    catch { /* ignore */ }
-}
 trace("connect.ts module loaded");
 export function buildBaseHeaders(token, clientVersion, extra) {
     const { machineId, macMachineId } = getDeviceIds();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursor-opencode-provider",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Use Cursor subscription models from OpenCode via Cursor's Connect-RPC agent protocol",
   "type": "module",
   "license": "MIT",
@@ -54,12 +54,12 @@
     "protobufjs": "^7.4.0"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": "~1.17.13"
+    "@opencode-ai/plugin": "^1.17.13"
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "~1.17.13",
+    "@opencode-ai/plugin": "^1.17.13",
     "@tsconfig/node22": "^22.0.1",
     "@types/node": "^22.15.3",
     "typescript": "^5.8.3"
   }
-}
+}