cursor-opencode-provider 0.2.9 → 0.3.0

package/dist/plugin-v2.d.ts

@@ -1,2 +1,9 @@
+/**
+ * OpenCode Effect / Promise v2 plugin.
+ *
+ * Wires the Cursor provider through `ctx.aisdk.sdk` / `ctx.aisdk.language`
+ * (the V2 extension points). Auth still lives in the classic Hooks plugin
+ * (`plugin.ts`) until OpenCode integrations fully replace provider OAuth.
+ */
 declare const _default: import("@opencode-ai/plugin/v2/promise").Plugin;
 export default _default;

package/dist/plugin-v2.js

@@ -1,6 +1,6 @@
 import { define } from "@opencode-ai/plugin/v2/promise";
 import { CURSOR_PROVIDER_ID } from "./shared.js";
-import { createCursorLanguageModel } from "./language-model.js";
+import { createSdk, isCursorPackage } from "./plugin-core.js";
 import { adoptCompatHostCacheDir } from "./context/paths.js";
 /**
  * OpenCode Effect / Promise v2 plugin.
@@ -9,20 +9,6 @@ import { adoptCompatHostCacheDir } from "./context/paths.js";
  * (the V2 extension points). Auth still lives in the classic Hooks plugin
  * (`plugin.ts`) until OpenCode integrations fully replace provider OAuth.
  */
-function isCursorPackage(pkg, providerID) {
-    if (providerID === CURSOR_PROVIDER_ID)
-        return true;
-    return (pkg.includes("cursor-opencode-provider") ||
-        /cursor-opencode-provider[/\\]dist[/\\]index\.js/.test(pkg));
-}
-function createSdk(options) {
-    const providerId = options.name || CURSOR_PROVIDER_ID;
-    return {
-        languageModel(modelId) {
-            return createCursorLanguageModel(modelId, providerId, options);
-        },
-    };
-}
 export default define({
     id: "cursor.provider",
     setup: async (ctx) => {

package/dist/plugin.d.ts

@@ -1,17 +1,3 @@
 import type { Hooks, PluginInput } from "@opencode-ai/plugin";
-import { type ModelInfo } from "./models.js";
-/**
- * Display names shared by both a thinking and a non-thinking model. A thinking
- * model with such a name needs a "Thinking" tag to disambiguate it from its
- * non-thinking twin (Cursor's Claude/Fable/Sonnet families). Models whose names
- * are already unique — including Cursor's GPT family, where the reasoning tier
- * ("None"/"Low"/"High"…) is baked into the name — are excluded, so they aren't
- * tagged redundantly.
- */
-export declare function thinkingSuffixBaseNames(models: ModelInfo[]): Set<string>;
-export declare function modelInfoToConfig(mi: ModelInfo, options?: {
-    thinkingSuffix?: boolean;
-    contextTier?: "base" | "long";
-}): Record<string, any>;
-export declare function modelsToConfig(models: ModelInfo[]): Record<string, any>;
+export { modelInfoToConfig, modelsToConfig, thinkingSuffixBaseNames } from "./model-config.js";
 export declare function CursorPlugin(input: PluginInput): Promise<Hooks>;

package/dist/plugin.js

@@ -1,199 +1,19 @@
 import { CURSOR_COMPACTION_OPTION, CURSOR_PROVIDER_ID, CURSOR_WEBSITE_HOST, CURSOR_API_HOST } from "./shared.js";
+import { cursorApiBaseURL, cursorGetServerConfigTelemetryEnabled } from "./plugin-core.js";
 import { pollForTokens, exchangeApiKey, refreshAccessToken, isExpiringSoon, generatePkceParams, generatePkceChallenge, buildLoginUrl, decodeJwtExpiryMs } from "./auth.js";
-import { CURSOR_VARIANT_PARAMETERS_KEY, CURSOR_WIRE_MODEL_ID_KEY, readCache, discoverModels, isCacheFresh, parseCursorContextLimit } from "./models.js";
+import { readCache, discoverModels, isCacheFresh } from "./models.js";
+// Re-exported for API compatibility: tests and downstream code import these
+// from "./plugin.js". Canonical home is ./model-config.ts, which stays free of
+// host plugin imports so the OpenCode 2.0 entrypoint can share it.
+import { modelsToConfig } from "./model-config.js";
+export { modelInfoToConfig, modelsToConfig, thinkingSuffixBaseNames } from "./model-config.js";
 import { adoptCompatHostCacheDir, opencodeGlobalCacheDir } from "./context/paths.js";
 import { readStoredAuth } from "./context/auth-store.js";
 import { resolveAgentUrl } from "./agent-url.js";
 import { captureCursorShellResult, cursorShellEnvForCall, cursorShellOriginalCommand, prepareCursorShellArgs, releaseCursorShellEnv, sanitizeRegisteredCursorShellOutput, setCursorShellPath, } from "./shell-timeout.js";
 import { sessionActivity } from "./activity.js";
-import { openCodeWebSearchTool } from "./web-tools.js";
+import { openCodeWebSearchTool } from "./web-search-tool.js";
 const MODULE_URL = new URL("./index.js", import.meta.url).href;
-/**
- * Strip characters and markup that break rendering in the OpenCode TUI/GUI from
- * a model or variant display name:
- *   • HTML tags (e.g. `<span style="…">Medium</span>`) — the IDE colours variant
- *     suffixes with a CSS var that doesn't exist in OpenCode, so the raw markup
- *     would show as literal text. We drop the tags and keep the inner text
- *     ("Medium").
- *   • HTML/markup chars (`< > & " ' \``), parentheses.
- *   • Tabs/newlines collapse to single spaces.
- * Dots and unicode letters are preserved so names stay readable.
- * Fixes https://github.com/oakimov/cursor-opencode-provider/issues/2.
- */
-function safeLabel(value) {
-    return (value
-        .replace(/<[^>]+>/g, "")
-        .replace(/[()<>&"'`]/g, "")
-        .replace(/\s+/g, " ")
-        .trim() || "default");
-}
-function baseName(mi) {
-    return safeLabel(mi.displayName ?? mi.id);
-}
-function modelInfoVariants(mi, variants) {
-    if (variants.length === 0)
-        return undefined;
-    const entries = {};
-    const usedKeys = new Set();
-    const baseName = safeLabel(mi.displayName ?? mi.id);
-    // Each variant's key is `safeLabel(displayName)` (the IDE's own label, e.g.
-    // "Opus 4.8 1M High Fast Thinking") so the picker matches what the user
-    // sees in Cursor. Two variants can sanitize to the same name when the IDE
-    // wraps a differentiator in `<span>…</span>` (e.g. Composer's "Fast"
-    // suffix collapses to the bare model name after stripping). To guarantee
-    // every variant stays pickable:
-    //   1. If the sanitized displayName matches the model name itself, suffix
-    //      it with distinguishing params (or "default") so it never collides
-    //      with the model entry in the variant panel.
-    //   2. If two variants still collide, tag the later one with its params.
-    // Suffixes must stay free of `()` / markup chars — same constraint as
-    // safeLabel (issue #2); use spaced tokens, not parenthetical tags.
-    const tagDims = (p) => {
-        const labels = [];
-        for (const d of p) {
-            if (d.id === "fast" && d.value === "true")
-                labels.push("Fast");
-            else if (d.id === "thinking" && d.value === "true")
-                labels.push("Thinking");
-            else if (d.id === "context")
-                labels.push(d.value);
-        }
-        if (labels.length > 0)
-            return ` ${labels.join(" ")}`;
-        // No params at all — still disambiguate from the model name itself.
-        if (p.length === 0)
-            return "";
-        return " default";
-    };
-    for (const v of variants) {
-        const sanitized = safeLabel(v.displayName || v.key || "default");
-        let key = sanitized;
-        // Never let a variant key equal the model name — that would make the
-        // variant entry indistinguishable from the model entry in pickers that
-        // collapse them.
-        if (key === baseName && !usedKeys.has(key)) {
-            key = `${baseName}${tagDims(v.parameterValues)}` || `${baseName} default`;
-        }
-        else if (usedKeys.has(key)) {
-            key = `${sanitized}${tagDims(v.parameterValues)}`;
-        }
-        let n = 2;
-        while (usedKeys.has(key))
-            key = `${sanitized}${tagDims(v.parameterValues)} ${n++}`;
-        usedKeys.add(key);
-        entries[key] = {
-            [CURSOR_VARIANT_PARAMETERS_KEY]: v.parameterValues.map((p) => ({ ...p })),
-        };
-    }
-    return entries;
-}
-function isLongContextVariant(v) {
-    return v.parameterValues.some((p) => p.id === "context" && parseCursorContextLimit(p.value) === 1_000_000);
-}
-function variantsForTier(mi, tier) {
-    return mi.variants.filter((v) => isLongContextVariant(v) === (tier === "long"));
-}
-/**
- * Display names shared by both a thinking and a non-thinking model. A thinking
- * model with such a name needs a "Thinking" tag to disambiguate it from its
- * non-thinking twin (Cursor's Claude/Fable/Sonnet families). Models whose names
- * are already unique — including Cursor's GPT family, where the reasoning tier
- * ("None"/"Low"/"High"…) is baked into the name — are excluded, so they aren't
- * tagged redundantly.
- */
-export function thinkingSuffixBaseNames(models) {
-    const flags = new Map();
-    for (const m of models) {
-        const base = baseName(m);
-        const entry = flags.get(base) ?? { hasThinking: false, hasNonThinking: false };
-        if (m.supportsThinking)
-            entry.hasThinking = true;
-        else
-            entry.hasNonThinking = true;
-        flags.set(base, entry);
-    }
-    const ambiguous = new Set();
-    for (const [base, f] of flags)
-        if (f.hasThinking && f.hasNonThinking)
-            ambiguous.add(base);
-    return ambiguous;
-}
-export function modelInfoToConfig(mi, options = {}) {
-    const contextTier = options.contextTier ?? "base";
-    const variants = variantsForTier(mi, contextTier);
-    let name = baseName(mi);
-    if (options.thinkingSuffix)
-        name += " Thinking";
-    if (contextTier === "long")
-        name += " 1M";
-    // OpenCode's context limit is static per model entry, while Cursor's context
-    // tier is a variant parameter. Long-context choices are therefore emitted as
-    // separate OpenCode entries by modelsToConfig.
-    const context = contextTier === "long"
-        ? (mi.maxContextForMaxMode ?? 1_000_000)
-        : (mi.maxContext ?? 200_000);
-    // OpenCode's overflow/compaction/UI use limit.context; generation and
-    // thinking budgets use limit.output. models.dev 1M peers advertise
-    // 64k–128k output — a tiny cap makes long-context sessions feel broken
-    // even when the 1M input window is correct.
-    const output = contextTier === "long" ? 128_000 : 32_000;
-    const config = {
-        name,
-        reasoning: mi.supportsThinking ?? false,
-        tool_call: mi.supportsAgent ?? true,
-        temperature: false,
-        limit: {
-            context,
-            output,
-        },
-    };
-    const variantConfig = modelInfoVariants(mi, variants);
-    if (variantConfig)
-        config.variants = variantConfig;
-    if (contextTier === "long") {
-        const defaultVariant = variants.find((v) => v.isDefaultMax) ?? variants[0];
-        if (defaultVariant) {
-            config.options = {
-                [CURSOR_WIRE_MODEL_ID_KEY]: mi.id,
-                [CURSOR_VARIANT_PARAMETERS_KEY]: defaultVariant.parameterValues.map((p) => ({ ...p })),
-            };
-        }
-    }
-    return config;
-}
-export function modelsToConfig(models) {
-    const ambiguous = thinkingSuffixBaseNames(models);
-    const out = {};
-    const usedIds = new Set(models.map((m) => m.id));
-    for (const m of models) {
-        const thinkingSuffix = !!m.supportsThinking && ambiguous.has(baseName(m));
-        const baseVariants = variantsForTier(m, "base");
-        const longVariants = variantsForTier(m, "long");
-        if (baseVariants.length > 0 || longVariants.length === 0) {
-            out[m.id] = modelInfoToConfig(m, { thinkingSuffix, contextTier: "base" });
-        }
-        if (longVariants.length === 0)
-            continue;
-        if (baseVariants.length === 0) {
-            out[m.id] = modelInfoToConfig(m, { thinkingSuffix, contextTier: "long" });
-            continue;
-        }
-        let longId = `${m.id}-1m`;
-        let suffix = 2;
-        while (usedIds.has(longId))
-            longId = `${m.id}-1m-${suffix++}`;
-        usedIds.add(longId);
-        out[longId] = modelInfoToConfig(m, { thinkingSuffix, contextTier: "long" });
-    }
-    return out;
-}
-function cursorApiBaseURL() {
-    return process.env.CURSOR_API_BASE_URL ?? `https://${CURSOR_API_HOST}`;
-}
-function cursorGetServerConfigTelemetryEnabled() {
-    return (process.env.CURSOR_GET_SERVER_CONFIG_TELEMETRY === "1" ||
-        process.env.CURSOR_GET_SERVER_CONFIG_TELEMETRY === "true");
-}
 export async function CursorPlugin(input) {
     // Prefer strong OCP host identity when available; otherwise resolve from explicit host signals/install path.
     await adoptCompatHostCacheDir();
@@ -443,10 +263,10 @@ export async function CursorPlugin(input) {
                             type: "text",
                             key: "apiKey",
                             message: "Cursor API key",
-                            placeholder: "sk-...",
+                            placeholder: "crsr_...",
                             validate(value) {
-                                if (!value.startsWith("sk-"))
-                                    return "API key should start with sk-";
+                                if (!value.startsWith("crsr_"))
+                                    return "API key should start with crsr_";
                                 return undefined;
                             },
                         },

package/dist/protocol/messages.d.ts

@@ -3,6 +3,16 @@ export declare function createMessageTypes(): protobuf.Root;
 export declare function getMessageTypes(): protobuf.Root;
 export declare function encodeMessage(typeName: string, message: Record<string, unknown>): Uint8Array;
 export declare function decodeMessage<T = Record<string, unknown>>(typeName: string, data: Uint8Array): T;
+/**
+ * Diagnostic-only: walk AgentServerMessage.interaction_update(1).turn_ended(14)
+ * without going through our hand-written TurnEnded schema, so a `cache_write`/
+ * `reasoning_tokens` question can be checked against the raw wire instead of
+ * guessed. Confirmed field ids 1-5 (input/output/cache_read/cache_write/
+ * reasoning) decode correctly. Live captures routinely include `f4` explicitly
+ * as `0` while `f3` (cache_read) and `f5` (reasoning) are non-zero — Cursor's
+ * agent TurnEnded populates the field but does not report write counts here.
+ */
+export declare function debugWalkTurnEnded(payload: Uint8Array): string;
 /**
  * Decode a protobuf sub-message from a frame payload that wraps it in
  * a top-level field key + length varint.  Skips the outer wrapper and

package/dist/protocol/messages.js

@@ -1209,6 +1209,62 @@ export function decodeMessage(typeName, data) {
     const decoded = type.decode(data);
     return type.toObject(decoded, { defaults: true, json: true, longs: Number });
 }
+/** Schema-free walk of one message's top-level wire fields (no nested descent). */
+function readRawFields(buf) {
+    const reader = protobuf.Reader.create(buf);
+    const fields = [];
+    while (reader.pos < reader.len) {
+        const tag = reader.uint32();
+        const field = tag >>> 3;
+        const wireType = tag & 7;
+        switch (wireType) {
+            case 0:
+                fields.push({ field, wireType, varint: reader.uint64().toString() });
+                break;
+            case 1:
+                fields.push({ field, wireType, fixed: reader.fixed64().toString() });
+                break;
+            case 2:
+                fields.push({ field, wireType, bytes: reader.bytes() });
+                break;
+            case 5:
+                fields.push({ field, wireType, fixed: reader.fixed32() });
+                break;
+            default:
+                // Groups (3/4) aren't used on this wire; bail rather than desync the reader.
+                return fields;
+        }
+    }
+    return fields;
+}
+/**
+ * Diagnostic-only: walk AgentServerMessage.interaction_update(1).turn_ended(14)
+ * without going through our hand-written TurnEnded schema, so a `cache_write`/
+ * `reasoning_tokens` question can be checked against the raw wire instead of
+ * guessed. Confirmed field ids 1-5 (input/output/cache_read/cache_write/
+ * reasoning) decode correctly. Live captures routinely include `f4` explicitly
+ * as `0` while `f3` (cache_read) and `f5` (reasoning) are non-zero — Cursor's
+ * agent TurnEnded populates the field but does not report write counts here.
+ */
+export function debugWalkTurnEnded(payload) {
+    try {
+        const top = readRawFields(payload);
+        const iuField = top.find((f) => f.field === 1 && f.wireType === 2);
+        if (!iuField?.bytes)
+            return "(no interaction_update field)";
+        const iu = readRawFields(iuField.bytes);
+        const teField = iu.find((f) => f.field === 14 && f.wireType === 2);
+        if (!teField?.bytes)
+            return "(no turn_ended field in interaction_update)";
+        const te = readRawFields(teField.bytes);
+        return te
+            .map((f) => `f${f.field}:wt${f.wireType}=${f.varint ?? f.fixed ?? (f.bytes ? `bytes[${f.bytes.length}]` : "?")}`)
+            .join(" ");
+    }
+    catch (e) {
+        return `(walk failed: ${e.message})`;
+    }
+}
 /**
  * Decode a protobuf sub-message from a frame payload that wraps it in
  * a top-level field key + length varint.  Skips the outer wrapper and

package/dist/protocol/tools.d.ts

@@ -158,6 +158,13 @@ export type ToolResultInput = {
     resultMetadata?: Record<string, unknown>;
     /** Structured shell completion captured by the OpenCode plugin hook. */
     shellOutcome?: CursorShellOutcome;
+    /**
+     * Workspace root for result shapes that must name a directory
+     * (grep_result workspace_results keys, ls_result directory_tree_root).
+     * Must not fall back to process.cwd() — the OpenCode 2.0 daemon's cwd is
+     * often $HOME and would re-advertise the wrong folder to the model.
+     */
+    workspaceRoot?: string;
 };
 /**
  * Build one or more ExecClientMessage frames for a tool result.
@@ -195,7 +202,7 @@ export declare function unwrapReadOutput(output: string): string;
  * OpenCode returns free-form text; we wrap it in the minimal success shape the
  * server accepts (verified against agent.v1 wire captures).
  */
-export declare function buildTypedExecResult(resultField: string, output: string, error?: string, toolName?: string, resultMetadata?: Record<string, unknown>, shellOutcome?: CursorShellOutcome): Record<string, unknown>;
+export declare function buildTypedExecResult(resultField: string, output: string, error?: string, toolName?: string, resultMetadata?: Record<string, unknown>, shellOutcome?: CursorShellOutcome, workspaceRoot?: string): Record<string, unknown>;
 export declare function buildToolCallPart(execMsg: ParsedExecRequest, sessionId: string): {
     toolCallId: string;
     toolName: string;

package/dist/protocol/tools.js

@@ -976,7 +976,7 @@ export function buildExecClientMessages(input) {
             id: input.execId,
             local_execution_time_ms: input.executionTimeMs ?? 0,
         };
-        clientMsg[resultField] = buildTypedExecResult(resultField, input.output, input.error, input.toolName, input.resultMetadata, input.shellOutcome);
+        clientMsg[resultField] = buildTypedExecResult(resultField, input.output, input.error, input.toolName, input.resultMetadata, input.shellOutcome, input.workspaceRoot);
         frames.push(encodeMessage("AgentClientMessage", {
             exec_client_message: clientMsg,
         }));
@@ -1063,7 +1063,12 @@ export function unwrapReadOutput(output) {
  * OpenCode returns free-form text; we wrap it in the minimal success shape the
  * server accepts (verified against agent.v1 wire captures).
  */
-export function buildTypedExecResult(resultField, output, error, toolName, resultMetadata, shellOutcome) {
+export function buildTypedExecResult(resultField, output, error, toolName, resultMetadata, shellOutcome, workspaceRoot) {
+    // Prefer the session workspace; never advertise the host process cwd (daemon
+    // often starts in $HOME) as the path Cursor shows the model for glob/ls.
+    const resultRoot = typeof workspaceRoot === "string" && workspaceRoot.trim()
+        ? path.resolve(workspaceRoot)
+        : undefined;
     switch (resultField) {
         case "read_result": {
             const readPath = str(resultMetadata?.path) ?? extractPathTag(output) ?? "";
@@ -1094,7 +1099,7 @@ export function buildTypedExecResult(resultField, output, error, toolName, resul
             // Prefer files_with_matches: OpenCode glob/grep often returns path lists.
             // Content-mode GrepSuccess also works but needs GrepFileMatch nesting.
             const files = extractPathLines(output);
-            const cwd = process.cwd();
+            const cwd = resultRoot ?? "";
             return {
                 success: {
                     pattern: "",
@@ -1184,7 +1189,7 @@ export function buildTypedExecResult(resultField, output, error, toolName, resul
         case "ls_result": {
             if (error)
                 return { error: { path: "", error } };
-            const rootPath = process.cwd();
+            const rootPath = resultRoot ?? "";
             const entries = extractPathLines(output);
             return {
                 success: {

package/dist/session-directory.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Session-scoped workspace directory for the OpenCode 2.0 plugin.
+ *
+ * The classic plugin learns the project directory from `input.directory`,
+ * supplied once per invocation by the 1.x host. OpenCode 2.0 runs a single
+ * daemon across many projects, so `process.cwd()` captured at sdk-creation
+ * time is wrong for any session but the one open when the daemon started.
+ * The only place the 2.0 runtime names a session's actual directory is
+ * `SessionInfo.location.directory`, reachable from `session.hook("context")`'s
+ * `sessionID` via `ctx.session.get()`. Record it there and let the provider
+ * read it back by session id, same mechanism as `compaction-marker.ts`.
+ *
+ * Bounded so a long-lived server cannot accumulate ids for dead sessions.
+ */
+export declare function markSessionDirectory(sessionID: string, directory: string | undefined): void;
+export declare function getSessionDirectory(sessionID: string | undefined): string | undefined;
+export declare function clearSessionDirectories(): void;

package/dist/session-directory.js

@@ -0,0 +1,35 @@
+/**
+ * Session-scoped workspace directory for the OpenCode 2.0 plugin.
+ *
+ * The classic plugin learns the project directory from `input.directory`,
+ * supplied once per invocation by the 1.x host. OpenCode 2.0 runs a single
+ * daemon across many projects, so `process.cwd()` captured at sdk-creation
+ * time is wrong for any session but the one open when the daemon started.
+ * The only place the 2.0 runtime names a session's actual directory is
+ * `SessionInfo.location.directory`, reachable from `session.hook("context")`'s
+ * `sessionID` via `ctx.session.get()`. Record it there and let the provider
+ * read it back by session id, same mechanism as `compaction-marker.ts`.
+ *
+ * Bounded so a long-lived server cannot accumulate ids for dead sessions.
+ */
+const MAX_TRACKED_SESSIONS = 256;
+const sessionDirectories = new Map();
+export function markSessionDirectory(sessionID, directory) {
+    if (!sessionID || !directory)
+        return;
+    // Re-insert to keep insertion order meaningful for the eviction below.
+    sessionDirectories.delete(sessionID);
+    sessionDirectories.set(sessionID, directory);
+    while (sessionDirectories.size > MAX_TRACKED_SESSIONS) {
+        const oldest = sessionDirectories.keys().next().value;
+        if (oldest === undefined)
+            break;
+        sessionDirectories.delete(oldest);
+    }
+}
+export function getSessionDirectory(sessionID) {
+    return typeof sessionID === "string" ? sessionDirectories.get(sessionID) : undefined;
+}
+export function clearSessionDirectories() {
+    sessionDirectories.clear();
+}

package/dist/session.d.ts

@@ -50,7 +50,7 @@ export type PendingExec = {
      */
     bridged?: boolean;
 };
-export type ContinuationTerminalReason = "hard-cap-expired" | "remote-clean-close" | "remote-error" | "result-write-failed" | "ambiguous-partial-write" | "heartbeat-write-failed" | "reply-write-failed" | "process-disposed";
+export type ContinuationTerminalReason = "hard-cap-expired" | "remote-clean-close" | "remote-error" | "result-write-failed" | "ambiguous-partial-write" | "heartbeat-write-failed" | "reply-write-failed" | "process-disposed" | "superseded-by-new-run" | "open-session-cap-exceeded";
 export type SessionCloseReason = ContinuationTerminalReason | "ordinary-cleanup" | "turn-ended" | "initial-write-failed";
 export type ContinuationClaim = {
     session: CursorSession;
@@ -140,6 +140,7 @@ export type CursorSession = {
         outputTokens: number;
         cacheRead: number;
         cacheWrite: number;
+        reasoningTokens: number;
     };
     /**
      * True while a doStream pull() is actively reading this session's frames.
@@ -171,10 +172,12 @@ type SessionManagerOptions = {
     activitySource?: SessionActivitySource;
     tombstoneTtlMs?: number;
     tombstoneLimit?: number;
+    maxOpenSessions?: number;
 };
 export declare class SessionManager {
     private byExecId;
     private sessions;
+    private byOpenCodeSessionId;
     private tombstones;
     private readonly now;
     private readonly setTimer;
@@ -182,8 +185,17 @@ export declare class SessionManager {
     private readonly activitySource;
     private readonly tombstoneTtlMs;
     private readonly tombstoneLimit;
+    private readonly maxOpenSessions;
     constructor(options?: SessionManagerOptions);
     registerSession(session: CursorSession): void;
+    private isPumping;
+    /**
+     * Force-close the oldest idle open session(s) once registration exceeds the
+     * cap. Never closes a session with a live pull() mid-await (see the same
+     * guard in the supersede check above) — an unclosable backlog of genuinely
+     * active sessions just means the cap can't be enforced until one finishes.
+     */
+    private enforceOpenSessionCap;
     recordSemanticProgress(session: CursorSession, at?: number): void;
     recordHeartbeatWrite(session: CursorSession): void;
     /** Register that `session` is awaiting a result for `execId`. */

package/dist/session.js

@@ -9,6 +9,11 @@ export const DEFAULT_CONTINUATION_POLICY = {
 const MAX_TIMER_MS = 2_147_483_647;
 const DEFAULT_TOMBSTONE_TTL_MS = 15 * 60_000;
 const DEFAULT_TOMBSTONE_LIMIT = 1_024;
+// Well below Cursor's server-side concurrent-Run ceiling per HTTP/2 connection,
+// so a caller that keeps abandoning Runs instead of delivering continuations
+// gets corrected here instead of piling up open streams until Cursor's server
+// force-closes the whole shared connection.
+const DEFAULT_MAX_OPEN_SESSIONS = 24;
 function positiveInteger(name, value, fallback) {
     const resolved = value === undefined ? fallback : value;
     if (typeof resolved !== "number" ||
@@ -50,6 +55,10 @@ export class SessionManager {
     // counters per stream) coexist instead of overwriting each other.
     byExecId = new Map();
     sessions = new Set();
+    // Most recently registered open session per OpenCode session id. A second
+    // registration for the same id means the caller started a fresh Run instead
+    // of continuing the held-open one — the prior entry is stale and superseded.
+    byOpenCodeSessionId = new Map();
     tombstones = new Map();
     now;
     setTimer;
@@ -57,6 +66,7 @@ export class SessionManager {
     activitySource;
     tombstoneTtlMs;
     tombstoneLimit;
+    maxOpenSessions;
     constructor(options = {}) {
         this.now = options.now ?? Date.now;
         this.setTimer = options.setTimer ?? ((callback, delayMs) => setTimeout(callback, delayMs));
@@ -64,6 +74,7 @@ export class SessionManager {
         this.activitySource = options.activitySource ?? sessionActivity;
         this.tombstoneTtlMs = positiveInteger("tombstoneTtlMs", options.tombstoneTtlMs, DEFAULT_TOMBSTONE_TTL_MS);
         this.tombstoneLimit = positiveInteger("tombstoneLimit", options.tombstoneLimit, DEFAULT_TOMBSTONE_LIMIT);
+        this.maxOpenSessions = positiveInteger("maxOpenSessions", options.maxOpenSessions, DEFAULT_MAX_OPEN_SESSIONS);
     }
     registerSession(session) {
         if (session.closed)
@@ -84,12 +95,66 @@ export class SessionManager {
         session.lastHeartbeatWriteAt ??= this.now();
         session.semanticDeadlineAt ??= this.now() + session.policy.semanticIdleMs;
         this.sessions.add(session);
+        if (session.openCodeSessionId) {
+            const prior = this.byOpenCodeSessionId.get(session.openCodeSessionId);
+            if (prior && prior !== session && !prior.closed) {
+                if (this.isPumping(prior)) {
+                    // A live pull() is mid-await on this stream (nextFrameWithSemanticDeadline
+                    // or the raw frame iterator). Forcing close() here would reject that await
+                    // and propagate a real error to whatever still holds the ReadableStream —
+                    // exactly the kind of self-inflicted failure this cap is meant to prevent.
+                    // Let it finish or expire on its own (hard deadline / heartbeat failure).
+                    trace(`sessionManager.registerSession: openCodeSessionId=${session.openCodeSessionId} ` +
+                        `has a still-pumping prior session ${prior.sessionId} (pending=${prior.pending.size}) ` +
+                        `— leaving it to finish or expire naturally instead of interrupting it`);
+                }
+                else {
+                    trace(`sessionManager.registerSession: superseding stale session ${prior.sessionId} ` +
+                        `(openCodeSessionId=${session.openCodeSessionId}, pending=${prior.pending.size}) ` +
+                        `with new session ${session.sessionId}`);
+                    this.close(prior, "superseded-by-new-run");
+                }
+            }
+            this.byOpenCodeSessionId.set(session.openCodeSessionId, session);
+        }
+        this.enforceOpenSessionCap(session);
         const unsubscribe = session.stream.onTerminal?.((event) => this.onStreamTerminal(session, event)) ?? (() => { });
         if (session.closed)
             unsubscribe();
         else
             session.terminalUnsubscribe = unsubscribe;
     }
+    isPumping(session) {
+        return session.pumpOwner != null || session.pumpActive;
+    }
+    /**
+     * Force-close the oldest idle open session(s) once registration exceeds the
+     * cap. Never closes a session with a live pull() mid-await (see the same
+     * guard in the supersede check above) — an unclosable backlog of genuinely
+     * active sessions just means the cap can't be enforced until one finishes.
+     */
+    enforceOpenSessionCap(justRegistered) {
+        while (this.sessions.size > this.maxOpenSessions) {
+            let oldest;
+            for (const candidate of this.sessions) {
+                if (candidate === justRegistered || this.isPumping(candidate))
+                    continue;
+                if (!oldest || candidate.createdAt < oldest.createdAt)
+                    oldest = candidate;
+            }
+            if (!oldest) {
+                trace(`sessionManager.registerSession: open session cap exceeded ` +
+                    `(${this.sessions.size} > ${this.maxOpenSessions}) but no idle session is ` +
+                    `available to close — all remaining sessions are actively pumping`);
+                return;
+            }
+            trace(`sessionManager.registerSession: open session cap exceeded ` +
+                `(${this.sessions.size} > ${this.maxOpenSessions}), force-closing oldest idle session ` +
+                `${oldest.sessionId} (openCodeSessionId=${oldest.openCodeSessionId ?? "-"}, ` +
+                `ageMs=${this.now() - oldest.createdAt}, pending=${oldest.pending.size})`);
+            this.close(oldest, "open-session-cap-exceeded");
+        }
+    }
     recordSemanticProgress(session, at) {
         if (session.closed)
             return;
@@ -295,6 +360,10 @@ export class SessionManager {
         session.displayToolCalls?.clear();
         session.blobs?.clear();
         this.sessions.delete(session);
+        if (session.openCodeSessionId &&
+            this.byOpenCodeSessionId.get(session.openCodeSessionId) === session) {
+            this.byOpenCodeSessionId.delete(session.openCodeSessionId);
+        }
         try {
             session.stream.destroy();
         }
@@ -311,7 +380,7 @@ export class SessionManager {
     closeUnlessPending(session) {
         if (session.closed)
             return true;
-        const pumpActive = session.pumpOwner != null || session.pumpActive;
+        const pumpActive = this.isPumping(session);
         if (session.pending.size > 0 || pumpActive) {
             trace(`sessionManager.closeUnlessPending: KEEP open pendingCount=${session.pending.size} pumpActive=${pumpActive}`);
             return false;