cursor-opencode-provider 0.3.0 → 0.3.1

package/README.md

@@ -47,7 +47,7 @@ Add the package to OpenCode config. OpenCode installs npm plugins with Bun at st
 }
 ```
 
-Pin a version if you want: `"cursor-opencode-provider@0.2.9"`.
+Pin a version if you want: `"cursor-opencode-provider@0.3.1"`.
 
 You can also install it yourself first:
 
@@ -117,7 +117,7 @@ browser login or an API key. `CURSOR_API_KEY` is also picked up automatically.
 }
 ```
 
-Pin a version if you want: `"cursor-opencode-provider@0.2.9/plugin/opencode2"`.
+Pin a version if you want: `"cursor-opencode-provider@0.3.1/plugin/opencode2"`.
 
 OpenCode 2.0 installs the published package into its host cache and loads the AI SDK
 entry from there (`aisdk:cursor-opencode-provider`). No extra env vars are required.
@@ -350,10 +350,18 @@ OpenCode
 
 ### Injected system guidance
 
-The provider adds OpenCode-specific system guidance to normal tool-capable conversations, including tool availability, canonical workspace-path grounding, and preferring `edit` / `write` over shell-based file mutation when those tools are available. Compaction keeps its dedicated prompt unchanged.
+The provider adds OpenCode-specific system guidance to normal tool-capable conversations, including tool availability, canonical workspace-path grounding, and preferring `edit` / `write` (or `apply_patch`, when the host advertises that instead) over shell-based file mutation when those tools are available. Compaction keeps its dedicated prompt unchanged.
 
 If this guidance causes issues, update `buildOpenCodeInteractionGuidance` in [`src/language-model.ts`](src/language-model.ts) and its focused coverage in [`test/prompt-history.test.ts`](test/prompt-history.test.ts).
 
+### `apply_patch` models (GPT-5 and friends)
+
+OpenCode 1.x does not simply add `apply_patch` for GPT-series models — it **removes** `edit` and `write` from the tool catalog and advertises `apply_patch` in their place (`ToolRegistry.tools`; the model id must contain `gpt-` and neither `oss` nor `gpt-4`). Cursor keeps sending its native write/edit requests regardless, so without translation every file change on a `gpt-5*` model is refused as an unavailable tool.
+
+The provider translates transparently: a native write becomes an `*** Add File:` patch, and a Pi edit becomes a minimal `*** Update File:` chunk widened to whole lines. This is keyed purely off what the host advertises — it is inert whenever `edit`/`write` are offered normally, and inert again when the host offers neither those nor `apply_patch`. An edit that cannot be expressed faithfully (target unreadable, or the text to replace is absent or ambiguous) is refused with a specific message rather than applied to the wrong region.
+
+OpenCode 2.0 does not perform this substitution, so the path is 1.x-only in practice. See [`src/protocol/apply-patch.ts`](src/protocol/apply-patch.ts) for the upstream references.
+
 ### Native subagent routing
 
 The provider reads the permission-filtered subagent catalog from the current host `task` or `actor` definition and advertises those recipients to Cursor as custom subagents. Exact configured names are preserved; unknown future Cursor subtype strings fall back to `general`. If a complete catalog omits every compatible recipient, the request fails on Cursor's typed subagent channel instead of selecting an arbitrary specialist.
@@ -412,6 +420,7 @@ Project `instructions` may reference absolute or `~/` paths (OpenCode parity). S
 - **Compaction resets Cursor conversation state** — the classic plugin marks OpenCode's `compaction` agent explicitly. On those turns the provider mints an isolated Cursor `conversation_id`, drops the prior checkpoint + KV blobs, preserves real tool outputs as OpenCode-host observations in the seed history, and re-advertises the session's last tool catalog while refusing execution during the summary itself. The first normal turn then rebases once more onto a fresh conversation seeded with OpenCode's compacted prompt and normal system instructions, so the summary-agent checkpoint cannot suppress later tool calls. Ordinary no-tool / `toolChoice:none` calls do not reset conversation state.
 - **Conversation bindings and compaction catalogs are bounded** — process-global per-session bindings, prior tool catalogs, and pending post-compaction rebases use a 256-session LRU bound. Evicting a conversation binding also drops its checkpoint and KV blobs.
 - **Interrupted Runs resume from checkpoints** — a remote EOF, Connect end-stream, or trailer error is never emitted as a successful `stop`. When the failed Run produced an eligible checkpoint, the provider opens a new RPC for the same conversation and sends that state with `ResumeAction`, so completed text and tool work are not replayed. Before any stateful output, an interruption without a checkpoint can still rebase from OpenCode history. Stateful interruptions without a checkpoint are surfaced because replay would be ambiguous; retry exhaustion remains explicit. A transport closure after `turn_ended` is treated as successful completion.
+- **Large reads are capped at 50 KB by OpenCode, and the cap is reported** — OpenCode's `read` tool stops at `MAX_BYTES = 50 * 1024`, cutting on a whole-line boundary, and appends `(Output capped at 50 KB. Showing lines X-Y. Use offset=N to continue.)`. The provider strips that envelope before returning content to Cursor so the model cannot echo wrappers into a later write, but it re-states the cap: a capped native read appends a `[Partial read: …]` marker after the content, a capped MCP read gets a separate notice content item, and a Pi read carries structured `PiReadExecSuccess.truncation`. The structured `truncated` flag alone is not enough — verified against live `gpt-5.4-mini` and `grok-4.5` sessions, both of which asserted "highly confident" that partial content was the whole file until the textual marker was added. Deliberately paged reads (explicit `offset`/`limit`) are not marked. Without that signal the model treats a capped read as the whole file and rewrites it truncated, discarding everything past the cap. The cap is hardcoded in OpenCode's read tool — it is not the configurable `tool_output.max_bytes`, which governs `Truncate.Service` and not read's line accumulation — so the only lever is paging with `offset`. Prefer `edit` over whole-file `write` on files above 50 KB.
 - **No fallback models** — if Cursor’s `AvailableModels` API is unreachable and there is no local cache, the provider exposes no models.
 
 ## License

package/dist/agent-url.js

@@ -21,6 +21,8 @@ function normalizeApiBaseURL(baseURL) {
     return new URL(baseURL).origin;
 }
 function resolveCacheKey(token, options) {
+    // codeql[js/insufficient-password-hash] -- The token is a high-entropy JWT/API key,
+    // and this digest is only an ephemeral memoization key, never a password verifier.
     const tokenHash = createHash("sha256").update(token).digest("hex").slice(0, 16);
     return `${tokenHash}|${normalizeApiBaseURL(options.apiBaseURL ?? options.baseURL)}|telem:${options.telemetryEnabled === true}`;
 }

package/dist/context/paths.js

@@ -145,8 +145,9 @@ export function slugifyWorkspacePath(workspaceRoot) {
     const resolved = path.resolve(workspaceRoot);
     return resolved
         .replace(/[^a-zA-Z0-9]/g, "-")
-        .replace(/-+/g, "-")
-        .replace(/^-+|-+$/g, "");
+        .split("-")
+        .filter(Boolean)
+        .join("-");
 }
 /**
  * Cursor-style project metadata root for a workspace.

package/dist/language-model.js

@@ -6,7 +6,7 @@ import { trace, traceRequestContextPaths } from "./debug.js";
 import { buildRunRequest, buildHeartbeat } from "./protocol/request.js";
 import { decodeFramePayload } from "./protocol/framing.js";
 import { debugWalkTurnEnded, decodeMessage } from "./protocol/messages.js";
-import { parseExecServerMessage, buildToolCallPart, buildExecClientMessages, buildReadRejectionMessages, classifyMissingReadTarget, resolveReadTargetPath, parseExecIdFromToolCallId, detectExecVariantField, buildRequestContextResult, buildMcpStateResult, buildCustomWebToolAliases, extractHostSubagentCatalog, resolveCustomWebToolAlias, remapNativeSubagentForCatalog, CUSTOM_WEBFETCH_TOOL, CUSTOM_WEBSEARCH_TOOL, } from "./protocol/tools.js";
+import { parseExecServerMessage, buildToolCallPart, buildExecClientMessages, buildReadRejectionMessages, classifyMissingReadTarget, resolveReadTargetPath, parseExecIdFromToolCallId, detectExecVariantField, buildRequestContextResult, buildMcpStateResult, buildCustomWebToolAliases, extractHostSubagentCatalog, resolveCustomWebToolAlias, remapNativeSubagentForCatalog, remapEditToolsForCatalog, CUSTOM_WEBFETCH_TOOL, CUSTOM_WEBSEARCH_TOOL, } from "./protocol/tools.js";
 import { describeCursorExecVariant } from "./protocol/exec-variants.js";
 import { advertisedToolNamesFromDescriptors, extractExecDisplayCallId, extractProtobufSubmessage, listProtobufFieldNumbers, parseDisplayToolCall, resolveBridgedOpenCodeToolCall, } from "./protocol/tool-call-bridge.js";
 import { handleKvServerMessage } from "./protocol/kv.js";
@@ -954,7 +954,9 @@ export async function pump(session, controller, ids, abortSignal) {
         if (!displayCallId ||
             parsed.resultField !== "read_result" ||
             parsed.toolName !== "read" ||
-            !advertisedToolNameSet.has("write"))
+            // `apply_patch` is the substitute this host offers when it withholds
+            // `write` — the follow-up write_args is remapped onto it either way.
+            !(advertisedToolNameSet.has("write") || advertisedToolNameSet.has("apply_patch")))
             return false;
         const stored = session.displayToolCalls.get(displayCallId);
         const display = parseDisplayToolCall(displayCallId, stored);
@@ -1377,6 +1379,10 @@ export async function pump(session, controller, ids, abortSignal) {
                             parsed.toolName = executableToolName;
                         }
                         remapNativeSubagentForCatalog(parsed, advertisedToolNameSet, session.subagentCatalog);
+                        // Hosts that advertise `apply_patch` in place of `edit`/`write` (see
+                        // protocol/apply-patch.ts) still receive Cursor's native write/edit
+                        // exec requests. Translate before the unavailable-tool check below.
+                        remapEditToolsForCatalog(parsed, advertisedToolNameSet, workspaceRootFromRequestContext(session.requestContext));
                     }
                     const displayCallId = extractExecDisplayCallId(esm);
                     trace(`exec: id=${parsed?.id} variant=${parsed ? Object.keys(parsed).join(",") : "none"} toolName=${parsed?.toolName} resultField=${parsed?.resultField}`);
@@ -1663,6 +1669,12 @@ export function buildOpenCodeInteractionGuidance(tools, isCompaction, workspaceR
             ? "- For file changes, use OpenCode `edit` for targeted changes to existing files and `write` to create files or intentionally replace complete contents; do not use shell, Python, or heredocs to change file content while these tools are available."
             : "- Use OpenCode `write` for file-content changes; do not use shell, Python, or heredocs to change file content while it is available.");
     }
+    else if (names.has("apply_patch")) {
+        // This host withheld `edit`/`write` and offers `apply_patch` instead. Native
+        // Cursor write/edit requests are translated into it, so say so rather than
+        // leaving the turn with no file-editing guidance at all.
+        instructions.push("- Use OpenCode `apply_patch` for file-content changes; do not use shell, Python, or heredocs to change file content while it is available. Cursor-native write and edit requests are accepted and converted to `apply_patch` automatically.");
+    }
     return [
         `OpenCode exposes exactly these executable tools for this turn: ${[...names].map((name) => `\`${name}\``).join(", ")}.`,
         `Workspace root: ${JSON.stringify(workspaceRoot)}. Resolve workspace paths against exactly this root; never invent an absolute prefix, and verify uncertain paths with an available tool before using them.`,

package/dist/model-config.js

@@ -19,9 +19,27 @@ import { CURSOR_VARIANT_PARAMETERS_KEY, CURSOR_WIRE_MODEL_ID_KEY, parseCursorCon
  * Dots and unicode letters are preserved so names stay readable.
  * Fixes https://github.com/oakimov/cursor-opencode-provider/issues/2.
  */
+function stripMarkupTags(value) {
+    const chunks = [];
+    let cursor = 0;
+    while (cursor < value.length) {
+        const start = value.indexOf("<", cursor);
+        if (start === -1) {
+            chunks.push(value.slice(cursor));
+            break;
+        }
+        chunks.push(value.slice(cursor, start));
+        const end = value.indexOf(">", start + 1);
+        if (end === -1) {
+            chunks.push(value.slice(start));
+            break;
+        }
+        cursor = end + 1;
+    }
+    return chunks.join("");
+}
 function safeLabel(value) {
-    return (value
-        .replace(/<[^>]+>/g, "")
+    return (stripMarkupTags(value)
         .replace(/[()<>&"'`]/g, "")
         .replace(/\s+/g, " ")
         .trim() || "default");

package/dist/protocol/apply-patch.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Synthesis of OpenCode `apply_patch` envelopes from Cursor's native write/edit
+ * exec requests.
+ *
+ * ## Why this exists
+ *
+ * OpenCode 1.x does not merely *add* `apply_patch` for GPT models — it removes
+ * `edit` and `write` from the catalog in exchange. From
+ * `packages/opencode/src/tool/registry.ts` (`ToolRegistry.tools`):
+ *
+ * ```ts
+ * // use apply tool in same format as codex
+ * const usePatch =
+ *   input.modelID.includes("gpt-") && !input.modelID.includes("oss") && !input.modelID.includes("gpt-4")
+ * if (tool.id === ApplyPatchTool.id) return usePatch
+ * if (tool.id === EditTool.id || tool.id === WriteTool.id) return !usePatch
+ * ```
+ *
+ * The predicate runs on the *API* model id, so every Cursor `gpt-5*` model
+ * matches (and, as a quirk of substring matching, `gpt-3.5-*` does too while
+ * `gpt-4o` does not).
+ *
+ * Upstream context, in case this ever needs revisiting:
+ *
+ * - Introduced by opencode PR #9127 ("apply_patch tool for openai models"). The
+ *   intent is to hand GPT/Codex models the tool surface they were post-trained
+ *   on; the same commit tells the codex system prompt to prefer `apply_patch`.
+ * - The *exclusivity* is deliberate. On opencode issue #34491 a maintainer
+ *   describes the gate as a "band-aid", "intentionally minimal", whose purpose
+ *   is that "GPT no longer receives edit + write + apply_patch simultaneously",
+ *   and notes that a plugin-side opt-out "isn't feasible today".
+ * - opencode issue #19942 reported exactly this hazard — model-conditional tool
+ *   substitution makes model-agnostic integrations impossible — and was closed
+ *   `not_planned` by a stale bot.
+ * - opencode issue #35408 (open, milestone 2.0) proposes a
+ *   `ctx.session.context(...)` hook exposing a mutable tool roster, and lists
+ *   "Select `apply_patch` versus `edit` + `write`" as work to move out of the
+ *   registry. Once that lands, a host-side opt-out replaces this shim.
+ * - OpenCode 2.0 (`packages/core`) has **no** such gate: `apply_patch`, `edit`
+ *   and `write` are all registered unconditionally in `tool/builtins.ts`. This
+ *   translation is therefore 1.x-only in practice, but it is keyed off the
+ *   advertised set rather than a version check, so it simply never fires on 2.0.
+ *
+ * ## Why translation, not advertisement
+ *
+ * `toolsToDescriptors` forwards every advertised host tool to Cursor verbatim,
+ * so `opencode-apply_patch` already appears in Cursor's catalog whenever
+ * OpenCode advertises it, and an `mcp_args` call naming it already executes.
+ * What breaks is Cursor's *native* write/edit channel (`write_args`,
+ * `pi_edit_args`), which this provider resolves to the fixed host names
+ * `write`/`edit`.
+ *
+ * Translating on our side is the only option: Cursor's agent protocol has no
+ * patch-format edit tool at all (its `ToolCall` oneof offers whole-file
+ * `edit_tool_call`/`write_args` and substring `pi_edit_tool_call`/`pi_edit_args`;
+ * `apply_agent_diff_tool_call` is unrelated — it applies a cloud agent's diff by
+ * `agent_id`). Cursor's CLI also contains no model-conditional branching
+ * whatsoever, and `ModelDetails` carries no tool-capability flags, so the same
+ * native requests arrive for every model. Those names are absent from
+ * the catalog, so the request is refused before it reaches OpenCode.
+ *
+ * ## Format notes (verified against `packages/opencode/src/patch/index.ts`)
+ *
+ * - `*** Add File:` **overwrites an existing file** — the tool's `add` case uses
+ *   `oldContent = ""` and never stats the target (upstream test: "adds file
+ *   overwriting existing file"). A whole-file write therefore needs no diff and
+ *   no existence check.
+ * - An empty `@@` header is a valid chunk start: the parser stores
+ *   `change_context: contextLine || undefined`, and a missing context simply
+ *   means "match `old_lines` from the current scan position".
+ * - Every payload line is prefixed with `+`, `-`, or a space, and the parser
+ *   only breaks on *unprefixed* `***` / `@@`. Content lines that themselves
+ *   begin with `***` or `@@` therefore survive a round trip unharmed.
+ * - `Add File` content is rejoined with `\n` and normalized to exactly one
+ *   trailing newline. A write of content with no trailing newline gains one.
+ * - Update chunks match **whole lines** via `seekSequence`, unlike OpenCode
+ *   `edit`, which is substring-based. Substring edits must be expanded to line
+ *   boundaries before they can be expressed as a patch — see `planSubstringEdit`.
+ * - Renames are rejected by OpenCode 2.0's implementation ("apply_patch moves
+ *   are not supported yet"), so `*** Move to:` is never emitted here.
+ */
+export declare const APPLY_PATCH_TOOL = "apply_patch";
+/** One `@@` chunk: replace `oldLines` with `newLines`. */
+export type UpdateChunk = {
+    oldLines: string[];
+    newLines: string[];
+};
+/**
+ * Whole-file write as `*** Add File:`. Valid whether or not the target exists —
+ * OpenCode's add case overwrites unconditionally.
+ */
+export declare function buildAddFilePatch(filePath: string, content: string): string;
+/** Targeted replacement as `*** Update File:` with one `@@` chunk per change. */
+export declare function buildUpdateFilePatch(filePath: string, chunks: UpdateChunk[]): string;
+export type SubstringEditPlan = {
+    ok: true;
+    chunks: UpdateChunk[];
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Expand a substring replacement to the whole lines it touches, because
+ * `apply_patch` matches line sequences rather than substrings.
+ *
+ * Refuses rather than guessing: an absent match, or an ambiguous one without
+ * `replaceAll`, would otherwise be silently applied to the wrong region.
+ */
+export declare function planSubstringEdit(source: string, oldString: string, newString: string, replaceAll?: boolean): SubstringEditPlan;

package/dist/protocol/apply-patch.js

@@ -0,0 +1,163 @@
+/**
+ * Synthesis of OpenCode `apply_patch` envelopes from Cursor's native write/edit
+ * exec requests.
+ *
+ * ## Why this exists
+ *
+ * OpenCode 1.x does not merely *add* `apply_patch` for GPT models — it removes
+ * `edit` and `write` from the catalog in exchange. From
+ * `packages/opencode/src/tool/registry.ts` (`ToolRegistry.tools`):
+ *
+ * ```ts
+ * // use apply tool in same format as codex
+ * const usePatch =
+ *   input.modelID.includes("gpt-") && !input.modelID.includes("oss") && !input.modelID.includes("gpt-4")
+ * if (tool.id === ApplyPatchTool.id) return usePatch
+ * if (tool.id === EditTool.id || tool.id === WriteTool.id) return !usePatch
+ * ```
+ *
+ * The predicate runs on the *API* model id, so every Cursor `gpt-5*` model
+ * matches (and, as a quirk of substring matching, `gpt-3.5-*` does too while
+ * `gpt-4o` does not).
+ *
+ * Upstream context, in case this ever needs revisiting:
+ *
+ * - Introduced by opencode PR #9127 ("apply_patch tool for openai models"). The
+ *   intent is to hand GPT/Codex models the tool surface they were post-trained
+ *   on; the same commit tells the codex system prompt to prefer `apply_patch`.
+ * - The *exclusivity* is deliberate. On opencode issue #34491 a maintainer
+ *   describes the gate as a "band-aid", "intentionally minimal", whose purpose
+ *   is that "GPT no longer receives edit + write + apply_patch simultaneously",
+ *   and notes that a plugin-side opt-out "isn't feasible today".
+ * - opencode issue #19942 reported exactly this hazard — model-conditional tool
+ *   substitution makes model-agnostic integrations impossible — and was closed
+ *   `not_planned` by a stale bot.
+ * - opencode issue #35408 (open, milestone 2.0) proposes a
+ *   `ctx.session.context(...)` hook exposing a mutable tool roster, and lists
+ *   "Select `apply_patch` versus `edit` + `write`" as work to move out of the
+ *   registry. Once that lands, a host-side opt-out replaces this shim.
+ * - OpenCode 2.0 (`packages/core`) has **no** such gate: `apply_patch`, `edit`
+ *   and `write` are all registered unconditionally in `tool/builtins.ts`. This
+ *   translation is therefore 1.x-only in practice, but it is keyed off the
+ *   advertised set rather than a version check, so it simply never fires on 2.0.
+ *
+ * ## Why translation, not advertisement
+ *
+ * `toolsToDescriptors` forwards every advertised host tool to Cursor verbatim,
+ * so `opencode-apply_patch` already appears in Cursor's catalog whenever
+ * OpenCode advertises it, and an `mcp_args` call naming it already executes.
+ * What breaks is Cursor's *native* write/edit channel (`write_args`,
+ * `pi_edit_args`), which this provider resolves to the fixed host names
+ * `write`/`edit`.
+ *
+ * Translating on our side is the only option: Cursor's agent protocol has no
+ * patch-format edit tool at all (its `ToolCall` oneof offers whole-file
+ * `edit_tool_call`/`write_args` and substring `pi_edit_tool_call`/`pi_edit_args`;
+ * `apply_agent_diff_tool_call` is unrelated — it applies a cloud agent's diff by
+ * `agent_id`). Cursor's CLI also contains no model-conditional branching
+ * whatsoever, and `ModelDetails` carries no tool-capability flags, so the same
+ * native requests arrive for every model. Those names are absent from
+ * the catalog, so the request is refused before it reaches OpenCode.
+ *
+ * ## Format notes (verified against `packages/opencode/src/patch/index.ts`)
+ *
+ * - `*** Add File:` **overwrites an existing file** — the tool's `add` case uses
+ *   `oldContent = ""` and never stats the target (upstream test: "adds file
+ *   overwriting existing file"). A whole-file write therefore needs no diff and
+ *   no existence check.
+ * - An empty `@@` header is a valid chunk start: the parser stores
+ *   `change_context: contextLine || undefined`, and a missing context simply
+ *   means "match `old_lines` from the current scan position".
+ * - Every payload line is prefixed with `+`, `-`, or a space, and the parser
+ *   only breaks on *unprefixed* `***` / `@@`. Content lines that themselves
+ *   begin with `***` or `@@` therefore survive a round trip unharmed.
+ * - `Add File` content is rejoined with `\n` and normalized to exactly one
+ *   trailing newline. A write of content with no trailing newline gains one.
+ * - Update chunks match **whole lines** via `seekSequence`, unlike OpenCode
+ *   `edit`, which is substring-based. Substring edits must be expanded to line
+ *   boundaries before they can be expressed as a patch — see `planSubstringEdit`.
+ * - Renames are rejected by OpenCode 2.0's implementation ("apply_patch moves
+ *   are not supported yet"), so `*** Move to:` is never emitted here.
+ */
+export const APPLY_PATCH_TOOL = "apply_patch";
+const BEGIN = "*** Begin Patch";
+const END = "*** End Patch";
+/**
+ * Whole-file write as `*** Add File:`. Valid whether or not the target exists —
+ * OpenCode's add case overwrites unconditionally.
+ */
+export function buildAddFilePatch(filePath, content) {
+    const lines = splitLines(content);
+    return [BEGIN, `*** Add File: ${filePath}`, ...lines.map((line) => `+${line}`), END].join("\n");
+}
+/** Targeted replacement as `*** Update File:` with one `@@` chunk per change. */
+export function buildUpdateFilePatch(filePath, chunks) {
+    const body = [];
+    for (const chunk of chunks) {
+        body.push("@@");
+        for (const line of chunk.oldLines)
+            body.push(`-${line}`);
+        for (const line of chunk.newLines)
+            body.push(`+${line}`);
+    }
+    return [BEGIN, `*** Update File: ${filePath}`, ...body, END].join("\n");
+}
+/**
+ * Expand a substring replacement to the whole lines it touches, because
+ * `apply_patch` matches line sequences rather than substrings.
+ *
+ * Refuses rather than guessing: an absent match, or an ambiguous one without
+ * `replaceAll`, would otherwise be silently applied to the wrong region.
+ */
+export function planSubstringEdit(source, oldString, newString, replaceAll = false) {
+    if (oldString === "")
+        return { ok: false, reason: "the text to replace is empty" };
+    const offsets = [];
+    for (let at = source.indexOf(oldString); at !== -1; at = source.indexOf(oldString, at + oldString.length)) {
+        offsets.push(at);
+    }
+    if (offsets.length === 0)
+        return { ok: false, reason: "the text to replace was not found in the file" };
+    if (offsets.length > 1 && !replaceAll) {
+        return {
+            ok: false,
+            reason: `the text to replace appears ${offsets.length} times; it must be unique`,
+        };
+    }
+    const targets = replaceAll ? offsets : offsets.slice(0, 1);
+    const chunks = [];
+    let previousEnd = -1;
+    for (const offset of targets) {
+        const start = lineStart(source, offset);
+        const end = lineEnd(source, offset + oldString.length);
+        // Overlapping expansions would emit the same original lines twice, and the
+        // second chunk could never match after the first replaced them.
+        if (start < previousEnd) {
+            return { ok: false, reason: "overlapping replacements cannot be expressed as a patch" };
+        }
+        previousEnd = end;
+        const before = source.slice(start, offset);
+        const after = source.slice(offset + oldString.length, end);
+        chunks.push({
+            oldLines: splitLines(source.slice(start, end)),
+            newLines: splitLines(before + newString + after),
+        });
+    }
+    return { ok: true, chunks };
+}
+/**
+ * Split into patch payload lines. A trailing newline is dropped so it is not
+ * emitted as a spurious empty line — OpenCode re-adds exactly one on apply.
+ */
+function splitLines(text) {
+    const normalized = text.endsWith("\n") ? text.slice(0, -1) : text;
+    return normalized.split("\n");
+}
+function lineStart(source, offset) {
+    const at = source.lastIndexOf("\n", offset - 1);
+    return at === -1 ? 0 : at + 1;
+}
+function lineEnd(source, offset) {
+    const at = source.indexOf("\n", offset);
+    return at === -1 ? source.length : at;
+}

package/dist/protocol/messages.js

@@ -434,15 +434,22 @@ export function createMessageTypes() {
         { id: 1, name: "success", type: "GrepSuccess" },
         { id: 2, name: "error", type: "GrepError" },
     ], [{ name: "result", fields: ["success", "error"] }]);
+    // agent.v1.WriteArgs. Cursor's own LocalWriteExecutor reads `file_bytes`
+    // first and only falls back to `file_text`, so a write whose content arrives
+    // as bytes decodes to an empty string unless field 5 is declared here.
     addType(root, "WriteArgs", [
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "file_text", type: "string" },
         { id: 3, name: "tool_call_id", type: "string" },
+        { id: 4, name: "return_file_content_after_write", type: "bool" },
+        { id: 5, name: "file_bytes", type: "bytes" },
+        { id: 6, name: "encoding_hint", type: "string" },
     ]);
     addType(root, "WriteSuccess", [
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "lines_created", type: "int32" },
         { id: 3, name: "file_size", type: "int32" },
+        { id: 4, name: "file_content_after_write", type: "string" },
     ]);
     addType(root, "WriteError", [
         { id: 1, name: "path", type: "string" },
@@ -476,7 +483,26 @@ export function createMessageTypes() {
         { id: 2, name: "error", type: "PiWriteError" },
         { id: 3, name: "rejected", type: "PiWriteRejected" },
     ], [{ name: "result", fields: ["success", "error", "rejected"] }]);
-    addType(root, "PiOutputSuccess", [{ id: 1, name: "output", type: "string" }]);
+    // agent.v1.PiTruncation. Every Pi *ExecSuccess shares output(1)+truncation(2)
+    // and only diverges at field 3, so the shared PiOutputSuccess can carry it.
+    // Cursor's own CLI always reports truncation rather than silently shortening
+    // a payload; emitting this keeps a capped read distinguishable from a
+    // complete one.
+    addType(root, "PiTruncation", [
+        { id: 1, name: "truncated", type: "bool" },
+        { id: 2, name: "truncated_by", type: "string" },
+        { id: 3, name: "total_lines", type: "uint32" },
+        { id: 4, name: "output_lines", type: "uint32" },
+        { id: 5, name: "output_bytes", type: "uint32" },
+        { id: 6, name: "max_lines", type: "uint32" },
+        { id: 7, name: "max_bytes", type: "uint32" },
+        { id: 8, name: "first_line_exceeds_limit", type: "bool" },
+        { id: 9, name: "last_line_partial", type: "bool" },
+    ]);
+    addType(root, "PiOutputSuccess", [
+        { id: 1, name: "output", type: "string" },
+        { id: 2, name: "truncation", type: "PiTruncation" },
+    ]);
     addType(root, "PiExecError", [{ id: 1, name: "error", type: "string" }]);
     addType(root, "PiExecRejected", [{ id: 1, name: "reason", type: "string" }]);
     for (const resultType of [

package/dist/protocol/tools.d.ts

@@ -87,6 +87,22 @@ export declare function resolveCursorSubagentType(subagentType: string, catalog?
 export declare function mapCursorSubagentTypeToOpenCode(subagentType: string): string;
 /** Resolve a native Cursor subagent request to this turn's executor and catalog. */
 export declare function remapNativeSubagentForCatalog(parsed: ParsedExecRequest, advertisedToolNames: Iterable<string>, catalog?: HostSubagentCatalog): void;
+/**
+ * Express a native Cursor write/edit as `apply_patch` when the host swapped the
+ * edit-tool family out from under us.
+ *
+ * OpenCode 1.x removes `edit` and `write` from the catalog for GPT models and
+ * advertises `apply_patch` in their place — see the module comment in
+ * `./apply-patch.ts` for the upstream reasoning and citations. Cursor keeps
+ * using its native write/edit exec channel regardless, so without this the
+ * request is refused as an unavailable tool and the model loses the ability to
+ * change files at all.
+ *
+ * Keyed purely off the advertised set: this is inert whenever the host offers
+ * `write`/`edit` normally, and equally inert when it offers neither those nor
+ * `apply_patch` (the caller's unavailable-tool rejection still applies).
+ */
+export declare function remapEditToolsForCatalog(parsed: ParsedExecRequest, advertisedToolNames: Iterable<string>, workspaceRoot?: string): void;
 export type ParsedExecRequest = {
     id: number;
     execId: string;

package/dist/protocol/tools.js

@@ -7,6 +7,7 @@ import { buildEnv } from "../context/env.js";
 import { ensureOpencodeProjectDir } from "../context/paths.js";
 import { trace, traceRequestContextPaths } from "../debug.js";
 import { cursorExecVariantByRequestName } from "./exec-variants.js";
+import { APPLY_PATCH_TOOL, buildAddFilePatch, buildUpdateFilePatch, planSubstringEdit, } from "./apply-patch.js";
 import { BACKGROUND_SHELL_MARKER, buildBackgroundShellCommand, } from "../shell-timeout.js";
 // Exec variant field number whose reply is the server-initiated request_context
 // probe (ExecServerMessage #10 → ExecClientMessage #10). request/result share a
@@ -260,11 +261,15 @@ const CURSOR_INTERNAL_KEYS = new Set([
     "close_stdin",
     "output_notification",
     "file_output_threshold_bytes",
+    // WriteArgs #4. A request for WriteSuccess.file_content_after_write, which we
+    // do not populate; harmless to omit, but it is not tool input.
     "return_file_content_after_write",
-    "file_bytes",
-    "encoding_hint",
     "ignore",
 ]);
+// WriteArgs #5/#6 are deliberately NOT internal: `file_bytes` carries the file
+// content itself whenever Cursor sends it instead of `file_text` (its own
+// LocalWriteExecutor prefers bytes when non-empty), and `encoding_hint` is how
+// that payload is decoded. The `write` mapping consumes both explicitly.
 /** Required content fields where an empty string is meaningful (for example, truncating a file). */
 const PRESERVE_EMPTY_STRING_KEYS = new Set([
     "content",
@@ -476,6 +481,92 @@ export function remapNativeSubagentForCatalog(parsed, advertisedToolNames, catal
         },
     };
 }
+/** Matches Cursor's own pre-write read threshold (`local-exec` 52428800). */
+const MAX_EDIT_SOURCE_BYTES = 50 * 1024 * 1024;
+/**
+ * Express a native Cursor write/edit as `apply_patch` when the host swapped the
+ * edit-tool family out from under us.
+ *
+ * OpenCode 1.x removes `edit` and `write` from the catalog for GPT models and
+ * advertises `apply_patch` in their place — see the module comment in
+ * `./apply-patch.ts` for the upstream reasoning and citations. Cursor keeps
+ * using its native write/edit exec channel regardless, so without this the
+ * request is refused as an unavailable tool and the model loses the ability to
+ * change files at all.
+ *
+ * Keyed purely off the advertised set: this is inert whenever the host offers
+ * `write`/`edit` normally, and equally inert when it offers neither those nor
+ * `apply_patch` (the caller's unavailable-tool rejection still applies).
+ */
+export function remapEditToolsForCatalog(parsed, advertisedToolNames, workspaceRoot) {
+    if (parsed.toolName !== "write" && parsed.toolName !== "edit")
+        return;
+    const advertised = new Set(advertisedToolNames);
+    if (advertised.has(parsed.toolName) || !advertised.has(APPLY_PATCH_TOOL))
+        return;
+    const requested = parsed.toolName;
+    const filePath = str(parsed.args.filePath);
+    const refuse = (reason) => {
+        parsed.toolName = APPLY_PATCH_TOOL;
+        parsed.args = {};
+        parsed.localError =
+            `Cursor ${requested} request cannot be expressed as an apply_patch call: ${reason}. ` +
+                "The host advertises `apply_patch` instead of `edit`/`write` for this model.";
+    };
+    if (!filePath) {
+        refuse("no target path was provided");
+        return;
+    }
+    let patchText;
+    if (requested === "write") {
+        const content = stringValue(parsed.args.content);
+        if (content === undefined) {
+            refuse("no file content was provided");
+            return;
+        }
+        // `*** Add File:` overwrites an existing target, so a whole-file write maps
+        // directly without reading the current contents or diffing.
+        patchText = buildAddFilePatch(filePath, content);
+    }
+    else {
+        const oldString = stringValue(parsed.args.oldString);
+        const newString = stringValue(parsed.args.newString);
+        if (oldString === undefined || newString === undefined) {
+            refuse("the replacement is missing its old or new text");
+            return;
+        }
+        // apply_patch matches whole lines, so a substring edit has to be widened to
+        // the lines it touches — which requires the file the model is editing.
+        const absolute = path.resolve(workspaceRoot ?? process.cwd(), filePath);
+        let source;
+        try {
+            // Bounded because this read is synchronous on the Run pump. Cursor's own
+            // executor uses the same 50 MB threshold before reading a file it is
+            // about to write.
+            const size = fs.statSync(absolute).size;
+            if (size > MAX_EDIT_SOURCE_BYTES) {
+                refuse(`the target file is ${Math.round(size / 1024 / 1024)} MB, too large to patch`);
+                return;
+            }
+            source = fs.readFileSync(absolute, "utf8");
+        }
+        catch (e) {
+            refuse(`the target file could not be read (${e.message})`);
+            return;
+        }
+        const plan = planSubstringEdit(source, oldString, newString, parsed.args.replaceAll === true);
+        if (!plan.ok) {
+            refuse(plan.reason);
+            return;
+        }
+        patchText = buildUpdateFilePatch(filePath, plan.chunks);
+    }
+    parsed.toolName = APPLY_PATCH_TOOL;
+    parsed.args = { patchText };
+    // apply_patch's output does not carry opencode `write`'s <path> tag, so keep
+    // the requested path for the typed Cursor result.
+    parsed.resultMetadata = { ...parsed.resultMetadata, path: filePath };
+}
 export function parseExecServerMessage(msg) {
     const id = msg.id;
     if (id === undefined)
@@ -707,7 +798,13 @@ export function mapCursorArgsToOpencode(toolName, raw, execVariant) {
             const filePath = str(cleaned.filePath) ?? str(cleaned.path) ?? str(cleaned.file_path);
             if (filePath)
                 args.filePath = filePath;
-            const content = stringValue(cleaned.content) ?? stringValue(cleaned.file_text) ?? stringValue(cleaned.fileText);
+            // Cursor's LocalWriteExecutor prefers `file_bytes` whenever it is
+            // non-empty and only falls back to `file_text`; mirror that order so a
+            // byte-encoded write is not silently seen as empty content.
+            const bytes = bytesValue(cleaned.file_bytes) ?? bytesValue(cleaned.fileBytes);
+            const content = bytes !== undefined
+                ? decodeWriteBytes(bytes, str(cleaned.encoding_hint) ?? str(cleaned.encodingHint))
+                : stringValue(cleaned.content) ?? stringValue(cleaned.file_text) ?? stringValue(cleaned.fileText);
             if (content !== undefined)
                 args.content = content;
             return { toolName: "write", args };
@@ -781,6 +878,32 @@ function str(v) {
 function stringValue(v) {
     return typeof v === "string" ? v : undefined;
 }
+/** A non-empty protobuf `bytes` field, or undefined when absent/empty. */
+function bytesValue(v) {
+    if (v instanceof Uint8Array)
+        return v.length > 0 ? v : undefined;
+    if (Array.isArray(v) && v.every((b) => typeof b === "number")) {
+        return v.length > 0 ? Uint8Array.from(v) : undefined;
+    }
+    return undefined;
+}
+/**
+ * Decode `WriteArgs.file_bytes`. `encoding_hint` names the file's original
+ * encoding; OpenCode's `write` takes a string, so anything Node cannot decode
+ * falls back to UTF-8 rather than dropping the write.
+ */
+function decodeWriteBytes(bytes, encodingHint) {
+    const encoding = encodingHint?.trim().toLowerCase().replace(/[_ ]/g, "-");
+    if (encoding && encoding !== "utf-8" && encoding !== "utf8") {
+        try {
+            return new TextDecoder(encoding, { fatal: false }).decode(bytes);
+        }
+        catch {
+            trace(`write: unsupported encoding_hint ${JSON.stringify(encodingHint)} — decoding as utf-8`);
+        }
+    }
+    return new TextDecoder("utf-8").decode(bytes);
+}
 function num(v) {
     if (typeof v === "number" && Number.isFinite(v))
         return v;
@@ -1076,16 +1199,22 @@ export function buildTypedExecResult(resultField, output, error, toolName, resul
                 return { error: { path: readPath, error } };
             // Strip opencode's <path>/<content> envelope so Cursor's model receives
             // raw file content and can't echo the wrapper into subsequent writes.
-            // reads route here only for native read_args; most arrive via mcp_result.
+            // Cursor's native read_args lands here; `mcp_args` reads land in
+            // mcp_result. Live captures show gpt-5.4-mini and grok-4.5 both use the
+            // native channel, so this is the path that matters in practice.
             const content = unwrapReadOutput(output);
             const statPath = extractPathTag(output) ?? readPath;
             const outputMetadata = parseOpenCodeReadMetadata(output);
             const totalLines = outputMetadata.totalLines ?? readFileLineCount(statPath) ?? countLines(content);
             const rangeApplied = readRangeApplied(resultMetadata, totalLines);
+            // `truncated` alone is not enough: it is set here, and models still assert
+            // the partial content is the whole file. Cursor's own executor puts the
+            // limit marker in the output text for the same reason, so append one.
+            const notice = readTruncationNotice(output, resultMetadata);
             return {
                 success: {
                     path: readPath,
-                    content,
+                    content: notice ? `${content}\n\n${notice}` : content,
                     total_lines: totalLines,
                     file_size: readFileSize(statPath),
                     truncated: readOutputTruncated(resultMetadata, outputMetadata, totalLines),
@@ -1117,25 +1246,34 @@ export function buildTypedExecResult(resultField, output, error, toolName, resul
                 },
             };
         }
-        case "write_result":
+        case "write_result": {
+            // `apply_patch` output carries no <path> tag, so prefer the path recorded
+            // when the request was remapped away from `write`.
+            const remappedPath = str(resultMetadata?.path);
             if (error)
-                return { error: { path: "", error } };
+                return { error: { path: remappedPath ?? "", error } };
             return {
                 success: {
-                    path: extractPathTag(output) ?? "",
+                    path: remappedPath ?? extractPathTag(output) ?? "",
                     lines_created: countLines(output),
                     file_size: output.length,
                 },
             };
+        }
         case "pi_write_result":
             // PiWriteExecSuccess is just { output }; error is { error }.
             if (error)
                 return { error: { error } };
             return { success: { output: output || "Wrote file successfully." } };
-        case "pi_read_result":
+        case "pi_read_result": {
             if (error)
                 return { error: { error } };
-            return { success: { output: unwrapReadOutput(output) } };
+            // Pi results carry truncation structurally (PiReadExecSuccess field 2),
+            // which is how Cursor's own executors report a capped payload.
+            const content = unwrapReadOutput(output);
+            const truncation = readTruncationMessage(output, content);
+            return { success: { output: content, ...(truncation ? { truncation } : {}) } };
+        }
         case "pi_bash_result":
         case "pi_edit_result":
         case "pi_grep_result":
@@ -1204,21 +1342,29 @@ export function buildTypedExecResult(resultField, output, error, toolName, resul
                 },
             };
         }
-        case "mcp_result":
+        case "mcp_result": {
             if (error)
                 return { error: { error } };
             // opencode built-ins (read/write/grep/…) are advertised as MCP tools, so
             // a read call returns through mcp_result. Scope the unwrap to toolName
             // "read" so a non-read MCP tool whose output merely contains a
             // "<content>"-like block is never rewritten.
+            if (toolName !== "read") {
+                return { success: { content: [{ text: { text: output } }], is_error: false } };
+            }
+            // Carry the truncation notice as its own content item: the file content
+            // item stays byte-exact, so it can still never be echoed into a write.
+            const notice = readTruncationNotice(output);
             return {
                 success: {
                     content: [
-                        { text: { text: toolName === "read" ? unwrapReadOutput(output) : output } },
+                        { text: { text: unwrapReadOutput(output) } },
+                        ...(notice ? [{ text: { text: notice } }] : []),
                     ],
                     is_error: false,
                 },
             };
+        }
         case "subagent_result": {
             const task = parseOpenCodeTaskOutput(output);
             if (error || task.state === "error") {
@@ -1270,22 +1416,114 @@ function extractPathTag(output) {
     const m = output.match(/<path>([^<]+)<\/path>/);
     return m?.[1];
 }
+/**
+ * Isolate opencode's read footer: the last blank-line-separated block before
+ * the closing `</content>`. Scanning the whole envelope would let a file that
+ * merely *quotes* a footer (this repository's own docs and tests do) pass for a
+ * truncated read. The body can never contain a blank line — every source line
+ * is rendered as `N: …`, so even an empty line keeps its `N: ` prefix.
+ *
+ * Falls back to the full string when the envelope is absent, preserving
+ * behavior for non-standard read output.
+ */
+function readEnvelopeFooter(output) {
+    const close = output.lastIndexOf("\n</content>");
+    if (close === -1)
+        return output;
+    const start = output.lastIndexOf("\n\n", close);
+    if (start === -1)
+        return output;
+    return output.slice(start + 2, close);
+}
 /** Recover full-file metadata before unwrapReadOutput removes OpenCode's footer. */
 function parseOpenCodeReadMetadata(output) {
-    const showing = /Showing lines (\d+)-(\d+)(?: of (\d+))?\./.exec(output);
+    const footer = readEnvelopeFooter(output);
+    const showing = /Showing lines (\d+)-(\d+)(?: of (\d+))?\./.exec(footer);
     if (showing) {
         return {
             startLine: Number(showing[1]),
             endLine: Number(showing[2]),
             ...(showing[3] ? { totalLines: Number(showing[3]) } : {}),
-            outputCapped: output.includes("(Output capped at "),
+            outputCapped: footer.includes("(Output capped at "),
         };
     }
-    const complete = /\(End of file - total (\d+) lines?\)/.exec(output);
+    const complete = /\(End of file - total (\d+) lines?\)/.exec(footer);
     if (complete)
         return { totalLines: Number(complete[1]) };
     return {};
 }
+/**
+ * OpenCode's `read` caps output at 50 KB (`tool/read.ts` MAX_BYTES = 50 * 1024)
+ * and cuts on a whole-line boundary, then appends
+ * "(Output capped at 50 KB. Showing lines X-Y. Use offset=N to continue.)".
+ *
+ * `unwrapReadOutput` strips that footer along with the envelope, deliberately:
+ * Cursor's model echoes whatever it is handed straight back into the next
+ * write, so anything left in the content stream can end up written into the
+ * file. But dropping the notice with no replacement is worse — the model then
+ * believes a capped read is the complete file, rewrites it from what it has,
+ * and everything past the cap is destroyed.
+ *
+ * Cursor's own CLI never truncates silently. Its local executor annotates every
+ * capped payload ("50KB limit reached", "[Showing last …KB of line N (50KB
+ * limit). Full output: …]") and returns structured truncation metadata. Mirror
+ * that, keeping the signal out of the file content itself so it still cannot be
+ * echoed into a write.
+ */
+function readTruncationSummary(output) {
+    const meta = parseOpenCodeReadMetadata(output);
+    if (meta.startLine === undefined || meta.endLine === undefined)
+        return undefined;
+    // A complete read reports "(End of file …)" and never reaches this shape.
+    if (meta.totalLines !== undefined && meta.endLine >= meta.totalLines && !meta.outputCapped)
+        return undefined;
+    return {
+        startLine: meta.startLine,
+        endLine: meta.endLine,
+        nextOffset: meta.endLine + 1,
+        capped: meta.outputCapped === true,
+        ...(meta.totalLines !== undefined ? { totalLines: meta.totalLines } : {}),
+    };
+}
+/**
+ * Model-visible replacement for the stripped footer.
+ *
+ * Only for reads the model did not ask to bound. A caller that passed an
+ * explicit offset/limit already knows it asked for a slice — warning there
+ * would cry wolf on every deliberate paged read.
+ */
+function readTruncationNotice(output, resultMetadata) {
+    const summary = readTruncationSummary(output);
+    if (!summary)
+        return undefined;
+    const rangeRequested = num(resultMetadata?.offset) !== undefined || num(resultMetadata?.limit) !== undefined;
+    if (rangeRequested && !summary.capped)
+        return undefined;
+    const range = summary.totalLines !== undefined
+        ? `lines ${summary.startLine}-${summary.endLine} of ${summary.totalLines}`
+        : `lines ${summary.startLine}-${summary.endLine}`;
+    return (`[Partial read: the content above is ${range}` +
+        (summary.capped ? ", capped at the host's 50 KB output limit" : "") +
+        `. It is NOT the complete file. Continue with offset=${summary.nextOffset} before ` +
+        `acting on the whole file; writing the content above back would delete everything ` +
+        `after line ${summary.endLine}.]`);
+}
+/** agent.v1.PiTruncation for a capped OpenCode read. */
+function readTruncationMessage(output, content) {
+    const summary = readTruncationSummary(output);
+    if (!summary)
+        return undefined;
+    return {
+        truncated: true,
+        truncated_by: summary.capped ? "bytes" : "lines",
+        ...(summary.totalLines !== undefined ? { total_lines: summary.totalLines } : {}),
+        output_lines: Math.max(0, summary.endLine - summary.startLine + 1),
+        output_bytes: Buffer.byteLength(content, "utf8"),
+        ...(summary.capped ? { max_bytes: OPENCODE_READ_MAX_BYTES } : {}),
+    };
+}
+/** `tool/read.ts` MAX_BYTES — mirrored only to report the cap, never to apply it. */
+const OPENCODE_READ_MAX_BYTES = 50 * 1024;
 function readRangeApplied(resultMetadata, totalLines) {
     const offset = num(resultMetadata?.offset);
     const limit = num(resultMetadata?.limit);

package/dist/shell-timeout.js

@@ -322,8 +322,12 @@ function lastPrivateMarker(output, marker, valuePattern) {
     return last;
 }
 function parseOpenCodeTimeout(output) {
-    const re = /<shell_metadata>\r?\nshell tool terminated command after exceeding timeout (\d+) ms\.[\s\S]*?<\/shell_metadata>\s*$/;
-    const match = re.exec(output);
+    const closeTag = "</shell_metadata>";
+    const closeAt = output.lastIndexOf(closeTag);
+    if (closeAt === -1 || output.slice(closeAt + closeTag.length).trim() !== "")
+        return undefined;
+    const header = /<shell_metadata>\r?\nshell tool terminated command after exceeding timeout (\d+) ms\./;
+    const match = header.exec(output.slice(0, closeAt));
     if (!match || match.index === undefined)
         return undefined;
     return { output: withoutMarker(output, match.index), timeoutMs: Number(match[1]) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursor-opencode-provider",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Use Cursor subscription models from OpenCode via Cursor's Connect-RPC agent protocol",
   "type": "module",
   "license": "MIT",
@@ -61,8 +61,8 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@ai-sdk/provider": "3.0.8",
-    "protobufjs": "^7.4.0"
+    "@ai-sdk/provider": "3.0.14",
+    "protobufjs": "^7.6.5"
   },
   "peerDependencies": {
     "@opencode-ai/plugin": "^1.17.13",
@@ -74,10 +74,10 @@
     }
   },
   "devDependencies": {
-    "@opencode-ai/plugin": "^1.17.13",
-    "@opencode-ai/plugin-next": "^0.0.0-next-16281",
-    "@tsconfig/node22": "^22.0.1",
-    "@types/node": "^22.15.3",
-    "typescript": "^5.8.3"
+    "@opencode-ai/plugin": "^1.18.13",
+    "@opencode-ai/plugin-next": "npm:@opencode-ai/plugin@0.0.0-next-16281",
+    "@tsconfig/node22": "^22.0.5",
+    "@types/node": "^22.20.1",
+    "typescript": "^5.9.3"
   }
 }