cursor-opencode-provider 0.7.5 → 0.8.0

package/dist/auth.js

@@ -1,23 +1,24 @@
-import { CURSOR_API_HOST, CURSOR_WEBSITE_HOST } from "./shared.js";
+import { CURSOR_API_HOST, CURSOR_OAUTH_CLIENT_ID, CURSOR_WEBSITE_HOST } from "./shared.js";
 import { withAbortDeadline } from "./deadline.js";
+import { errorMessage } from "./debug.js";
 const API_BASE = `https://${CURSOR_API_HOST}`;
 const AUTH_REQUEST_TIMEOUT_MS = 5_000;
+/** Cursor IDE aborts its session refresh after 20 s (`_performAccessTokenRefresh`). */
+const SESSION_REFRESH_TIMEOUT_MS = 20_000;
+/** Server error code Cursor's IDE and CLI both surface as a sign-in policy block. */
+const SIGN_IN_POLICY_VIOLATION = "sign_in_policy_violation";
 export class AuthExchangeError extends Error {
     cause;
-    constructor(message, cause) {
+    kind;
+    status;
+    constructor(message, cause, kind = "transient", status) {
         super(message);
         this.cause = cause;
+        this.kind = kind;
+        this.status = status;
         this.name = "AuthExchangeError";
     }
 }
-export class AuthRefreshError extends Error {
-    cause;
-    constructor(message, cause) {
-        super(message);
-        this.cause = cause;
-        this.name = "AuthRefreshError";
-    }
-}
 export class AuthPollError extends Error {
     cause;
     constructor(message, cause) {
@@ -69,10 +70,19 @@ function base64url(bytes) {
         .replace(/\//g, "_")
         .replace(/=+$/, "");
 }
+/** A raw Cursor API key (as opposed to a JWT already exchanged from one). */
+export function isExchangeableApiKey(value) {
+    return value.startsWith("crsr_");
+}
 // ── Mode A: pass-through auth token ──
 export function useAuthToken(token) {
     return { accessToken: token };
 }
+/**
+ * Exchange a raw `crsr_` API key for a short-lived JWT. This is also how an
+ * API-key login is renewed: Cursor CLI re-runs the exchange and never uses the
+ * returned refresh token (`auth-refresh.ts` → `loginWithApiKey`).
+ */
 export async function exchangeApiKey(apiKey, baseUrl = API_BASE) {
     return withAbortDeadline(AUTH_REQUEST_TIMEOUT_MS, () => new AuthExchangeError("API key exchange timed out"), async (signal) => {
         let res;
@@ -91,7 +101,18 @@ export async function exchangeApiKey(apiKey, baseUrl = API_BASE) {
             throw new AuthExchangeError("API key exchange request failed", cause);
         }
         if (!res.ok) {
-            throw new AuthExchangeError(`API key exchange failed: ${res.status} ${res.statusText}`);
+            let errorCode;
+            if (res.status === 403) {
+                errorCode = (await res.json().catch(() => undefined))?.error;
+            }
+            // Only an authentication refusal says the key itself is bad; rate
+            // limits, timeouts, and server errors are worth another attempt.
+            const kind = errorCode === SIGN_IN_POLICY_VIOLATION
+                ? "policy"
+                : res.status === 401 || res.status === 403 ? "rejected" : "transient";
+            throw new AuthExchangeError(kind === "policy"
+                ? `API key exchange blocked by Cursor sign-in policy (${SIGN_IN_POLICY_VIOLATION})`
+                : `API key exchange failed: ${res.status} ${res.statusText}`, undefined, kind, res.status);
         }
         let body;
         try {
@@ -106,97 +127,59 @@ export async function exchangeApiKey(apiKey, baseUrl = API_BASE) {
         return { accessToken: body.accessToken, refreshToken: body.refreshToken };
     });
 }
-export async function refreshAccessToken(refreshToken, baseUrl = API_BASE) {
-    return withAbortDeadline(AUTH_REQUEST_TIMEOUT_MS, () => new AuthRefreshError("Token refresh timed out"), async (signal) => {
-        let res;
-        try {
-            res = await fetch(`${baseUrl}/auth/token`, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ refreshToken }),
-                signal,
-            });
-        }
-        catch (cause) {
-            throw new AuthRefreshError("Token refresh request failed", cause);
-        }
-        if (!res.ok) {
-            throw new AuthRefreshError(`Token refresh failed: ${res.status} ${res.statusText}`);
-        }
-        let body;
-        try {
-            body = await res.json();
-        }
-        catch (cause) {
-            throw new AuthRefreshError("Token refresh returned malformed JSON", cause);
-        }
-        if (typeof body.accessToken !== "string" || typeof body.refreshToken !== "string") {
-            throw new AuthRefreshError("Refresh response missing tokens");
-        }
-        return { accessToken: body.accessToken, refreshToken: body.refreshToken };
-    });
-}
-// Cache JWTs obtained via API-key exchange so doStream doesn't re-exchange
-// on every turn when the caller only supplied `apiKey`.
-const _apiKeyTokenCache = new Map();
-const inflightBearer = new Map();
-/** Clear the apiKey→JWT cache (tests). */
-export function clearBearerTokenCache() {
-    _apiKeyTokenCache.clear();
-    inflightBearer.clear();
-}
 /**
- * Resolve a Bearer JWT for Cursor API calls. Prefer an already-exchanged
- * `accessToken`; otherwise exchange (and cache) from `apiKey`, refreshing
- * when the cached JWT is near expiry.
+ * Renew a browser-login session token, exactly as Cursor's IDE does
+ * (`_performAccessTokenRefresh`): `POST /oauth/token` with a refresh_token
+ * grant and the IDE's client id. The response carries no new refresh token;
+ * the IDE stores the new access token as both, and so must callers.
  *
- * `apiKey` is only ever a raw exchangeable secret when it has Cursor's
- * `crsr_` prefix. Callers that generically forward whatever credential value
- * they hold — e.g. a host's package-agnostic "aisdk:" SDK loader, which
- * doesn't distinguish our OAuth vs. API-key connection methods and may pass
- * an already-issued JWT through the `apiKey` field — hand us a token that's
- * already good to use as-is; POSTing it to the exchange endpoint 401s.
+ * A rejected token is not an HTTP error: Cursor answers 200 with
+ * `{"access_token":"","shouldLogout":true}`, so the body decides the outcome.
+ * Never throws; every failure is a classified result.
  */
-export async function resolveBearerToken(input) {
-    if (input.accessToken)
-        return input.accessToken;
-    if (!input.apiKey) {
-        throw new Error("Cursor provider: no access token or API key provided");
-    }
-    if (!input.apiKey.startsWith("crsr_"))
-        return input.apiKey;
-    const baseUrl = input.baseUrl ?? API_BASE;
-    const cached = _apiKeyTokenCache.get(input.apiKey);
-    if (cached && !isExpiringSoon(cached.accessToken)) {
-        return cached.accessToken;
-    }
-    const inflightKey = `${baseUrl}\0${input.apiKey}`;
-    const existing = inflightBearer.get(inflightKey);
-    if (existing)
-        return existing;
-    async function refreshOrExchange() {
-        if (cached) {
-            try {
-                const refreshed = await refreshAccessToken(cached.refreshToken, baseUrl);
-                _apiKeyTokenCache.set(input.apiKey, refreshed);
-                return refreshed.accessToken;
+export async function refreshCursorSession(refreshToken, baseUrl = API_BASE) {
+    try {
+        return await withAbortDeadline(SESSION_REFRESH_TIMEOUT_MS, () => new Error("session refresh timed out"), async (signal) => {
+            const res = await fetch(`${baseUrl}/oauth/token`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-cursor-client-type": "cli",
+                },
+                body: JSON.stringify({
+                    grant_type: "refresh_token",
+                    client_id: CURSOR_OAUTH_CLIENT_ID,
+                    refresh_token: refreshToken,
+                }),
+                signal,
+            });
+            if (!res.ok) {
+                return {
+                    ok: false,
+                    kind: "transient",
+                    status: res.status,
+                    message: `session refresh failed: ${res.status} ${res.statusText}`,
+                };
             }
-            catch {
-                // Fall through to a fresh exchange.
+            const body = await res.json().catch(() => undefined);
+            if (body?.shouldLogout === true) {
+                return body.error === SIGN_IN_POLICY_VIOLATION
+                    ? { ok: false, kind: "policy", status: res.status, message: `session blocked by Cursor sign-in policy (${SIGN_IN_POLICY_VIOLATION})` }
+                    : { ok: false, kind: "logout", status: res.status, message: "Cursor ended the session (shouldLogout)" };
             }
-        }
-        const pair = await exchangeApiKey(input.apiKey, baseUrl);
-        _apiKeyTokenCache.set(input.apiKey, pair);
-        return pair.accessToken;
-    }
-    const pending = refreshOrExchange();
-    inflightBearer.set(inflightKey, pending);
-    try {
-        return await pending;
+            // The IDE would store an empty token here; treat it as a failed attempt.
+            if (typeof body?.access_token !== "string" || body.access_token === "") {
+                return { ok: false, kind: "transient", status: res.status, message: "session refresh returned no access token" };
+            }
+            return { ok: true, accessToken: body.access_token };
+        });
     }
-    finally {
-        if (inflightBearer.get(inflightKey) === pending)
-            inflightBearer.delete(inflightKey);
+    catch (cause) {
+        return {
+            ok: false,
+            kind: "transient",
+            message: `session refresh request failed: ${errorMessage(cause)}`,
+        };
     }
 }
 // ── Mode C: PKCE browser login ──

package/dist/classic-tools.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Classic plugin tools built with the host's own `tool()` helper when it can
+ * be found. Lives outside `plugin.ts` because OpenCode 1.x calls every export
+ * of a plugin module as a plugin (`getLegacyPlugins`), so that module may
+ * export `CursorPlugin` only.
+ */
+export declare function loadClassicTools(options?: {
+    importModule?: (specifier: string) => Promise<{
+        tool?: any;
+    }>;
+    configDirs?: string[];
+}): Promise<{
+    webSearch: any;
+    imageSave: any;
+}>;

package/dist/classic-tools.js

@@ -0,0 +1,45 @@
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { opencodeGlobalConfigDirs } from "./context/paths.js";
+import { createOpenCodeWebSearchTool, openCodeWebSearchTool } from "./web-search-tool.js";
+import { createCursorImageSaveTool, cursorImageSaveTool } from "./image-save-tool.js";
+/**
+ * Classic plugin tools built with the host's own `tool()` helper when it can
+ * be found. Lives outside `plugin.ts` because OpenCode 1.x calls every export
+ * of a plugin module as a plugin (`getLegacyPlugins`), so that module may
+ * export `CursorPlugin` only.
+ */
+export async function loadClassicTools(options = {}) {
+    const configDir = options.configDirs?.[0] ?? opencodeGlobalConfigDirs()[0];
+    const candidates = [
+        ...(configDir
+            ? [path.join(configDir, "node_modules", "@opencode-ai", "plugin", "dist", "index.js")]
+            : []),
+        "@opencode-ai/plugin",
+    ];
+    const importModule = options.importModule ?? ((specifier) => import(specifier));
+    // The global config copy is the host-owned installation; bare import is a fallback.
+    for (const candidate of candidates) {
+        try {
+            const specifier = path.win32.isAbsolute(candidate) && !path.isAbsolute(candidate)
+                ? new URL(`file:///${candidate.replaceAll("\\", "/")}`).href
+                : path.isAbsolute(candidate)
+                    ? pathToFileURL(candidate).href
+                    : candidate;
+            const module = await importModule(specifier);
+            if (typeof module.tool === "function" && module.tool.schema) {
+                const factory = { tool: module.tool, schema: module.tool.schema };
+                return {
+                    webSearch: createOpenCodeWebSearchTool(factory),
+                    imageSave: createCursorImageSaveTool(factory),
+                };
+            }
+        }
+        catch {
+            // Try the next host-owned/normal resolution location.
+        }
+    }
+    // `tool()` is an identity helper; the fallback definitions use plain JSON
+    // Schema accepted by OpenCode's legacy registry when no Zod helper is present.
+    return { webSearch: openCodeWebSearchTool, imageSave: cursorImageSaveTool };
+}

package/dist/context/build.d.ts

@@ -11,15 +11,52 @@ export type BuildRequestContextInput = {
      * guidance MCP server ids). Skips a second `loadMergedConfig` disk read.
      */
     mergedConfig?: OpencodeJson;
+    /** Host system context to deliver as the frozen system-instructions rule. */
+    systemInstructions?: SystemInstructions;
 };
-export declare const DYNAMIC_REQUEST_CONTEXT_KEYS: readonly ["tools", "agent_skills", "custom_subagents", "mcp_file_system_options", "mcp_meta_tool_options", "web_search_enabled", "web_fetch_enabled", "agent_skills_info_complete", "custom_subagents_info_complete", "mcp_file_system_info_complete", "mcp_info_complete", "hooks_additional_context"];
+/**
+ * Host system context (OpenCode's system prompt plus this provider's
+ * interaction guidance) for one Cursor conversation.
+ */
+export type SystemInstructions = {
+    text: string;
+    /**
+     * True when `text` is this conversation's own frozen baseline (a Context
+     * Epoch started in this process, or an ephemeral Run's prompt): it replaces
+     * any rule already frozen. False when a restart recovered the epoch without
+     * its bytes: the persisted rule wins and `text` only fills a missing one.
+     */
+    authoritative: boolean;
+};
+/** Rule name Cursor shows for the host system context (not a file). */
+export declare const SYSTEM_INSTRUCTIONS_RULE_PATH = "OpenCode system instructions";
+/**
+ * Cursor does not follow a client-seeded `system` message, and applies a rule
+ * only by its type. The Cursor CLI sends AGENTS.md as `alwaysApply`
+ * (`CursorRuleType.global`) and the IDE ships its own guidance as a non-file
+ * global rule; the host system context goes out the same way, once, frozen
+ * with the RequestContext base.
+ */
+export declare function systemInstructionsRule(text: string): Record<string, unknown>;
+/** Text of the frozen system-instructions rule, if the context carries one. */
+export declare function systemInstructionsRuleText(context: Record<string, unknown>): string | undefined;
+/**
+ * Return `context` with the system-instructions rule applied, or the same
+ * object when nothing changes (see `SystemInstructions.authoritative`).
+ */
+export declare function withSystemInstructions(context: Record<string, unknown>, instructions: SystemInstructions | undefined): Record<string, unknown>;
+export declare const DYNAMIC_REQUEST_CONTEXT_KEYS: readonly ["tools", "custom_subagents", "mcp_file_system_options", "mcp_meta_tool_options", "web_search_enabled", "web_fetch_enabled", "custom_subagents_info_complete", "mcp_file_system_info_complete", "mcp_info_complete", "hooks_additional_context"];
 export type DynamicRequestContextKey = typeof DYNAMIC_REQUEST_CONTEXT_KEYS[number];
+/**
+ * The host system context (delivered as the system-instructions rule) already
+ * carries these; never keep them on a frozen base.
+ */
+export declare const HOST_DUPLICATED_REQUEST_CONTEXT_KEYS: readonly ["agent_skills", "agent_skills_info_complete"];
 /**
  * Full RequestContext payload for live UMA + exec #10 reply.
- * Sourced from OpenCode discovery (and .claude/.agents skill fallbacks).
- * Honors `instructions` globs the same way OpenCode does. The provider never
- * looks in Cursor's own directories; a `.cursor/` path is read only when the
- * user's own OpenCode config lists it, exactly as the host would read it.
+ * Workspace env/git/layout, the host system-instructions rule, and
+ * host-advertised tools and subagents. The provider never looks in Cursor's
+ * own directories.
  */
 export declare function buildRequestContext(input: BuildRequestContextInput): Promise<Record<string, unknown>>;
 /** Rediscover only capability/plugin sections that may change during a chat. */

package/dist/context/build.js

@@ -1,8 +1,6 @@
 import path from "node:path";
-import { extractHostSubagentCatalog, toolsToDescriptors, toolsToMcpDescriptors, } from "../protocol/tools.js";
-import { collectRules, findGitWorktree, loadMergedConfig, } from "./rules.js";
-import { collectSkills } from "./skills.js";
-import { collectAgents } from "./agents.js";
+import { extractHostSubagentCatalog, toolsToMcpDescriptors, } from "../protocol/tools.js";
+import { loadMergedConfig, } from "./rules.js";
 import { collectPlugins } from "./plugins.js";
 import { collectGit } from "./git.js";
 import { collectProjectLayout } from "./layout.js";
@@ -10,75 +8,108 @@ import { buildEnv } from "./env.js";
 import { ensureOpencodeProjectDir } from "./paths.js";
 import { holdCapabilityOverlay } from "./overlay.js";
 import { traceRequestContextPaths } from "../debug.js";
+/** Rule name Cursor shows for the host system context (not a file). */
+export const SYSTEM_INSTRUCTIONS_RULE_PATH = "OpenCode system instructions";
+/**
+ * Cursor does not follow a client-seeded `system` message, and applies a rule
+ * only by its type. The Cursor CLI sends AGENTS.md as `alwaysApply`
+ * (`CursorRuleType.global`) and the IDE ships its own guidance as a non-file
+ * global rule; the host system context goes out the same way, once, frozen
+ * with the RequestContext base.
+ */
+export function systemInstructionsRule(text) {
+    return {
+        full_path: SYSTEM_INSTRUCTIONS_RULE_PATH,
+        content: text,
+        type: { global: {} },
+    };
+}
+function isSystemInstructionsRule(rule) {
+    if (!rule || typeof rule !== "object")
+        return false;
+    const record = rule;
+    const type = record.type;
+    return record.full_path === SYSTEM_INSTRUCTIONS_RULE_PATH && !!type?.global
+        && typeof record.content === "string";
+}
+/** Text of the frozen system-instructions rule, if the context carries one. */
+export function systemInstructionsRuleText(context) {
+    const rules = Array.isArray(context.rules) ? context.rules : [];
+    const rule = rules.find(isSystemInstructionsRule);
+    return rule ? rule.content : undefined;
+}
+/**
+ * Return `context` with the system-instructions rule applied, or the same
+ * object when nothing changes (see `SystemInstructions.authoritative`).
+ */
+export function withSystemInstructions(context, instructions) {
+    const text = instructions?.text.trim() ? instructions.text : undefined;
+    if (!text)
+        return context;
+    const current = systemInstructionsRuleText(context);
+    if (current !== undefined && (current === text || !instructions.authoritative))
+        return context;
+    return { ...context, rules: [systemInstructionsRule(text)] };
+}
+/** Keep only the system-instructions rule; older bases carried untyped rules Cursor never applied. */
+function keepSystemInstructionsRule(context) {
+    if (!Object.hasOwn(context, "rules"))
+        return;
+    const rules = Array.isArray(context.rules) ? context.rules.filter(isSystemInstructionsRule) : [];
+    if (rules.length > 0)
+        context.rules = rules.slice(0, 1);
+    else
+        delete context.rules;
+}
 export const DYNAMIC_REQUEST_CONTEXT_KEYS = [
     "tools",
-    "agent_skills",
     "custom_subagents",
     "mcp_file_system_options",
     "mcp_meta_tool_options",
     "web_search_enabled",
     "web_fetch_enabled",
-    "agent_skills_info_complete",
     "custom_subagents_info_complete",
     "mcp_file_system_info_complete",
     "mcp_info_complete",
     "hooks_additional_context",
 ];
-const DEFAULT_HOST_SUBAGENTS = [
-    {
-        name: "general",
-        description: "General-purpose agent for complex research and multi-step tasks.",
-    },
-    {
-        name: "explore",
-        description: "Read-only agent for searching and understanding the local codebase.",
-    },
+/**
+ * The host system context (delivered as the system-instructions rule) already
+ * carries these; never keep them on a frozen base.
+ */
+export const HOST_DUPLICATED_REQUEST_CONTEXT_KEYS = [
+    "agent_skills",
+    "agent_skills_info_complete",
 ];
 /**
- * Convert the raw host executor catalog into the exact subagent list advertised
- * to Cursor. `hostSubagents.complete` answers a narrow question: did the host's
- * task tool itself exposes an exhaustive recipient list (schema enum or
- * catalog marker)? OpenCode's task tool intentionally uses a plain string, so
- * that raw flag is false even though we can still advertise a complete Cursor
- * catalog by adding built-in defaults and discovered agent files.
- *
- * `custom_subagents_info_complete` must describe the final advertised list, not
- * the raw extraction source. If there is no executor, the empty list is
- * complete. If the host catalog is complete, use it verbatim. Otherwise we make
- * the advertised set complete by augmenting with default host agents and all
- * locally discovered agents.
+ * Advertise only what the host `task` / `subagent` catalog already named.
  */
-function buildAdvertisedSubagentCatalog(hostSubagents, discoveredAgents) {
+function buildAdvertisedSubagentCatalog(hostSubagents) {
     if (!hostSubagents.executor)
         return { agents: [], complete: true };
-    if (hostSubagents.complete)
-        return { agents: hostSubagents.agents, complete: true };
-    return {
-        agents: [...DEFAULT_HOST_SUBAGENTS, ...hostSubagents.agents, ...discoveredAgents],
-        complete: true,
-    };
+    return { agents: hostSubagents.agents, complete: hostSubagents.complete };
+}
+function stripHostDuplicatedRequestContextFields(context) {
+    for (const key of HOST_DUPLICATED_REQUEST_CONTEXT_KEYS)
+        delete context[key];
+    keepSystemInstructionsRule(context);
 }
 /**
  * Full RequestContext payload for live UMA + exec #10 reply.
- * Sourced from OpenCode discovery (and .claude/.agents skill fallbacks).
- * Honors `instructions` globs the same way OpenCode does. The provider never
- * looks in Cursor's own directories; a `.cursor/` path is read only when the
- * user's own OpenCode config lists it, exactly as the host would read it.
+ * Workspace env/git/layout, the host system-instructions rule, and
+ * host-advertised tools and subagents. The provider never looks in Cursor's
+ * own directories.
  */
 export async function buildRequestContext(input) {
     const workspaceRoot = path.resolve(input.workspaceRoot || process.cwd());
-    const { rules, config, worktree } = await collectRules(workspaceRoot, input.mergedConfig);
+    const config = input.mergedConfig ?? await loadMergedConfig(workspaceRoot);
     const [dynamic, git, layout] = await Promise.all([
-        buildDynamicRequestContextFromDiscovery(input, workspaceRoot, worktree, config),
+        buildDynamicRequestContextFromDiscovery(input, workspaceRoot, config),
         collectGit(workspaceRoot),
         collectProjectLayout(workspaceRoot),
     ]);
-    const base = {
+    const workspace = {
         env: buildEnv(workspaceRoot),
-        rules: rules.map((r) => ({
-            full_path: r.fullPath,
-            content: r.content,
-        })),
         repository_info: git.repositoryInfo,
         git_repos: git.gitRepos,
         project_layouts: [layout],
@@ -88,47 +119,25 @@ export async function buildRequestContext(input) {
         git_repo_info_complete: true,
         git_status_info_complete: true,
     };
+    const base = withSystemInstructions(workspace, input.systemInstructions);
     const ctx = materializeRequestContext(base, dynamic);
     traceRequestContextPaths("buildRequestContext", ctx);
     return ctx;
 }
-async function buildDynamicRequestContextFromDiscovery(input, workspaceRoot, worktree, config) {
+async function buildDynamicRequestContextFromDiscovery(input, workspaceRoot, config) {
     const providerIdentifier = input.providerIdentifier ?? "opencode";
     const tools = input.tools ?? [];
-    const [skills, agents, plugins] = await Promise.all([
-        collectSkills(workspaceRoot, worktree),
-        collectAgents(workspaceRoot),
-        collectPlugins(workspaceRoot, config),
-    ]);
+    const plugins = await collectPlugins(workspaceRoot, config);
     const mcpServerNames = Object.keys(config.mcp ?? {});
-    const flat = toolsToDescriptors(tools, providerIdentifier, mcpServerNames);
-    const nested = toolsToMcpDescriptors(tools, providerIdentifier, mcpServerNames);
+    const slim = toolsToMcpDescriptors(tools, providerIdentifier, mcpServerNames, { namesOnly: true });
     const projectDir = ensureOpencodeProjectDir(workspaceRoot);
     const hostSubagents = extractHostSubagentCatalog(tools);
-    const advertisedSubagents = buildAdvertisedSubagentCatalog(hostSubagents, agents);
-    const discoveredByName = new Map(agents.map((agent) => [agent.name, agent]));
-    const advertisedByName = new Map();
-    for (const agent of advertisedSubagents.agents) {
-        if (!advertisedByName.has(agent.name))
-            advertisedByName.set(agent.name, agent);
-    }
-    const customSubagents = [...advertisedByName.values()].map((agent) => {
-        const discovered = discoveredByName.get(agent.name);
-        return {
-            full_path: discovered?.fullPath ?? "",
-            name: agent.name,
-            description: discovered?.description || agent.description || "Host-configured subagent.",
-            // The host applies the real configured prompt when Task/Actor executes.
-            // Cursor only needs enough context to select the recipient intentionally.
-            prompt: discovered?.prompt ||
-                `Delegate to the host-configured ${agent.name} subagent; its host instructions and tools apply.`,
-        };
-    });
-    const liveSkills = skills.map((s) => ({
-        id: s.name,
-        full_path: s.fullPath,
-        content: s.content,
-        description: s.description,
+    const advertisedSubagents = buildAdvertisedSubagentCatalog(hostSubagents);
+    const customSubagents = advertisedSubagents.agents.map((agent) => ({
+        full_path: "",
+        name: agent.name,
+        description: agent.description || "Host-configured subagent.",
+        prompt: `Delegate to the host-configured ${agent.name} subagent; its host instructions and tools apply.`,
     }));
     const livePlugins = plugins.map((p) => ({
         id: p.id,
@@ -136,24 +145,19 @@ async function buildDynamicRequestContextFromDiscovery(input, workspaceRoot, wor
     }));
     const overlay = input.conversationId
         ? holdCapabilityOverlay(input.conversationId, {
-            skills: liveSkills,
             subagents: customSubagents,
             plugins: livePlugins,
         })
-        : { skills: liveSkills.map(({ full_path, content, description }) => ({ full_path, content, description })), subagents: customSubagents, plugins: livePlugins };
+        : { subagents: customSubagents, plugins: livePlugins };
     const dynamic = {
-        tools: flat,
-        agent_skills: overlay.skills,
-        custom_subagents: overlay.subagents,
         mcp_file_system_options: {
             enabled: true,
             // Cursor metadata root (mcps / agent-tools), not the git workspace.
             workspace_project_dir: projectDir,
-            mcp_descriptors: nested,
         },
         mcp_meta_tool_options: {
             enabled: true,
-            mcp_descriptors: nested,
+            ...(slim.length > 0 ? { mcp_descriptors: slim } : {}),
         },
         // This provider always rejects native web_search/web_fetch interaction
         // queries with a headless-UI reason (see interactions.ts). Advertise that
@@ -161,11 +165,12 @@ async function buildDynamicRequestContextFromDiscovery(input, workspaceRoot, wor
         // custom_web* aliases instead of routing through a query doomed to fail.
         web_search_enabled: false,
         web_fetch_enabled: false,
-        agent_skills_info_complete: true,
         custom_subagents_info_complete: advertisedSubagents.complete,
         mcp_file_system_info_complete: true,
         mcp_info_complete: true,
     };
+    if (overlay.subagents.length > 0)
+        dynamic.custom_subagents = overlay.subagents;
     if (overlay.plugins.length > 0) {
         dynamic.hooks_additional_context = overlay.plugins.map((p) => p.line).join("\n");
     }
@@ -174,17 +179,15 @@ async function buildDynamicRequestContextFromDiscovery(input, workspaceRoot, wor
 /** Rediscover only capability/plugin sections that may change during a chat. */
 export async function buildDynamicRequestContext(input) {
     const workspaceRoot = path.resolve(input.workspaceRoot || process.cwd());
-    const [worktree, config] = await Promise.all([
-        findGitWorktree(workspaceRoot),
-        input.mergedConfig
-            ? Promise.resolve(input.mergedConfig)
-            : loadMergedConfig(workspaceRoot),
-    ]);
-    return buildDynamicRequestContextFromDiscovery(input, workspaceRoot, worktree, config);
+    const config = input.mergedConfig
+        ? input.mergedConfig
+        : await loadMergedConfig(workspaceRoot);
+    return buildDynamicRequestContextFromDiscovery(input, workspaceRoot, config);
 }
 /** Keep expensive workspace state frozen while replacing every live capability field. */
 export function materializeRequestContext(base, dynamic) {
     const context = structuredClone(base);
+    stripHostDuplicatedRequestContextFields(context);
     for (const key of DYNAMIC_REQUEST_CONTEXT_KEYS)
         delete context[key];
     for (const key of DYNAMIC_REQUEST_CONTEXT_KEYS) {
@@ -196,6 +199,7 @@ export function materializeRequestContext(base, dynamic) {
 /** Strip live capability fields before retaining/persisting a conversation base. */
 export function requestContextBase(context) {
     const base = structuredClone(context);
+    stripHostDuplicatedRequestContextFields(base);
     for (const key of DYNAMIC_REQUEST_CONTEXT_KEYS)
         delete base[key];
     return base;