cursor-opencode-provider 0.8.0 → 0.8.3

package/dist/session.d.ts

@@ -3,11 +3,18 @@ import { type CursorProviderError } from "./errors.js";
 import { type SessionActivitySource } from "./activity.js";
 import type { HostSubagentCatalog, HostToolDialect, OpencodeToolDef, ToolAliasRegistry } from "./protocol/tools.js";
 import type { CursorConversationTokenDetails } from "./protocol/token-details.js";
+import type { HostNoteBatch } from "./protocol/host-notes.js";
+import type { RunHistoryImages } from "./protocol/sent-history-images.js";
+import type { ParallelStepState } from "./parallel-step.js";
+import type { OpenCodeModelCost } from "./pricing.js";
+import type { RunCostEstimate } from "./billing.js";
+import type { ReplaySafetyState } from "./replay-safety.js";
 export type Frame = {
     flags: number;
     payload: Uint8Array;
 };
 export type CursorContinuationOptions = {
+    /** A Run that owes the host nothing fails after this long without any inbound frame. */
     semanticIdleMs?: number;
     /** @deprecated Use semanticIdleMs. Kept as a strict alias for compatibility. */
     softHealthMs?: number;
@@ -50,8 +57,14 @@ export type PendingExec = {
      * exec result back to Cursor — just clear pending and keep pumping.
      */
     bridged?: boolean;
+    /**
+     * Cursor withdrew the exec (`ExecServerControlMessage.abort`). As in Cursor
+     * CLI, nothing is written back for it, but the host's late result still
+     * finds this Run so the turn goes on.
+     */
+    aborted?: boolean;
 };
-export type ContinuationTerminalReason = "hard-cap-expired" | "remote-clean-close" | "remote-error" | "result-write-failed" | "ambiguous-partial-write" | "heartbeat-write-failed" | "reply-write-failed" | "process-disposed" | "superseded-by-new-run" | "open-session-cap-exceeded";
+export type ContinuationTerminalReason = "host-interrupted" | "hard-cap-expired" | "remote-clean-close" | "remote-error" | "result-write-failed" | "ambiguous-partial-write" | "heartbeat-write-failed" | "reply-write-failed" | "process-disposed" | "superseded-by-new-run" | "open-session-cap-exceeded";
 export type SessionCloseReason = ContinuationTerminalReason | "ordinary-cleanup" | "turn-ended" | "initial-write-failed";
 export type ContinuationClaim = {
     session: CursorSession;
@@ -78,7 +91,7 @@ export type DeliveryOutcome = {
 } | {
     kind: "duplicate";
     reason: "in-flight" | "delivered";
-    framesWritten: 0;
+    framesWritten: number;
 } | {
     kind: "terminal";
     reason: ContinuationTerminalReason;
@@ -86,7 +99,7 @@ export type DeliveryOutcome = {
 } | {
     kind: "missing";
     reason: "missing-process-local-state";
-    framesWritten: 0;
+    framesWritten: number;
 };
 export type CursorSession = {
     /**
@@ -95,6 +108,10 @@ export type CursorSession = {
      * (Cursor resets them per stream) can't cross-deliver results.
      */
     sessionId: string;
+    /** AgentRunRequest.run_id, for context injections bound to this Run. */
+    runId?: string;
+    /** Host notes consumed by this Run's initial user action, retained for a rebase. */
+    userTurnHostNotes?: HostNoteBatch[];
     /**
      * Cursor conversation_id for this Run — used to store/echo
      * conversation_checkpoint_update (CLI parity).
@@ -104,10 +121,32 @@ export type CursorSession = {
     cacheDir?: string;
     /** Latest eligible checkpoint emitted by this Run attempt. */
     resumeCheckpoint?: Uint8Array;
+    /**
+     * This Run sent a user message or tool result after its last checkpoint:
+     * recovery must not resume earlier state that lacks the delivered input.
+     */
+    checkpointRevoked?: boolean;
+    /** Only a delivered host result, rather than an unrepresented follow-up, revoked it. */
+    checkpointRevokedByHostResult?: boolean;
+    /** Ignore queued checkpoints received before the latest message/result delivery. */
+    resumeCheckpointAfterFrame?: number;
+    /** Stateful replay barriers survive host tool-step boundaries on this Run. */
+    replaySafety?: ReplaySafetyState;
+    /** History images this Run's checkpoints hold or may hold; absent for a Run outside an OpenCode session. */
+    historyImages?: RunHistoryImages;
     /** Last checkpoint-derived context snapshot, independent of retry eligibility. */
     tokenDetails?: CursorConversationTokenDetails;
     /** True only after this Run receives a checkpoint containing token details. */
     tokenDetailsFresh?: boolean;
+    /** Cost reporting for this Run's steps (`src/billing.ts`). */
+    billing: RunCostEstimate & {
+        /** Ledger key: the OpenCode session, or this Run for an ephemeral one. */
+        key: string;
+        /** Catalog cost entry; absent for a model Cursor publishes no rate for. */
+        cost?: OpenCodeModelCost;
+        /** Context the previous billed step already sent: read from cache on the next one. */
+        prefixTokens: number;
+    };
     /**
      * Run-lifetime cache evidence. Cursor exposes only aggregate cache counters at
      * TurnEnded, so retain the inputs and protocol activity needed to explain
@@ -121,6 +160,8 @@ export type CursorSession = {
         modelId?: string;
         priorTokenDetails?: CursorConversationTokenDetails;
         startedWithCheckpoint: boolean;
+        /** Why a Run started without a checkpoint: a reset reason, `ephemeral`, or `no-checkpoint`. */
+        coldReason?: string;
         requestContextReused: boolean;
         requestContextHash: string;
         systemPromptHash?: string;
@@ -136,6 +177,8 @@ export type CursorSession = {
     };
     /** OpenCode session whose own or descendant activity renews tool leases. */
     openCodeSessionId?: string;
+    /** OpenCode session whose Stop cancels this Run, also for a helper isolated from it. */
+    stoppedWithSessionId?: string;
     /** Host primary agent whose prompt/permissions this Run was seeded with. */
     hostAgent?: string;
     /** Stable host-system + provider-guidance identity for restart validation. */
@@ -152,8 +195,30 @@ export type CursorSession = {
     toolCatalog?: OpencodeToolDef[];
     /** Configured MCP server ids used to split flattened host tool names. */
     knownMcpServers?: string[];
+    /** The Run's model accepts images, so held-Run exec results may carry them. */
+    supportsImages?: boolean;
     stream: BidiStream;
     frames: AsyncIterator<Frame>;
+    /** An iterator read retained across an idle-guard timeout. */
+    pendingFrameRead?: Promise<IteratorResult<Frame>>;
+    /**
+     * One-slot pushback for a terminal update that must start the next pump pass
+     * after the host settles emitted tools. Timed-out reads use pendingFrameRead.
+     */
+    pushbackFrame?: Frame;
+    /**
+     * Frames the held-Run reader took while the host ran tools and the next pump
+     * must see, in arrival order. They follow `pushbackFrame` and precede any
+     * unread frame.
+     */
+    heldFrames?: Frame[];
+    /**
+     * In-progress parallel tool-call step (field 27 hold). Cleared when the step
+     * finishes; added to priorParallelStepCallIds for late-completion filtering.
+     */
+    parallelStep?: ParallelStepState;
+    /** Resolved call ids from prior steps of this Run — ignore late completions. */
+    priorParallelStepCallIds?: Set<string>;
     pending: Map<number, PendingExec>;
     /**
      * Cursor display tool calls (tool_call_started) awaiting either an exec or a
@@ -167,6 +232,11 @@ export type CursorSession = {
      * completed list so host todos still receive a replace-all snapshot.
      */
     mirroredTodos?: Array<Record<string, unknown>>;
+    /**
+     * CreatePlan display calls whose plan was deferred to the host plan agent.
+     * Their completed display carries no recorded plan, so it is not mirrored.
+     */
+    deferredCreatePlanCalls?: Set<string>;
     /**
      * Legacy edit calls whose authoritative exec path is still in progress.
      * Cursor implements these as read -> whole-file write; retaining the path
@@ -231,13 +301,18 @@ export type CursorSession = {
     deferredTerminalReason: "remote-clean-close" | "remote-error" | null;
     policy: CursorContinuationPolicy;
     createdAt: number;
+    /** When the host's model call that opened this Run started; it may open the Run after a stop. */
+    requestedAt?: number;
     lastInboundAt: number;
     lastHeartbeatWriteAt: number;
     semanticDeadlineAt: number;
     closeError: CursorProviderError | null;
     closed: boolean;
-    reopenWithUserMessage?: (text: string) => Promise<void>;
+    /** The host stopped the turn (OpenCode 2 interrupt); the Run is being cancelled and must not be continued. */
+    hostInterrupted?: string;
+    reopenWithUserMessage?: (text: string, signal?: AbortSignal) => Promise<void>;
 };
+export declare function stoppedWith(session: CursorSession): string | undefined;
 type SessionManagerOptions = {
     now?: () => number;
     setTimer?: (callback: () => void, delayMs: number) => ReturnType<typeof setTimeout>;
@@ -248,10 +323,14 @@ type SessionManagerOptions = {
     maxOpenSessions?: number;
 };
 export declare class SessionManager {
+    /** A claimed result has one writer even while that writer awaits drain. */
+    private readonly delivering;
     private byExecId;
     private sessions;
     private byOpenCodeSessionId;
     private tombstones;
+    /** Early-row tool call id → the exec that bound it. Bounded like the tombstones. */
+    private toolCallRoutes;
     private readonly now;
     private readonly setTimer;
     private readonly clearTimer;
@@ -264,12 +343,24 @@ export declare class SessionManager {
     /** Live open Run for this OpenCode session id, if any. */
     findOpenByOpenCodeSessionId(openCodeSessionId: string | undefined): CursorSession | undefined;
     isActivelyPumping(session: CursorSession): boolean;
+    /** Every open Run a Stop of this OpenCode session cancels, including one a newer Run did not supersede. */
+    openSessionsStoppedWith(openCodeSessionId: string | undefined): CursorSession[];
+    /**
+     * Forget every result the host still owed this Run, without writing any: the
+     * host stopped the turn, and the Run is about to be cancelled.
+     *
+     * @returns number of pendings dropped
+     */
+    abandonPending(session: CursorSession): number;
+    /** Cursor withdrew this exec; returns false when it is not one the host still owes. */
+    markExecAborted(session: CursorSession, execId: number): boolean;
     /**
-     * Clear display-only bridged pendings that do not require a Cursor exec write.
-     * Used when the host starts a fresh user turn instead of returning the bridged
-     * tool result (e.g. human `continue` while a todowrite mirror is outstanding).
+     * Clear pendings that do not require a Cursor exec write: display-only bridged
+     * ones and execs Cursor aborted. Used when the host starts a fresh user turn
+     * instead of returning the result (e.g. human `continue` while a todowrite
+     * mirror is outstanding).
      *
-     * @returns number of bridged pendings settled
+     * @returns number of pendings settled
      */
     settleBridgedPending(session: CursorSession): number;
     private isPumping;
@@ -289,7 +380,9 @@ export declare class SessionManager {
     pendingFor(sessionId: string, execId: number): PendingExec | undefined;
     classify(sessionId: string, execId: number): ContinuationClassification;
     claim(sessionId: string, execId: number): ContinuationClaim | ContinuationClassification;
-    deliverClaim(claim: ContinuationClaim, frames: readonly Uint8Array[]): DeliveryOutcome;
+    deliverClaim(claim: ContinuationClaim, frames: readonly Uint8Array[], 
+    /** Called at each actual serialized write, before write() and its drain. */
+    beforeWrite?: () => void): Promise<DeliveryOutcome>;
     /** Find the live session awaiting one of the given exec ids. */
     findByExecIds(sessionId: string, execIds: number[]): CursorSession | undefined;
     /** Mark an exec id as resolved (its result has been delivered). */
@@ -302,7 +395,7 @@ export declare class SessionManager {
      * Callers must cancel the session heartbeat and wait for the old stream's
      * write chain before this, so an in-flight heartbeat cannot close the session.
      */
-    replaceStream(session: CursorSession, next: BidiStream): void;
+    replaceStream(session: CursorSession, next: BidiStream, runId?: string): void;
     private subscribeTerminal;
     private key;
     close(session: CursorSession, reason?: SessionCloseReason, error?: CursorProviderError): void;
@@ -318,6 +411,22 @@ export declare class SessionManager {
     dispose(): void;
     sweepHardDeadlines(): void;
     private onStreamTerminal;
+    /**
+     * The host tool-call id a continuation will send for this exec, when it is
+     * not `cursor_<session>_<execId>` (an early row bound to the real exec).
+     * The route outlives its Run, like a tombstone, so a result that arrives
+     * after the Run closed still names its exec and rebuilds from host history.
+     */
+    bindToolCall(toolCallId: string, sessionId: string, execId: number): void;
+    toolCallExec(toolCallId: string): {
+        sessionId: string;
+        execId: number;
+    } | undefined;
+    /**
+     * Leases only grow. Session activity renews from its own time; a running
+     * host tool renews from now, but never past that tool's own ceiling. The
+     * ceiling limits the tool's extension, not the lease activity already gave.
+     */
     private refreshHardDeadline;
     private hardDeadlineExpired;
     private scheduleHardDeadline;
@@ -325,5 +434,15 @@ export declare class SessionManager {
     private putTombstone;
     private isTerminalReason;
 }
+/**
+ * Read one frame, retaining ownership of the iterator read when a timeout
+ * wins. Every reader uses this function so a continuation cannot overtake a
+ * late frame (or discard its EOF/error).
+ */
+export declare function readSessionFrame(session: CursorSession): Promise<IteratorResult<Frame>>;
+export declare function readSessionFrame(session: CursorSession, timeoutMs: number): Promise<IteratorResult<Frame> | {
+    done: true;
+    timedOut: true;
+}>;
 export declare const sessionManager: SessionManager;
 export {};

package/dist/session.js

@@ -1,8 +1,11 @@
 import { trace } from "./debug.js";
+import { releaseUnstartedTerminal } from "./terminal-runner.js";
 import { CursorProtocolError } from "./errors.js";
-import { sessionActivity } from "./activity.js";
+import { StreamWriteDrainError, writeStreamMessage } from "./stream-write.js";
+import { RUNNING_TOOL_CAP_MS, sessionActivity } from "./activity.js";
 export const DEFAULT_CONTINUATION_POLICY = {
-    semanticIdleMs: 120_000,
+    // Cursor CLI aborts an active attempt after 30 s without an inbound frame.
+    semanticIdleMs: 30_000,
     hardCapMs: 600_000,
     heartbeatMs: 5_000,
 };
@@ -33,13 +36,15 @@ export function resolveContinuationPolicy(options) {
             throw new CursorProtocolError(`Unknown Cursor continuation option: ${key}`);
         }
     }
+    // Read the deprecated alias once, without the deprecated typed accessor.
+    const legacySemanticIdleMs = options?.softHealthMs;
     if (options?.semanticIdleMs !== undefined &&
-        options.softHealthMs !== undefined &&
-        options.semanticIdleMs !== options.softHealthMs) {
+        legacySemanticIdleMs !== undefined &&
+        options.semanticIdleMs !== legacySemanticIdleMs) {
         throw new CursorProtocolError("Cursor continuation semanticIdleMs and deprecated softHealthMs must match when both are set");
     }
     const heartbeatMs = positiveInteger("heartbeatMs", options?.heartbeatMs, DEFAULT_CONTINUATION_POLICY.heartbeatMs);
-    const semanticIdleMs = positiveInteger("semanticIdleMs", options?.semanticIdleMs ?? options?.softHealthMs, DEFAULT_CONTINUATION_POLICY.semanticIdleMs);
+    const semanticIdleMs = positiveInteger("semanticIdleMs", options?.semanticIdleMs ?? legacySemanticIdleMs, DEFAULT_CONTINUATION_POLICY.semanticIdleMs);
     const hardCapMs = positiveInteger("hardCapMs", options?.hardCapMs, DEFAULT_CONTINUATION_POLICY.hardCapMs);
     if (heartbeatMs >= semanticIdleMs) {
         throw new CursorProtocolError("Cursor continuation heartbeatMs must be less than semanticIdleMs");
@@ -49,7 +54,12 @@ export function resolveContinuationPolicy(options) {
     }
     return { heartbeatMs, semanticIdleMs, hardCapMs };
 }
+export function stoppedWith(session) {
+    return session.stoppedWithSessionId ?? session.openCodeSessionId;
+}
 export class SessionManager {
+    /** A claimed result has one writer even while that writer awaits drain. */
+    delivering = new WeakSet();
     // Composite key `${sessionId}:${execId}` → owning session. Composite keying
     // means two Run streams that both register an execId of 1 (Cursor resets
     // counters per stream) coexist instead of overwriting each other.
@@ -60,6 +70,8 @@ export class SessionManager {
     // of continuing the held-open one — the prior entry is stale and superseded.
     byOpenCodeSessionId = new Map();
     tombstones = new Map();
+    /** Early-row tool call id → the exec that bound it. Bounded like the tombstones. */
+    toolCallRoutes = new Map();
     now;
     setTimer;
     clearTimer;
@@ -146,19 +158,54 @@ export class SessionManager {
     isActivelyPumping(session) {
         return this.isPumping(session);
     }
+    /** Every open Run a Stop of this OpenCode session cancels, including one a newer Run did not supersede. */
+    openSessionsStoppedWith(openCodeSessionId) {
+        return [...this.sessions].filter((session) => !session.closed && (openCodeSessionId === undefined || stoppedWith(session) === openCodeSessionId));
+    }
+    /**
+     * Forget every result the host still owed this Run, without writing any: the
+     * host stopped the turn, and the Run is about to be cancelled.
+     *
+     * @returns number of pendings dropped
+     */
+    abandonPending(session) {
+        if (session.closed)
+            return 0;
+        const dropped = session.pending.size;
+        for (const [execId, pending] of session.pending) {
+            const directory = pending.resultMetadata?.managed_job_directory;
+            if (typeof directory === "string")
+                releaseUnstartedTerminal(directory);
+            const key = this.key(session.sessionId, execId);
+            this.byExecId.delete(key);
+            this.putTombstone(key, "host-interrupted");
+        }
+        session.pending.clear();
+        this.scheduleHardDeadline(session);
+        return dropped;
+    }
+    /** Cursor withdrew this exec; returns false when it is not one the host still owes. */
+    markExecAborted(session, execId) {
+        const pending = session.pending.get(execId);
+        if (session.closed || !pending || pending.bridged || pending.aborted || pending.state !== "pending")
+            return false;
+        pending.aborted = true;
+        return true;
+    }
     /**
-     * Clear display-only bridged pendings that do not require a Cursor exec write.
-     * Used when the host starts a fresh user turn instead of returning the bridged
-     * tool result (e.g. human `continue` while a todowrite mirror is outstanding).
+     * Clear pendings that do not require a Cursor exec write: display-only bridged
+     * ones and execs Cursor aborted. Used when the host starts a fresh user turn
+     * instead of returning the result (e.g. human `continue` while a todowrite
+     * mirror is outstanding).
      *
-     * @returns number of bridged pendings settled
+     * @returns number of pendings settled
      */
     settleBridgedPending(session) {
         if (session.closed)
             return 0;
         let settled = 0;
         for (const [execId, pending] of [...session.pending.entries()]) {
-            if (!pending.bridged)
+            if (!pending.bridged && !pending.aborted)
                 continue;
             if (pending.state === "claimed")
                 continue;
@@ -192,8 +239,9 @@ export class SessionManager {
                 if (candidate === justRegistered || this.isPumping(candidate))
                     continue;
                 // Held-open Runs with pending tools must not be cap-evicted — that is
-                // mid-exec supersede by another name and throws away the prefix.
-                if (candidate.pending.size > 0)
+                // mid-exec supersede by another name and throws away the prefix. An
+                // exec Cursor aborted no longer waits on the host, so it does not hold.
+                if ([...candidate.pending.values()].some((pending) => !pending.aborted))
                     continue;
                 if (!oldest || candidate.createdAt < oldest.createdAt)
                     oldest = candidate;
@@ -291,20 +339,25 @@ export class SessionManager {
             pending: classification.pending,
         };
     }
-    deliverClaim(claim, frames) {
+    async deliverClaim(claim, frames, 
+    /** Called at each actual serialized write, before write() and its drain. */
+    beforeWrite) {
         const { session, execId, pending } = claim;
         const key = this.key(session.sessionId, execId);
-        if (session.closed ||
-            this.byExecId.get(key) !== session ||
-            session.pending.get(execId) !== pending) {
+        const unavailable = (framesWritten) => {
+            if (!session.closed &&
+                this.byExecId.get(key) === session &&
+                session.pending.get(execId) === pending)
+                return undefined;
             const current = this.classify(session.sessionId, execId);
-            if (current.kind === "duplicate")
-                return { ...current, framesWritten: 0 };
-            if (current.kind === "terminal")
-                return { ...current, framesWritten: 0 };
-            return { kind: "missing", reason: "missing-process-local-state", framesWritten: 0 };
-        }
-        if (pending.state !== "claimed") {
+            if (current.kind === "duplicate" || current.kind === "terminal")
+                return { ...current, framesWritten };
+            return { kind: "missing", reason: "missing-process-local-state", framesWritten };
+        };
+        const invalid = unavailable(0);
+        if (invalid)
+            return invalid;
+        if (pending.state !== "claimed" || this.delivering.has(pending)) {
             return {
                 kind: "duplicate",
                 reason: pending.state === "delivered" ? "delivered" : "in-flight",
@@ -315,17 +368,37 @@ export class SessionManager {
             this.close(session, "hard-cap-expired");
             return { kind: "terminal", reason: "hard-cap-expired", framesWritten: 0 };
         }
+        this.delivering.add(pending);
         let framesWritten = 0;
         try {
-            if (!pending.bridged && frames.length === 0) {
+            if (!pending.bridged && !pending.aborted && frames.length === 0) {
                 throw new CursorProtocolError("No result frames were produced");
             }
             for (const frame of frames) {
-                session.stream.write(frame);
+                try {
+                    await writeStreamMessage(session.stream, frame, "continuation result", beforeWrite ? () => {
+                        beforeWrite();
+                        return true;
+                    } : undefined);
+                }
+                catch (error) {
+                    // write() returned false before the drain failed: the bytes are buffered.
+                    if (error instanceof StreamWriteDrainError)
+                        framesWritten++;
+                    throw error;
+                }
                 framesWritten++;
+                // The Run can close or replace this pending exec while drain is awaited.
+                // Never send its remaining frames or apply approval/state to that owner.
+                const invalid = unavailable(framesWritten);
+                if (invalid)
+                    return invalid;
             }
         }
         catch {
+            const invalid = unavailable(framesWritten);
+            if (invalid)
+                return invalid;
             const reason = framesWritten === 0 ? "result-write-failed" : "ambiguous-partial-write";
             this.close(session, reason);
             return { kind: "terminal", reason, framesWritten };
@@ -377,7 +450,8 @@ export class SessionManager {
         session.pumpActive = false;
         const deferred = session.deferredTerminalReason;
         session.deferredTerminalReason = null;
-        if (deferred)
+        // A Run the host stopped is closed by its cancel, after it has read what Cursor sent last.
+        if (deferred && !session.hostInterrupted)
             this.close(session, deferred);
         return true;
     }
@@ -386,7 +460,7 @@ export class SessionManager {
      * Callers must cancel the session heartbeat and wait for the old stream's
      * write chain before this, so an in-flight heartbeat cannot close the session.
      */
-    replaceStream(session, next) {
+    replaceStream(session, next, runId) {
         if (session.closed)
             throw new CursorProtocolError("Cannot replace stream on a closed Cursor session");
         session.heartbeatCancel?.();
@@ -395,7 +469,17 @@ export class SessionManager {
         session.deferredTerminalReason = null;
         const old = session.stream;
         session.stream = next;
+        // Preserve session totals but give the replacement Run its own estimates.
+        session.billing.estimatedUsd = 0;
+        delete session.billing.ledgerEpoch;
+        if (runId !== undefined)
+            session.runId = runId;
         session.frames = next.frames()[Symbol.asyncIterator]();
+        session.pendingFrameRead = undefined;
+        session.pushbackFrame = undefined;
+        session.heldFrames = undefined;
+        session.parallelStep = undefined;
+        session.priorParallelStepCallIds = undefined;
         this.subscribeTerminal(session);
         try {
             old.destroy();
@@ -437,13 +521,21 @@ export class SessionManager {
         session.terminalUnsubscribe?.();
         session.terminalUnsubscribe = null;
         session.deferredTerminalReason = null;
-        for (const id of session.pending.keys()) {
+        for (const [id, pending] of session.pending) {
+            const directory = pending.resultMetadata?.managed_job_directory;
+            if (typeof directory === "string")
+                releaseUnstartedTerminal(directory);
             const key = this.key(session.sessionId, id);
             this.byExecId.delete(key);
             if (this.isTerminalReason(reason))
                 this.putTombstone(key, reason);
         }
         session.pending.clear();
+        session.pendingFrameRead = undefined;
+        session.pushbackFrame = undefined;
+        session.heldFrames = undefined;
+        session.parallelStep = undefined;
+        session.priorParallelStepCallIds = undefined;
         session.pumpOwner = null;
         session.pumpActive = false;
         session.displayToolCalls?.clear();
@@ -482,6 +574,7 @@ export class SessionManager {
         for (const session of [...this.sessions])
             this.close(session, "process-disposed");
         this.byExecId.clear();
+        this.toolCallRoutes.clear();
     }
     sweepHardDeadlines() {
         for (const session of [...this.sessions]) {
@@ -497,22 +590,55 @@ export class SessionManager {
         const reason = event.kind === "remote-error" ? "remote-error" : "remote-clean-close";
         if (event.kind === "remote-error")
             session.closeError = event.error;
-        if (session.pumpOwner !== null) {
+        if (session.pumpOwner !== null || session.hostInterrupted) {
             session.deferredTerminalReason = reason;
             return;
         }
         this.close(session, reason, event.kind === "remote-error" ? event.error : undefined);
     }
+    /**
+     * The host tool-call id a continuation will send for this exec, when it is
+     * not `cursor_<session>_<execId>` (an early row bound to the real exec).
+     * The route outlives its Run, like a tombstone, so a result that arrives
+     * after the Run closed still names its exec and rebuilds from host history.
+     */
+    bindToolCall(toolCallId, sessionId, execId) {
+        this.toolCallRoutes.delete(toolCallId);
+        this.toolCallRoutes.set(toolCallId, { sessionId, execId });
+        while (this.toolCallRoutes.size > this.tombstoneLimit) {
+            const oldest = this.toolCallRoutes.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.toolCallRoutes.delete(oldest);
+        }
+    }
+    toolCallExec(toolCallId) {
+        return this.toolCallRoutes.get(toolCallId);
+    }
+    /**
+     * Leases only grow. Session activity renews from its own time; a running
+     * host tool renews from now, but never past that tool's own ceiling. The
+     * ceiling limits the tool's extension, not the lease activity already gave.
+     */
     refreshHardDeadline(session, pending) {
         if (!session.openCodeSessionId)
             return pending.hardDeadlineAt;
+        const now = this.now();
+        const toolCapAt = this.activitySource.runningToolDeadline?.(session.openCodeSessionId, now, RUNNING_TOOL_CAP_MS);
         const activityAt = this.activitySource.lastActivityAt(session.openCodeSessionId);
-        if (activityAt === undefined || activityAt <= pending.registeredAt)
-            return pending.hardDeadlineAt;
-        const renewedDeadline = activityAt + session.policy.hardCapMs;
-        if (renewedDeadline > pending.hardDeadlineAt) {
-            pending.hardDeadlineAt = renewedDeadline;
-            trace("continuation lease renewed from OpenCode session activity");
+        if (activityAt !== undefined && activityAt > pending.registeredAt) {
+            const renewedDeadline = activityAt + session.policy.hardCapMs;
+            if (renewedDeadline > pending.hardDeadlineAt) {
+                pending.hardDeadlineAt = renewedDeadline;
+                trace("continuation lease renewed from OpenCode session activity");
+            }
+        }
+        if (toolCapAt !== undefined) {
+            const renewedDeadline = Math.min(now + session.policy.hardCapMs, toolCapAt);
+            if (renewedDeadline > pending.hardDeadlineAt) {
+                pending.hardDeadlineAt = renewedDeadline;
+                trace("continuation lease renewed while a host tool is running");
+            }
         }
         return pending.hardDeadlineAt;
     }
@@ -570,6 +696,43 @@ export class SessionManager {
         return !["ordinary-cleanup", "turn-ended", "initial-write-failed"].includes(reason);
     }
 }
+export async function readSessionFrame(session, timeoutMs) {
+    if (session.pushbackFrame) {
+        const value = session.pushbackFrame;
+        session.pushbackFrame = undefined;
+        return { done: false, value };
+    }
+    const held = session.heldFrames?.shift();
+    if (held)
+        return { done: false, value: held };
+    const pending = session.pendingFrameRead ??= session.frames.next();
+    // A timed-out read can reject while no pump is consuming it. Preserve the
+    // rejection for the next reader without an unhandled detached promise.
+    void pending.catch(() => { });
+    let timer;
+    try {
+        const result = timeoutMs === undefined ? await pending : await Promise.race([
+            pending,
+            new Promise(resolve => {
+                timer = setTimeout(() => resolve({ done: true, timedOut: true }), timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+        if (!("timedOut" in result) && session.pendingFrameRead === pending) {
+            session.pendingFrameRead = undefined;
+        }
+        return result;
+    }
+    catch (error) {
+        if (session.pendingFrameRead === pending)
+            session.pendingFrameRead = undefined;
+        throw error;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 export const sessionManager = new SessionManager();
 function installProcessCleanup() {
     const dispose = () => {

package/dist/shared.d.ts

@@ -21,7 +21,7 @@ export declare const AVAILABLE_MODELS_PATH = "/aiserver.v1.AiService/AvailableMo
 export declare const SERVER_CONFIG_PATH = "/aiserver.v1.ServerConfigService/GetServerConfig";
 export declare const MODEL_CACHE_FILE = "cursor-models.json";
 /** Bumped when the on-disk model cache shape/semantics change (forces refetch). */
-export declare const MODEL_CACHE_SCHEMA_VERSION = 3;
+export declare const MODEL_CACHE_SCHEMA_VERSION = 6;
 export declare const MODEL_CACHE_TTL_MS = 86400000;
 export declare const CONVERSATION_CACHE_DIR = "cursor-conversations";
 export declare const CONVERSATION_CACHE_SCHEMA_VERSION = 4;

package/dist/shared.js

@@ -21,7 +21,7 @@ export const AVAILABLE_MODELS_PATH = "/aiserver.v1.AiService/AvailableModels";
 export const SERVER_CONFIG_PATH = "/aiserver.v1.ServerConfigService/GetServerConfig";
 export const MODEL_CACHE_FILE = "cursor-models.json";
 /** Bumped when the on-disk model cache shape/semantics change (forces refetch). */
-export const MODEL_CACHE_SCHEMA_VERSION = 3;
+export const MODEL_CACHE_SCHEMA_VERSION = 6;
 export const MODEL_CACHE_TTL_MS = 86_400_000;
 export const CONVERSATION_CACHE_DIR = "cursor-conversations";
 export const CONVERSATION_CACHE_SCHEMA_VERSION = 4;