cursor-opencode-provider 0.8.0 → 0.8.3

package/dist/host-steer.d.ts

@@ -0,0 +1,71 @@
+export type HostSteer = {
+    sessionID: string;
+    inboxID: string;
+    text: string;
+};
+export type EarlySteer = HostSteer & {
+    injectionId: string;
+    /** The Cursor Run (`CursorSession.sessionId`) it was injected into, or the Run resumed from its checkpoint. */
+    run: string;
+    delivered: boolean;
+    /** A checkpoint arrived after Cursor delivered it, so a Run resumed from that checkpoint holds it. */
+    checkpointed: boolean;
+    /** Its Run reached `turn_ended` after delivering it, so the model has answered it. */
+    answered: boolean;
+    /** OpenCode's own copy came after the step's tool results and was left out of the continuation. */
+    promoted?: boolean;
+    /** Prompt boundary at which the host supplied its copy; distinct later replies do not match it. */
+    hostTurn?: string;
+};
+/** undefined when another plugin copy already announced the steer. */
+export declare function announceHostSteer(steer: HostSteer): boolean | undefined;
+/** Remember a queued message, so a later switch to `steer` can announce it. */
+export declare function rememberQueuedSteer(steer: HostSteer): void;
+export declare function takeQueuedSteer(inboxID: string): HostSteer | undefined;
+export declare function listenForHostSteers(sessionID: string, listener: (steer: HostSteer) => boolean): () => void;
+/** false when there is no room to track it; OpenCode's own copy then runs as usual. */
+export declare function recordEarlySteer(steer: EarlySteer): boolean;
+export declare function isEarlySteerTracked(sessionID: string, injectionId: string): boolean;
+/** An injection Cursor never accepted. A promoted one stays, to be sent at `turn_ended`. */
+export declare function forgetUndeliveredEarlySteer(sessionID: string, injectionId: string): void;
+/** The host withdrew the message, so no copy of it will come. */
+export declare function forgetEarlySteerOfInbox(sessionID: string, inboxID: string): void;
+/** true when the injection is an early steer. */
+export declare function markEarlySteerDelivered(sessionID: string | undefined, injectionId: string | undefined): boolean;
+export declare function markEarlySteersCheckpointed(sessionID: string | undefined, run: string): void;
+/**
+ * At `turn_ended`: a delivered steer is answered and waits for OpenCode's copy; one Cursor never took is
+ * forgotten, so OpenCode's copy runs as an ordinary message. A promoted one has no copy left to come:
+ * one Cursor never took is returned for a follow-up Run and stays, as sent, until a checkpoint holds it.
+ * Answered receipts survive retries and are retired when a later Run finishes.
+ */
+export declare function settleEarlySteers(sessionID: string | undefined, run: string): {
+    answered: number;
+    undelivered: EarlySteer[];
+    leftToHost: number;
+};
+/**
+ * A failed Run's steers: those its checkpoint holds go to the Run resumed from it (`to`), and so does a
+ * promoted one it does not hold, to be sent at that Run's `turn_ended`. The rest are forgotten, so
+ * OpenCode's own copy of each runs as an ordinary message. A rebase (`to` undefined) seeds from host
+ * history, which already holds a promoted copy.
+ */
+export declare function handOverEarlySteers(sessionID: string | undefined, from: string, to: string | undefined): void;
+/** The host may add `<system-reminder>` parts to a promoted copy; any other difference is another message. */
+export declare function carriesSteer(message: string, text: string): boolean;
+/** The record each message carries, or nothing unless every message carries one. */
+export declare function matchEarlySteers(sessionID: string | undefined, messages: readonly string[], accept: (record: EarlySteer) => boolean): EarlySteer[];
+export declare function forgetEarlySteerRecords(sessionID: string, records: readonly EarlySteer[]): void;
+/**
+ * A steer of a Run that ended without answering it (a stop, a failed recovery) that only host history
+ * holds reliably: OpenCode placed it in its history (a checkpoint may hold it too, and resuming would
+ * then send it twice), or a checkpoint holds it while OpenCode's copy is still to come.
+ */
+export declare function needsHostHistory(sessionID: string | undefined, openRun: string | undefined): boolean;
+/** Keep answered receipts until the new turn succeeds, so a host retry still omits its copies. */
+export declare function clearUnansweredEarlySteers(sessionID: string | undefined): void;
+/** Private restart metadata, saved atomically with the checkpoint it describes. */
+export declare function serializeEarlySteers(sessionID: string): string | undefined;
+export declare function restoreEarlySteers(sessionID: string, encoded: string | undefined): void;
+export declare function forgetEarlySteers(sessionID: string): void;
+export declare function resetHostSteersForTests(): void;

package/dist/host-steer.js

@@ -0,0 +1,232 @@
+import { processShared } from "./process-shared.js";
+const MAX_RECORDS_PER_SESSION = 32;
+const MAX_REMEMBERED = 256;
+// The plugin and the model can be separate copies of this module, and each plugin copy sees every event.
+const state = processShared("host-steers.v1", () => ({
+    listeners: new Map(),
+    injected: new Map(),
+    queued: new Map(),
+    announced: new Set(),
+}));
+function remember(entries, key) {
+    while (entries.size > MAX_REMEMBERED) {
+        const oldest = entries.keys().next().value;
+        if (oldest === undefined || oldest === key)
+            break;
+        entries.delete(oldest);
+    }
+}
+/** undefined when another plugin copy already announced the steer. */
+export function announceHostSteer(steer) {
+    if (state.announced.has(steer.inboxID))
+        return undefined;
+    state.announced.add(steer.inboxID);
+    remember(state.announced, steer.inboxID);
+    const listener = state.listeners.get(steer.sessionID);
+    return listener ? listener(steer) : false;
+}
+/** Remember a queued message, so a later switch to `steer` can announce it. */
+export function rememberQueuedSteer(steer) {
+    if (state.announced.has(steer.inboxID))
+        return;
+    state.queued.delete(steer.inboxID);
+    state.queued.set(steer.inboxID, steer);
+    remember(state.queued, steer.inboxID);
+}
+export function takeQueuedSteer(inboxID) {
+    const steer = state.queued.get(inboxID);
+    state.queued.delete(inboxID);
+    return steer;
+}
+export function listenForHostSteers(sessionID, listener) {
+    state.listeners.set(sessionID, listener);
+    return () => {
+        if (state.listeners.get(sessionID) === listener)
+            state.listeners.delete(sessionID);
+    };
+}
+/** false when there is no room to track it; OpenCode's own copy then runs as usual. */
+export function recordEarlySteer(steer) {
+    const records = state.injected.get(steer.sessionID);
+    if (records ? records.length >= MAX_RECORDS_PER_SESSION : state.injected.size >= MAX_REMEMBERED)
+        return false;
+    state.injected.set(steer.sessionID, [...records ?? [], steer]);
+    return true;
+}
+function keep(sessionID, records) {
+    if (records.length === 0)
+        state.injected.delete(sessionID);
+    else
+        state.injected.set(sessionID, records);
+}
+export function isEarlySteerTracked(sessionID, injectionId) {
+    return !!state.injected.get(sessionID)?.some((record) => record.injectionId === injectionId);
+}
+/** An injection Cursor never accepted. A promoted one stays, to be sent at `turn_ended`. */
+export function forgetUndeliveredEarlySteer(sessionID, injectionId) {
+    keep(sessionID, (state.injected.get(sessionID) ?? [])
+        .filter((record) => record.injectionId !== injectionId || record.delivered || record.promoted));
+}
+/** The host withdrew the message, so no copy of it will come. */
+export function forgetEarlySteerOfInbox(sessionID, inboxID) {
+    keep(sessionID, (state.injected.get(sessionID) ?? []).filter((record) => record.inboxID !== inboxID));
+}
+/** true when the injection is an early steer. */
+export function markEarlySteerDelivered(sessionID, injectionId) {
+    const record = sessionID && injectionId
+        ? state.injected.get(sessionID)?.find((candidate) => candidate.injectionId === injectionId)
+        : undefined;
+    if (record)
+        record.delivered = true;
+    return !!record;
+}
+export function markEarlySteersCheckpointed(sessionID, run) {
+    for (const record of (sessionID && state.injected.get(sessionID)) || []) {
+        if (record.run === run && record.delivered)
+            record.checkpointed = true;
+    }
+}
+/**
+ * At `turn_ended`: a delivered steer is answered and waits for OpenCode's copy; one Cursor never took is
+ * forgotten, so OpenCode's copy runs as an ordinary message. A promoted one has no copy left to come:
+ * one Cursor never took is returned for a follow-up Run and stays, as sent, until a checkpoint holds it.
+ * Answered receipts survive retries and are retired when a later Run finishes.
+ */
+export function settleEarlySteers(sessionID, run) {
+    const records = sessionID ? state.injected.get(sessionID) : undefined;
+    if (!records)
+        return { answered: 0, undelivered: [], leftToHost: 0 };
+    let answered = 0;
+    let leftToHost = 0;
+    const undelivered = [];
+    const kept = records.filter((record) => {
+        if (record.run !== run)
+            return !record.answered;
+        if (record.promoted) {
+            if (record.delivered) {
+                if (!record.answered) {
+                    record.answered = true;
+                    answered++;
+                }
+                return true;
+            }
+            undelivered.push(record);
+            record.delivered = true;
+            return true;
+        }
+        if (!record.delivered) {
+            leftToHost++;
+            return false;
+        }
+        if (!record.answered) {
+            record.answered = true;
+            answered++;
+        }
+        return true;
+    });
+    keep(sessionID, kept);
+    return { answered, undelivered, leftToHost };
+}
+/**
+ * A failed Run's steers: those its checkpoint holds go to the Run resumed from it (`to`), and so does a
+ * promoted one it does not hold, to be sent at that Run's `turn_ended`. The rest are forgotten, so
+ * OpenCode's own copy of each runs as an ordinary message. A rebase (`to` undefined) seeds from host
+ * history, which already holds a promoted copy.
+ */
+export function handOverEarlySteers(sessionID, from, to) {
+    const records = sessionID ? state.injected.get(sessionID) : undefined;
+    if (!records)
+        return;
+    keep(sessionID, records.filter((record) => {
+        if (record.run !== from || record.answered)
+            return true;
+        if (!to || (!record.checkpointed && !record.promoted))
+            return false;
+        record.run = to;
+        if (!record.checkpointed)
+            record.delivered = false;
+        return true;
+    }));
+}
+const SYSTEM_REMINDER = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
+/** The host may add `<system-reminder>` parts to a promoted copy; any other difference is another message. */
+export function carriesSteer(message, text) {
+    return message.replace(SYSTEM_REMINDER, "").trim() === text.trim();
+}
+/** The record each message carries, or nothing unless every message carries one. */
+export function matchEarlySteers(sessionID, messages, accept) {
+    const records = sessionID ? state.injected.get(sessionID) : undefined;
+    if (!records?.length || messages.length === 0)
+        return [];
+    const candidates = [...records];
+    const matched = [];
+    for (const message of messages) {
+        const index = candidates.findIndex((record) => accept(record) && carriesSteer(message, record.text));
+        if (index === -1)
+            return [];
+        matched.push(...candidates.splice(index, 1));
+    }
+    return matched;
+}
+export function forgetEarlySteerRecords(sessionID, records) {
+    keep(sessionID, (state.injected.get(sessionID) ?? []).filter((record) => !records.includes(record)));
+}
+/**
+ * A steer of a Run that ended without answering it (a stop, a failed recovery) that only host history
+ * holds reliably: OpenCode placed it in its history (a checkpoint may hold it too, and resuming would
+ * then send it twice), or a checkpoint holds it while OpenCode's copy is still to come.
+ */
+export function needsHostHistory(sessionID, openRun) {
+    return !!sessionID && !!state.injected.get(sessionID)?.some((record) => !record.answered && record.run !== openRun && (record.promoted || record.checkpointed));
+}
+/** Keep answered receipts until the new turn succeeds, so a host retry still omits its copies. */
+export function clearUnansweredEarlySteers(sessionID) {
+    if (sessionID)
+        keep(sessionID, (state.injected.get(sessionID) ?? []).filter((record) => record.answered));
+}
+/** Private restart metadata, saved atomically with the checkpoint it describes. */
+export function serializeEarlySteers(sessionID) {
+    const records = state.injected.get(sessionID);
+    return records?.length ? JSON.stringify({ version: 1, records }) : undefined;
+}
+export function restoreEarlySteers(sessionID, encoded) {
+    if (!encoded || state.injected.has(sessionID) || state.injected.size >= MAX_REMEMBERED)
+        return;
+    let value;
+    try {
+        value = JSON.parse(encoded);
+    }
+    catch {
+        return;
+    }
+    if (!value || value.version !== 1 || !Array.isArray(value.records) || value.records.length > MAX_RECORDS_PER_SESSION)
+        return;
+    const records = [];
+    for (const record of value.records) {
+        if (!record || record.sessionID !== sessionID
+            || ![record.inboxID, record.injectionId, record.run, record.text].every((part) => typeof part === "string" && part.length > 0)
+            || ![record.delivered, record.checkpointed, record.answered].every((part) => typeof part === "boolean")
+            || ((record.checkpointed || record.answered) && !record.delivered)
+            || (record.promoted !== undefined && typeof record.promoted !== "boolean")
+            || (record.hostTurn !== undefined && (typeof record.hostTurn !== "string" || !/^[a-f0-9]{64}$/.test(record.hostTurn))))
+            return;
+        records.push({
+            sessionID, inboxID: record.inboxID, injectionId: record.injectionId, run: record.run, text: record.text,
+            delivered: record.delivered, checkpointed: record.checkpointed, answered: record.answered,
+            ...(record.promoted !== undefined ? { promoted: record.promoted } : {}),
+            ...(record.hostTurn !== undefined ? { hostTurn: record.hostTurn } : {}),
+        });
+    }
+    if (records.length)
+        state.injected.set(sessionID, records);
+}
+export function forgetEarlySteers(sessionID) {
+    state.injected.delete(sessionID);
+    state.listeners.delete(sessionID);
+}
+export function resetHostSteersForTests() {
+    state.listeners.clear();
+    state.injected.clear();
+    state.queued.clear();
+    state.announced.clear();
+}

package/dist/image-input.d.ts

@@ -9,6 +9,8 @@ export type CursorHistoryImageExtraction = {
     hashes: string[];
     candidateCount: number;
     duplicateCount: number;
+    /** Unreadable optional tool media; explicit user attachments still fail loudly. */
+    omittedCount?: number;
 };
 export type CursorPromptImageExtraction = CursorHistoryImageExtraction & {
     userImageCount: number;
@@ -23,6 +25,22 @@ export declare function extractCursorHistoryImages(prompt: readonly unknown[], o
     maxBytes?: number;
     filenameOffset?: number;
 }): Promise<CursorHistoryImageExtraction>;
+/**
+ * Decode the images a host tool returned (its own `file-data` / `image-data`
+ * parts, or the `file` parts OpenCode moves into the trailing
+ * `Attached media from tool result:` message) for a held-Run exec result.
+ * Non-image parts are skipped; a part that cannot be decoded is dropped so the
+ * text result is still delivered.
+ */
+export declare function extractCursorToolResultImages(parts: readonly unknown[], options?: {
+    signal?: AbortSignal;
+    maxBytes?: number;
+    maxImages?: number;
+}): Promise<{
+    images: CursorImageInput[];
+    hashes: string[];
+    omittedCount: number;
+}>;
 export declare function extractCursorPromptImages(prompt: readonly unknown[], lastUser: Record<string, unknown> | undefined, options: {
     supportsImages: boolean;
     seenHistoryHashes?: ReadonlySet<string>;

package/dist/image-input.js

@@ -4,8 +4,14 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { UnsupportedFunctionalityError } from "@ai-sdk/provider";
 export const MAX_CURSOR_IMAGE_INPUT_BYTES = 20 * 1024 * 1024;
+function isToolMediaCaption(message) {
+    if (!message || !Array.isArray(message.content))
+        return false;
+    const first = message.content[0];
+    return first?.type === "text" && first.text === "Attached media from tool result:";
+}
 export function hasCursorUserImages(lastUser) {
-    return !!lastUser && Array.isArray(lastUser.content) && lastUser.content.some((part) => {
+    return !isToolMediaCaption(lastUser) && !!lastUser && Array.isArray(lastUser.content) && lastUser.content.some((part) => {
         if (!part || typeof part !== "object")
             return false;
         const file = part;
@@ -20,18 +26,20 @@ export function assertCursorUserImageSupport(lastUser, supportsImages, modelId)
         return;
     unsupported("image input", `Cursor model ${JSON.stringify(modelId)} does not support image input`);
 }
-function decodeBase64(value) {
+function decodeBase64(value, remaining) {
     const normalized = value.replace(/\s/g, "");
     if (!normalized || !/^[A-Za-z0-9+/_-]*={0,2}$/.test(normalized)) {
         return unsupported("image input", "Cursor provider received invalid base64 image data");
     }
+    const padding = normalized.endsWith("==") ? 2 : normalized.endsWith("=") ? 1 : 0;
+    assertImageSize(Math.floor((normalized.length - padding) * 3 / 4), remaining);
     const data = Uint8Array.from(Buffer.from(normalized, "base64"));
     if (data.length === 0) {
         return unsupported("image input", "Cursor provider received an empty image");
     }
     return data;
 }
-function decodeDataUrl(value) {
+function decodeDataUrl(value, remaining) {
     if (!value.startsWith("data:")) {
         return unsupported("image input", "Cursor provider supports base64-encoded image data URLs only");
     }
@@ -47,7 +55,7 @@ function decodeDataUrl(value) {
     const firstSeparator = metadata.indexOf(";");
     const mimeType = metadata.slice(0, firstSeparator);
     return {
-        data: decodeBase64(value.slice(commaIndex + 1)),
+        data: decodeBase64(value.slice(commaIndex + 1), remaining),
         mimeType: mimeType || undefined,
     };
 }
@@ -121,13 +129,15 @@ async function readResponseBytes(response, remaining) {
     return data;
 }
 async function resolveImageData(value, remaining, signal) {
-    if (value instanceof Uint8Array)
+    if (value instanceof Uint8Array) {
+        assertImageSize(value.length, remaining);
         return { data: Uint8Array.from(value) };
+    }
     if (typeof value === "string") {
-        return value.startsWith("data:") ? decodeDataUrl(value) : { data: decodeBase64(value) };
+        return value.startsWith("data:") ? decodeDataUrl(value, remaining) : { data: decodeBase64(value, remaining) };
     }
     if (value.protocol === "data:")
-        return decodeDataUrl(value.href);
+        return decodeDataUrl(value.href, remaining);
     if (value.protocol === "file:") {
         const filePath = fileURLToPath(value);
         const info = await stat(filePath);
@@ -183,21 +193,33 @@ export async function extractCursorUserImages(lastUser, signal, maxBytes = MAX_C
         const file = part;
         if (file.type !== "file")
             continue;
-        const image = await decodeCursorImagePart(file, byteBudget - totalBytes, signal, `image-${images.length + 1}`);
+        const image = await decodeCursorImagePart(toolImagePart(file) ?? file, byteBudget - totalBytes, signal, `image-${images.length + 1}`);
         totalBytes += image.data.length;
         images.push(image);
     }
     return images;
 }
-function pushImageFileParts(parts, content) {
+/** Normalize OpenCode / AI SDK attachment shapes before either delivery path. */
+function toolImagePart(part) {
+    if (!part || typeof part !== "object")
+        return undefined;
+    const file = part;
+    if (!["file", "file-data", "image-data", "image-url", "media", "image"].includes(String(file.type)))
+        return undefined;
+    const mediaType = typeof file.mediaType === "string" ? file.mediaType
+        : file.type === "image-url" ? "image/*" : file.mime;
+    if (typeof mediaType !== "string" || !mediaType.startsWith("image/"))
+        return undefined;
+    const source = file.url ?? file.uri;
+    const data = file.data ?? (typeof source === "string" && /^(?:https?|file):/.test(source) && URL.canParse(source)
+        ? new URL(source) : source);
+    return { ...file, mediaType, data };
+}
+function pushImageFileParts(parts, content, toolResult = false) {
     for (const part of content) {
-        if (!part || typeof part !== "object")
-            continue;
-        const file = part;
-        if (file.type === "file" &&
-            typeof file.mediaType === "string" &&
-            file.mediaType.startsWith("image/"))
-            parts.push(file);
+        const file = toolImagePart(part);
+        if (file?.type === "file")
+            parts.push({ file, toolResult });
     }
 }
 function cursorHistoryImageParts(prompt) {
@@ -222,7 +244,7 @@ function cursorHistoryImageParts(prompt) {
         if (record.role === "user") {
             if (i === lastUserIndex)
                 continue;
-            pushImageFileParts(parts, record.content);
+            pushImageFileParts(parts, record.content, isToolMediaCaption(record));
             continue;
         }
         if (record.role === "assistant") {
@@ -244,11 +266,9 @@ function cursorHistoryImageParts(prompt) {
             for (const value of output.value) {
                 if (!value || typeof value !== "object")
                     continue;
-                const file = value;
-                if (file.type === "file-data" &&
-                    typeof file.mediaType === "string" &&
-                    file.mediaType.startsWith("image/"))
-                    parts.push(file);
+                const file = toolImagePart(value);
+                if (file)
+                    parts.push({ file, toolResult: true });
             }
         }
     }
@@ -264,11 +284,22 @@ export async function extractCursorHistoryImages(prompt, options) {
     const hashes = [];
     const hashesThisTurn = new Set();
     let duplicateCount = 0;
+    let omittedCount = 0;
     let totalBytes = 0;
-    for (const file of candidates) {
+    for (const { file, toolResult } of candidates) {
         // Resolve against the per-image cap first so a previously sent duplicate
         // does not fail merely because little combined budget remains this turn.
-        const image = await decodeCursorImagePart(file, MAX_CURSOR_IMAGE_INPUT_BYTES, options.signal, `image-${(options.filenameOffset ?? 0) + images.length + 1}`, MAX_CURSOR_IMAGE_INPUT_BYTES);
+        let image;
+        try {
+            image = await decodeCursorImagePart(file, MAX_CURSOR_IMAGE_INPUT_BYTES, options.signal, `image-${(options.filenameOffset ?? 0) + images.length + 1}`);
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            if (!toolResult || (error instanceof Error && error.name === "AbortError"))
+                throw error;
+            omittedCount++;
+            continue;
+        }
         const hash = imageContentHash(image.data);
         if (options.seenHashes?.has(hash) || hashesThisTurn.has(hash)) {
             duplicateCount++;
@@ -280,17 +311,74 @@ export async function extractCursorHistoryImages(prompt, options) {
         hashes.push(hash);
         hashesThisTurn.add(hash);
     }
-    return { images, hashes, candidateCount: candidates.length, duplicateCount };
+    return { images, hashes, candidateCount: candidates.length, duplicateCount, ...(omittedCount > 0 ? { omittedCount } : {}) };
+}
+/**
+ * Decode the images a host tool returned (its own `file-data` / `image-data`
+ * parts, or the `file` parts OpenCode moves into the trailing
+ * `Attached media from tool result:` message) for a held-Run exec result.
+ * Non-image parts are skipped; a part that cannot be decoded is dropped so the
+ * text result is still delivered.
+ */
+export async function extractCursorToolResultImages(parts, options = {}) {
+    const maxBytes = cursorImageBudget(options.maxBytes ?? MAX_CURSOR_IMAGE_INPUT_BYTES);
+    const images = [];
+    const hashes = [];
+    let totalBytes = 0;
+    let omittedCount = 0;
+    options.signal?.throwIfAborted();
+    for (const part of parts) {
+        options.signal?.throwIfAborted();
+        const file = toolImagePart(part);
+        if (!file)
+            continue;
+        if (images.length >= (options.maxImages ?? Infinity) || totalBytes >= maxBytes) {
+            omittedCount++;
+            continue;
+        }
+        try {
+            const image = await decodeCursorImagePart(file, maxBytes - totalBytes, options.signal, `image-${images.length + 1}`);
+            options.signal?.throwIfAborted();
+            totalBytes += image.data.length;
+            images.push(image);
+            hashes.push(imageContentHash(image.data));
+        }
+        catch (error) {
+            // Tool media is optional: a missing file or failed download must not
+            // strand every pending exec. Cancellation still belongs to the caller.
+            options.signal?.throwIfAborted();
+            if (error instanceof Error && error.name === "AbortError")
+                throw error;
+            omittedCount++;
+        }
+    }
+    return { images, hashes, omittedCount };
 }
 export async function extractCursorPromptImages(prompt, lastUser, options) {
     const maxBytes = cursorImageBudget(options.maxBytes ?? MAX_CURSOR_IMAGE_INPUT_BYTES);
-    const userImages = await extractCursorUserImages(lastUser, options.signal, maxBytes);
+    const toolCaption = isToolMediaCaption(lastUser);
+    const caption = toolCaption && options.supportsImages
+        ? await extractCursorToolResultImages(lastUser.content, { signal: options.signal, maxBytes })
+        : undefined;
+    const captionHashes = [];
+    const seenHashes = new Set(options.seenHistoryHashes);
+    let captionDuplicates = 0;
+    const userImages = toolCaption ? (caption?.images ?? []).filter((_image, index) => {
+        const hash = caption.hashes[index];
+        if (seenHashes.has(hash)) {
+            captionDuplicates++;
+            return false;
+        }
+        seenHashes.add(hash);
+        captionHashes.push(hash);
+        return true;
+    }) : await extractCursorUserImages(lastUser, options.signal, maxBytes);
     const userBytes = userImages.reduce((total, image) => total + image.data.length, 0);
+    const userHashes = toolCaption ? captionHashes : userImages.map((image) => imageContentHash(image.data));
     // Seed history dedupe with this-turn last-user hashes so the same bytes on an
     // earlier user/assistant/tool message are not attached twice in one Run.
-    const seenHashes = new Set(options.seenHistoryHashes);
-    for (const image of userImages)
-        seenHashes.add(imageContentHash(image.data));
+    for (const hash of userHashes)
+        seenHashes.add(hash);
     const history = await extractCursorHistoryImages(prompt, {
         supportsImages: options.supportsImages,
         seenHashes,
@@ -300,7 +388,11 @@ export async function extractCursorPromptImages(prompt, lastUser, options) {
     });
     return {
         ...history,
+        hashes: [...userHashes, ...history.hashes],
+        duplicateCount: history.duplicateCount + captionDuplicates,
         images: [...userImages, ...history.images],
-        userImageCount: userImages.length,
+        userImageCount: toolCaption ? 0 : userImages.length,
+        ...((history.omittedCount ?? 0) + (caption?.omittedCount ?? 0) > 0
+            ? { omittedCount: (history.omittedCount ?? 0) + (caption?.omittedCount ?? 0) } : {}),
     };
 }

package/dist/image-save.d.ts

@@ -17,16 +17,24 @@ export declare const IMAGE_PERMISSION_DENIED_PREFIX = "CursorImagePermissionDeni
 export type ImageSaveToolContext = {
     worktree: string;
     directory: string;
-    ask(input: {
+    /**
+     * Classic OpenCode 1.x `ToolContext.ask`. A host whose tool context has no
+     * permission prompt (OpenCode 2.0's public `ToolContext`) passes `null`
+     * explicitly: the commit then writes after containment, gated only by the
+     * tool's catalog permission. A missing `ask` is refused, never treated as
+     * permission.
+     */
+    ask: ((input: {
         permission: string;
         patterns: string[];
         always: string[];
         metadata: Record<string, unknown>;
-    }): Promise<void>;
+    }) => Promise<void>) | null;
 };
 export type ImageSaveResult = {
     title: string;
     output: string;
+    bytes: number;
     attachments?: Array<{
         type: "file";
         mime: string;