cursor-opencode-provider 0.8.1 → 0.8.3

package/dist/protocol/conversation-state.d.ts

@@ -6,10 +6,15 @@ export declare function hydrateConversationState(cacheDir: string, sessionKey: s
     toolCatalog: OpencodeToolDef[];
     hostAgent?: string;
     systemPromptHash?: string;
+    hostNote?: string;
 } | undefined>;
 /** Restore only turn provenance when its in-memory entry was evicted. */
 export declare function hydrateTurnProvenance(cacheDir: string, sessionKey: string): Promise<void>;
-/** Persist the complete resumable state only after Cursor confirms TurnEnded. */
+/**
+ * Persist the resumable state at Cursor's TurnEnded, or before it
+ * (`runInProgress`) so a Run the host interrupts, or a restart, resumes from
+ * the latest checkpoint and still recognizes the step in progress.
+ */
 export declare function persistConversationState(cacheDir: string, input: {
     sessionKey: string;
     conversationId: string;
@@ -18,5 +23,7 @@ export declare function persistConversationState(cacheDir: string, input: {
     postCompactionRebase?: boolean;
     hostAgent?: string;
     systemPromptHash?: string;
+    hostNote?: string;
+    runInProgress?: boolean;
 }): Promise<void>;
 export declare function clearPersistedConversationState(cacheDir: string, sessionKey: string, expectedConversationId?: string): Promise<void>;

package/dist/protocol/conversation-state.js

@@ -1,10 +1,13 @@
 import { trace } from "../debug.js";
+import { restoreEarlySteers, serializeEarlySteers } from "../host-steer.js";
+import { restoreLostRequest, serializeLostRequest } from "../lost-request.js";
 import { getFrozenRequestContext, setFrozenRequestContext, } from "../context/frozen.js";
 import { hasConversationBinding, isActiveConversationBinding, restoreConversationBinding, } from "./conversation-bind.js";
 import { compactConversationBlobs, restoreConversationBlobs, } from "./blob-store.js";
 import { getCheckpoint, setCheckpoint } from "./checkpoint.js";
 import { getTurnProvenance, parseTurnProvenance, restoreTurnProvenance, serializeTurnProvenance, } from "./turn-provenance.js";
-import { deletePersistedConversation, loadPersistedConversation, persistConversation, } from "./conversation-persistence.js";
+import { heldHistoryImagesSnapshot, restoreHeldHistoryImages } from "./sent-history-images.js";
+import { deletePersistedConversation, getPersistedTurnProvenance, loadPersistedConversation, persistConversation, } from "./conversation-persistence.js";
 /** Restore one OpenCode session before its conversation binding is resolved. */
 export async function hydrateConversationState(cacheDir, sessionKey) {
     if (hasConversationBinding(sessionKey))
@@ -17,6 +20,8 @@ export async function hydrateConversationState(cacheDir, sessionKey) {
         return undefined;
     }
     restoreConversationBinding(sessionKey, persisted.conversationId);
+    restoreEarlySteers(sessionKey, persisted.earlySteers);
+    restoreLostRequest(sessionKey, persisted.lostRequest);
     if (persisted.checkpoint)
         setCheckpoint(persisted.conversationId, persisted.checkpoint);
     restoreConversationBlobs(persisted.conversationId, persisted.blobs);
@@ -24,29 +29,38 @@ export async function hydrateConversationState(cacheDir, sessionKey) {
     const provenance = persisted.turnProvenance ? parseTurnProvenance(persisted.turnProvenance) : undefined;
     if (provenance?.conversationId === persisted.conversationId)
         restoreTurnProvenance(sessionKey, provenance);
+    restoreHeldHistoryImages(sessionKey, persisted.conversationId, {
+        checkpoint: persisted.sentImagesCheckpoint,
+        hashes: persisted.sentImageHashes,
+    });
     trace(`conversation persistence: restored sessionKey=${sessionKey} ` +
         `conversationId=${persisted.conversationId} checkpoint=${persisted.checkpoint?.length ?? 0}B ` +
-        `blobs=${persisted.blobs.length}`);
+        `blobs=${persisted.blobs.length} heldImages=${persisted.sentImageHashes?.length ?? 0}`);
     return {
         conversationId: persisted.conversationId,
         postCompactionRebase: persisted.postCompactionRebase,
         toolCatalog: structuredClone(persisted.toolCatalog),
         ...(persisted.hostAgent ? { hostAgent: persisted.hostAgent } : {}),
         ...(persisted.systemPromptHash ? { systemPromptHash: persisted.systemPromptHash } : {}),
+        ...(persisted.hostNote ? { hostNote: persisted.hostNote } : {}),
     };
 }
 /** Restore only turn provenance when its in-memory entry was evicted. */
 export async function hydrateTurnProvenance(cacheDir, sessionKey) {
     if (getTurnProvenance(sessionKey))
         return;
-    const persisted = (await loadPersistedConversation(cacheDir, sessionKey)).value;
-    if (!persisted?.turnProvenance)
+    const persisted = await getPersistedTurnProvenance(cacheDir, sessionKey);
+    if (!persisted)
         return;
     const provenance = parseTurnProvenance(persisted.turnProvenance);
     if (provenance?.conversationId === persisted.conversationId)
         restoreTurnProvenance(sessionKey, provenance);
 }
-/** Persist the complete resumable state only after Cursor confirms TurnEnded. */
+/**
+ * Persist the resumable state at Cursor's TurnEnded, or before it
+ * (`runInProgress`) so a Run the host interrupts, or a restart, resumes from
+ * the latest checkpoint and still recognizes the step in progress.
+ */
 export async function persistConversationState(cacheDir, input) {
     // A newer Run may have reset/superseded this conversation while its final
     // frame was still in flight. Never let that late TurnEnded resurrect it.
@@ -56,10 +70,13 @@ export async function persistConversationState(cacheDir, input) {
         return;
     }
     const checkpoint = getCheckpoint(input.conversationId);
-    const blobCompaction = compactConversationBlobs(input.conversationId, checkpoint);
+    const blobCompaction = compactConversationBlobs(input.conversationId, checkpoint, {
+        keepInMemory: input.runInProgress,
+    });
     const blobs = blobCompaction.blobs;
     const requestContext = getFrozenRequestContext(input.conversationId) ?? input.requestContext;
     const provenance = getTurnProvenance(input.sessionKey);
+    const heldImages = heldHistoryImagesSnapshot(input.sessionKey, input.conversationId, checkpoint);
     await persistConversation(cacheDir, {
         sessionKey: input.sessionKey,
         conversationId: input.conversationId,
@@ -70,11 +87,15 @@ export async function persistConversationState(cacheDir, input) {
         postCompactionRebase: input.postCompactionRebase,
         hostAgent: input.hostAgent,
         systemPromptHash: input.systemPromptHash,
+        hostNote: input.hostNote,
+        earlySteers: serializeEarlySteers(input.sessionKey),
+        lostRequest: serializeLostRequest(input.sessionKey),
+        ...(heldImages ? { sentImageHashes: heldImages.hashes, sentImagesCheckpoint: heldImages.checkpoint } : {}),
         ...(provenance?.conversationId === input.conversationId
             ? { turnProvenance: serializeTurnProvenance(provenance) }
             : {}),
     });
-    trace(`conversation persistence: saved sessionKey=${input.sessionKey} ` +
+    trace(`conversation persistence: saved${input.runInProgress ? " in-progress" : ""} sessionKey=${input.sessionKey} ` +
         `conversationId=${input.conversationId} checkpoint=${checkpoint?.length ?? 0}B ` +
         `blobs=${blobCompaction.beforeCount}->${blobCompaction.afterCount} ` +
         `blobBytes=${blobCompaction.beforeBytes}->${blobCompaction.afterBytes}` +

package/dist/protocol/host-notes.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Host notes (OpenCode `<system-update>` and read-tool instructions) in the
+ * shapes Cursor's own clients give model-visible context:
+ * - mid-turn, plain text in a `user_context` injection, as Cursor SDK
+ *   `Run.steer` sends it (no wrapper: wrapped text was refused live);
+ * - on a later user turn, a `<system_reminder>` block in the message text;
+ * - provider notices about one exec result, as postToolUse hook context.
+ */
+/** Cursor CLI rejects a hook additional_context longer than this. */
+export declare const HOOK_ADDITIONAL_CONTEXT_MAX_CHARS = 10000;
+/** Stable delivery order survives asynchronous acknowledgements and Run recovery. */
+export type HostNoteBatch = {
+    notes: string[];
+    order: number;
+};
+export type HookAdditionalContext = {
+    hook_event_name: string;
+    content: string;
+};
+/** Plain note text for one mid-turn injection, in host order. */
+export declare function hostNoteText(notes: readonly string[]): string;
+/**
+ * One postToolUse hook context per note, trimmed like Cursor CLI's carrier.
+ * A note over the CLI limit is split rather than dropped, so no text is lost.
+ */
+export declare function hostNoteHookContexts(notes: readonly string[]): HookAdditionalContext[];
+/** One `<system_reminder>` block per note, for a user turn's text. */
+export declare function wrapHostNoteForCursor(text: string): string;
+export declare function wrapHostNotesForCursor(notes: readonly string[]): string[];
+export declare function encodePersistedHostNotes(notes: readonly string[]): string | undefined;
+export declare function decodePersistedHostNotes(blob: string | undefined): string[];

package/dist/protocol/host-notes.js

@@ -0,0 +1,85 @@
+/**
+ * Host notes (OpenCode `<system-update>` and read-tool instructions) in the
+ * shapes Cursor's own clients give model-visible context:
+ * - mid-turn, plain text in a `user_context` injection, as Cursor SDK
+ *   `Run.steer` sends it (no wrapper: wrapped text was refused live);
+ * - on a later user turn, a `<system_reminder>` block in the message text;
+ * - provider notices about one exec result, as postToolUse hook context.
+ */
+const SYSTEM_UPDATE_BLOCK = /<system-update>([\s\S]*?)<\/system-update>/g;
+const SYSTEM_REMINDER_OPEN = "<system_reminder>";
+const SYSTEM_REMINDER_CLOSE = "</system_reminder>";
+/** Cursor CLI's hook event name for context attached to a tool result. */
+const POST_TOOL_USE_HOOK_EVENT = "postToolUse";
+/** Cursor CLI rejects a hook additional_context longer than this. */
+export const HOOK_ADDITIONAL_CONTEXT_MAX_CHARS = 10_000;
+/** Delimiter for ordered note bodies in the restart-snapshot `hostNote` string. */
+const HOST_NOTE_PERSIST_SEP = "\n\u001e\n";
+/** Plain note text for one mid-turn injection, in host order. */
+export function hostNoteText(notes) {
+    return notes.map(hostNoteBody).filter(Boolean).join("\n\n");
+}
+/**
+ * One postToolUse hook context per note, trimmed like Cursor CLI's carrier.
+ * A note over the CLI limit is split rather than dropped, so no text is lost.
+ */
+export function hostNoteHookContexts(notes) {
+    return notes.flatMap((note) => {
+        const body = hostNoteBody(note);
+        const chunks = [];
+        for (let start = 0; start < body.length;) {
+            let end = Math.min(body.length, start + HOOK_ADDITIONAL_CONTEXT_MAX_CHARS);
+            // Never split a surrogate pair.
+            if (end < body.length && /[\uD800-\uDBFF]/.test(body[end - 1]))
+                end--;
+            chunks.push(body.slice(start, end));
+            start = end;
+        }
+        return chunks.map((content) => ({ hook_event_name: POST_TOOL_USE_HOOK_EVENT, content }));
+    });
+}
+/** One `<system_reminder>` block per note, for a user turn's text. */
+export function wrapHostNoteForCursor(text) {
+    return `${SYSTEM_REMINDER_OPEN}\n${escapeReminderTags(hostNoteBody(text))}\n${SYSTEM_REMINDER_CLOSE}`;
+}
+export function wrapHostNotesForCursor(notes) {
+    return notes.filter((note) => hostNoteBody(note).length > 0).map(wrapHostNoteForCursor);
+}
+export function encodePersistedHostNotes(notes) {
+    const present = notes.filter((note) => note.length > 0);
+    if (present.length === 0)
+        return undefined;
+    return present.join(HOST_NOTE_PERSIST_SEP);
+}
+export function decodePersistedHostNotes(blob) {
+    if (!blob)
+        return [];
+    return blob.split(HOST_NOTE_PERSIST_SEP).filter((note) => note.length > 0);
+}
+/**
+ * Unwrap OpenCode `<system-update>` blocks. One host message may hold several
+ * (joined by `hostTailNote`); text that is not only such blocks stays as is.
+ */
+function hostNoteBody(text) {
+    const trimmed = text.trim();
+    const bodies = [];
+    let rest = trimmed;
+    for (const match of trimmed.matchAll(SYSTEM_UPDATE_BLOCK)) {
+        bodies.push(unescapeSystemUpdateText(match[1].trim()));
+        rest = rest.replace(match[0], "");
+    }
+    return bodies.length > 0 && rest.trim() === ""
+        ? bodies.filter(Boolean).join("\n\n")
+        : trimmed;
+}
+/**
+ * Inverse of OpenCode's `escapeSystemUpdateText` (`packages/llm/src/protocols/
+ * shared.ts`): it escapes `&`, `<`, `>` inside the wrapper. `&amp;` goes last.
+ */
+function unescapeSystemUpdateText(text) {
+    return text.replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&amp;", "&");
+}
+/** Same neutralization Cursor CLI applies to text placed inside its reminders. */
+function escapeReminderTags(text) {
+    return text.replace(/system_reminder/gi, "system_reminder_");
+}

package/dist/protocol/messages.js

@@ -135,6 +135,7 @@ export function createMessageTypes() {
         { id: 4, name: "model", type: "string" },
         { id: 5, name: "resume", type: "string" },
         { id: 6, name: "agent_id", type: "string" },
+        { id: 7, name: "attachments", type: "string", repeated: true },
     ]);
     addType(root, "TaskToolCall", [{ id: 1, name: "args", type: "TaskToolArgs" }]);
     // Native subagent execution is separate from the display-only TaskToolCall.
@@ -427,8 +428,33 @@ export function createMessageTypes() {
         { id: 15, name: "tool_call_delta", type: "ToolCallDeltaUpdate" },
         { id: 16, name: "step_started", type: "StepStarted" },
         { id: 17, name: "step_completed", type: "StepCompleted" },
+        { id: 23, name: "context_injection_state", type: "ContextInjectionStateUpdate" },
         { id: 27, name: "tool_requests_listed", type: "ToolRequestsListedUpdate" },
-    ], [{ name: "update", fields: ["text_delta", "tool_call_started", "tool_call_completed", "thinking_delta", "partial_tool_call", "heartbeat", "turn_ended", "tool_call_delta", "step_started", "step_completed", "tool_requests_listed"] }]);
+    ], [{ name: "update", fields: ["text_delta", "tool_call_started", "tool_call_completed", "thinking_delta", "partial_tool_call", "heartbeat", "turn_ended", "tool_call_delta", "step_started", "step_completed", "context_injection_state", "tool_requests_listed"] }]);
+    // Server status for an `inject_context_action` (InteractionUpdate #23).
+    // Cursor CLI only tracks it to show queued steer delivery; it carries no output.
+    addType(root, "ContextInjectionQueued", []);
+    addType(root, "ContextInjectionQueuedForNextTurn", []);
+    addType(root, "ContextInjectionCancelled", []);
+    addType(root, "ContextInjectionDelivered", [
+        { id: 1, name: "step", type: "int32" },
+        { id: 2, name: "delivery_batch_id", type: "string" },
+        { id: 3, name: "delivered_at_ms", type: "int64" },
+    ]);
+    addType(root, "ContextInjectionRejected", [
+        { id: 1, name: "reason", type: "string" },
+    ]);
+    addType(root, "ContextInjectionState", [
+        { id: 1, name: "queued", type: "ContextInjectionQueued" },
+        { id: 2, name: "delivered", type: "ContextInjectionDelivered" },
+        { id: 3, name: "queued_for_next_turn", type: "ContextInjectionQueuedForNextTurn" },
+        { id: 4, name: "cancelled", type: "ContextInjectionCancelled" },
+        { id: 5, name: "rejected", type: "ContextInjectionRejected" },
+    ], [{ name: "state", fields: ["queued", "delivered", "queued_for_next_turn", "cancelled", "rejected"] }]);
+    addType(root, "ContextInjectionStateUpdate", [
+        { id: 1, name: "injection_id", type: "string" },
+        { id: 2, name: "state", type: "ContextInjectionState" },
+    ]);
     // ── Exec channel ──
     // Field numbers match agent.v1. Extra fields we don't use are still declared
     // so protobufjs doesn't drop them on decode.
@@ -465,16 +491,21 @@ export function createMessageTypes() {
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "reason", type: "string" },
     ]);
+    addType(root, "ReadRejected", [
+        { id: 1, name: "path", type: "string" },
+        { id: 2, name: "reason", type: "string" },
+    ]);
     addType(root, "ReadResult", [
         { id: 1, name: "success", type: "ReadSuccess" },
         { id: 2, name: "error", type: "ReadError" },
+        { id: 3, name: "rejected", type: "ReadRejected" },
         { id: 4, name: "file_not_found", type: "ReadFileNotFound" },
         { id: 5, name: "permission_denied", type: "ReadPermissionDenied" },
         { id: 6, name: "invalid_file", type: "ReadInvalidFile" },
     ], [
         {
             name: "result",
-            fields: ["success", "error", "file_not_found", "permission_denied", "invalid_file"],
+            fields: ["success", "error", "rejected", "file_not_found", "permission_denied", "invalid_file"],
         },
     ]);
     addType(root, "GrepArgs", [
@@ -554,11 +585,16 @@ export function createMessageTypes() {
         { id: 4, name: "error", type: "string" },
         { id: 5, name: "is_readonly", type: "bool" },
     ]);
+    addType(root, "WriteRejected", [
+        { id: 1, name: "path", type: "string" },
+        { id: 2, name: "reason", type: "string" },
+    ]);
     addType(root, "WriteResult", [
         { id: 1, name: "success", type: "WriteSuccess" },
         { id: 3, name: "permission_denied", type: "WritePermissionDenied" },
         { id: 5, name: "error", type: "WriteError" },
-    ], [{ name: "result", fields: ["success", "permission_denied", "error"] }]);
+        { id: 6, name: "rejected", type: "WriteRejected" },
+    ], [{ name: "result", fields: ["success", "permission_denied", "error", "rejected"] }]);
     // agent.v1 Pi exec results. Cursor places Pi requests at ExecServerMessage
     // fields #45..#51 and their corresponding ExecClientMessage results at
     // #46..#52 (the result fields are deliberately offset by one).
@@ -634,10 +670,21 @@ export function createMessageTypes() {
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "error", type: "string" },
     ]);
+    addType(root, "DeletePermissionDenied", [
+        { id: 1, name: "path", type: "string" },
+        { id: 2, name: "client_visible_error", type: "string" },
+        { id: 3, name: "is_readonly", type: "bool" },
+    ]);
+    addType(root, "DeleteRejected", [
+        { id: 1, name: "path", type: "string" },
+        { id: 2, name: "reason", type: "string" },
+    ]);
     addType(root, "DeleteResult", [
         { id: 1, name: "success", type: "DeleteSuccess" },
+        { id: 4, name: "permission_denied", type: "DeletePermissionDenied" },
+        { id: 6, name: "rejected", type: "DeleteRejected" },
         { id: 7, name: "error", type: "DeleteError" },
-    ], [{ name: "result", fields: ["success", "error"] }]);
+    ], [{ name: "result", fields: ["success", "permission_denied", "rejected", "error"] }]);
     addType(root, "LsArgs", [
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "ignore", type: "string", repeated: true },
@@ -657,10 +704,15 @@ export function createMessageTypes() {
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "error", type: "string" },
     ]);
+    addType(root, "LsRejected", [
+        { id: 1, name: "path", type: "string" },
+        { id: 2, name: "reason", type: "string" },
+    ]);
     addType(root, "LsResult", [
         { id: 1, name: "success", type: "LsSuccess" },
         { id: 2, name: "error", type: "LsError" },
-    ], [{ name: "result", fields: ["success", "error"] }]);
+        { id: 3, name: "rejected", type: "LsRejected" },
+    ], [{ name: "result", fields: ["success", "error", "rejected"] }]);
     addType(root, "ShellArgs", [
         { id: 1, name: "command", type: "string" },
         { id: 2, name: "working_directory", type: "string" },
@@ -670,6 +722,7 @@ export function createMessageTypes() {
         // foreground cancellation deadline from a soft background handoff.
         { id: 13, name: "timeout_behavior", type: "uint32" },
         { id: 14, name: "hard_timeout", type: "uint32" },
+        { id: 15, name: "description", type: "string" },
     ]);
     addType(root, "ShellStreamStart", []); // optional SandboxPolicy only; empty is valid
     addType(root, "ShellStreamStdout", [{ id: 1, name: "data", type: "string" }]);
@@ -740,9 +793,10 @@ export function createMessageTypes() {
         { id: 2, name: "failure", type: "ShellFailure" },
         { id: 3, name: "timeout", type: "ShellTimeout" },
         { id: 4, name: "rejected", type: "ShellRejected" },
+        { id: 7, name: "permission_denied", type: "ShellPermissionDenied" },
         { id: 102, name: "is_background", type: "bool" },
         { id: 104, name: "pid", type: "uint32" },
-    ], [{ name: "result", fields: ["success", "failure", "timeout", "rejected"] }]);
+    ], [{ name: "result", fields: ["success", "failure", "timeout", "rejected", "permission_denied"] }]);
     addType(root, "DiagnosticsError", [
         { id: 1, name: "path", type: "string" },
         { id: 2, name: "error", type: "string" },
@@ -924,6 +978,15 @@ export function createMessageTypes() {
         { id: 3, name: "rejected", type: "ShellRejected" },
         { id: 4, name: "permission_denied", type: "ShellPermissionDenied" },
     ], [{ name: "result", fields: ["success", "error", "rejected", "permission_denied"] }]);
+    // Cursor CLI postToolUse hook context: ExecClientMessage #45 on a unary
+    // result, ShellStream #8 on a shell stream (agent.v1 hook_additional_context).
+    addType(root, "HookAdditionalContext", [
+        { id: 1, name: "hook_event_name", type: "string" },
+        { id: 2, name: "content", type: "string" },
+    ]);
+    addType(root, "ShellStreamHookContext", [
+        { id: 1, name: "hook_additional_contexts", type: "HookAdditionalContext", repeated: true },
+    ]);
     addType(root, "ShellStream", [
         { id: 1, name: "stdout", type: "ShellStreamStdout" },
         { id: 2, name: "stderr", type: "ShellStreamStderr" },
@@ -932,7 +995,8 @@ export function createMessageTypes() {
         { id: 5, name: "rejected", type: "ShellRejected" },
         { id: 6, name: "permission_denied", type: "ShellPermissionDenied" },
         { id: 7, name: "backgrounded", type: "ShellStreamBackgrounded" },
-    ], [{ name: "event", fields: ["stdout", "stderr", "exit", "start", "rejected", "permission_denied", "backgrounded"] }]);
+        { id: 8, name: "hook_context", type: "ShellStreamHookContext" },
+    ], [{ name: "event", fields: ["stdout", "stderr", "exit", "start", "rejected", "permission_denied", "backgrounded", "hook_context"] }]);
     addType(root, "GlobArgs", [
         { id: 1, name: "target_directory", type: "string" },
         { id: 2, name: "glob_pattern", type: "string" },
@@ -962,6 +1026,14 @@ export function createMessageTypes() {
         { id: 1, name: "text", type: "McpTextContent" },
         { id: 2, name: "image", type: "McpImageContent" },
     ], [{ name: "content", fields: ["text", "image"] }]);
+    addType(root, "McpRejected", [
+        { id: 1, name: "reason", type: "string" },
+        { id: 2, name: "is_readonly", type: "bool" },
+    ]);
+    addType(root, "McpPermissionDenied", [
+        { id: 1, name: "error", type: "string" },
+        { id: 2, name: "is_readonly", type: "bool" },
+    ]);
     addType(root, "McpSuccess", [
         { id: 1, name: "content", type: "McpToolResultContentItem", repeated: true },
         { id: 2, name: "is_error", type: "bool" },
@@ -974,7 +1046,9 @@ export function createMessageTypes() {
     addType(root, "McpResult", [
         { id: 1, name: "success", type: "McpSuccess" },
         { id: 2, name: "error", type: "McpError" },
-    ], [{ name: "result", fields: ["success", "error"] }]);
+        { id: 3, name: "rejected", type: "McpRejected" },
+        { id: 4, name: "permission_denied", type: "McpPermissionDenied" },
+    ], [{ name: "result", fields: ["success", "error", "rejected", "permission_denied"] }]);
     // McpToolDefinition — agent.v1 shape for RequestContext.tools (#7) and
     // AgentRunRequest.mcp_tools (#4). Defined early so RequestContext* can
     // reference it.
@@ -1259,6 +1333,7 @@ export function createMessageTypes() {
         { id: 49, name: "pi_grep_args", type: "PiGrepToolArgs" },
         { id: 50, name: "pi_find_args", type: "PiFindToolArgs" },
         { id: 51, name: "pi_ls_args", type: "PiLsToolArgs" },
+        { id: 55, name: "accept_hook_additional_contexts", type: "bool" },
     ], [{ name: "args", fields: [
                 "shell_args", "write_args", "delete_args", "grep_args", "read_args", "ls_args",
                 "request_context_args", "mcp_args", "shell_stream_args", "background_shell_spawn_args",
@@ -1272,6 +1347,7 @@ export function createMessageTypes() {
         { id: 1, name: "id", type: "uint32" },
         { id: 15, name: "exec_id", type: "string" },
         { id: 39, name: "local_execution_time_ms", type: "uint64" },
+        { id: 45, name: "hook_additional_contexts", type: "HookAdditionalContext", repeated: true },
         { id: 2, name: "shell_result", type: "ShellResult" },
         { id: 3, name: "write_result", type: "WriteResult" },
         { id: 4, name: "delete_result", type: "DeleteResult" },
@@ -1452,9 +1528,16 @@ export function createMessageTypes() {
         { id: 1, name: "producer", type: "string" },
         { id: 2, name: "content", type: "string" },
     ]);
+    // Cursor SDK `Run.steer` / CLI steering payload: a user message added to the
+    // running turn. `request_context` is optional and unused by the SDK.
+    addType(root, "UserContextInjection", [
+        { id: 1, name: "user_message", type: "UserMessage" },
+        { id: 2, name: "request_context", type: "RequestContext" },
+    ]);
     addType(root, "InjectContextAction", [
         { id: 1, name: "injection_id", type: "string" },
         { id: 2, name: "expected_run_id", type: "string" },
+        { id: 3, name: "user_context", type: "UserContextInjection" },
         { id: 4, name: "system_context", type: "SystemContextInjection" },
     ]);
     addType(root, "ConversationAction", [

package/dist/protocol/request.d.ts

@@ -12,16 +12,17 @@ export type RunRequestInput = {
     /** Stable parent group; unlike conversationId, this survives compaction/rebase. */
     conversationGroupId?: string;
     /**
-     * Prior chat turns for a seed ConversationStateStructure (no checkpoint).
-     * Tool outputs, when required for compaction/recovery, are represented as
-     * user-role OpenCode host observations rather than assistant-authored prose.
+     * Prior chat turns for a Run without a checkpoint, carried in the live user
+     * text (see {@link seedHistoryUserText}). Tool outputs, when required for
+     * compaction/recovery, are represented as user-role OpenCode host
+     * observations rather than assistant-authored prose.
      */
     history?: SeedHistoryMessage[];
     /**
      * Opaque ConversationStateStructure bytes from the last
      * conversation_checkpoint_update for this conversation_id. When set, echoed
-     * as AgentRunRequest.conversation_state (CLI parity). When absent, a seed
-     * state carrying only `history` (or empty) is built for turn 1.
+     * as AgentRunRequest.conversation_state (CLI parity). When absent, an empty
+     * seed state is sent and `history` travels in the user text.
      */
     conversationState?: Uint8Array;
     parameterValues?: Array<{
@@ -44,26 +45,32 @@ export type RunRequestInput = {
     mode?: number;
 };
 /**
- * Seed ConversationStateStructure for the first turn (no checkpoint yet).
+ * Empty ConversationStateStructure for a Run without a checkpoint (turn 1,
+ * compaction, rebase, reseed). After the first checkpoint arrives we stop
+ * inventing state and echo the server's opaque structure instead (CLI behavior).
  *
- * After the first checkpoint arrives we stop inventing state and echo the
- * server's opaque structure instead (CLI behavior). Compaction resets and
- * rebases also use this seed, with `history` carrying OpenCode's prompt turns
- * so Cursor can continue without the old checkpoint.
- *
- * No `system` entry is seeded: Cursor does not follow a client-authored
- * `system` root message, and neither Cursor client writes
- * `root_prompt_messages_json`. Host system context travels as the
- * system-instructions rule in RequestContext (`systemInstructionsRule`), so
- * `system` history entries are dropped here rather than duplicated.
+ * Nothing goes in `root_prompt_messages_json` (#1). Neither Cursor client
+ * writes it: Cursor checkpoints fill it with references to the conversation's
+ * own rendered root prompt. A client-written entry stands in for that prompt,
+ * so Cursor stops rendering RequestContext rules, skills and subagents — the
+ * host system-instructions rule included. Verified live 2026-10-09
+ * (claude-sonnet-5-5): two seeded history messages there gave checkpoint
+ * categories `rules:0, subagents:0` and a reply that ignored the rule; the same
+ * history in the user text kept both. History therefore travels in the user
+ * text ({@link seedHistoryUserText}).
  *
  * We deliberately do NOT use `AgentRunRequest.custom_system_prompt` (#8): that
  * field is the internal `--system-prompt` CLI override and the server rejects
  * it for normal accounts.
  */
-export declare function buildSeedConversationState(input?: {
-    history?: SeedHistoryMessage[];
-}): Uint8Array;
+export declare function buildSeedConversationState(): Uint8Array;
+/**
+ * Prior turns of a Run without a checkpoint, as a transcript ahead of the live
+ * user text. `system` entries are dropped: host system context travels as the
+ * system-instructions rule in RequestContext. Closing tags inside a message are
+ * escaped so a message cannot end its own block early.
+ */
+export declare function seedHistoryUserText(text: string, history: readonly SeedHistoryMessage[] | undefined): string;
 /**
  * Build an AgentClientMessage{run_request} for a conversation turn.
  *
@@ -75,3 +82,12 @@ export declare function buildRunRequest(input: RunRequestInput): Uint8Array;
  * Build a heartbeat message.
  */
 export declare function buildHeartbeat(): Uint8Array;
+/**
+ * ACM #5 `exec_client_control_message.heartbeat{id}`: Cursor CLI sends it every
+ * 3 s for each exec it is still running, keyed by the exec message id. The CLI
+ * leaves a zero id out, as proto3 does for a default scalar; protobufjs would
+ * write it explicitly, so it is omitted here to send the CLI's exact bytes.
+ */
+export declare function buildExecHeartbeat(execId: number): Uint8Array;
+/** Stops the live Run, as Cursor CLI does on a user Stop before it closes the stream. */
+export declare function buildCancelAction(reason: string): Uint8Array;