lynkr 9.14.14 → 9.14.16

package/src/clients/databricks.js

@@ -3382,6 +3382,121 @@ async function invokeCodex(body, _incomingHeaders = {}) {
   };
 }
 
+async function invokeCursor(body, _incomingHeaders = {}) {
+  const cursorUtils = require("./cursor-utils");
+
+  if (config.cursor?.enabled === false) {
+    throw new Error("Cursor provider is disabled (set CURSOR_ENABLED=true to use cursor: tiers)");
+  }
+
+  const model = body._tierModel || config.cursor?.model || cursorUtils.DEFAULT_MODEL;
+  const { prompt, systemContext } = cursorUtils.convertAnthropicToCursorPrompt(body);
+
+  if (!prompt) {
+    throw new Error("Cursor: no prompt content to send");
+  }
+
+  const fullPrompt = systemContext ? `System context:\n${systemContext}\n\nUser request:\n${prompt}` : prompt;
+  const binaryPath = cursorUtils.getBinaryPath(config.cursor);
+  const baseTimeoutMs = config.cursor?.timeout || cursorUtils.DEFAULT_TIMEOUT_MS;
+  const workspace = body._workspace || null;
+
+  // Streaming (Phase 3, 2026-09-27): synthesize an OpenAI SSE stream from
+  // ACP session/update deltas. "cursor" is registered in
+  // DEFAULT_OPENAI_SSE_PROVIDERS, so the orchestrator either transforms this
+  // to Anthropic SSE (badge injection included) or passes it through to
+  // OpenAI-surface clients. The legacy spawn fallback emits no deltas — its
+  // full text arrives as one chunk at the end, which is still a valid
+  // stream. Errors after SSE has started cannot re-enter tier fallback (the
+  // 200 is already committed) — same semantics as every streaming provider.
+  if (body.stream === true) {
+    const { PassThrough } = require("node:stream");
+    const stream = new PassThrough();
+    const chunkId = `chatcmpl-cursor-${Date.now()}`;
+    let deltasSent = false;
+    const writeChunk = (delta, finishReason = null) => {
+      stream.write(`data: ${JSON.stringify({
+        id: chunkId,
+        object: "chat.completion.chunk",
+        created: Math.floor(Date.now() / 1000),
+        model,
+        choices: [{ index: 0, delta, finish_reason: finishReason }],
+      })}\n\n`);
+    };
+    writeChunk({ role: "assistant" });
+    // SSE comment keep-alive: harmless to parsers, keeps idle-timeout-prone
+    // clients on passthrough surfaces alive during silent gaps.
+    const keepAlive = setInterval(() => { try { stream.write(": ka\n\n"); } catch { /* stream gone */ } }, 15000);
+    keepAlive.unref?.();
+    cursorUtils.runCursorAgent({
+      prompt: fullPrompt,
+      resumePrompt: cursorUtils.latestUserTurnPrompt(body),
+      sessionKey: cursorUtils.deriveSessionKey(body),
+      model,
+      baseTimeoutMs,
+      binaryPath,
+      workspace,
+      onDelta: (text, kind) => {
+        deltasSent = true;
+        if (kind === "thought") {
+          writeChunk({ reasoning_content: text });
+        } else if (kind === "tool") {
+          // Visible in EVERY client (Cursor chat ignores reasoning_content),
+          // badge-styled so stripLynkrBadges removes it from resubmitted
+          // history — narration renders once and never re-enters context.
+          writeChunk({ content: `\n\n*[Lynkr] ${String(text).replace(/[*\n]+/g, " ").trim()}*\n\n` });
+        } else {
+          writeChunk({ content: text });
+        }
+      },
+    }).then((run) => {
+      clearInterval(keepAlive);
+      if (!deltasSent && run.text) writeChunk({ content: run.text });
+      writeChunk({}, "stop");
+      stream.write("data: [DONE]\n\n");
+      stream.end();
+    }).catch((err) => {
+      clearInterval(keepAlive);
+      logger.warn({ err: err.message }, "[Cursor] streaming serve failed mid-flight");
+      writeChunk({ content: `\n[cursor provider error: ${String(err.message || err).slice(0, 200)}]` }, "stop");
+      stream.write("data: [DONE]\n\n");
+      stream.end();
+    });
+    return { ok: true, status: 200, stream, contentType: "text/event-stream", headers: {} };
+  }
+
+  let run;
+  try {
+    run = await cursorUtils.runCursorAgent({
+      prompt: fullPrompt,
+      resumePrompt: cursorUtils.latestUserTurnPrompt(body),
+      sessionKey: cursorUtils.deriveSessionKey(body),
+      model,
+      baseTimeoutMs,
+      binaryPath,
+      workspace,
+    });
+  } catch (err) {
+    // classifyCursorError already attached the honest cause (timeout vs
+    // auth vs missing binary) — no blanket subscription hint here.
+    throw new Error(`Cursor CLI failed: ${err.message || err}`);
+  }
+
+  if (!run.text) {
+    throw new Error("Cursor: empty response from cursor-agent");
+  }
+
+  const anthropicJson = cursorUtils.convertCursorResponseToAnthropic(run.text, model, run.usage, run.thinking);
+
+  return {
+    ok: true,
+    status: 200,
+    json: anthropicJson,
+    text: JSON.stringify(anthropicJson),
+    contentType: "application/json",
+  };
+}
+
 /**
  * Compute request cost in USD from model pricing × token usage.
  * Registry returns per-1M-token prices ({ input, output }); returns null when
@@ -3457,6 +3572,13 @@ function captureResponseText(resultJson) {
 // non-greedy lazy match is unnecessary — match up to (and including) the
 // closing `*` plus trailing whitespace.
 const LYNKR_BADGE_PREFIX_RE = /^\*\[Lynkr\][^*\n]*\*\s*/;
+// Mid-message badge LINES (tool narration, 2026-09-27) — strip anywhere in
+// assistant content, swallowing surrounding blank lines so paragraphs reflow.
+const LYNKR_BADGE_LINE_RE = /\n{0,2}\*\[Lynkr\][^*\n]*\*[ \t]*(?=\n|$)/g;
+
+function _stripBadgeText(text) {
+  return text.replace(LYNKR_BADGE_PREFIX_RE, "").replace(LYNKR_BADGE_LINE_RE, "");
+}
 
 function stripLynkrBadges(messages) {
   if (!Array.isArray(messages)) return messages;
@@ -3468,8 +3590,8 @@ function stripLynkrBadges(messages) {
     // what the orchestrator's OpenAI-format response branch produces, and
     // it's where badges actually leak in the Ollama agent loop.
     if (typeof msg.content === 'string') {
-      if (!LYNKR_BADGE_PREFIX_RE.test(msg.content)) return msg;
-      const stripped = msg.content.replace(LYNKR_BADGE_PREFIX_RE, '');
+      const stripped = _stripBadgeText(msg.content);
+      if (stripped === msg.content) return msg;
       mutated = true;
       // Badge-only content must not become an empty string — Anthropic
       // rejects empty assistant content (this is the interrupted-response
@@ -3487,9 +3609,9 @@ function stripLynkrBadges(messages) {
       let changed = false;
       const rebuilt = [];
       for (const b of msg.content) {
-        if (b?.type === 'text' && typeof b.text === 'string' && LYNKR_BADGE_PREFIX_RE.test(b.text)) {
+        if (b?.type === 'text' && typeof b.text === 'string' && _stripBadgeText(b.text) !== b.text) {
           changed = true;
-          const strippedText = b.text.replace(LYNKR_BADGE_PREFIX_RE, '');
+          const strippedText = _stripBadgeText(b.text);
           if (strippedText.trim()) rebuilt.push({ ...b, text: strippedText });
           // badge-only block → drop
         } else {
@@ -3533,6 +3655,7 @@ const PROVIDER_INVOKERS = {
   vertex: invokeVertex,
   moonshot: invokeMoonshot,
   codex: invokeCodex,
+  cursor: invokeCursor,
   baidu: invokeBaidu,
   fireworks: invokeFireworks,
   orcarouter: invokeOrcaRouter,
@@ -3585,6 +3708,9 @@ async function invokeModel(body, options = {}) {
         escalation_source: body._escalationSource ?? null,
         pinned: body._pinnedRoute ? true : false,
         switch_reason: body._switchReason ?? null,
+        // TaskBand stamp for the continuation telemetry columns
+        // (telemetry.taskbandFields reads routingResult.taskband).
+        taskband: body._taskband ?? null,
         // WS4 — off-policy evaluation from telemetry alone requires
         // propensity + candidates on every row. Deterministic default is
         // 1.0 with a single-entry candidate list matching the served pair.
@@ -3802,6 +3928,7 @@ async function invokeModel(body, options = {}) {
       pinned: routingResult.pinned ? 1 : 0,
       switch_reason: routingResult.switch_reason ?? null,
       ...telemetry.jevFields(routingResult),
+      ...telemetry.taskbandFields(routingResult),
       cache_decision: routingResult._cacheDecision ?? null,
       cache_read_tokens: result.json?.usage?.cache_read_input_tokens ?? null,
       cache_creation_tokens: result.json?.usage?.cache_creation_input_tokens ?? null,
@@ -4038,6 +4165,7 @@ async function invokeModel(body, options = {}) {
         pinned: routingResult.pinned ? 1 : 0,
         switch_reason: routingResult.switch_reason ?? null,
       ...telemetry.jevFields(routingResult),
+      ...telemetry.taskbandFields(routingResult),
       cache_decision: routingResult._cacheDecision ?? null,
       });
 
@@ -4152,6 +4280,7 @@ async function invokeModel(body, options = {}) {
           pinned: routingResult.pinned ? 1 : 0,
           switch_reason: routingResult.switch_reason ?? null,
       ...telemetry.jevFields(routingResult),
+      ...telemetry.taskbandFields(routingResult),
           cache_decision: routingResult._cacheDecision ?? null,
         });
 
@@ -4250,6 +4379,7 @@ async function invokeModel(body, options = {}) {
         pinned: routingResult.pinned ? 1 : 0,
         switch_reason: routingResult.switch_reason ?? null,
       ...telemetry.jevFields(routingResult),
+      ...telemetry.taskbandFields(routingResult),
       cache_decision: routingResult._cacheDecision ?? null,
       cache_read_tokens: fallbackResult.json?.usage?.cache_read_input_tokens ?? null,
       cache_creation_tokens: fallbackResult.json?.usage?.cache_creation_input_tokens ?? null,
@@ -4312,6 +4442,7 @@ async function invokeModel(body, options = {}) {
         pinned: routingResult.pinned ? 1 : 0,
         switch_reason: routingResult.switch_reason ?? null,
       ...telemetry.jevFields(routingResult),
+      ...telemetry.taskbandFields(routingResult),
       cache_decision: routingResult._cacheDecision ?? null,
       });
 
@@ -4415,6 +4546,7 @@ module.exports = {
   invokeFireworks,
   invokeAtlas,
   invokeOrcaRouter,
+  invokeCursor,
   PROVIDER_INVOKERS,
   stripLynkrBadges,
   destroyHttpAgents,

package/src/clients/health-probe.js

@@ -60,6 +60,16 @@ function _registerBuiltins() {
       : {};
     probes.set('lmstudio', () => _cheapGet(`${config.lmstudio.endpoint}/v1/models`, headers));
   }
+  if (config.cursor?.enabled === true) {
+    // Cheap local check: the CLI binary responds to --version. Auth status
+    // (subscription) is NOT probed here — a logged-out CLI still prints a
+    // version, and per-request failures surface via normal tier fallback.
+    probes.set('cursor', async () => {
+      const { execFileSync } = require('node:child_process');
+      const binary = config.cursor?.binaryPath?.trim() || process.env.CURSOR_BINARY_PATH?.trim() || 'cursor-agent';
+      execFileSync(binary, ['--version'], { timeout: PROBE_TIMEOUT_MS, stdio: 'ignore' });
+    });
+  }
 }
 
 /**

package/src/config/index.js

@@ -727,6 +727,12 @@ var config = {
     model: process.env.CODEX_MODEL?.trim() || "gpt-5.3-codex",
     timeout: Number.parseInt(process.env.CODEX_TIMEOUT || "120000", 10) || 120000,
   },
+  cursor: {
+    enabled: process.env.CURSOR_ENABLED === "true",
+    binaryPath: process.env.CURSOR_BINARY_PATH?.trim() || "cursor-agent",
+    model: process.env.CURSOR_MODEL?.trim() || "composer-2.5",
+    timeout: Number.parseInt(process.env.CURSOR_TIMEOUT || "120000", 10) || 120000,
+  },
   hotReload: {
     enabled: hotReloadEnabled,
     debounceMs: Number.isNaN(hotReloadDebounceMs) ? 1000 : hotReloadDebounceMs,
@@ -1197,6 +1203,10 @@ function reloadConfig() {
   config.orcarouter.authBaseUrl = orcaAuth;
   config.orcarouter.apiBaseUrl = orcaApi;
   config.orcarouter.endpoint = process.env.ORCAROUTER_ENDPOINT?.trim() || `${orcaApi}/v1/chat/completions`;
+  config.cursor.enabled = process.env.CURSOR_ENABLED === "true";
+  config.cursor.binaryPath = process.env.CURSOR_BINARY_PATH?.trim() || "cursor-agent";
+  config.cursor.model = process.env.CURSOR_MODEL?.trim() || "composer-2.5";
+  config.cursor.timeout = Number.parseInt(process.env.CURSOR_TIMEOUT || "120000", 10) || 120000;
 
   // Model provider settings
   const newProvider = (process.env.MODEL_PROVIDER ?? "databricks").toLowerCase();

package/src/orchestrator/index.js

@@ -65,6 +65,8 @@ function getDestinationUrl(providerType) {
       return config.orcarouter?.endpoint ?? 'https://api.orcarouter.ai/v1/chat/completions';
     case 'codex':
       return 'codex://app-server (local process)';
+    case 'cursor':
+      return 'cursor://cursor-agent (local CLI)';
     default:
       return 'unknown';
   }
@@ -2783,6 +2785,12 @@ IMPORTANT TOOL USAGE RULES:
       if (Array.isArray(anthropicPayload?.content)) {
         anthropicPayload.content = policy.sanitiseContent(anthropicPayload.content);
       }
+    } else if (actualProvider === "cursor") {
+      // Cursor CLI responses are already in Anthropic format from invokeCursor
+      anthropicPayload = databricksResponse.json;
+      if (Array.isArray(anthropicPayload?.content)) {
+        anthropicPayload.content = policy.sanitiseContent(anthropicPayload.content);
+      }
     } else if (databricksResponse.json?.type === "message" && Array.isArray(databricksResponse.json?.content)) {
       // Shape-detected: already Anthropic (some clients convert upstream).
       // Re-converting via toAnthropicResponse reads the absent choices[]

package/src/orchestrator/sse-transformer.js

@@ -25,9 +25,9 @@ const logger = require("../logger");
 // invoke fn converts buffered responses to Anthropic, and its Anthropic-format
 // endpoint has the native passthrough path instead). moonshot joined the list
 // once invokeMoonshot learned to return the raw stream (its old forced
-// stream:false predated this transformer). Caveat: reasoning_content deltas
-// (kimi thinking) are not reshaped — thinking text is dropped from streamed
-// responses; the buffered path still lifts it into thinking blocks.
+// stream:false predated this transformer). reasoning_content deltas (kimi/
+// glm/gpt-oss/cursor thoughts) are reshaped into Anthropic thinking blocks
+// (2026-09-27) so the thinking phase streams live instead of dropping.
 // baidu (Qianfan's /v2/chat/completions) already returns the raw stream the
 // same way moonshot does (invokeBaidu's `if (response?.stream) return
 // response;`) and its endpoint is documented as OpenAI-compatible — but
@@ -38,6 +38,7 @@ const logger = require("../logger");
 // shared transformer for one provider's quirk.
 const DEFAULT_OPENAI_SSE_PROVIDERS = [
   "openai",
+  "cursor",
   "atlas",
   "azure-openai",
   "openrouter",
@@ -163,6 +164,7 @@ async function* _openaiToAnthropicEvents(upstream, opts = {}) {
   let model = fallbackModel;
   let nextIndex = 0;
   let textIndex = null; // open text block index, null when closed
+  let thinkingIndex = null; // open thinking block index, null when closed
   let finishReason = null;
   const toolAcc = new Map(); // openai tool index -> { id, name, args }
 
@@ -239,6 +241,12 @@ async function* _openaiToAnthropicEvents(upstream, opts = {}) {
     return out;
   };
 
+  const closeThinkingBlock = function* () {
+    if (thinkingIndex === null) return;
+    yield _sse("content_block_stop", { type: "content_block_stop", index: thinkingIndex });
+    thinkingIndex = null;
+  };
+
   const closeTextBlock = function* () {
     // Flush a held-back fragment that turned out not to be a tag.
     if (_tagTail && !_inThink && textIndex !== null) {
@@ -306,11 +314,34 @@ async function* _openaiToAnthropicEvents(upstream, opts = {}) {
 
       yield* startMessage();
 
+      // Reasoning deltas (kimi/glm/gpt-oss/cursor-ACP thoughts) become a
+      // proper Anthropic thinking block so clients show live activity during
+      // the thinking phase instead of dead air (2026-09-26 complaint: badge,
+      // then minutes of silence). Thinking and text are sequential blocks —
+      // close one before opening the other.
+      if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
+        yield* closeTextBlock();
+        if (thinkingIndex === null) {
+          thinkingIndex = nextIndex++;
+          yield _sse("content_block_start", {
+            type: "content_block_start",
+            index: thinkingIndex,
+            content_block: { type: "thinking", thinking: "" },
+          });
+        }
+        yield _sse("content_block_delta", {
+          type: "content_block_delta",
+          index: thinkingIndex,
+          delta: { type: "thinking_delta", thinking: delta.reasoning_content },
+        });
+      }
+
       // Text deltas are straightforward: open a block on first text, then
       // emit a text_delta per chunk.
       if (typeof delta.content === "string" && delta.content.length > 0) {
         const visible = filterThink(delta.content);
         if (visible.length > 0) {
+          yield* closeThinkingBlock();
           if (textIndex === null) {
             textIndex = nextIndex++;
             yield _sse("content_block_start", {
@@ -331,6 +362,7 @@ async function* _openaiToAnthropicEvents(upstream, opts = {}) {
       // function.arguments are NOT parseable individually — only the full
       // concatenation is valid JSON, so blocks are emitted at stream end.
       if (Array.isArray(delta.tool_calls)) {
+        yield* closeThinkingBlock();
         yield* closeTextBlock();
         for (const tc of delta.tool_calls) {
           const idx = tc.index ?? 0;
@@ -345,6 +377,7 @@ async function* _openaiToAnthropicEvents(upstream, opts = {}) {
   } catch (err) {
     logger.warn({ err: err.message }, "[SSETransform] Upstream stream failed mid-flight");
     yield* startMessage();
+    yield* closeThinkingBlock();
     yield* closeTextBlock();
     yield _sse("error", {
       type: "error",
@@ -358,6 +391,7 @@ async function* _openaiToAnthropicEvents(upstream, opts = {}) {
 
   // Normal end of stream ([DONE] or upstream EOF).
   yield* startMessage();
+  yield* closeThinkingBlock();
   yield* closeTextBlock();
 
   // An EOF with no finish_reason is a dropped upstream, not a completed

package/src/routing/affinity-store.js

@@ -77,6 +77,14 @@ function _db() {
           ttl_ms             INTEGER NOT NULL
         );
         CREATE INDEX IF NOT EXISTS idx_cache_state_ts ON session_cache_state(last_request_at);
+        CREATE TABLE IF NOT EXISTS session_task_state (
+          session_id     TEXT PRIMARY KEY,
+          anchor_hash    TEXT,
+          effective_band INTEGER,
+          open           INTEGER,
+          low_streak     INTEGER,
+          updated_at     INTEGER
+        );
       `);
       schemaEnsured = true;
     } catch (err) {
@@ -253,6 +261,122 @@ function loadCacheState(sessionId) {
   }
 }
 
+// TaskBand — per-session task difficulty state. Lives in its OWN table for
+// the same reason as session_cache_state: piggybacking non-pin rows onto
+// session_pins let tier-less rows be served as routing pins (see note above
+// saveCacheState). Falls back to this in-memory Map when the DB is
+// unavailable so continuation floors keep working without persistence.
+const taskStateMem = new Map();
+
+/**
+ * Load TaskBand state for a session. Returns null when absent or on any
+ * DB failure.
+ *
+ * @param {string} sessionId
+ * @returns {{anchorHash:string|null, effectiveBand:number, open:boolean, lowStreak:number}|null}
+ */
+function getTaskState(sessionId) {
+  if (!sessionId) return null;
+  const db = _db();
+  if (!db) {
+    const mem = taskStateMem.get(sessionId);
+    return mem ? { ...mem } : null;
+  }
+  try {
+    const row = _stmt(
+      db,
+      "task_state_load",
+      "SELECT anchor_hash, effective_band, open, low_streak FROM session_task_state WHERE session_id = ?"
+    ).get(sessionId);
+    if (!row) return null;
+    return {
+      anchorHash: row.anchor_hash ?? null,
+      effectiveBand: Number(row.effective_band) || 0,
+      open: !!row.open,
+      lowStreak: Number(row.low_streak) || 0,
+    };
+  } catch (err) {
+    degradation.record("feedback", err);
+    return null;
+  }
+}
+
+/**
+ * Upsert TaskBand state. effective_band is MAX-merged only while the stored
+ * anchor matches — a new anchor means a new task, whose band must not
+ * inherit the old peak, so the whole row is overwritten instead.
+ *
+ * @param {string} sessionId
+ * @param {{anchorHash:string|null, effectiveBand:number, open:boolean, lowStreak?:number}} state
+ */
+function setTaskState(sessionId, state) {
+  if (!sessionId || !state) return;
+  const next = {
+    anchorHash: state.anchorHash ?? null,
+    effectiveBand: Number.isFinite(state.effectiveBand) ? state.effectiveBand : 0,
+    open: state.open ? 1 : 0,
+    lowStreak: Number.isFinite(state.lowStreak) ? state.lowStreak : 0,
+  };
+  const db = _db();
+  if (!db) {
+    const prev = taskStateMem.get(sessionId);
+    if (prev && prev.anchorHash === next.anchorHash) {
+      next.effectiveBand = Math.max(prev.effectiveBand, next.effectiveBand);
+    }
+    taskStateMem.set(sessionId, {
+      anchorHash: next.anchorHash,
+      effectiveBand: next.effectiveBand,
+      open: !!next.open,
+      lowStreak: next.lowStreak,
+    });
+    return;
+  }
+  try {
+    _stmt(
+      db,
+      "task_state_upsert",
+      // IS (not =) so a null↔null anchor comparison still MAX-merges. All
+      // SET expressions see the pre-update row, so assignment order below
+      // doesn't affect the CASE.
+      `INSERT INTO session_task_state (session_id, anchor_hash, effective_band, open, low_streak, updated_at)
+       VALUES (@session_id, @anchor_hash, @effective_band, @open, @low_streak, @updated_at)
+       ON CONFLICT(session_id) DO UPDATE SET
+         effective_band = CASE WHEN anchor_hash IS excluded.anchor_hash
+           THEN MAX(effective_band, excluded.effective_band)
+           ELSE excluded.effective_band END,
+         anchor_hash = excluded.anchor_hash,
+         open = excluded.open,
+         low_streak = excluded.low_streak,
+         updated_at = excluded.updated_at`
+    ).run({
+      session_id: sessionId,
+      anchor_hash: next.anchorHash,
+      effective_band: next.effectiveBand,
+      open: next.open,
+      low_streak: next.lowStreak,
+      updated_at: Date.now(),
+    });
+  } catch (err) {
+    degradation.record("feedback", err);
+  }
+}
+
+/**
+ * Remove TaskBand state for a session.
+ * @param {string} sessionId
+ */
+function clearTaskState(sessionId) {
+  if (!sessionId) return;
+  taskStateMem.delete(sessionId);
+  const db = _db();
+  if (!db) return;
+  try {
+    _stmt(db, "task_state_delete", "DELETE FROM session_task_state WHERE session_id = ?").run(sessionId);
+  } catch (err) {
+    degradation.record("feedback", err);
+  }
+}
+
 /**
  * Remove a pin.
  * @param {string} sessionId
@@ -298,4 +422,15 @@ function _clear() {
   } catch { /* best-effort */ }
 }
 
-module.exports = { load, save, remove, cleanup, saveCacheState, loadCacheState, _clear };
+module.exports = {
+  load,
+  save,
+  remove,
+  cleanup,
+  saveCacheState,
+  loadCacheState,
+  getTaskState,
+  setTaskState,
+  clearTaskState,
+  _clear,
+};

package/src/routing/capabilities.js

@@ -71,6 +71,12 @@ function buildRequirementVector({ dimensions = {}, agenticResult = null } = {})
     // Agentic work always needs tool orchestration — floor only, never lower.
     if (agenticResult?.isAgentic) {
       toolUse = Math.max(toolUse, 0.6);
+    } else if (agenticResult && agenticResult.isAgentic === false) {
+      // The detector already scored this turn NON-agentic using EFFECTIVE
+      // tools (harness baseline subtracted, WS3.2). Attached-tool dims must
+      // not out-vote that verdict: a bare "Hi" from a harness with 9 default
+      // tools is not a tool-orchestration workload. Cap, never raise.
+      toolUse = Math.min(toolUse, 0.25);
     }
 
     const round3 = (v) => Math.round(_clamp01(v) * 1000) / 1000;

package/src/routing/complexity-analyzer.js

@@ -422,18 +422,22 @@ function extractContent(payload) {
     return '';
   }
 
-  // Get last user message
+  // Get last user message. Harness envelopes (Cursor's <user_info>/<rules>/
+  // attached context inside the user message) are stripped so force patterns,
+  // risk keywords (risk-analyzer imports this) and text dims score the ASK,
+  // not the harness boilerplate.
+  const { stripHarnessEnvelope } = require('./harness-envelope');
   for (let i = payload.messages.length - 1; i >= 0; i--) {
     const msg = payload.messages[i];
     if (msg?.role === 'user') {
       if (typeof msg.content === 'string') {
-        return msg.content;
+        return stripHarnessEnvelope(msg.content);
       }
       if (Array.isArray(msg.content)) {
-        return msg.content
+        return stripHarnessEnvelope(msg.content
           .filter(block => block?.type === 'text')
           .map(block => block.text || '')
-          .join(' ');
+          .join(' '));
       }
     }
   }

package/src/routing/harness-envelope.js

@@ -0,0 +1,71 @@
+/**
+ * Harness-envelope hygiene for trigger/risk/dimension text.
+ *
+ * GUI harnesses (Cursor at minimum) deliver the user's ask embedded in a
+ * context envelope INSIDE the user message: <user_info>, <git_status>,
+ * <rules> (workspace rules — routinely contain phrases like "never expose
+ * API keys" or "do not deploy to production"), <agent_transcripts>, attached
+ * file contents. Trigger-style scanners (force patterns, risk keywords) and
+ * text dimensions must evaluate the ASK, not the harness's boilerplate — a
+ * workspace rule about keys must not make "Hi" high-risk (live incident
+ * 2026-09-26: routing_method=risk REASONING serve on a bare greeting).
+ *
+ * Claude Code payloads never carry these tags (its wrapper text rides in
+ * system-reminders, stripped elsewhere) — this is a no-op for them.
+ *
+ * Pure functions, no I/O. Never throws.
+ */
+
+const ENVELOPE_TAGS = [
+  'user_info',
+  'git_status',
+  'agent_transcripts',
+  'rules',
+  'always_applied_workspace_rules',
+  'uuid',
+  'project_layout',
+  'attached_files',
+  'file_contents',
+  'additional_data',
+  'custom_instructions',
+  'linter_errors',
+  'recently_viewed_files',
+  'open_files',
+  'user_rules',
+  'memories',
+  'workspace_rules',
+];
+
+const PAIRED_RES = ENVELOPE_TAGS.map(
+  (t) => new RegExp(`<${t}(?:\\s[^>]*)?>[\\s\\S]*?<\\/${t}>`, 'gi')
+);
+// Unclosed blocks that OPEN at line start swallow to end-of-string (telemetry
+// and upstream truncation cut envelopes mid-block). Mid-line opens are
+// preserved — a user QUOTING a tag is content, not envelope (same rationale
+// as the jev-router cleaner's line-start rule).
+const UNCLOSED_RES = ENVELOPE_TAGS.map(
+  (t) => new RegExp(`(?:^|\\n)<${t}(?:\\s[^>]*)?>[\\s\\S]*$`, 'i')
+);
+const USER_QUERY_RE = /<user_query(?:\s[^>]*)?>([\s\S]*?)<\/user_query>/gi;
+
+/**
+ * @param {string} text - one user message's text content
+ * @returns {string} the user's ask with harness envelope blocks removed;
+ *   when the harness marks the ask explicitly (<user_query>), that wins.
+ */
+function stripHarnessEnvelope(text) {
+  if (typeof text !== 'string' || text.length === 0) return typeof text === 'string' ? text : '';
+  try {
+    if (!text.includes('<')) return text;
+    const queries = [...text.matchAll(USER_QUERY_RE)].map((m) => m[1].trim()).filter(Boolean);
+    if (queries.length > 0) return queries.join(' ');
+    let out = text;
+    for (const re of PAIRED_RES) out = out.replace(re, ' ');
+    for (const re of UNCLOSED_RES) out = out.replace(re, ' ');
+    return out.replace(/[ \t]{2,}/g, ' ').replace(/\n{3,}/g, '\n\n').trim();
+  } catch {
+    return text;
+  }
+}
+
+module.exports = { stripHarnessEnvelope, ENVELOPE_TAGS };