mixdog 1.2.3 → 1.2.4

package/src/runtime/agent/orchestrator/providers/cursor-client-version.mjs

@@ -4,7 +4,7 @@ import { createRemoteVersionSource } from './npm-cli-version.mjs';
 // documented version endpoint; the official installer script embeds the
 // current build (…/lab/<build>/…), parsed best-effort. Any format change or
 // failure falls back to the floor.
-export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.14-941492e';
+export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.16-e3cb207';
 const BUILD_PATTERN = /downloads\.cursor\.com\/lab\/(\d{4}\.\d{2}\.\d{2}-[0-9a-f]{6,40})\//;
 export const CURSOR_INSTALL_URL = 'https://cursor.com/install';
 

package/src/runtime/agent/orchestrator/providers/cursor-native-context.mjs

@@ -0,0 +1,48 @@
+import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+
+const PREFIX = 'cursor_native_';
+const pendingCalls = new Map();
+const AUTHORIZATION_MS = 10 * 60 * 1000;
+
+export function isCursorNativeCallId(id) {
+  return typeof id === 'string' && id.startsWith(PREFIX);
+}
+
+// Registered before streaming the call, including when a later frame is partial.
+// Model arguments never grant this capability.
+export function registerCursorNativeCall(ownerSessionId, pending, executions) {
+  if (!ownerSessionId || !pending.native) return;
+  if (pending.toolName !== 'read' && pending.toolName !== 'edit') return;
+  if (!['readResult', 'writeResult'].includes(pending.native.resultType)) return;
+  const now = Date.now();
+  for (const [id, entry] of pendingCalls) {
+    if (entry.expiresAt <= now) pendingCalls.delete(id);
+  }
+  if (pendingCalls.size >= 4096) throw new Error('Cursor native execution authorization capacity exceeded');
+  pending.toolCallId = `${PREFIX}${randomUUID()}`;
+  const entry = {
+    ownerSessionId,
+    pending,
+    executions,
+    expiresAt: now + AUTHORIZATION_MS,
+    arguments: JSON.parse(pending.decodedArgs),
+  };
+  pendingCalls.set(pending.toolCallId, entry);
+}
+
+export function cursorNativeCall(ownerSessionId, id, name, args) {
+  if (!isCursorNativeCallId(id)) return null;
+  const entry = pendingCalls.get(id);
+  if (!entry) throw new Error('Cursor native execution authorization is missing');
+  if (entry.expiresAt <= Date.now()) throw new Error('Cursor native execution authorization expired');
+  if (entry.ownerSessionId !== ownerSessionId) throw new Error('Cursor native execution authorization owner mismatch');
+  if (entry.pending.toolName !== name) throw new Error('Cursor native execution authorization tool mismatch');
+  if (!isDeepStrictEqual(entry.arguments, args))
+    throw new Error('Cursor native execution authorization argument mismatch');
+  return entry;
+}
+
+export function releaseCursorNativeCall(pending) {
+  pendingCalls.delete(pending.toolCallId);
+}

package/src/runtime/agent/orchestrator/providers/cursor-wire-exec.mjs

@@ -1,11 +1,28 @@
 // Cursor exec/kv message handling: routing native exec requests to local
 // tools and sending results back on the bridge.
 import crypto from 'node:crypto';
+import { BRIDGE_NAME_MAX_CHARS, isBridgeMetaTool } from '../runtime-core/tool-bridge-contract.mjs';
+import { releaseCursorNativeCall } from './cursor-native-context.mjs';
 import { decodeJsonValue, encodeMessage } from './cursor-wire-protobuf.mjs';
 import { capCursorToolResult, storeCursorBlob } from './cursor-wire-guards.mjs';
 import { buildCursorExecThrow } from './cursor-wire-interactions.mjs';
 import { connectFrame, textDecoder, textEncoder } from './cursor-wire-transport.mjs';
 import { buildRequestContext } from './cursor-wire-request.mjs';
+import { readSourceWindow } from '../../../shared/read-row-numbers.mjs';
+import { splitGrepLineNumberOnlyPrefix, splitGrepCountPrefix } from '../tools/builtin/grep-formatting.mjs';
+
+const nativeWriteDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+
+function nativeWriteText(args) {
+  if (!args.fileBytes?.length) return args.fileText || '';
+  try {
+    return nativeWriteDecoder.decode(args.fileBytes);
+  } catch {
+    throw Object.assign(new Error('Native Write fileBytes must be valid UTF-8; no file was written'), {
+      code: 'CURSOR_WRITE_ENCODING',
+    });
+  }
+}
 
 export function heartbeatFrame() {
   return connectFrame(encodeMessage('AgentClientMessage', { clientHeartbeat: {} }));
@@ -70,12 +87,15 @@ const NATIVE_EXEC_CASES = [
   ],
   [
     'writeArgs',
-    ['write'],
+    // Only the guarded edit tool: it creates missing files and fills empty
+    // ones, while its executor rejects overwrites of non-empty files. An
+    // explicit write tool would overwrite without any native capability
+    // (remote/proxied calls), so it never serves a native Write.
+    ['edit'],
     (tool, args) => ({
       [argumentName(tool, ['file_path', 'filePath', 'path'], 'file_path')]: args.path || '',
-      [argumentName(tool, ['content', 'file_text', 'text'], 'content')]: args.fileBytes?.length
-        ? textDecoder.decode(args.fileBytes)
-        : args.fileText || '',
+      old_string: '',
+      new_string: nativeWriteText(args),
     }),
     'writeResult',
   ],
@@ -90,7 +110,9 @@ const NATIVE_EXEC_CASES = [
       pattern: args.pattern || '.',
       ...(args.path ? { path: args.path } : {}),
       ...(args.glob ? { glob: args.glob } : {}),
-      mode: args.outputMode || 'content',
+      mode: args.outputMode === 'files_with_matches' ? 'files' : args.outputMode || 'content',
+      context: 0,
+      ...(args.headLimit > 0 ? { limit: args.headLimit } : {}),
     }),
     'grepResult',
   ],
@@ -130,6 +152,16 @@ const rejectedPath = (args) => ({ rejected: { path: args.path || '', reason: UNA
 const rejectedShell = (args) => ({
   rejected: { command: args.command || '', workingDirectory: args.workingDirectory || '', reason: UNAVAILABLE },
 });
+const rejectedBackgroundShell = (args) => ({
+  rejected: {
+    command: args.command || '',
+    workingDirectory: args.workingDirectory || '',
+    reason:
+      'Cursor background shell is not supported. Use the mixdog MCP shell tool with {"command":"..."}; ' +
+      'if it returns task_id, use the mixdog task tool with {"action":"wait","task_id":"<returned id>"}. ' +
+      'Use load_tool {"names":"task"} if task is not loaded.',
+  },
+});
 const unavailableError = () => ({ error: { error: UNAVAILABLE } });
 
 // Native exec cases with no Mixdog tool behind them: [exec key, exec result
@@ -143,7 +175,7 @@ const UNAVAILABLE_EXEC_RESULTS = [
   ['fetchArgs', 'fetchResult', (args) => ({ error: { url: args.url || '', error: UNAVAILABLE } })],
   ['shellArgs', 'shellResult', rejectedShell],
   ['shellStreamArgs', 'shellResult', rejectedShell],
-  ['backgroundShellSpawnArgs', 'backgroundShellSpawnResult', rejectedShell],
+  ['backgroundShellSpawnArgs', 'backgroundShellSpawnResult', rejectedBackgroundShell],
   ['writeShellStdinArgs', 'writeShellStdinResult', unavailableError],
   ['diagnosticsArgs', 'diagnosticsResult', () => ({})],
 ];
@@ -163,18 +195,44 @@ function rejectUnavailableExec(bridge, exec) {
 function handleMcpExec(bridge, exec, tools, onToolCall) {
   const args = exec.mcpArgs;
   const requestedName = args.toolName || args.name;
-  const tool = toolByNames(tools, [requestedName]);
+  const directTool = toolByNames(tools, [requestedName]);
+  // Only the bridge granted in this request can resolve a deferred name.
+  // The ordinary runtime still projects the target and enforces its policy.
+  let tool =
+    directTool ||
+    (typeof requestedName === 'string' && requestedName.length > 0 ? toolByNames(tools, ['call_tool']) : null);
   if (!tool) {
     sendExecResult(bridge, exec, 'mcpResult', {
       error: { error: `Tool not available: ${requestedName || 'unknown'}` },
     });
     return;
   }
+  let decodedArgs = decodeMcpArgs(args.args);
+  if (
+    requestedName === 'call_tool' &&
+    directTool &&
+    Object.keys(decodedArgs).length === 2 &&
+    Object.hasOwn(decodedArgs, 'name') &&
+    Object.hasOwn(decodedArgs, 'arguments') &&
+    typeof decodedArgs.name === 'string' &&
+    decodedArgs.name.length > 0 &&
+    decodedArgs.name.length <= BRIDGE_NAME_MAX_CHARS &&
+    !isBridgeMetaTool(decodedArgs.name) &&
+    decodedArgs.arguments !== null &&
+    typeof decodedArgs.arguments === 'object' &&
+    !Array.isArray(decodedArgs.arguments)
+  ) {
+    const target = toolByNames(tools, [decodedArgs.name]);
+    if (target) {
+      tool = target;
+      decodedArgs = decodedArgs.arguments;
+    }
+  }
   onToolCall({
     exec,
     toolCallId: args.toolCallId || crypto.randomUUID(),
     toolName: tool.name,
-    decodedArgs: JSON.stringify(decodeMcpArgs(args.args)),
+    decodedArgs: JSON.stringify(directTool ? decodedArgs : { name: requestedName, arguments: decodedArgs }),
   });
 }
 
@@ -191,7 +249,14 @@ export function handleExecMessage(bridge, exec, tools, cloudRule, onToolCall) {
     handleMcpExec(bridge, exec, tools, onToolCall);
     return;
   }
-  const redirect = redirectNativeExec(exec, tools);
+  let redirect;
+  try {
+    redirect = redirectNativeExec(exec, tools);
+  } catch (error) {
+    if (error.code !== 'CURSOR_WRITE_ENCODING') throw error;
+    sendExecResult(bridge, exec, 'writeResult', { error: { path: exec.writeArgs.path || '', error: error.message } });
+    return;
+  }
   if (redirect) {
     onToolCall(redirect);
     return;
@@ -227,31 +292,41 @@ function parseListedPaths(text, rootPath) {
 
 function parseGrepResult(text, args) {
   const mode = args.outputMode || 'content';
+  const lines = text.split(/\r?\n/).filter((line) => line && !line.startsWith('[total ') && !line.startsWith('... ['));
   if (mode === 'files_with_matches') {
-    const files = text
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter(Boolean);
+    const files = lines.map((line) => line.trim()).filter((line) => !line.startsWith('(no matches)'));
     return { files: { files, totalFiles: files.length } };
   }
   if (mode === 'count') {
     const counts = [];
     let totalMatches = 0;
-    for (const line of text.split(/\r?\n/)) {
-      const match = line.match(/^(.*):(\d+)$/);
-      if (!match) continue;
-      const count = Number(match[2]);
-      counts.push({ file: match[1], count });
+    for (const line of lines) {
+      const parsed = splitGrepCountPrefix(line);
+      if (!parsed && !/^\d+$/.test(line)) continue;
+      const count = parsed ? parsed.count : Number(line);
+      counts.push({ file: parsed?.path || args.path, count });
       totalMatches += count;
     }
     return { count: { counts, totalFiles: counts.length, totalMatches } };
   }
   const byFile = new Map();
-  for (const line of text.split(/\r?\n/)) {
-    const match = line.match(/^(.+?):(\d+):(.*)$/);
-    if (!match) continue;
-    if (!byFile.has(match[1])) byFile.set(match[1], []);
-    byFile.get(match[1]).push({ lineNumber: Number(match[2]), content: match[3] });
+  let currentFile = args.path;
+  for (const line of lines) {
+    const grouped = /^ {2}(\d+): (.*)$/.exec(line);
+    // Native searches request no context: only :N: is a line delimiter.
+    // A -N- segment may be part of the filename, not a context-line prefix.
+    const match = grouped ? null : /^(.+?):(\d+):/.exec(line);
+    const prefix = match ? { path: match[1], lineNo: Number(match[2]), markerEnd: match[0].length } : null;
+    const single = grouped || prefix ? null : splitGrepLineNumberOnlyPrefix(line);
+    if (!grouped && !prefix && !single) {
+      currentFile = line.replace(/ \(\d+ hits\)$/, '');
+      continue;
+    }
+    const file = prefix?.path || currentFile;
+    const lineNumber = grouped ? Number(grouped[1]) : (prefix || single).lineNo;
+    const content = grouped ? grouped[2] : line.slice((prefix || single).markerEnd);
+    if (!byFile.has(file)) byFile.set(file, []);
+    byFile.get(file).push({ lineNumber, content });
   }
   const matches = [...byFile].map(([file, fileMatches]) => ({ file, matches: fileMatches }));
   const matchedLines = matches.reduce((sum, entry) => sum + entry.matches.length, 0);
@@ -290,7 +365,7 @@ function sendShellStream(bridge, exec, text, code) {
 // rejected shell command.
 const NATIVE_FAILURE_PAYLOADS = {
   readResult: (args, text) => ({ rejected: { path: args.path || '', reason: text || 'Read failed' } }),
-  writeResult: (args, text) => ({ rejected: { path: args.path || '', reason: text || 'Write failed' } }),
+  writeResult: (args, text) => ({ error: { path: args.path || '', error: text || 'Write failed' } }),
   fetchResult: (args, text) => ({ error: { url: args.url || '', error: text || 'Fetch failed' } }),
   lsResult: (args, text) => ({ rejected: { path: args.path || '', reason: text || 'List failed' } }),
   grepResult: (_args, text) => ({ error: { error: text || 'Grep failed' } }),
@@ -304,16 +379,30 @@ const NATIVE_FAILURE_PAYLOADS = {
 };
 
 const NATIVE_SUCCESS_PAYLOADS = {
-  readResult: (args, text) => ({
-    success: {
-      path: args.path || '',
-      content: text,
-      totalLines: text ? text.split(/\r?\n/).length : 0,
-      fileSize: textEncoder.encode(text).length,
-    },
-  }),
+  readResult: (args, text, pending, result) => {
+    const source = readSourceWindow(text);
+    // The read executor reports per-line clipping out of band: on the
+    // pending call (local) or on the result (remote/proxied).
+    if (!source || pending.nativeReadWindow?.lineClipped || result?.readWindow?.lineClipped)
+      return {
+        rejected: {
+          path: args.path || '',
+          reason:
+            'This read result is not a complete contiguous source window. Use the mixdog MCP read tool with file_path, offset and limit; do not treat display markers as file content.',
+        },
+      };
+    return {
+      success: {
+        path: args.path || '',
+        content: source.content,
+        ...(source.totalLines === undefined ? {} : { totalLines: source.totalLines }),
+        truncated: source.truncated,
+        rangeApplied: Boolean(args.offset || args.limit || (source.startLine != null && source.startLine > 1)),
+      },
+    };
+  },
   writeResult: (args) => {
-    const content = args.fileBytes?.length ? textDecoder.decode(args.fileBytes) : args.fileText || '';
+    const content = nativeWriteText(args);
     return {
       success: {
         path: args.path || '',
@@ -345,7 +434,9 @@ const NATIVE_SUCCESS_PAYLOADS = {
 };
 
 export function sendToolResult(bridge, pending, result, ok) {
+  releaseCursorNativeCall(pending);
   result = capCursorToolResult(result);
+  pending.completedResult = { result, ok };
   const { exec, native } = pending;
   const text = String(result?.content ?? '');
   const media = Array.isArray(result?.media) ? result.media : [];
@@ -354,6 +445,21 @@ export function sendToolResult(bridge, pending, result, ok) {
     return;
   }
   const { args, resultType } = native;
+  if (ok && resultType === 'readResult' && pending.nativeReadReply) {
+    let reply = pending.nativeReadReply;
+    if (pending.nativeUserMessage) {
+      reply = {
+        rejected: {
+          path: args.path || '',
+          reason: `Read interrupted by a new user instruction: ${pending.nativeUserMessage}`,
+        },
+      };
+    } else if (pending.nativeSnapshot) {
+      pending.nativeSnapshot.delivered = true;
+    }
+    sendExecResult(bridge, exec, resultType, reply);
+    return;
+  }
   if (resultType === 'shellStreamResult') {
     sendShellStream(bridge, exec, text, ok ? 0 : 1);
     return;
@@ -364,6 +470,10 @@ export function sendToolResult(bridge, pending, result, ok) {
     return;
   }
   if (Object.hasOwn(NATIVE_SUCCESS_PAYLOADS, resultType)) {
-    sendExecResult(bridge, exec, resultType, NATIVE_SUCCESS_PAYLOADS[resultType](args, text));
+    const value = NATIVE_SUCCESS_PAYLOADS[resultType](args, text, pending, result);
+    if (resultType === 'writeResult' && Number.isInteger(pending.nativeWrittenBytes)) {
+      value.success.fileSize = pending.nativeWrittenBytes;
+    }
+    sendExecResult(bridge, exec, resultType, value);
   }
 }

package/src/runtime/agent/orchestrator/providers/cursor-wire-protobuf.mjs

@@ -87,7 +87,19 @@ const SCHEMAS = {
     ['clientHeartbeat', 7, 'ClientHeartbeat'],
   ]),
   TextDeltaUpdate: fields([['text', 1, 'string']]),
-  ToolCall: fields([['mcpToolCall', 15, 'McpToolCall']]),
+  ToolCall: fields([
+    ['editToolCall', 12, 'NativeEditToolCall'],
+    ['mcpToolCall', 15, 'McpToolCall'],
+  ]),
+  NativeEditToolCall: fields([['result', 2, 'NativeEditResult']]),
+  NativeEditResult: fields([
+    ['success', 1, 'raw'],
+    ['fileNotFound', 2, 'raw'],
+    ['readPermissionDenied', 3, 'raw'],
+    ['writePermissionDenied', 4, 'raw'],
+    ['rejected', 6, 'raw'],
+    ['error', 7, 'raw'],
+  ]),
   McpToolCall: fields([
     ['args', 1, 'McpArgs'],
     ['result', 2, 'McpResult'],
@@ -422,6 +434,7 @@ const SCHEMAS = {
     ['totalLines', 3, 'int'],
     ['fileSize', 4, 'int'],
     ['truncated', 6, 'bool'],
+    ['rangeApplied', 8, 'bool'],
   ]),
   ReadRejected: fields([
     ['path', 1, 'string'],
@@ -430,7 +443,9 @@ const SCHEMAS = {
   ReadResult: fields([
     ['success', 1, 'ReadSuccess'],
     ['rejected', 3, 'ReadRejected'],
+    ['fileNotFound', 4, 'ReadFileNotFound'],
   ]),
+  ReadFileNotFound: fields([['path', 1, 'string']]),
   WriteSuccess: fields([
     ['path', 1, 'string'],
     ['linesCreated', 2, 'int'],
@@ -440,8 +455,13 @@ const SCHEMAS = {
     ['path', 1, 'string'],
     ['reason', 2, 'string'],
   ]),
+  WriteError: fields([
+    ['path', 1, 'string'],
+    ['error', 2, 'string'],
+  ]),
   WriteResult: fields([
     ['success', 1, 'WriteSuccess'],
+    ['error', 5, 'WriteError'],
     ['rejected', 6, 'WriteRejected'],
   ]),
   DeleteRejected: fields([
@@ -610,7 +630,7 @@ const SCHEMAS = {
   JsonValue: fields([
     ['nullValue', 1, 'int'],
     ['numberValue', 2, 'double'],
-    ['stringValue', 3, 'string'],
+    ['stringValue', 3, 'string', { presence: true }],
     ['boolValue', 4, 'bool'],
     ['structValue', 5, 'JsonStruct'],
     ['listValue', 6, 'JsonList'],
@@ -620,7 +640,8 @@ const SCHEMAS = {
 };
 
 const textEncoder = new TextEncoder();
-const textDecoder = new TextDecoder();
+// A protobuf string is data, not a text document with a disposable BOM.
+const textDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
 
 function concatBytes(parts) {
   const length = parts.reduce((sum, part) => sum + part.length, 0);
@@ -709,7 +730,10 @@ export function encodeMessage(type, value = {}) {
     let values = [fieldValue];
     if (descriptor.repeated) values = Array.isArray(fieldValue) ? fieldValue : [];
     for (const item of values) {
-      if (shouldWrite(descriptor.type, item)) parts.push(encodeField(descriptor.no, descriptor.type, item));
+      // A oneof's explicit empty string is a value, not an absent field.
+      if ((descriptor.presence && item != null) || shouldWrite(descriptor.type, item)) {
+        parts.push(encodeField(descriptor.no, descriptor.type, item));
+      }
     }
   }
   return concatBytes(parts);

package/src/runtime/agent/orchestrator/providers/cursor-wire-request.mjs

@@ -61,7 +61,13 @@ function toolResultEntry(message, text, toolNames) {
   const isError = message.mixdog_tool_error === true;
   const toolName = toolNames.get(toolCallId) || '';
   return {
-    toolResult: { toolCallId, content: text, media, isError },
+    toolResult: {
+      toolCallId,
+      content: text,
+      media,
+      isError,
+      ...(message.mixdog_read_window?.lineClipped === true ? { readWindow: { lineClipped: true } } : {}),
+    },
     entry: {
       role: 'tool',
       id: toolCallId,
@@ -170,9 +176,7 @@ export function buildRequestContext(tools, cloudRule) {
           {
             serverName: 'mixdog',
             instructions:
-              'Use the tools provided by the mixdog MCP server for this task. ' +
-              'Follow their descriptions and input schemas. Prefer them over Cursor native tools; ' +
-              'native tools do not directly access the Mixdog environment. ' +
+              'Do not use Cursor native tools; use only the tools provided by the mixdog MCP server, following their descriptions and declared input schemas. ' +
               'If a needed tool is not available, use the provided tool discovery mechanism rather than inventing a tool.',
           },
         ]

package/src/runtime/agent/orchestrator/providers/cursor-wire-stream-bridge.mjs

@@ -4,6 +4,7 @@
  * close verdict and the bounded in-place restart.
  */
 import {
+  MAX_CONNECT_FRAME_BYTES,
   isCursorAuthError,
   isCursorThrottleError,
   isRetryableCursorStreamError,
@@ -13,6 +14,10 @@ import { emitProviderRetryStage, markProviderRecoveryExhausted, retryAfterMsFrom
 import { createFrameParser, cursorError, parseEndStream } from './cursor-wire-transport.mjs';
 import { processServerMessage } from './cursor-wire-stream-messages.mjs';
 
+// A parked HTTP/2 run can still receive parallel execs. Keep their raw chunks
+// with the transport until the next SSE consumer attaches.
+const parkedInputs = new WeakMap();
+
 // Resolves after `ms`, or early when the stream is cancelled.
 function abortableSleep(ms, signal) {
   return new Promise((resolve) => {
@@ -51,7 +56,9 @@ export function createBridgeController(ctx) {
       modelParameters: run.modelParameters,
       maxMode: run.maxMode,
       sessionId: run.sessionId,
+      ownerSessionId: run.ownerSessionId,
       pending: state.pending,
+      executions: state.executions,
       sawTurnEnded: state.sawTurnEnded,
     });
     sink.finish('tool_calls');
@@ -80,13 +87,11 @@ export function createBridgeController(ctx) {
     const serverDelay = retryAfterMsFromError(error);
     // Server advice is honored in full for every retryable kind; local
     // backoff applies only when the server gave none.
-    const delayMs = Number.isFinite(serverDelay)
-      ? serverDelay
-      : backoffMs(throttled ? throttleCount + 1 : retryCount + 1);
+    const backoffAttempt = (throttled ? throttleCount : retryCount) + 1;
+    const delayMs = Number.isFinite(serverDelay) ? serverDelay : backoffMs(backoffAttempt);
     const throttleOk = throttled && throttleCount < tuning.maxThrottleRetries;
     const authOk = authFailure && authCount < tuning.maxAuthRetries;
-    const canRetry =
-      retryCount < tuning.maxRetries && recoveryEligible && (retryable || throttleOk || authOk);
+    const canRetry = retryCount < tuning.maxRetries && recoveryEligible && (retryable || throttleOk || authOk);
     if (!canRetry) {
       // A fresh Cursor run owns its bounded in-place retries. Mark
       // exhaustion so the outer loop does not multiply that budget.
@@ -96,8 +101,7 @@ export function createBridgeController(ctx) {
       // A throttle that spent its bounded retries is final for the turn too.
       if (
         recoveryEligible &&
-        ((retryable && retryCount >= tuning.maxRetries) ||
-          (throttled && throttleCount >= tuning.maxThrottleRetries))
+        ((retryable && retryCount >= tuning.maxRetries) || (throttled && throttleCount >= tuning.maxThrottleRetries))
       ) {
         markProviderRecoveryExhausted(error, { owner: 'cursor-wire', attempts: retryCount + 1 });
       }
@@ -118,6 +122,9 @@ export function createBridgeController(ctx) {
       lastErr: error,
       delayMs,
     });
+    let restartReason = 'transient';
+    if (throttled) restartReason = 'throttle';
+    else if (authFailure) restartReason = 'auth';
     void sleep(delayMs, cancelSignal).then(async () => {
       if (isCancelled() || state.closed) return;
       try {
@@ -126,7 +133,7 @@ export function createBridgeController(ctx) {
           attempt: retryCount,
           fromCheckpoint: !throttled && Boolean(run.conversation.checkpoint),
           visibleOutput: state.visibleOutput,
-          reason: throttled ? 'throttle' : authFailure ? 'auth' : 'transient',
+          reason: restartReason,
           error,
         });
         if (isCancelled() || state.closed) {
@@ -200,6 +207,11 @@ export function createBridgeController(ctx) {
   const attach = (ownedBridge, nextHeartbeat) => {
     live.bridge = ownedBridge;
     live.heartbeat = nextHeartbeat;
+    let inbox = parkedInputs.get(ownedBridge);
+    if (!inbox) {
+      inbox = { chunks: [], bytes: 0 };
+      parkedInputs.set(ownedBridge, inbox);
+    }
     const messageCtx = {
       state,
       filter,
@@ -208,14 +220,26 @@ export function createBridgeController(ctx) {
       tools: run.tools,
       cloudRule: run.cloudRule,
       sessionId: run.sessionId,
+      ownerSessionId: run.ownerSessionId,
     };
     const frameParser = createFrameParser(
       // Server requests answer on whichever bridge is live when they arrive.
       (bytes) => watchdog.progress(processServerMessage(bytes, { ...messageCtx, bridge: live.bridge })),
       (bytes) => onEndStream(ownedBridge, bytes)
     );
-    ownedBridge.onData((chunk) => {
-      if (live.bridge !== ownedBridge || state.closed) return;
+    const receive = (chunk) => {
+      if (live.bridge !== ownedBridge || isCancelled()) return;
+      if (state.closed) {
+        if (inbox.bytes + chunk.byteLength > MAX_CONNECT_FRAME_BYTES) {
+          ownedBridge.close(
+            cursorError('Cursor parked input exceeds the buffer limit', { code: 'stream_buffer_limit' })
+          );
+          return;
+        }
+        inbox.chunks.push(chunk);
+        inbox.bytes += chunk.byteLength;
+        return;
+      }
       state.chunkSeq += 1;
       try {
         frameParser(chunk);
@@ -227,9 +251,15 @@ export function createBridgeController(ctx) {
       } catch (error) {
         ownedBridge.close(error);
       }
-    });
+    };
+    ownedBridge.onData(receive);
     ownedBridge.onClose((error) => onBridgeClose(ownedBridge, nextHeartbeat, frameParser, error));
     watchdog.start();
+    while (!state.closed && !isCancelled() && inbox.chunks.length) {
+      const chunk = inbox.chunks.shift();
+      inbox.bytes -= chunk.byteLength;
+      receive(chunk);
+    }
   };
 
   return { attach };