mixdog 1.2.3 → 1.2.5

package/src/runtime/agent/orchestrator/providers/antigravity-transport.mjs

@@ -6,15 +6,22 @@
  * account-verification URL Google hides in the error details), and the
  * per-attempt hand-off of the live stream to the turn collector.
  */
-import { emitProviderRetryStage, markProviderRecoveryExhausted, sleepWithAbort, withRetry } from './retry-classifier.mjs';
+import {
+  emitProviderRetryStage,
+  markProviderRecoveryExhausted,
+  sleepWithAbort,
+  withRetry,
+} from './retry-classifier.mjs';
 import {
   ANTIGRAVITY_RETRY,
+  ANTIGRAVITY_UNCLASSED_FIRST_BYTE,
   antigravity429WaitMs,
   isAntigravityCapacityError,
 } from './antigravity-retry-policy.mjs';
-import { createTimeoutSignal } from '../stall-policy.mjs';
+import { createTimeoutSignal, firstByteWindowMs } from '../stall-policy.mjs';
+import { MODEL_THINKING_STAGE } from '../../../shared/quiet-progress.mjs';
+import { TIMEOUT_PHASE, isFirstByteTimeout } from '../../../shared/provider-timeout-phase.mjs';
 import { getLlmDispatcher } from '../../../shared/llm/http-agent.mjs';
-import { GEMINI_FIRST_BYTE_TIMEOUT_MS } from './gemini-stream.mjs';
 import { _scrubTokens } from './antigravity-oauth-tokens.mjs';
 import { applyGeminiErrorContract } from './gemini-error-contract.mjs';
 import { DETERMINISTIC_KINDS, providerErrorKind } from './provider-error-kind.mjs';
@@ -77,8 +84,10 @@ export function antigravityError(res, text, endpoint) {
     .map((link) => link?.url)
     .find((url) => typeof url === 'string' && url.length > 0);
   const metadataUrl = (key) =>
-    detailEntries.find((entry) => entry?.reason === 'VALIDATION_REQUIRED' && typeof entry.metadata?.[key] === 'string' && entry.metadata[key])
-      ?.metadata[key];
+    detailEntries.find(
+      (entry) =>
+        entry?.reason === 'VALIDATION_REQUIRED' && typeof entry.metadata?.[key] === 'string' && entry.metadata[key]
+    )?.metadata[key];
   const validationUrl =
     helpUrl ||
     metadataUrl('validation_url') ||
@@ -105,19 +114,53 @@ export function antigravityError(res, text, endpoint) {
  * @param {object} deps.opts  send options (stage heartbeat)
  * @param {AbortSignal|null} deps.signal  retry-loop signal (session pass-through)
  * @param {{ beginAttempt: Function, consume: Function }} deps.collector
+ * @param {{ timeoutMs: number, maxMs: number, retries: number|null }} [deps.firstByte]
+ *   first-byte window per attempt (antigravityFirstBytePolicy)
  * @returns {() => Promise<object>} one retried request that resolves the final payload
  */
-export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opts, signal, collector, sleepFn }) {
+export function createAntigravityRequest({
+  fetchFn,
+  endpoint,
+  headers,
+  body,
+  opts,
+  signal,
+  collector,
+  sleepFn,
+  firstByte = ANTIGRAVITY_UNCLASSED_FIRST_BYTE,
+}) {
   const log = (attempt, lastErr, delayMs) => {
+    // A first-byte timeout runs on its own, shorter retry budget.
+    const firstByteLimited = isFirstByteTimeout(lastErr) && firstByte.retries != null;
     emitProviderRetryStage(opts.onStageChange, {
       attempt: attempt + 1,
-      maxAttempts: ANTIGRAVITY_RETRY.maxAttempts,
+      maxAttempts: firstByteLimited
+        ? Math.min(ANTIGRAVITY_RETRY.maxAttempts, firstByte.retries + 1)
+        : ANTIGRAVITY_RETRY.maxAttempts,
       lastErr,
       delayMs,
     });
     process.stderr.write(`[antigravity] retry ${attempt + 1} after ${lastErr?.message || 'transient error'}\n`);
   };
-  const attemptOnce = () =>
+  // Stamps what the attempt tells the user: how many attempts ran and, for a
+  // first-byte timeout, how long the model was given in total. A timeout past
+  // the first-byte retry budget ends the ladder here. A caller's cancellation
+  // reason may be shared by other requests and is never stamped.
+  const noteFailure = (err, { attemptSignal, windowMs, send }) => {
+    if (!err || typeof err !== 'object' || attemptSignal?.aborted) return err;
+    send.attempts += 1;
+    err.attempts = send.attempts;
+    if (!isFirstByteTimeout(err)) return err;
+    send.firstByteTimeouts += 1;
+    send.firstByteWaitedMs += windowMs;
+    err.waitedMs = send.firstByteWaitedMs;
+    err.providerLabel = 'Antigravity';
+    if (firstByte.retries != null && send.firstByteTimeouts > firstByte.retries) {
+      markProviderRecoveryExhausted(err, { owner: 'antigravity-first-byte', attempts: send.attempts, terminal: true });
+    }
+    return err;
+  };
+  const attemptOnce = (send) =>
     withRetry(
       async ({ signal: attemptSignal }) => {
         try {
@@ -125,37 +168,63 @@ export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opt
         } catch {
           /* heartbeat */
         }
-        const firstByte = createTimeoutSignal(attemptSignal, GEMINI_FIRST_BYTE_TIMEOUT_MS, 'Antigravity first byte');
-        let res;
+        const windowMs = firstByteWindowMs(firstByte, send.firstByteTimeouts);
         try {
-          res = await fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
-            method: 'POST',
-            headers,
-            body,
-            signal: firstByte.signal,
-            dispatcher: getLlmDispatcher(),
-          });
-        } catch (err) {
-          // Fetch surfaces AbortError; rethrow the timer/parent
-          // reason so same-host retry sees EPROVIDERTIMEOUT and
-          // a caller cancel stays a cancel.
-          if (firstByte.signal.aborted && firstByte.signal.reason instanceof Error) {
-            throw firstByte.signal.reason;
+          const firstByteTimer = createTimeoutSignal(attemptSignal, windowMs, 'Antigravity first byte');
+          let res;
+          try {
+            const response = fetchFn(`${endpoint}/v1internal:streamGenerateContent?alt=sse`, {
+              method: 'POST',
+              headers,
+              body,
+              signal: firstByteTimer.signal,
+              dispatcher: getLlmDispatcher(),
+            });
+            // The request is on the wire and its headers are pending: the
+            // gateway sends them only with the first chunk, so this wait is
+            // the model's queueing and thinking time.
+            try {
+              opts.onStageChange?.(MODEL_THINKING_STAGE);
+            } catch {
+              /* heartbeat */
+            }
+            res = await response;
+          } catch (err) {
+            // Fetch surfaces AbortError; rethrow the timer/parent
+            // reason so same-host retry sees EPROVIDERTIMEOUT and
+            // a caller cancel stays a cancel.
+            if (firstByteTimer.signal.aborted && firstByteTimer.signal.reason instanceof Error) {
+              const reason = firstByteTimer.signal.reason;
+              if (!attemptSignal?.aborted) reason.timeoutPhase = TIMEOUT_PHASE.HEADERS;
+              throw reason;
+            }
+            throw err;
+          } finally {
+            firstByteTimer.cleanup();
           }
-          throw err;
-        } finally {
-          firstByte.cleanup();
-        }
-        if (!res.ok) {
-          const text = await res.text().catch(() => '');
-          const failure = antigravityError(res, text, endpoint);
-          // Capacity is paced by the local schedule below; the generic loop
-          // would sleep whatever wait the server names.
-          if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
-          throw failure;
+          // Headers arrived: the connection is live even while the model
+          // has not produced its first chunk.
+          try {
+            opts.onStreamDelta?.('transport');
+          } catch {}
+          if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            const failure = antigravityError(res, text, endpoint);
+            // Capacity is paced by the local schedule below; the generic loop
+            // would sleep whatever wait the server names.
+            if (isCapacityFailure(failure)) markProviderRecoveryExhausted(failure, { owner: 'antigravity-capacity' });
+            throw failure;
+          }
+          try {
+            opts.onStageChange?.('streaming');
+          } catch {
+            /* heartbeat */
+          }
+          collector.beginAttempt();
+          return await collector.consume(res, attemptSignal, { firstByteTimeoutMs: windowMs });
+        } catch (err) {
+          throw noteFailure(err, { attemptSignal, windowMs, send });
         }
-        collector.beginAttempt();
-        return collector.consume(res, attemptSignal);
       },
       {
         ...ANTIGRAVITY_RETRY,
@@ -170,9 +239,10 @@ export function createAntigravityRequest({ fetchFn, endpoint, headers, body, opt
   // gets one quick retry, a spent quota surfaces.
   return async () => {
     const state = { capacityRetries: 0, quickRetried: false };
+    const send = { attempts: 0, firstByteTimeouts: 0, firstByteWaitedMs: 0 };
     for (let tried = 1; ; tried++) {
       try {
-        return await attemptOnce();
+        return await attemptOnce(send);
       } catch (err) {
         const waitMs = antigravity429WaitMs(err, state);
         if (waitMs == null) {

package/src/runtime/agent/orchestrator/providers/command-code-oauth.mjs

@@ -79,7 +79,10 @@ export function modelEndpoints(item) {
 // The route for a model with these declared endpoints (null: undeclared, Chat).
 // `undefined`: nothing describes the model, so no wire is ruled out.
 function commandCodeRoute(model, endpoints, ctx = {}) {
-  return resolveWireRoute(PROVIDER_ID, model, { ...ctx, endpoints: endpoints === undefined ? null : (endpoints ?? ['chat']) });
+  return resolveWireRoute(PROVIDER_ID, model, {
+    ...ctx,
+    endpoints: endpoints === undefined ? null : (endpoints ?? ['chat']),
+  });
 }
 
 /**

package/src/runtime/agent/orchestrator/providers/cursor-auth.mjs

@@ -366,7 +366,9 @@ export async function resolveCursorOAuthAccessToken({ forceRefresh = false, fetc
               try {
                 saveCredentials({ ...persisted, reauth_required: true });
               } catch (saveError) {
-                process.stderr.write(`[cursor-oauth] dead-account mark failed: ${String(saveError?.message || saveError).slice(0, 200)}\n`);
+                process.stderr.write(
+                  `[cursor-oauth] dead-account mark failed: ${String(saveError?.message || saveError).slice(0, 200)}\n`
+                );
               }
             }
           }

package/src/runtime/agent/orchestrator/providers/cursor-client-version.mjs

@@ -4,7 +4,7 @@ import { createRemoteVersionSource } from './npm-cli-version.mjs';
 // documented version endpoint; the official installer script embeds the
 // current build (…/lab/<build>/…), parsed best-effort. Any format change or
 // failure falls back to the floor.
-export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.14-941492e';
+export const CURSOR_CLIENT_VERSION_FLOOR = 'cli-2026.10.16-e3cb207';
 const BUILD_PATTERN = /downloads\.cursor\.com\/lab\/(\d{4}\.\d{2}\.\d{2}-[0-9a-f]{6,40})\//;
 export const CURSOR_INSTALL_URL = 'https://cursor.com/install';
 

package/src/runtime/agent/orchestrator/providers/cursor-native-context.mjs

@@ -0,0 +1,48 @@
+import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+
+const PREFIX = 'cursor_native_';
+const pendingCalls = new Map();
+const AUTHORIZATION_MS = 10 * 60 * 1000;
+
+export function isCursorNativeCallId(id) {
+  return typeof id === 'string' && id.startsWith(PREFIX);
+}
+
+// Registered before streaming the call, including when a later frame is partial.
+// Model arguments never grant this capability.
+export function registerCursorNativeCall(ownerSessionId, pending, executions) {
+  if (!ownerSessionId || !pending.native) return;
+  if (pending.toolName !== 'read' && pending.toolName !== 'edit') return;
+  if (!['readResult', 'writeResult'].includes(pending.native.resultType)) return;
+  const now = Date.now();
+  for (const [id, entry] of pendingCalls) {
+    if (entry.expiresAt <= now) pendingCalls.delete(id);
+  }
+  if (pendingCalls.size >= 4096) throw new Error('Cursor native execution authorization capacity exceeded');
+  pending.toolCallId = `${PREFIX}${randomUUID()}`;
+  const entry = {
+    ownerSessionId,
+    pending,
+    executions,
+    expiresAt: now + AUTHORIZATION_MS,
+    arguments: JSON.parse(pending.decodedArgs),
+  };
+  pendingCalls.set(pending.toolCallId, entry);
+}
+
+export function cursorNativeCall(ownerSessionId, id, name, args) {
+  if (!isCursorNativeCallId(id)) return null;
+  const entry = pendingCalls.get(id);
+  if (!entry) throw new Error('Cursor native execution authorization is missing');
+  if (entry.expiresAt <= Date.now()) throw new Error('Cursor native execution authorization expired');
+  if (entry.ownerSessionId !== ownerSessionId) throw new Error('Cursor native execution authorization owner mismatch');
+  if (entry.pending.toolName !== name) throw new Error('Cursor native execution authorization tool mismatch');
+  if (!isDeepStrictEqual(entry.arguments, args))
+    throw new Error('Cursor native execution authorization argument mismatch');
+  return entry;
+}
+
+export function releaseCursorNativeCall(pending) {
+  pendingCalls.delete(pending.toolCallId);
+}

package/src/runtime/agent/orchestrator/providers/cursor-wire-exec.mjs

@@ -1,11 +1,28 @@
 // Cursor exec/kv message handling: routing native exec requests to local
 // tools and sending results back on the bridge.
 import crypto from 'node:crypto';
+import { BRIDGE_NAME_MAX_CHARS, isBridgeMetaTool } from '../runtime-core/tool-bridge-contract.mjs';
+import { releaseCursorNativeCall } from './cursor-native-context.mjs';
 import { decodeJsonValue, encodeMessage } from './cursor-wire-protobuf.mjs';
 import { capCursorToolResult, storeCursorBlob } from './cursor-wire-guards.mjs';
 import { buildCursorExecThrow } from './cursor-wire-interactions.mjs';
 import { connectFrame, textDecoder, textEncoder } from './cursor-wire-transport.mjs';
 import { buildRequestContext } from './cursor-wire-request.mjs';
+import { readSourceWindow } from '../../../shared/read-row-numbers.mjs';
+import { splitGrepLineNumberOnlyPrefix, splitGrepCountPrefix } from '../tools/builtin/grep-formatting.mjs';
+
+const nativeWriteDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+
+function nativeWriteText(args) {
+  if (!args.fileBytes?.length) return args.fileText || '';
+  try {
+    return nativeWriteDecoder.decode(args.fileBytes);
+  } catch {
+    throw Object.assign(new Error('Native Write fileBytes must be valid UTF-8; no file was written'), {
+      code: 'CURSOR_WRITE_ENCODING',
+    });
+  }
+}
 
 export function heartbeatFrame() {
   return connectFrame(encodeMessage('AgentClientMessage', { clientHeartbeat: {} }));
@@ -70,12 +87,15 @@ const NATIVE_EXEC_CASES = [
   ],
   [
     'writeArgs',
-    ['write'],
+    // Only the guarded edit tool: it creates missing files and fills empty
+    // ones, while its executor rejects overwrites of non-empty files. An
+    // explicit write tool would overwrite without any native capability
+    // (remote/proxied calls), so it never serves a native Write.
+    ['edit'],
     (tool, args) => ({
       [argumentName(tool, ['file_path', 'filePath', 'path'], 'file_path')]: args.path || '',
-      [argumentName(tool, ['content', 'file_text', 'text'], 'content')]: args.fileBytes?.length
-        ? textDecoder.decode(args.fileBytes)
-        : args.fileText || '',
+      old_string: '',
+      new_string: nativeWriteText(args),
     }),
     'writeResult',
   ],
@@ -90,7 +110,9 @@ const NATIVE_EXEC_CASES = [
       pattern: args.pattern || '.',
       ...(args.path ? { path: args.path } : {}),
       ...(args.glob ? { glob: args.glob } : {}),
-      mode: args.outputMode || 'content',
+      mode: args.outputMode === 'files_with_matches' ? 'files' : args.outputMode || 'content',
+      context: 0,
+      ...(args.headLimit > 0 ? { limit: args.headLimit } : {}),
     }),
     'grepResult',
   ],
@@ -130,6 +152,16 @@ const rejectedPath = (args) => ({ rejected: { path: args.path || '', reason: UNA
 const rejectedShell = (args) => ({
   rejected: { command: args.command || '', workingDirectory: args.workingDirectory || '', reason: UNAVAILABLE },
 });
+const rejectedBackgroundShell = (args) => ({
+  rejected: {
+    command: args.command || '',
+    workingDirectory: args.workingDirectory || '',
+    reason:
+      'Cursor background shell is not supported. Use the mixdog MCP shell tool with {"command":"..."}; ' +
+      'if it returns task_id, use the mixdog task tool with {"action":"wait","task_id":"<returned id>"}. ' +
+      'Use load_tool {"names":"task"} if task is not loaded.',
+  },
+});
 const unavailableError = () => ({ error: { error: UNAVAILABLE } });
 
 // Native exec cases with no Mixdog tool behind them: [exec key, exec result
@@ -143,7 +175,7 @@ const UNAVAILABLE_EXEC_RESULTS = [
   ['fetchArgs', 'fetchResult', (args) => ({ error: { url: args.url || '', error: UNAVAILABLE } })],
   ['shellArgs', 'shellResult', rejectedShell],
   ['shellStreamArgs', 'shellResult', rejectedShell],
-  ['backgroundShellSpawnArgs', 'backgroundShellSpawnResult', rejectedShell],
+  ['backgroundShellSpawnArgs', 'backgroundShellSpawnResult', rejectedBackgroundShell],
   ['writeShellStdinArgs', 'writeShellStdinResult', unavailableError],
   ['diagnosticsArgs', 'diagnosticsResult', () => ({})],
 ];
@@ -163,18 +195,44 @@ function rejectUnavailableExec(bridge, exec) {
 function handleMcpExec(bridge, exec, tools, onToolCall) {
   const args = exec.mcpArgs;
   const requestedName = args.toolName || args.name;
-  const tool = toolByNames(tools, [requestedName]);
+  const directTool = toolByNames(tools, [requestedName]);
+  // Only the bridge granted in this request can resolve a deferred name.
+  // The ordinary runtime still projects the target and enforces its policy.
+  let tool =
+    directTool ||
+    (typeof requestedName === 'string' && requestedName.length > 0 ? toolByNames(tools, ['call_tool']) : null);
   if (!tool) {
     sendExecResult(bridge, exec, 'mcpResult', {
       error: { error: `Tool not available: ${requestedName || 'unknown'}` },
     });
     return;
   }
+  let decodedArgs = decodeMcpArgs(args.args);
+  if (
+    requestedName === 'call_tool' &&
+    directTool &&
+    Object.keys(decodedArgs).length === 2 &&
+    Object.hasOwn(decodedArgs, 'name') &&
+    Object.hasOwn(decodedArgs, 'arguments') &&
+    typeof decodedArgs.name === 'string' &&
+    decodedArgs.name.length > 0 &&
+    decodedArgs.name.length <= BRIDGE_NAME_MAX_CHARS &&
+    !isBridgeMetaTool(decodedArgs.name) &&
+    decodedArgs.arguments !== null &&
+    typeof decodedArgs.arguments === 'object' &&
+    !Array.isArray(decodedArgs.arguments)
+  ) {
+    const target = toolByNames(tools, [decodedArgs.name]);
+    if (target) {
+      tool = target;
+      decodedArgs = decodedArgs.arguments;
+    }
+  }
   onToolCall({
     exec,
     toolCallId: args.toolCallId || crypto.randomUUID(),
     toolName: tool.name,
-    decodedArgs: JSON.stringify(decodeMcpArgs(args.args)),
+    decodedArgs: JSON.stringify(directTool ? decodedArgs : { name: requestedName, arguments: decodedArgs }),
   });
 }
 
@@ -191,7 +249,14 @@ export function handleExecMessage(bridge, exec, tools, cloudRule, onToolCall) {
     handleMcpExec(bridge, exec, tools, onToolCall);
     return;
   }
-  const redirect = redirectNativeExec(exec, tools);
+  let redirect;
+  try {
+    redirect = redirectNativeExec(exec, tools);
+  } catch (error) {
+    if (error.code !== 'CURSOR_WRITE_ENCODING') throw error;
+    sendExecResult(bridge, exec, 'writeResult', { error: { path: exec.writeArgs.path || '', error: error.message } });
+    return;
+  }
   if (redirect) {
     onToolCall(redirect);
     return;
@@ -227,31 +292,41 @@ function parseListedPaths(text, rootPath) {
 
 function parseGrepResult(text, args) {
   const mode = args.outputMode || 'content';
+  const lines = text.split(/\r?\n/).filter((line) => line && !line.startsWith('[total ') && !line.startsWith('... ['));
   if (mode === 'files_with_matches') {
-    const files = text
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter(Boolean);
+    const files = lines.map((line) => line.trim()).filter((line) => !line.startsWith('(no matches)'));
     return { files: { files, totalFiles: files.length } };
   }
   if (mode === 'count') {
     const counts = [];
     let totalMatches = 0;
-    for (const line of text.split(/\r?\n/)) {
-      const match = line.match(/^(.*):(\d+)$/);
-      if (!match) continue;
-      const count = Number(match[2]);
-      counts.push({ file: match[1], count });
+    for (const line of lines) {
+      const parsed = splitGrepCountPrefix(line);
+      if (!parsed && !/^\d+$/.test(line)) continue;
+      const count = parsed ? parsed.count : Number(line);
+      counts.push({ file: parsed?.path || args.path, count });
       totalMatches += count;
     }
     return { count: { counts, totalFiles: counts.length, totalMatches } };
   }
   const byFile = new Map();
-  for (const line of text.split(/\r?\n/)) {
-    const match = line.match(/^(.+?):(\d+):(.*)$/);
-    if (!match) continue;
-    if (!byFile.has(match[1])) byFile.set(match[1], []);
-    byFile.get(match[1]).push({ lineNumber: Number(match[2]), content: match[3] });
+  let currentFile = args.path;
+  for (const line of lines) {
+    const grouped = /^ {2}(\d+): (.*)$/.exec(line);
+    // Native searches request no context: only :N: is a line delimiter.
+    // A -N- segment may be part of the filename, not a context-line prefix.
+    const match = grouped ? null : /^(.+?):(\d+):/.exec(line);
+    const prefix = match ? { path: match[1], lineNo: Number(match[2]), markerEnd: match[0].length } : null;
+    const single = grouped || prefix ? null : splitGrepLineNumberOnlyPrefix(line);
+    if (!grouped && !prefix && !single) {
+      currentFile = line.replace(/ \(\d+ hits\)$/, '');
+      continue;
+    }
+    const file = prefix?.path || currentFile;
+    const lineNumber = grouped ? Number(grouped[1]) : (prefix || single).lineNo;
+    const content = grouped ? grouped[2] : line.slice((prefix || single).markerEnd);
+    if (!byFile.has(file)) byFile.set(file, []);
+    byFile.get(file).push({ lineNumber, content });
   }
   const matches = [...byFile].map(([file, fileMatches]) => ({ file, matches: fileMatches }));
   const matchedLines = matches.reduce((sum, entry) => sum + entry.matches.length, 0);
@@ -290,7 +365,7 @@ function sendShellStream(bridge, exec, text, code) {
 // rejected shell command.
 const NATIVE_FAILURE_PAYLOADS = {
   readResult: (args, text) => ({ rejected: { path: args.path || '', reason: text || 'Read failed' } }),
-  writeResult: (args, text) => ({ rejected: { path: args.path || '', reason: text || 'Write failed' } }),
+  writeResult: (args, text) => ({ error: { path: args.path || '', error: text || 'Write failed' } }),
   fetchResult: (args, text) => ({ error: { url: args.url || '', error: text || 'Fetch failed' } }),
   lsResult: (args, text) => ({ rejected: { path: args.path || '', reason: text || 'List failed' } }),
   grepResult: (_args, text) => ({ error: { error: text || 'Grep failed' } }),
@@ -304,16 +379,30 @@ const NATIVE_FAILURE_PAYLOADS = {
 };
 
 const NATIVE_SUCCESS_PAYLOADS = {
-  readResult: (args, text) => ({
-    success: {
-      path: args.path || '',
-      content: text,
-      totalLines: text ? text.split(/\r?\n/).length : 0,
-      fileSize: textEncoder.encode(text).length,
-    },
-  }),
+  readResult: (args, text, pending, result) => {
+    const source = readSourceWindow(text);
+    // The read executor reports per-line clipping out of band: on the
+    // pending call (local) or on the result (remote/proxied).
+    if (!source || pending.nativeReadWindow?.lineClipped || result?.readWindow?.lineClipped)
+      return {
+        rejected: {
+          path: args.path || '',
+          reason:
+            'This read result is not a complete contiguous source window. Use the mixdog MCP read tool with file_path, offset and limit; do not treat display markers as file content.',
+        },
+      };
+    return {
+      success: {
+        path: args.path || '',
+        content: source.content,
+        ...(source.totalLines === undefined ? {} : { totalLines: source.totalLines }),
+        truncated: source.truncated,
+        rangeApplied: Boolean(args.offset || args.limit || (source.startLine != null && source.startLine > 1)),
+      },
+    };
+  },
   writeResult: (args) => {
-    const content = args.fileBytes?.length ? textDecoder.decode(args.fileBytes) : args.fileText || '';
+    const content = nativeWriteText(args);
     return {
       success: {
         path: args.path || '',
@@ -345,7 +434,9 @@ const NATIVE_SUCCESS_PAYLOADS = {
 };
 
 export function sendToolResult(bridge, pending, result, ok) {
+  releaseCursorNativeCall(pending);
   result = capCursorToolResult(result);
+  pending.completedResult = { result, ok };
   const { exec, native } = pending;
   const text = String(result?.content ?? '');
   const media = Array.isArray(result?.media) ? result.media : [];
@@ -354,6 +445,21 @@ export function sendToolResult(bridge, pending, result, ok) {
     return;
   }
   const { args, resultType } = native;
+  if (ok && resultType === 'readResult' && pending.nativeReadReply) {
+    let reply = pending.nativeReadReply;
+    if (pending.nativeUserMessage) {
+      reply = {
+        rejected: {
+          path: args.path || '',
+          reason: `Read interrupted by a new user instruction: ${pending.nativeUserMessage}`,
+        },
+      };
+    } else if (pending.nativeSnapshot) {
+      pending.nativeSnapshot.delivered = true;
+    }
+    sendExecResult(bridge, exec, resultType, reply);
+    return;
+  }
   if (resultType === 'shellStreamResult') {
     sendShellStream(bridge, exec, text, ok ? 0 : 1);
     return;
@@ -364,6 +470,10 @@ export function sendToolResult(bridge, pending, result, ok) {
     return;
   }
   if (Object.hasOwn(NATIVE_SUCCESS_PAYLOADS, resultType)) {
-    sendExecResult(bridge, exec, resultType, NATIVE_SUCCESS_PAYLOADS[resultType](args, text));
+    const value = NATIVE_SUCCESS_PAYLOADS[resultType](args, text, pending, result);
+    if (resultType === 'writeResult' && Number.isInteger(pending.nativeWrittenBytes)) {
+      value.success.fileSize = pending.nativeWrittenBytes;
+    }
+    sendExecResult(bridge, exec, resultType, value);
   }
 }

package/src/runtime/agent/orchestrator/providers/cursor-wire-protobuf.mjs

@@ -87,7 +87,19 @@ const SCHEMAS = {
     ['clientHeartbeat', 7, 'ClientHeartbeat'],
   ]),
   TextDeltaUpdate: fields([['text', 1, 'string']]),
-  ToolCall: fields([['mcpToolCall', 15, 'McpToolCall']]),
+  ToolCall: fields([
+    ['editToolCall', 12, 'NativeEditToolCall'],
+    ['mcpToolCall', 15, 'McpToolCall'],
+  ]),
+  NativeEditToolCall: fields([['result', 2, 'NativeEditResult']]),
+  NativeEditResult: fields([
+    ['success', 1, 'raw'],
+    ['fileNotFound', 2, 'raw'],
+    ['readPermissionDenied', 3, 'raw'],
+    ['writePermissionDenied', 4, 'raw'],
+    ['rejected', 6, 'raw'],
+    ['error', 7, 'raw'],
+  ]),
   McpToolCall: fields([
     ['args', 1, 'McpArgs'],
     ['result', 2, 'McpResult'],
@@ -422,6 +434,7 @@ const SCHEMAS = {
     ['totalLines', 3, 'int'],
     ['fileSize', 4, 'int'],
     ['truncated', 6, 'bool'],
+    ['rangeApplied', 8, 'bool'],
   ]),
   ReadRejected: fields([
     ['path', 1, 'string'],
@@ -430,7 +443,9 @@ const SCHEMAS = {
   ReadResult: fields([
     ['success', 1, 'ReadSuccess'],
     ['rejected', 3, 'ReadRejected'],
+    ['fileNotFound', 4, 'ReadFileNotFound'],
   ]),
+  ReadFileNotFound: fields([['path', 1, 'string']]),
   WriteSuccess: fields([
     ['path', 1, 'string'],
     ['linesCreated', 2, 'int'],
@@ -440,8 +455,13 @@ const SCHEMAS = {
     ['path', 1, 'string'],
     ['reason', 2, 'string'],
   ]),
+  WriteError: fields([
+    ['path', 1, 'string'],
+    ['error', 2, 'string'],
+  ]),
   WriteResult: fields([
     ['success', 1, 'WriteSuccess'],
+    ['error', 5, 'WriteError'],
     ['rejected', 6, 'WriteRejected'],
   ]),
   DeleteRejected: fields([
@@ -610,7 +630,7 @@ const SCHEMAS = {
   JsonValue: fields([
     ['nullValue', 1, 'int'],
     ['numberValue', 2, 'double'],
-    ['stringValue', 3, 'string'],
+    ['stringValue', 3, 'string', { presence: true }],
     ['boolValue', 4, 'bool'],
     ['structValue', 5, 'JsonStruct'],
     ['listValue', 6, 'JsonList'],
@@ -620,7 +640,8 @@ const SCHEMAS = {
 };
 
 const textEncoder = new TextEncoder();
-const textDecoder = new TextDecoder();
+// A protobuf string is data, not a text document with a disposable BOM.
+const textDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
 
 function concatBytes(parts) {
   const length = parts.reduce((sum, part) => sum + part.length, 0);
@@ -709,7 +730,10 @@ export function encodeMessage(type, value = {}) {
     let values = [fieldValue];
     if (descriptor.repeated) values = Array.isArray(fieldValue) ? fieldValue : [];
     for (const item of values) {
-      if (shouldWrite(descriptor.type, item)) parts.push(encodeField(descriptor.no, descriptor.type, item));
+      // A oneof's explicit empty string is a value, not an absent field.
+      if ((descriptor.presence && item != null) || shouldWrite(descriptor.type, item)) {
+        parts.push(encodeField(descriptor.no, descriptor.type, item));
+      }
     }
   }
   return concatBytes(parts);