pi-cursor-sdk 0.3.7 → 0.3.8

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.3.8 - 2026-09-19
+
+### Fixed
+
+- Narrow SDK replay and MCP bridge arguments to JSON objects before emitting Pi tool calls, preserving valid payloads without serialization or casts. This supports Pi's tightened transcript types and reports non-JSON arguments before dispatch.
+- Compile source and test fixtures against published Pi 0.85.1, pinned official source, and the fork. Native packed-host checks require common provider, replay, and runtime behavior on every host. The fork additionally qualifies legacy `SystemMessage.replace` checkpoints; current official Pi removed that host feature, which is not required by this extension.
+- Load the already-shipped TypeScript source graph through Pi's native loader so provider streams and replay helpers remain host-owned even with local Pi peer packages installed. Keep compiled output for scripts and programmatic consumers.
+- Preserve hyperlink text and split terminal control sequences when checking platform-smoke read cards, using Node's terminal-control stripping rather than a custom regular expression.
+
+### Changed
+
+- Native source loading fixes host peer identity at the cost of more initial startup/load work. On macOS/Node 24.21.0/Pi fork `90e6`, three fresh-process, warm-cache loader runs measured 0.85–1.24 s for source versus 0.08–0.13 s for dist; these are not TUI startup timings or guarantees for other environments or repeated `/reload`.
+- **Filter migration required:** update old dist-targeting extension filters to preserve include/exclude intent (`+dist/index.js` → `+src/index.ts`, `-dist/index.js` → `-src/index.ts`, `!dist/**` → `!src/**`). The old exclusion alone no longer disables Cursor; retain `-dist/index.js` alongside `-src/index.ts` for rollback. See README's “Existing extension filters”; settings are not rewritten automatically.
+
 ## 0.3.7 - 2026-09-16
 
 ### Fixed

package/README.md

@@ -70,6 +70,15 @@ Alternative GitHub install:
 pi install https://github.com/fitchmultz/pi-cursor-sdk
 ```
 
+### Existing extension filters
+
+The Pi entrypoint is now `src/index.ts`. Update any filters in this package's `extensions` setting that target the old `dist/` entry, preserving their include/exclude intent:
+
+- Exact filters: `+dist/index.js` → `+src/index.ts`; `-dist/index.js` → `-src/index.ts`.
+- Glob filters: for example, `dist/**` → `src/**` and `!dist/**` → `!src/**`. Adjust other old-dist patterns to match the new entrypoint with the same intent.
+
+To keep Cursor disabled across upgrades and rollback, retain `-dist/index.js` and add `-src/index.ts`; the old exclusion alone no longer disables Cursor. The package does not rewrite user or project settings.
+
 ### Project-local install
 
 Use `-l` if you want the package recorded in the current project's `.pi/settings.json` instead of your global pi settings:
@@ -91,11 +100,13 @@ Without `--approve`, the project-local extension still runs after Pi trusts the
 For development from this repository:
 
 ```bash
-npm install   # runs prepare, which compiles src/ into dist/ (the manifest entry pi loads)
+npm install   # runs prepare to build dist/ for scripts and programmatic consumers
 pi --approve -e . --model cursor/grok-4.6
 ```
 
-After editing `src/`, run `npm run build` before the next `pi -e .` run, or pi loads the previous build.
+Pi loads the packaged `src/index.ts` graph through its native TypeScript loader. This keeps Pi imports bound to the running host even when another Pi version is installed alongside the extension. `dist/` remains shipped for scripts and programmatic consumers. After editing `src/`, run `npm run build` for validation and compiled consumers, then restart Pi.
+
+The host-identity fix adds initial startup/load work: three fresh-process loader measurements on macOS with Node 24.21.0, Pi fork `90e6`, a warm Jiti disk cache, and network denied took 0.85–1.24 s for source versus 0.08–0.13 s for dist. These are environment-specific loader timings, not full TUI startup measurements or timing guarantees. That host caches extension factories for the same cwd; the initial-load cost does not describe every in-process `/reload`.
 
 ## Configure your Cursor SDK API key
 
@@ -708,7 +719,7 @@ npm install
 CURSOR_API_KEY="your-key" pi --approve -e . --model cursor/grok-4.6
 ```
 
-After editing `src/`, run `npm run build` before the next `pi -e .` run, or pi loads the previous build.
+After editing `src/`, run `npm run build` for validation and compiled consumers, then restart Pi to load the changed source graph.
 
 Maintainer design notes live in [`docs/cursor-model-ux-spec.md`](docs/cursor-model-ux-spec.md).
 

package/dist/cursor-provider-live-run-drain.js

@@ -9,6 +9,7 @@ import { trimCurrentTurnAlreadyEmittedCursorText } from "./cursor-run-final-text
 import { formatCursorSdkAbortMessage, resolveCursorSdkAbortCause } from "./cursor-provider-errors.js";
 import { formatInactiveCursorReplayTrace } from "./cursor-native-replay-trace.js";
 import { partitionNativeToolsByActiveContext } from "./cursor-native-replay-routing.js";
+import { isJsonObject } from "./cursor-record-utils.js";
 export const DEFAULT_CURSOR_NATIVE_REPLAY_IDLE_DISPOSE_MS = 5 * 60 * 1000;
 const CURSOR_NATIVE_REPLAY_TOOL_ID_PATTERN = /^(cursor-replay-\d+-\d+)-tool-\d+$/;
 let cursorNativeReplayIdleDisposeMs = DEFAULT_CURSOR_NATIVE_REPLAY_IDLE_DISPOSE_MS;
@@ -128,6 +129,8 @@ function emitCursorLiveQueuedEvent(turn, event, run) {
 function emitCursorNativeToolUseTurn(stream, partial, model, context, run, toolResultInputTokens, tools, debugRecorder) {
     const shouldTerminate = run.done && !run.finalText?.trim() && !cursorLiveRuns.peekEvent(run);
     for (const tool of tools) {
+        if (!isJsonObject(tool.args))
+            throw new Error("Cursor replay tool arguments must be a JSON object");
         const contentIndex = partial.content.length;
         partial.content.push({
             type: "toolCall",
@@ -172,6 +175,8 @@ function emitInactiveCursorReplayTrace(turn, tools, debugRecorder) {
 }
 function emitCursorBridgeToolUseTurn(stream, partial, model, context, run, toolResultInputTokens, requests) {
     for (const request of requests) {
+        if (!isJsonObject(request.args))
+            throw new Error("Cursor bridge tool arguments must be a JSON object");
         const contentIndex = partial.content.length;
         partial.content.push({
             type: "toolCall",

package/dist/cursor-record-utils.js

@@ -1,3 +1,22 @@
+/** Narrow untyped SDK/MCP arguments at the Pi transcript boundary without rewriting them. */
+export function isJsonObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        && isJsonValue(value, new Set());
+}
+function isJsonValue(value, ancestors) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (typeof value !== "object" || ancestors.has(value))
+        return false;
+    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+        return false;
+    ancestors.add(value);
+    const valid = Object.values(value).every(entry => isJsonValue(entry, ancestors));
+    ancestors.delete(value);
+    return valid;
+}
 export function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 }

package/docs/cursor-dogfood-checklist.md

@@ -4,7 +4,7 @@ Short maintainer checklist for **minimal-surface** validation after prompt, brid
 
 ## Minimal environment
 
-- Build first after any `src/` edit: `npm run build` (the pi manifest loads compiled `dist/`)
+- Build first after any `src/` edit: `npm run build` (validation and compiled-script consumers); restart Pi to load the changed `src/index.ts` manifest graph
 - Extension only: `pi --approve -e . --cursor-no-fast --model cursor/grok-4.6`
 - Fresh session dir: `--session-dir /tmp/pi-cursor-dogfood-<id>`
 - Baseline surface (no ambient Cursor MCP/rules):

package/docs/cursor-live-smoke-checklist.md

@@ -8,7 +8,7 @@ Use this manual checklist during development and debugging of Cursor provider/ru
 
 ## Inner-loop rule
 
-- Build first: `npm run build` after any `src/` edit — the pi manifest loads compiled `dist/`, so unbuilt runs validate stale code. (the cloud/steering/local-resume/provider-debug launchers rebuild automatically even when run directly with `node scripts/...`; `smoke:live`/`smoke:visual`/`smoke:isolated` build via their npm scripts; direct `pi -e .` invocations do not build.)
+- Build first: `npm run build` after any `src/` edit validates emit and updates `dist/` for scripts/programmatic consumers. Pi loads the packaged `src/index.ts` graph; restart Pi after source changes. The cloud/steering/local-resume/provider-debug launchers rebuild automatically even when run directly with `node scripts/...`; `smoke:live`/`smoke:visual`/`smoke:isolated` build via their npm scripts. Packed-install gates must exercise the tarball's actual manifest, not a checkout path.
 - Run from a clean working tree except for the intended branch diff.
 - Use the local extension under test: `pi --approve -e . --cursor-no-fast --model cursor/grok-4.6`.
 - Use a temporary `--session-dir` for every run.

package/docs/cursor-testing-lessons.md

@@ -54,6 +54,22 @@ If resync runs but `context.tools` is still stale (e.g. only `read` listed), the
 
 The test covers bootstrap/incremental prompts, empty-vs-absent request tools, native replay/drain, cloud fresh/bootstrap selection, and actual host prompt serialization for context files and skills. It is offline contract evidence, not a replacement for the required live platform/cloud release gates.
 
+### Native package identity regression
+
+Pi's manifest loads the shipped `src/index.ts` graph, while scripts and programmatic consumers retain `dist/`. Native ESM imports of compiled JS can bypass Pi's host-peer aliases when another Pi version is installed beside the extension. A TypeScript wrapper around compiled JS does not fix transitive ownership. Do not remove local peers or use an import hook to turn this regression green.
+
+`test/native-package-host.test.ts` packs and normally installs the package with both 0.84.0 and 0.85.1 peers, then exercises the actual manifest via the installed development host's SDK and CLI (including the bundled CLI when shipped by that host; Pi 0.84 ships only the modular CLI). It also checks a minimal native managed install. For each additional pinned host, run the same offline probe against the installed tarball (not this checkout):
+
+```bash
+node scripts/check-pi-host-runtime.mjs /path/to/pi-coding-agent /path/to/installed/pi-cursor-sdk --out=/new/evidence/sdk
+node scripts/check-pi-host-runtime.mjs /path/to/pi-coding-agent /path/to/installed/pi-cursor-sdk --cli=modular --out=/new/evidence/modular
+node scripts/check-pi-host-runtime.mjs /path/to/pi-coding-agent /path/to/installed/pi-cursor-sdk --cli=bundled --out=/new/evidence/bundled
+```
+
+The probe asserts host stream identity, ordinary prompt/tool replay, recorded native tool emission and replay execution without reading the fixture path, final drain, lazy bridge/SDK/SQLite imports and bundled ripgrep lookup. The SDK lane also invokes the actual manifest-registered provider callback with no key, requiring the expected auth preflight error before SDK execution. It uses no import redirection and makes no Cursor requests. The recorded tool fixture is offline replay evidence, not a claim of a live SDK tool call.
+
+Every host must pass the common provider, context and replay checks. Add `--verify-fork-checkpoints` only to qualify the fork's native `SystemMessage.replace` support; explicit qualification fails on hosts lacking those semantics or transcript helpers. This additional host check is not a Cursor requirement. Published Pi 0.85.1 uses its supported shorthand context instead of synthetic transcript messages. None of these probes replaces the live platform gate.
+
 ## Auth: use `auth.json`, not only env
 
 pi resolves Cursor auth in this order:
@@ -177,6 +193,8 @@ Session summaries can hide per-message usage bugs. When investigating token or c
 
 The compaction poison fixture mirrors the observed failure shape: one assistant message with `RunResult`-sized input/cache-read counts near 1M immediately before compaction. Regression coverage should prove that such usage falls back to bounded pi estimates before it reaches `AssistantMessage.usage`.
 
+Compaction continuity needs content evidence, not just a new agent ID or a successful recall reply. The compaction smoke checks the returned and persisted summaries for the exact marker before recall, verifies the original user was cut and the native kept context has no other marker source, and checks the actual bootstrap inputs too. Both post-compaction and restart recall reject tool calls: retained session/debug files must not become a filesystem fallback. Keep the raw summary and journals on failure as well as success; an unchanged later model success does not erase an earlier summary-content failure or prove a deterministic provider fix.
+
 ### False-positive edge case (2026-05-23)
 
 Plan-strip live smoke can make Cursor `read` testing docs that *document* replay failure strings. A naive whole-record JSON scan reported four failures from one successful `read` toolResult (`isError: false`).

package/docs/platform-smoke-implementation.md

@@ -18,6 +18,8 @@ Required behavior:
 - fail when a card/evidence item has the wrong success/error state;
 - fail when footer/status is missing or unreadable.
 
+The plain-text card inventory uses Node's `stripVTControlCharacters` on the complete captured ANSI stream. OSC-8 hyperlinks may use either BEL or ST (ESC followed by a backslash) terminators, and a PTY chunk may split either sequence. Do not strip chunks independently or use a greedy OSC regex: that can consume the visible `package.json` label, successful read content, or subsequent cards even when xterm renders them correctly. Raw ANSI remains unchanged for independent xterm/PNG rendering and secret scanning; exact card patterns and JSONL success/error assertions still apply. `test/fixtures/platform-read-hyperlinks.json` retains minimal native/bridge headers from real captures with only the local hyperlink target anonymized.
+
 Meaningful gap closed: earlier card assertions could pass when the prompt mentioned `pi__read` or a missing-file path even if the actual tool card/result never rendered. The gate now requires JSONL result evidence and per-evidence rendered screenshots for native read, native shell success/failure, native edit diffs, bridge read success/failure, and bridge shell success.
 
 ## Registry visual classification

package/docs/platform-smoke.md

@@ -206,7 +206,7 @@ The copy/switch lane copies a session file containing resume custom entries, swi
 
 The fallback lane rewrites a persisted handle to a missing local SDK `agent-*`, verifies create+bootstrap fallback, and asserts the continuity notice is emitted in `pi-stream-events.jsonl`.
 
-The compaction lane uses an isolated temp pi settings file with `compaction.keepRecentTokens: 1` to force manual compaction without huge dummy prompts. It verifies the pre-compaction SDK agent is not reused, the new handle records `compactionGeneration: 1`, and restart resumes the post-compaction agent.
+The compaction lane uses an isolated temp pi settings file with `compaction.keepRecentTokens: 1` to force manual compaction without huge dummy prompts. Before recall, it requires the exact marker in both the returned and native persisted summary, agreement on the kept boundary, and removal of the original marker-bearing user from the kept context. Native `get_messages` and the subsequent captured provider inputs must supply the marker only through that summary. The post-compaction agent must bootstrap without reusing the baseline or captured summarizer agents, persist `compactionGeneration: 1`, and resume as the same agent after restart. Both recall turns must return the marker without tool calls, so searching retained QA files cannot satisfy continuity. The lane retains its journals/debug artifacts and `compaction-boundary.json` on success and failure.
 
 The default/opt-out lane verifies the built-in local resume default resumes, then verifies `PI_CURSOR_LOCAL_RESUME=0` opts out and creates a new agent while bootstrapping the transcript.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-cursor-sdk",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "pi provider extension backed by @cursor/sdk local and cloud agents",
   "author": "Mitch Fultz (https://github.com/fitchmultz)",
   "license": "MIT",
@@ -187,7 +187,7 @@
   },
   "pi": {
     "extensions": [
-      "./dist/index.js"
+      "./src/index.ts"
     ]
   },
   "allowScripts": {

package/scripts/build.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
- * Purpose: Produce the compiled runtime files that the Pi extension manifest loads.
+ * Purpose: Produce compiled runtime files for scripts and programmatic consumers.
+ * Pi's manifest loads the shipped source graph through its native TypeScript loader.
  * Responsibilities: Run TypeScript emit into a staging directory, then atomically swap it
  * into dist/ so a failed TypeScript emit never destroys a previously working dist.
  * Usage: `npm run build`; also invoked by scripts/prepare.mjs during install lifecycles.

package/scripts/lib/local-resume-smoke-harness.mjs

@@ -307,7 +307,7 @@ function metadataFiles(artifactDir) {
 	return files.sort((a, b) => statSync(a).mtimeMs - statSync(b).mtimeMs);
 }
 
-function readMetadataSince(artifactDir, seenPaths) {
+export function readMetadataSince(artifactDir, seenPaths) {
 	return metadataFiles(artifactDir)
 		.filter((metadataPath) => !seenPaths.has(metadataPath))
 		.map((metadataPath) => ({
@@ -383,11 +383,6 @@ export function resumeEntryCount(entries) {
 	return resumeEntries(entries).length;
 }
 
-export function compactionEntryCount(entries) {
-	return (entries.entries ?? []).filter((entry) => entry?.type === "compaction")
-		.length;
-}
-
 function entryText(entry) {
 	const content = entry?.message?.content;
 	if (typeof content === "string") return content;

package/scripts/local-resume-smoke.mjs

@@ -8,7 +8,6 @@ import {
 	assistantEntryContaining,
 	buildLocalResumeSmokeEnv,
 	cleanupArtifactRoot,
-	compactionEntryCount,
 	createRunContext,
 	fail,
 	getEntries,
@@ -17,6 +16,7 @@ import {
 	parseTimeout,
 	promptAbortAndRead,
 	promptAndRead,
+	readMetadataSince,
 	reportFailure,
 	resumeEntries,
 	scrubSmokeText,
@@ -514,10 +514,33 @@ async function runCompactionSmoke() {
 			});
 			assertTurnMetadata("compaction baseline", baseline, { resumedAgent: false });
 			preCompactionAgentId = baseline.metadata.run.agentId;
+			const originalUser = userEntryContaining(await getEntries(rpc), marker);
+			if (!originalUser) fail("compaction baseline did not persist the marker-bearing user message");
 			const result = await rpcData(rpc, "compact", { customInstructions: `Preserve the exact marker ${marker}.` }, timeoutMs);
-			if (!result.summary || typeof result.tokensBefore !== "number") fail("manual compaction did not return a summary result", JSON.stringify(result, null, 2));
 			const compactedEntries = await getEntries(rpc);
-			if (compactionEntryCount(compactedEntries) < 1) fail("manual compaction did not append a compaction entry");
+			const compaction = compactedEntries.entries.findLast((entry) => entry.type === "compaction");
+			const active = await rpcData(rpc, "get_messages");
+			const summarizerTurns = readMetadataSince(artifactRoot, seenMetadata);
+			// Save the native boundary before assertions or any recall turn can inspect files.
+			const boundaryPath = join(artifactRoot, "compaction-boundary.json");
+			writeFileSync(boundaryPath, JSON.stringify({ result, compaction, originalUserEntryId: originalUser.id, activeMessages: active.messages, summarizerTurns }, null, 2));
+			if (typeof result.summary !== "string" || typeof result.tokensBefore !== "number") fail("manual compaction did not return a summary result", boundaryPath);
+			if (!result.summary.includes(marker)) fail("returned compaction summary lost the exact marker", boundaryPath);
+			if (!compaction) fail("manual compaction did not append a compaction entry", boundaryPath);
+			if (typeof compaction.summary !== "string" || !compaction.summary.includes(marker)) fail("persisted compaction summary lost the exact marker", boundaryPath);
+			if (compaction.summary !== result.summary || compaction.firstKeptEntryId !== result.firstKeptEntryId) fail("returned and persisted compaction boundaries disagree", boundaryPath);
+			const originalIndex = compactedEntries.entries.findIndex((entry) => entry.id === originalUser.id);
+			const keptIndex = compactedEntries.entries.findIndex((entry) => entry.id === compaction.firstKeptEntryId);
+			const compactionIndex = compactedEntries.entries.indexOf(compaction);
+			if (originalIndex < 0 || keptIndex <= originalIndex || keptIndex >= compactionIndex) fail("compaction did not move the kept boundary past the original marker-bearing user", boundaryPath);
+			// Ask the host for its active messages; do not reproduce its cut/replay algorithm.
+			const summaryMessage = active.messages.find((message) => message.role === "compactionSummary" && message.summary === compaction.summary);
+			if (!summaryMessage) fail("native active context does not contain the persisted compaction summary", boundaryPath);
+			if (active.messages.some((message) => message !== summaryMessage && JSON.stringify(message).includes(marker))) fail("kept context independently supplies the compaction marker", boundaryPath);
+			for (const turn of summarizerTurns) {
+				assertNotResumedFrom("compaction summarizer", turn, preCompactionAgentId);
+				seenMetadata.add(turn.metadataPath);
+			}
 
 			const postCompaction = await promptAndRead({
 				rpc,
@@ -527,6 +550,19 @@ async function runCompactionSmoke() {
 				seenMetadata,
 			});
 			assertNotResumedFrom("post-compaction turn", postCompaction, preCompactionAgentId);
+			for (const turn of summarizerTurns) assertNotResumedFrom("post-compaction turn versus summarizer", postCompaction, turn.metadata.run.agentId);
+			if (postCompaction.metadata.providerMeta?.sendPlan?.mode !== "bootstrap") fail("post-compaction turn did not bootstrap the compacted context", postCompaction.metadataPath);
+			// Inspect the actual provider inputs too: the native summary must be the only marker source.
+			const postDir = dirname(postCompaction.metadataPath);
+			const escapedSummary = JSON.stringify(compaction.summary).slice(1, -1);
+			for (const file of ["context-snapshot.json", "send-payload.json"]) {
+				const path = join(postDir, file);
+				const input = JSON.stringify(JSON.parse(readFileSync(path, "utf8")));
+				if (!input.includes(escapedSummary)) fail("post-compaction input omitted the persisted summary", path);
+				if (input.replace(escapedSummary, "").includes(marker)) fail("post-compaction input independently supplies the marker outside the summary", path);
+			}
+			const postSteps = readFileSync(join(postDir, "on-step.jsonl"), "utf8").split("\n").filter(Boolean).map(JSON.parse);
+			if (postSteps.some((row) => row.step?.type === "toolCall")) fail("post-compaction recall used tools instead of summary-only recall", postCompaction.metadataPath);
 			if (!postCompaction.text.includes(`MARKER=${marker}`)) fail("post-compaction turn did not recall marker", JSON.stringify({ expected: `MARKER=${marker}`, actual: postCompaction.text }, null, 2));
 			postCompactionAgentId = postCompaction.metadata.run.agentId;
 			const postHandle = latestResumeEntry(await getEntries(rpc));
@@ -544,11 +580,14 @@ async function runCompactionSmoke() {
 			});
 			assertTurnMetadata("post-compaction restart", restart, { resumedAgent: true });
 			if (restart.metadata.run.agentId !== postCompactionAgentId) fail("post-compaction restart did not resume the post-compaction agent", JSON.stringify({ expected: postCompactionAgentId, actual: restart.metadata.run.agentId }, null, 2));
+			const restartSteps = readFileSync(join(dirname(restart.metadataPath), "on-step.jsonl"), "utf8").split("\n").filter(Boolean).map(JSON.parse);
+			if (restartSteps.some((row) => row.step?.type === "toolCall")) fail("post-compaction restart used tools instead of recalling the marker", restart.metadataPath);
+			if (!restart.text.includes(`MARKER=${marker}`)) fail("post-compaction restart did not recall marker", JSON.stringify({ expected: `MARKER=${marker}`, actual: restart.text }, null, 2));
 		});
 		console.log("local-resume-compaction-smoke-ok");
 		console.error(scrubSmokeText(`[local-resume-smoke] pre-compaction ${preCompactionAgentId} replaced by and resumed post-compaction ${postCompactionAgentId}`));
 	} finally {
-		cleanupArtifactRoot(artifactRoot);
+		console.error(scrubSmokeText(`[local-resume-smoke] retained compaction evidence: ${artifactRoot}`));
 	}
 }
 

package/scripts/platform-smoke/card-detect.mjs

@@ -8,6 +8,7 @@
 
 import { writeFileSync, mkdirSync } from "node:fs";
 import { resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import { matchesWrappedLineAt } from "./wrapped-line-match.mjs";
 
 const CARD_PATTERNS = [
@@ -35,10 +36,7 @@ const CARD_PATTERNS = [
 ];
 
 function cleanLine(line) {
-	return line
-		.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "")
-		.replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "")
-		.replace(/\r/g, "");
+	return stripVTControlCharacters(line).replace(/\r/g, "");
 }
 
 function matchesCardAt(lines, index, card) {

package/scripts/platform-smoke/live-suite-runner.mjs

@@ -13,6 +13,7 @@ import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSy
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
+import { stripVTControlCharacters } from "node:util";
 import { redactSecrets, writePlatformArtifactBundle } from "./artifacts.mjs";
 import { extractContentText, jsonlHasAssistantFinalTextMarker } from "./jsonl-text.mjs";
 import { getScenario, renderPrompt } from "./scenarios.mjs";
@@ -237,10 +238,6 @@ function prepareSharedPackedInstall(prepDir, logDir, artifactDir, packageName) {
 	return prepared;
 }
 
-function stripANSI(text) {
-	return text.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "");
-}
-
 function ptySpawnCommand(args) {
 	const cliEntry = resolve(process.cwd(), "node_modules", "@earendil-works", "pi-coding-agent", "dist", "cli.js");
 	if (!existsSync(cliEntry)) throw new Error(`Pi CLI entry not found: ${cliEntry}`);
@@ -278,7 +275,6 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	}
 
 	let ansi = "";
-	let plain = "";
 	const events = [];
 	const startedAt = Date.now();
 	const { file, args } = ptyCommand;
@@ -297,7 +293,6 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	let exitEvent;
 	child.onData((data) => {
 		ansi += data;
-		plain += stripANSI(data);
 		events.push({ type: "output", elapsedMs: Date.now() - startedAt, bytes: data.length });
 	});
 	child.onExit((event) => {
@@ -313,7 +308,9 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	let abortObserved = false;
 	const abortStartedPath = join(cwd, ".debug", "platform-smoke", "abort-started.txt");
 	while (Date.now() - startedAt < waitMs) {
-		const currentPlain = plain;
+		// PTY chunks may split an OSC-8 link. Strip the complete captured stream,
+		// not individual chunks, and preserve the label between open/close links.
+		const currentPlain = stripVTControlCharacters(ansi);
 		const responsePlain = currentPlain.slice(responseStartOffset);
 		if (finalMarker && responsePlain.includes(finalMarker)) finalMarkerSeen = true;
 		if (finalMarkerSeen && sessionJsonlMeetsRequirements(sessionDir, scenario) && sessionJsonlHasAssistantMarker(sessionDir, finalMarker)) {
@@ -364,6 +361,7 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	await waitForSessionJsonl(sessionDir, null, startedAt, events);
 	await delay(1_000);
 
+	const plain = stripVTControlCharacters(ansi);
 	writeRedactedTextFile(join(artifactDir, "terminal.ansi"), ansi);
 	writeRedactedTextFile(join(artifactDir, "terminal.txt"), plain);
 	writeFileSync(join(artifactDir, "pty.events.jsonl"), events.map((event) => JSON.stringify(event)).join("\n") + "\n");

package/scripts/platform-smoke/pty-capture.mjs

@@ -8,6 +8,7 @@
 import { spawn } from "node:child_process";
 import { writeFileSync, appendFileSync, mkdirSync } from "node:fs";
 import { resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 
 const COLS = 150;
 const ROWS = 45;
@@ -27,7 +28,6 @@ export async function capturePTY(dir, command, opts = {}) {
 	const txtPath = resolve(dir, "terminal.txt");
 
 	let ansiBuffer = "";
-	let txtBuffer = "";
 
 	function appendEvent(event) {
 		appendFileSync(eventsPath, JSON.stringify(event) + "\n");
@@ -35,8 +35,6 @@ export async function capturePTY(dir, command, opts = {}) {
 	function appendOutput(data) {
 		const text = typeof data === "string" ? data : data.toString();
 		ansiBuffer += text;
-		// Strip ANSI for plain text
-		txtBuffer += stripANSI(text);
 	}
 
 	// Try node-pty first
@@ -79,7 +77,7 @@ export async function capturePTY(dir, command, opts = {}) {
 		});
 
 		writeFileSync(ansiPath, ansiBuffer);
-		writeFileSync(txtPath, txtBuffer);
+		writeFileSync(txtPath, stripVTControlCharacters(ansiBuffer));
 
 		return { code: code ?? (signal ? 1 : 0), signal, ansiPath, txtPath, eventsPath };
 	} else {
@@ -111,17 +109,12 @@ export async function capturePTY(dir, command, opts = {}) {
 		});
 
 		writeFileSync(ansiPath, ansiBuffer);
-		writeFileSync(txtPath, txtBuffer);
+		writeFileSync(txtPath, stripVTControlCharacters(ansiBuffer));
 
 		return { code: code ?? (signal ? 1 : 0), signal, ansiPath, txtPath, eventsPath };
 	}
 }
 
-/** Strip ANSI escape sequences from a string. */
-function stripANSI(str) {
-	return str.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "").replace(/\x1b\][^\x07]*\x07/g, "");
-}
-
 /** Self-test: can we create a simple PTY? */
 export async function ptySelfTest() {
 	const dir = resolve(process.cwd(), ".artifacts", "pty-self-test");

package/scripts/platform-smoke/render-ansi.mjs

@@ -7,6 +7,7 @@
 
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 
 import { buildTerminalHtml, writeTerminalScreenshot } from "../lib/cursor-visual-render.mjs";
 
@@ -14,14 +15,10 @@ const COLS = 150;
 const ROWS = 45;
 const HISTORY_LINES = 3_000;
 
-function stripANSI(text) {
-	return text.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "");
-}
-
 /** Render terminal.ansi to terminal.html using the shared xterm.js renderer. */
 export async function renderHTML(ansiPath, htmlPath, options = {}) {
 	const ansi = readFileSync(ansiPath, "utf8");
-	const plain = options.plain ?? stripANSI(ansi);
+	const plain = options.plain ?? stripVTControlCharacters(ansi);
 	const html = buildTerminalHtml({
 		ansi,
 		plain,

package/src/cursor-provider-live-run-drain.ts

@@ -28,6 +28,7 @@ import { formatCursorSdkAbortMessage, resolveCursorSdkAbortCause } from "./curso
 import { formatInactiveCursorReplayTrace } from "./cursor-native-replay-trace.js";
 import { partitionNativeToolsByActiveContext } from "./cursor-native-replay-routing.js";
 import type { CursorSdkEventDebugRecorder } from "./cursor-sdk-event-debug.js";
+import { isJsonObject } from "./cursor-record-utils.js";
 
 export const DEFAULT_CURSOR_NATIVE_REPLAY_IDLE_DISPOSE_MS = 5 * 60 * 1000;
 const CURSOR_NATIVE_REPLAY_TOOL_ID_PATTERN = /^(cursor-replay-\d+-\d+)-tool-\d+$/;
@@ -180,6 +181,7 @@ function emitCursorNativeToolUseTurn(
 ): void {
 	const shouldTerminate = run.done && !run.finalText?.trim() && !cursorLiveRuns.peekEvent(run);
 	for (const tool of tools) {
+		if (!isJsonObject(tool.args)) throw new Error("Cursor replay tool arguments must be a JSON object");
 		const contentIndex = partial.content.length;
 		partial.content.push({
 			type: "toolCall",
@@ -236,6 +238,7 @@ function emitCursorBridgeToolUseTurn(
 	requests: CursorPiBridgeToolRequest[],
 ): void {
 	for (const request of requests) {
+		if (!isJsonObject(request.args)) throw new Error("Cursor bridge tool arguments must be a JSON object");
 		const contentIndex = partial.content.length;
 		partial.content.push({
 			type: "toolCall",

package/src/cursor-record-utils.ts

@@ -1,3 +1,22 @@
+import type { JsonValue } from "@earendil-works/pi-ai";
+
+/** Narrow untyped SDK/MCP arguments at the Pi transcript boundary without rewriting them. */
+export function isJsonObject(value: unknown): value is Record<string, JsonValue> {
+	return value !== null && typeof value === "object" && !Array.isArray(value)
+		&& isJsonValue(value, new Set());
+}
+
+function isJsonValue(value: unknown, ancestors: Set<object>): boolean {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (typeof value !== "object" || ancestors.has(value)) return false;
+	if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return false;
+	ancestors.add(value);
+	const valid = Object.values(value).every(entry => isJsonValue(entry, ancestors));
+	ancestors.delete(value);
+	return valid;
+}
+
 export function asRecord(value: unknown): Record<string, unknown> | undefined {
 	return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
 }