pi-cursor-sdk 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.3.9 - 2026-09-19
+
+### Fixed
+
+- Serialize replay tool-call arguments once at the Pi transcript boundary to satisfy Pi 0.86.1's JSON-only contract without sharing mutable SDK payloads.
+- Preserve secret-scanned JSON and JSONL smoke artifacts byte-for-byte, and fail qualification when retained structured evidence cannot be parsed.
+
+### Changed
+
+- Restore the compiled `dist/index.js` Pi entrypoint and the pre-0.3.8 tool-argument handling. Released Pi 0.85.1 did not require the source-loader or newer transcript-type changes.
+- Remove the additional source-host compatibility matrix, probes, and compaction qualification added with 0.3.8. Keep the terminal capture detector fix, which corrects QA evidence rather than runtime rendering.
+- Extension filters changed for 0.3.8 must target `dist/index.js` again. Keep exclusions for both entrypoints when disabling Cursor across versions; see README's “Existing extension filters”.
+
+## 0.3.8 - 2026-09-19
+
+### Fixed
+
+- Narrow SDK replay and MCP bridge arguments to JSON objects before emitting Pi tool calls, preserving valid payloads without serialization or casts. This supports Pi's tightened transcript types and reports non-JSON arguments before dispatch.
+- Compile source and test fixtures against published Pi 0.85.1, pinned official source, and the fork. Native packed-host checks require common provider, replay, and runtime behavior on every host. The fork additionally qualifies legacy `SystemMessage.replace` checkpoints; current official Pi removed that host feature, which is not required by this extension.
+- Load the already-shipped TypeScript source graph through Pi's native loader so provider streams and replay helpers remain host-owned even with local Pi peer packages installed. Keep compiled output for scripts and programmatic consumers.
+- Preserve hyperlink text and split terminal control sequences when checking platform-smoke read cards, using Node's terminal-control stripping rather than a custom regular expression.
+
+### Changed
+
+- Native source loading fixes host peer identity at the cost of more initial startup/load work. On macOS/Node 24.21.0/Pi fork `90e6`, three fresh-process, warm-cache loader runs measured 0.85–1.24 s for source versus 0.08–0.13 s for dist; these are not TUI startup timings or guarantees for other environments or repeated `/reload`.
+- **Filter migration required:** update old dist-targeting extension filters to preserve include/exclude intent (`+dist/index.js` → `+src/index.ts`, `-dist/index.js` → `-src/index.ts`, `!dist/**` → `!src/**`). The old exclusion alone no longer disables Cursor; retain `-dist/index.js` alongside `-src/index.ts` for rollback. See README's “Existing extension filters”; settings are not rewritten automatically.
+
 ## 0.3.7 - 2026-09-16
 
 ### Fixed

package/README.md

@@ -70,6 +70,12 @@ Alternative GitHub install:
 pi install https://github.com/fitchmultz/pi-cursor-sdk
 ```
 
+### Existing extension filters
+
+The Pi entrypoint is `dist/index.js`. If you changed extension filters for 0.3.8's `src/index.ts` entrypoint, restore their compiled-entry equivalents: `+src/index.ts` → `+dist/index.js`, `-src/index.ts` → `-dist/index.js`, and `!src/**` → `!dist/**`.
+
+To keep Cursor disabled across both entrypoints, retain both `-src/index.ts` and `-dist/index.js`. The package does not rewrite user or project settings.
+
 ### Project-local install
 
 Use `-l` if you want the package recorded in the current project's `.pi/settings.json` instead of your global pi settings:
@@ -673,6 +679,10 @@ Cursor native replay is a display enhancement for TUI sessions and structured JS
 
 ## Development
 
+The source qualification baseline is official Pi **0.86.1**, with optional wildcard host peers and Cursor SDK **1.0.27** unchanged. Run `npm ci --ignore-scripts` then `npm run check:compat` in an empty HOME/agent profile for credential-free qualification. This builds the manifest entry, runs existing type/unit/package checks, and tests the compiled provider's registration plus production prompt shaping against native Pi transcript/tool transitions. Replay arguments must match their JSON stream deltas. Tests use no live Cursor service.
+
+This is not Cursor authentication, desktop/cloud execution, visual, or all-platform release proof. The existing `smoke:platform:all` and applicable `smoke:cloud` gates remain required; a passing compatibility check does not make a runtime change release-ready. Older advertised Pi/Node floors require their own matrix evidence.
+
 Run checks:
 
 ```bash

package/dist/cursor-provider-live-run-drain.js

@@ -129,14 +129,16 @@ function emitCursorNativeToolUseTurn(stream, partial, model, context, run, toolR
     const shouldTerminate = run.done && !run.finalText?.trim() && !cursorLiveRuns.peekEvent(run);
     for (const tool of tools) {
         const contentIndex = partial.content.length;
+        // Pi persists JSON arguments: keep the completed call identical to its wire delta.
+        const serializedArgs = JSON.stringify(tool.args);
         partial.content.push({
             type: "toolCall",
             id: tool.id,
             name: tool.toolName,
-            arguments: tool.args,
+            arguments: JSON.parse(serializedArgs),
         });
         stream.push({ type: "toolcall_start", contentIndex, partial });
-        stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(tool.args), partial });
+        stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
         const block = partial.content[contentIndex];
         if (block.type === "toolCall")
             stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });
@@ -173,14 +175,15 @@ function emitInactiveCursorReplayTrace(turn, tools, debugRecorder) {
 function emitCursorBridgeToolUseTurn(stream, partial, model, context, run, toolResultInputTokens, requests) {
     for (const request of requests) {
         const contentIndex = partial.content.length;
+        const serializedArgs = JSON.stringify(request.args);
         partial.content.push({
             type: "toolCall",
             id: request.piToolCallId,
             name: request.piToolName,
-            arguments: request.args,
+            arguments: JSON.parse(serializedArgs),
         });
         stream.push({ type: "toolcall_start", contentIndex, partial });
-        stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(request.args), partial });
+        stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
         const block = partial.content[contentIndex];
         if (block.type === "toolCall")
             stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });

package/docs/platform-smoke-implementation.md

@@ -18,6 +18,8 @@ Required behavior:
 - fail when a card/evidence item has the wrong success/error state;
 - fail when footer/status is missing or unreadable.
 
+The plain-text card inventory uses Node's `stripVTControlCharacters` on the complete captured ANSI stream. OSC-8 hyperlinks may use either BEL or ST (ESC followed by a backslash) terminators, and a PTY chunk may split either sequence. Do not strip chunks independently or use a greedy OSC regex: that can consume the visible `package.json` label, successful read content, or subsequent cards even when xterm renders them correctly. Raw ANSI remains unchanged for independent xterm/PNG rendering and secret scanning; exact card patterns and JSONL success/error assertions still apply. `test/fixtures/platform-read-hyperlinks.json` retains minimal native/bridge headers from real captures with only the local hyperlink target anonymized.
+
 Meaningful gap closed: earlier card assertions could pass when the prompt mentioned `pi__read` or a missing-file path even if the actual tool card/result never rendered. The gate now requires JSONL result evidence and per-evidence rendered screenshots for native read, native shell success/failure, native edit diffs, bridge read success/failure, and bridge shell success.
 
 ## Registry visual classification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-cursor-sdk",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "pi provider extension backed by @cursor/sdk local and cloud agents",
   "author": "Mitch Fultz (https://github.com/fitchmultz)",
   "license": "MIT",
@@ -120,6 +120,7 @@
     "node": ">=22.19.0"
   },
   "scripts": {
+    "check:compat": "npm run build && npm run verify && node --test test/native-provider.test.mjs",
     "build": "node ./scripts/build.mjs",
     "prepare": "node ./scripts/prepare.mjs",
     "typecheck": "npm run typecheck:src && npm run typecheck:tests && npm run typecheck:replay-compile",
@@ -175,9 +176,9 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.84.0",
-    "@earendil-works/pi-coding-agent": "0.84.0",
-    "@earendil-works/pi-tui": "0.84.0",
+    "@earendil-works/pi-ai": "0.86.1",
+    "@earendil-works/pi-coding-agent": "0.86.1",
+    "@earendil-works/pi-tui": "0.86.1",
     "@xterm/xterm": "^6.0.0",
     "node-pty": "^1.1.0",
     "playwright": "^1.60.0",

package/scripts/platform-smoke/artifact-secrets.mjs

@@ -71,6 +71,60 @@ export function redactSecrets(text) {
 	return redacted;
 }
 
+/** JSON syntax is not secret material. Scan decoded scalar values with the same
+ * canonical rules, retaining key/value context for auth fields. Never regex-scrub
+ * a serialized document: escaped quotes, numeric tokens and scoped names break. */
+export function scanArtifactSecrets(path, content) {
+	if (!/\.jsonl?$/i.test(path) || isBinaryArtifactContent(content)) return scanForSecrets(content);
+	const text = String(content);
+	const documents = /\.jsonl$/i.test(path) ? text.split(/\r?\n/).filter((line) => line.trim()) : [text];
+	try {
+		for (const document of documents) JSON.parse(document);
+	} catch {
+		// Malformed evidence is never repaired. Scan its bytes and let the
+		// structural gate report it independently (without echoing input).
+		return scanForSecrets(content);
+	}
+	const violations = new Set();
+	const scan = (value) => scanForSecrets(value).forEach((violation) => violations.add(violation));
+	for (const document of documents) {
+		// Native JSON validation above owns grammar. Scan the original tokens, not
+		// the parsed object: duplicate members (including entire subtrees) survive
+		// in transported bytes even though JSON.parse overwrites them.
+		let key;
+		for (const match of document.matchAll(/("(?:[^"\\]|\\.)*")(\s*:)?|[{}\[\],]|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g)) {
+			const token = match[1] ?? match[0];
+			if ("{}[],".includes(token)) {
+				key = undefined;
+				continue;
+			}
+			// Decode string escapes, but retain number spelling (no rounding/overflow).
+			const value = match[1] ? JSON.parse(token) : token;
+			scan(value);
+			if (match[2]) key = value;
+			else {
+				// A space after ':' keeps syntax from looking like SCP credentials.
+				if (key !== undefined) scan(`${JSON.stringify(key)}: ${match[1] ? JSON.stringify(value) : token}`);
+				key = undefined;
+			}
+		}
+	}
+	return [...violations];
+}
+
+export function structuredArtifactViolations(path, content) {
+	if (!/\.jsonl?$/i.test(path)) return [];
+	const lines = /\.jsonl$/i.test(path) ? String(content).split(/\r?\n/) : [String(content)];
+	const violations = [];
+	for (const [index, line] of lines.entries()) {
+		if (/\.jsonl$/i.test(path) && !line.trim()) continue;
+		try { JSON.parse(line); } catch {
+			violations.push(/\.jsonl$/i.test(path) ? `invalid JSONL at line ${index + 1}` : "invalid JSON");
+		}
+	}
+	return violations;
+}
+
 export function isBinaryArtifactContent(value) {
 	return Buffer.isBuffer(value) && (!isUtf8(value) || value.includes(0));
 }

package/scripts/platform-smoke/artifacts.mjs

@@ -18,7 +18,7 @@ import {
 	boundedFileSnapshot, openRegularFileNoFollow, walkArtifactTree,
 	writeBundleSpillFile, writeExtractedFiles,
 } from "./artifact-fs-safety.mjs";
-import { isBinaryArtifactContent, redactSecrets, scanForSecrets } from "./artifact-secrets.mjs";
+import { isBinaryArtifactContent, redactSecrets, scanArtifactSecrets, scanForSecrets, structuredArtifactViolations } from "./artifact-secrets.mjs";
 
 export {
 	MAX_BUNDLE_AGGREGATE_BYTES, MAX_BUNDLE_FILE_BYTES, MAX_BUNDLE_FILE_COUNT,
@@ -182,7 +182,7 @@ export function scanArtifacts(dir) {
 				failures.push({ file, violation: `artifact scan ${snapshot.reason}` });
 				return;
 			}
-			for (const violation of scanForSecrets(snapshot.content)) findings.push({ file, violation });
+			for (const violation of [...scanArtifactSecrets(path, snapshot.content), ...structuredArtifactViolations(path, snapshot.content)]) findings.push({ file, violation });
 		},
 	});
 	return failures.length > 0 ? failures : findings;
@@ -265,7 +265,7 @@ export function buildPlatformArtifactBundle(root, pathPrefix = "") {
 				return;
 			}
 			const { content } = snapshot;
-			for (const violation of scanForSecrets(content)) findings.push({ file, violation });
+			for (const violation of scanArtifactSecrets(path, content)) findings.push({ file, violation });
 			if (pathViolations.length > 0 || !shouldTransportBundleFile(canonicalRoot, path, pathPrefix)) return;
 			if (isBinaryArtifactContent(content)) {
 				limitReasons.push("binary-content");
@@ -308,7 +308,7 @@ function validatePlatformArtifactBundle(bundle) {
 		aggregateBytes += file.size;
 		if (aggregateBytes > MAX_BUNDLE_AGGREGATE_BYTES) return undefined;
 		const content = decodeCanonicalBase64(file.contentBase64, file.size);
-		if (!content || content.length !== file.size || isBinaryArtifactContent(content) || scanForSecrets(content).length > 0) return undefined;
+		if (!content || content.length !== file.size || isBinaryArtifactContent(content) || scanArtifactSecrets(file.path, content).length > 0) return undefined;
 		files.push({ path: file.path, content });
 	}
 	for (const path of paths) {
@@ -406,9 +406,12 @@ export function extractPlatformArtifactBundle(outputDir, stdout) {
 
 	const files = [];
 	const violations = [];
+	let structuredValid = true;
 	for (const file of decodedFiles) {
 		const text = file.content.toString("utf8");
-		violations.push(...scanForSecrets(file.content).map((violation) => ({ file: file.path, violation })));
+		const malformed = structuredArtifactViolations(file.path, file.content);
+		structuredValid &&= malformed.length === 0;
+		violations.push(...malformed.map((violation) => ({ file: file.path, violation })));
 		if (file.path.endsWith("redaction-violations.json")) {
 			try {
 				const parsed = JSON.parse(text);
@@ -417,11 +420,13 @@ export function extractPlatformArtifactBundle(outputDir, stdout) {
 				})));
 			} catch {}
 		}
-		files.push({ path: file.path, content: Buffer.from(redactSecrets(text)) });
+		// validatePlatformArtifactBundle already secret-scanned these bytes.
+		// Keep even malformed evidence verbatim for diagnosis; never repair it.
+		files.push({ path: file.path, content: /\.jsonl?$/i.test(file.path) ? file.content : Buffer.from(redactSecrets(text)) });
 	}
 
 	const succeeded = writeExtractedFiles(outputDir, files);
-	return succeeded ? { ok: true, violations } : failed;
+	return succeeded ? { ok: structuredValid, violations } : failed;
 }
 
 function collectFiles(root) {

package/scripts/platform-smoke/card-detect.mjs

@@ -8,6 +8,7 @@
 
 import { writeFileSync, mkdirSync } from "node:fs";
 import { resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import { matchesWrappedLineAt } from "./wrapped-line-match.mjs";
 
 const CARD_PATTERNS = [
@@ -35,10 +36,7 @@ const CARD_PATTERNS = [
 ];
 
 function cleanLine(line) {
-	return line
-		.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "")
-		.replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "")
-		.replace(/\r/g, "");
+	return stripVTControlCharacters(line).replace(/\r/g, "");
 }
 
 function matchesCardAt(lines, index, card) {

package/scripts/platform-smoke/live-suite-runner.mjs

@@ -13,6 +13,7 @@ import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSy
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
+import { stripVTControlCharacters } from "node:util";
 import { redactSecrets, writePlatformArtifactBundle } from "./artifacts.mjs";
 import { extractContentText, jsonlHasAssistantFinalTextMarker } from "./jsonl-text.mjs";
 import { getScenario, renderPrompt } from "./scenarios.mjs";
@@ -237,10 +238,6 @@ function prepareSharedPackedInstall(prepDir, logDir, artifactDir, packageName) {
 	return prepared;
 }
 
-function stripANSI(text) {
-	return text.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "");
-}
-
 function ptySpawnCommand(args) {
 	const cliEntry = resolve(process.cwd(), "node_modules", "@earendil-works", "pi-coding-agent", "dist", "cli.js");
 	if (!existsSync(cliEntry)) throw new Error(`Pi CLI entry not found: ${cliEntry}`);
@@ -278,7 +275,6 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	}
 
 	let ansi = "";
-	let plain = "";
 	const events = [];
 	const startedAt = Date.now();
 	const { file, args } = ptyCommand;
@@ -297,7 +293,6 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	let exitEvent;
 	child.onData((data) => {
 		ansi += data;
-		plain += stripANSI(data);
 		events.push({ type: "output", elapsedMs: Date.now() - startedAt, bytes: data.length });
 	});
 	child.onExit((event) => {
@@ -313,7 +308,9 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	let abortObserved = false;
 	const abortStartedPath = join(cwd, ".debug", "platform-smoke", "abort-started.txt");
 	while (Date.now() - startedAt < waitMs) {
-		const currentPlain = plain;
+		// PTY chunks may split an OSC-8 link. Strip the complete captured stream,
+		// not individual chunks, and preserve the label between open/close links.
+		const currentPlain = stripVTControlCharacters(ansi);
 		const responsePlain = currentPlain.slice(responseStartOffset);
 		if (finalMarker && responsePlain.includes(finalMarker)) finalMarkerSeen = true;
 		if (finalMarkerSeen && sessionJsonlMeetsRequirements(sessionDir, scenario) && sessionJsonlHasAssistantMarker(sessionDir, finalMarker)) {
@@ -364,6 +361,7 @@ async function runPtyPi({ artifactDir, ptyCommand, env, cwd, sessionDir, finalMa
 	await waitForSessionJsonl(sessionDir, null, startedAt, events);
 	await delay(1_000);
 
+	const plain = stripVTControlCharacters(ansi);
 	writeRedactedTextFile(join(artifactDir, "terminal.ansi"), ansi);
 	writeRedactedTextFile(join(artifactDir, "terminal.txt"), plain);
 	writeFileSync(join(artifactDir, "pty.events.jsonl"), events.map((event) => JSON.stringify(event)).join("\n") + "\n");
@@ -441,7 +439,9 @@ function writeJsonlArtifacts(artifactDir, sessionDir) {
 	const jsonlFiles = findJsonlFiles(sessionDir);
 	writeRedactedTextFile(join(artifactDir, "session-jsonl-files.txt"), jsonlFiles.join("\n") + (jsonlFiles.length ? "\n" : ""));
 	if (jsonlFiles[0]) {
-		writeRedactedTextFile(join(artifactDir, "session.jsonl"), readFileSync(jsonlFiles[0], "utf8"));
+		// The bundle boundary secret-scans structured evidence before transport.
+		// Text redaction here corrupts JSON escaping and numeric fields.
+		copyFileSync(jsonlFiles[0], join(artifactDir, "session.jsonl"));
 	}
 	return jsonlFiles;
 }

package/scripts/platform-smoke/pty-capture.mjs

@@ -8,6 +8,7 @@
 import { spawn } from "node:child_process";
 import { writeFileSync, appendFileSync, mkdirSync } from "node:fs";
 import { resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 
 const COLS = 150;
 const ROWS = 45;
@@ -27,7 +28,6 @@ export async function capturePTY(dir, command, opts = {}) {
 	const txtPath = resolve(dir, "terminal.txt");
 
 	let ansiBuffer = "";
-	let txtBuffer = "";
 
 	function appendEvent(event) {
 		appendFileSync(eventsPath, JSON.stringify(event) + "\n");
@@ -35,8 +35,6 @@ export async function capturePTY(dir, command, opts = {}) {
 	function appendOutput(data) {
 		const text = typeof data === "string" ? data : data.toString();
 		ansiBuffer += text;
-		// Strip ANSI for plain text
-		txtBuffer += stripANSI(text);
 	}
 
 	// Try node-pty first
@@ -79,7 +77,7 @@ export async function capturePTY(dir, command, opts = {}) {
 		});
 
 		writeFileSync(ansiPath, ansiBuffer);
-		writeFileSync(txtPath, txtBuffer);
+		writeFileSync(txtPath, stripVTControlCharacters(ansiBuffer));
 
 		return { code: code ?? (signal ? 1 : 0), signal, ansiPath, txtPath, eventsPath };
 	} else {
@@ -111,17 +109,12 @@ export async function capturePTY(dir, command, opts = {}) {
 		});
 
 		writeFileSync(ansiPath, ansiBuffer);
-		writeFileSync(txtPath, txtBuffer);
+		writeFileSync(txtPath, stripVTControlCharacters(ansiBuffer));
 
 		return { code: code ?? (signal ? 1 : 0), signal, ansiPath, txtPath, eventsPath };
 	}
 }
 
-/** Strip ANSI escape sequences from a string. */
-function stripANSI(str) {
-	return str.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "").replace(/\x1b\][^\x07]*\x07/g, "");
-}
-
 /** Self-test: can we create a simple PTY? */
 export async function ptySelfTest() {
 	const dir = resolve(process.cwd(), ".artifacts", "pty-self-test");

package/scripts/platform-smoke/render-ansi.mjs

@@ -7,6 +7,7 @@
 
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 
 import { buildTerminalHtml, writeTerminalScreenshot } from "../lib/cursor-visual-render.mjs";
 
@@ -14,14 +15,10 @@ const COLS = 150;
 const ROWS = 45;
 const HISTORY_LINES = 3_000;
 
-function stripANSI(text) {
-	return text.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "");
-}
-
 /** Render terminal.ansi to terminal.html using the shared xterm.js renderer. */
 export async function renderHTML(ansiPath, htmlPath, options = {}) {
 	const ansi = readFileSync(ansiPath, "utf8");
-	const plain = options.plain ?? stripANSI(ansi);
+	const plain = options.plain ?? stripVTControlCharacters(ansi);
 	const html = buildTerminalHtml({
 		ansi,
 		plain,

package/scripts/platform-smoke/target-runtime.mjs

@@ -11,6 +11,7 @@ import {
 } from "./artifact-bundle-contract.mjs";
 import { redactSecrets } from "./artifact-secrets.mjs";
 import {
+	scanArtifacts,
 	writeCommand,
 	writeExitCode,
 	writeManifest,
@@ -29,6 +30,12 @@ export function finalizeSuiteArtifacts(
 	summaryData,
 	expectedFiles,
 ) {
+	const malformed = scanArtifacts(suiteDir).filter(({ violation }) => violation.startsWith("invalid JSON"));
+	checks = [...checks, {
+		id: "structured-artifacts-parseable",
+		fn: () => malformed.length === 0,
+		error: malformed.map(({ file, violation }) => `${file}: ${violation}`).join("; "),
+	}];
 	const assertions = runAssertions(suiteDir, checks);
 	writeSummary(suiteDir, { ...summaryData, ok: assertions.ok });
 	const expected = assertions.ok

package/scripts/platform-smoke/targets.mjs

@@ -6,6 +6,7 @@
  */
 
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { scanArtifactSecrets } from "./artifact-secrets.mjs";
 import { resolve } from "node:path";
 
 import {
@@ -604,7 +605,8 @@ async function executeLiveSuite(config, targetName, suiteName, suiteDir, slug, l
 			},
 		}));
 	const violations = [
-		...scanForSecrets(result.stdout + result.stderr + terminalText + jsonlRaw).map((violation) => ({ file: "process-output", violation })),
+		...scanForSecrets(result.stdout + result.stderr + terminalText).map((violation) => ({ file: "process-output", violation })),
+		...scanArtifactSecrets(jsonlPath, jsonlRaw).map((violation) => ({ file: "artifacts/session.jsonl", violation })),
 		...bundle.violations,
 		...scanArtifacts(suiteDir),
 	];

package/src/cursor-provider-live-run-drain.ts

@@ -181,14 +181,16 @@ function emitCursorNativeToolUseTurn(
 	const shouldTerminate = run.done && !run.finalText?.trim() && !cursorLiveRuns.peekEvent(run);
 	for (const tool of tools) {
 		const contentIndex = partial.content.length;
+		// Pi persists JSON arguments: keep the completed call identical to its wire delta.
+		const serializedArgs = JSON.stringify(tool.args);
 		partial.content.push({
 			type: "toolCall",
 			id: tool.id,
 			name: tool.toolName,
-			arguments: tool.args,
+			arguments: JSON.parse(serializedArgs),
 		});
 		stream.push({ type: "toolcall_start", contentIndex, partial });
-		stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(tool.args), partial });
+		stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
 		const block = partial.content[contentIndex];
 		if (block.type === "toolCall") stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });
 		if (recordCursorNativeToolDisplay({ ...tool, terminate: shouldTerminate })) {
@@ -237,14 +239,15 @@ function emitCursorBridgeToolUseTurn(
 ): void {
 	for (const request of requests) {
 		const contentIndex = partial.content.length;
+		const serializedArgs = JSON.stringify(request.args);
 		partial.content.push({
 			type: "toolCall",
 			id: request.piToolCallId,
 			name: request.piToolName,
-			arguments: request.args,
+			arguments: JSON.parse(serializedArgs),
 		});
 		stream.push({ type: "toolcall_start", contentIndex, partial });
-		stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(request.args), partial });
+		stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
 		const block = partial.content[contentIndex];
 		if (block.type === "toolCall") stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });
 	}