pi-cursor-sdk 0.3.8 → 0.3.9

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.3.9 - 2026-09-19
+
+### Fixed
+
+- Serialize replay tool-call arguments once at the Pi transcript boundary to satisfy Pi 0.86.1's JSON-only contract without sharing mutable SDK payloads.
+- Preserve secret-scanned JSON and JSONL smoke artifacts byte-for-byte, and fail qualification when retained structured evidence cannot be parsed.
+
+### Changed
+
+- Restore the compiled `dist/index.js` Pi entrypoint and the pre-0.3.8 tool-argument handling. Released Pi 0.85.1 did not require the source-loader or newer transcript-type changes.
+- Remove the additional source-host compatibility matrix, probes, and compaction qualification added with 0.3.8. Keep the terminal capture detector fix, which corrects QA evidence rather than runtime rendering.
+- Extension filters changed for 0.3.8 must target `dist/index.js` again. Keep exclusions for both entrypoints when disabling Cursor across versions; see README's “Existing extension filters”.
+
 ## 0.3.8 - 2026-09-19
 
 ### Fixed

package/README.md

@@ -72,12 +72,9 @@ pi install https://github.com/fitchmultz/pi-cursor-sdk
 
 ### Existing extension filters
 
-The Pi entrypoint is now `src/index.ts`. Update any filters in this package's `extensions` setting that target the old `dist/` entry, preserving their include/exclude intent:
+The Pi entrypoint is `dist/index.js`. If you changed extension filters for 0.3.8's `src/index.ts` entrypoint, restore their compiled-entry equivalents: `+src/index.ts` → `+dist/index.js`, `-src/index.ts` → `-dist/index.js`, and `!src/**` → `!dist/**`.
 
-- Exact filters: `+dist/index.js` → `+src/index.ts`; `-dist/index.js` → `-src/index.ts`.
-- Glob filters: for example, `dist/**` → `src/**` and `!dist/**` → `!src/**`. Adjust other old-dist patterns to match the new entrypoint with the same intent.
-
-To keep Cursor disabled across upgrades and rollback, retain `-dist/index.js` and add `-src/index.ts`; the old exclusion alone no longer disables Cursor. The package does not rewrite user or project settings.
+To keep Cursor disabled across both entrypoints, retain both `-src/index.ts` and `-dist/index.js`. The package does not rewrite user or project settings.
 
 ### Project-local install
 
@@ -100,13 +97,11 @@ Without `--approve`, the project-local extension still runs after Pi trusts the
 For development from this repository:
 
 ```bash
-npm install   # runs prepare to build dist/ for scripts and programmatic consumers
+npm install   # runs prepare, which compiles src/ into dist/ (the manifest entry pi loads)
 pi --approve -e . --model cursor/grok-4.6
 ```
 
-Pi loads the packaged `src/index.ts` graph through its native TypeScript loader. This keeps Pi imports bound to the running host even when another Pi version is installed alongside the extension. `dist/` remains shipped for scripts and programmatic consumers. After editing `src/`, run `npm run build` for validation and compiled consumers, then restart Pi.
-
-The host-identity fix adds initial startup/load work: three fresh-process loader measurements on macOS with Node 24.21.0, Pi fork `90e6`, a warm Jiti disk cache, and network denied took 0.85–1.24 s for source versus 0.08–0.13 s for dist. These are environment-specific loader timings, not full TUI startup measurements or timing guarantees. That host caches extension factories for the same cwd; the initial-load cost does not describe every in-process `/reload`.
+After editing `src/`, run `npm run build` before the next `pi -e .` run, or pi loads the previous build.
 
 ## Configure your Cursor SDK API key
 
@@ -684,6 +679,10 @@ Cursor native replay is a display enhancement for TUI sessions and structured JS
 
 ## Development
 
+The source qualification baseline is official Pi **0.86.1**, with optional wildcard host peers and Cursor SDK **1.0.27** unchanged. Run `npm ci --ignore-scripts` then `npm run check:compat` in an empty HOME/agent profile for credential-free qualification. This builds the manifest entry, runs existing type/unit/package checks, and tests the compiled provider's registration plus production prompt shaping against native Pi transcript/tool transitions. Replay arguments must match their JSON stream deltas. Tests use no live Cursor service.
+
+This is not Cursor authentication, desktop/cloud execution, visual, or all-platform release proof. The existing `smoke:platform:all` and applicable `smoke:cloud` gates remain required; a passing compatibility check does not make a runtime change release-ready. Older advertised Pi/Node floors require their own matrix evidence.
+
 Run checks:
 
 ```bash
@@ -719,7 +718,7 @@ npm install
 CURSOR_API_KEY="your-key" pi --approve -e . --model cursor/grok-4.6
 ```
 
-After editing `src/`, run `npm run build` for validation and compiled consumers, then restart Pi to load the changed source graph.
+After editing `src/`, run `npm run build` before the next `pi -e .` run, or pi loads the previous build.
 
 Maintainer design notes live in [`docs/cursor-model-ux-spec.md`](docs/cursor-model-ux-spec.md).
 

package/dist/cursor-provider-live-run-drain.js

@@ -9,7 +9,6 @@ import { trimCurrentTurnAlreadyEmittedCursorText } from "./cursor-run-final-text
 import { formatCursorSdkAbortMessage, resolveCursorSdkAbortCause } from "./cursor-provider-errors.js";
 import { formatInactiveCursorReplayTrace } from "./cursor-native-replay-trace.js";
 import { partitionNativeToolsByActiveContext } from "./cursor-native-replay-routing.js";
-import { isJsonObject } from "./cursor-record-utils.js";
 export const DEFAULT_CURSOR_NATIVE_REPLAY_IDLE_DISPOSE_MS = 5 * 60 * 1000;
 const CURSOR_NATIVE_REPLAY_TOOL_ID_PATTERN = /^(cursor-replay-\d+-\d+)-tool-\d+$/;
 let cursorNativeReplayIdleDisposeMs = DEFAULT_CURSOR_NATIVE_REPLAY_IDLE_DISPOSE_MS;
@@ -129,17 +128,17 @@ function emitCursorLiveQueuedEvent(turn, event, run) {
 function emitCursorNativeToolUseTurn(stream, partial, model, context, run, toolResultInputTokens, tools, debugRecorder) {
     const shouldTerminate = run.done && !run.finalText?.trim() && !cursorLiveRuns.peekEvent(run);
     for (const tool of tools) {
-        if (!isJsonObject(tool.args))
-            throw new Error("Cursor replay tool arguments must be a JSON object");
         const contentIndex = partial.content.length;
+        // Pi persists JSON arguments: keep the completed call identical to its wire delta.
+        const serializedArgs = JSON.stringify(tool.args);
         partial.content.push({
             type: "toolCall",
             id: tool.id,
             name: tool.toolName,
-            arguments: tool.args,
+            arguments: JSON.parse(serializedArgs),
         });
         stream.push({ type: "toolcall_start", contentIndex, partial });
-        stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(tool.args), partial });
+        stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
         const block = partial.content[contentIndex];
         if (block.type === "toolCall")
             stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });
@@ -175,17 +174,16 @@ function emitInactiveCursorReplayTrace(turn, tools, debugRecorder) {
 }
 function emitCursorBridgeToolUseTurn(stream, partial, model, context, run, toolResultInputTokens, requests) {
     for (const request of requests) {
-        if (!isJsonObject(request.args))
-            throw new Error("Cursor bridge tool arguments must be a JSON object");
         const contentIndex = partial.content.length;
+        const serializedArgs = JSON.stringify(request.args);
         partial.content.push({
             type: "toolCall",
             id: request.piToolCallId,
             name: request.piToolName,
-            arguments: request.args,
+            arguments: JSON.parse(serializedArgs),
         });
         stream.push({ type: "toolcall_start", contentIndex, partial });
-        stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(request.args), partial });
+        stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
         const block = partial.content[contentIndex];
         if (block.type === "toolCall")
             stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });

package/dist/cursor-record-utils.js

@@ -1,22 +1,3 @@
-/** Narrow untyped SDK/MCP arguments at the Pi transcript boundary without rewriting them. */
-export function isJsonObject(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        && isJsonValue(value, new Set());
-}
-function isJsonValue(value, ancestors) {
-    if (value === null || typeof value === "string" || typeof value === "boolean")
-        return true;
-    if (typeof value === "number")
-        return Number.isFinite(value);
-    if (typeof value !== "object" || ancestors.has(value))
-        return false;
-    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
-        return false;
-    ancestors.add(value);
-    const valid = Object.values(value).every(entry => isJsonValue(entry, ancestors));
-    ancestors.delete(value);
-    return valid;
-}
 export function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 }

package/docs/cursor-dogfood-checklist.md

@@ -4,7 +4,7 @@ Short maintainer checklist for **minimal-surface** validation after prompt, brid
 
 ## Minimal environment
 
-- Build first after any `src/` edit: `npm run build` (validation and compiled-script consumers); restart Pi to load the changed `src/index.ts` manifest graph
+- Build first after any `src/` edit: `npm run build` (the pi manifest loads compiled `dist/`)
 - Extension only: `pi --approve -e . --cursor-no-fast --model cursor/grok-4.6`
 - Fresh session dir: `--session-dir /tmp/pi-cursor-dogfood-<id>`
 - Baseline surface (no ambient Cursor MCP/rules):

package/docs/cursor-live-smoke-checklist.md

@@ -8,7 +8,7 @@ Use this manual checklist during development and debugging of Cursor provider/ru
 
 ## Inner-loop rule
 
-- Build first: `npm run build` after any `src/` edit validates emit and updates `dist/` for scripts/programmatic consumers. Pi loads the packaged `src/index.ts` graph; restart Pi after source changes. The cloud/steering/local-resume/provider-debug launchers rebuild automatically even when run directly with `node scripts/...`; `smoke:live`/`smoke:visual`/`smoke:isolated` build via their npm scripts. Packed-install gates must exercise the tarball's actual manifest, not a checkout path.
+- Build first: `npm run build` after any `src/` edit — the pi manifest loads compiled `dist/`, so unbuilt runs validate stale code. (the cloud/steering/local-resume/provider-debug launchers rebuild automatically even when run directly with `node scripts/...`; `smoke:live`/`smoke:visual`/`smoke:isolated` build via their npm scripts; direct `pi -e .` invocations do not build.)
 - Run from a clean working tree except for the intended branch diff.
 - Use the local extension under test: `pi --approve -e . --cursor-no-fast --model cursor/grok-4.6`.
 - Use a temporary `--session-dir` for every run.

package/docs/cursor-testing-lessons.md

@@ -54,22 +54,6 @@ If resync runs but `context.tools` is still stale (e.g. only `read` listed), the
 
 The test covers bootstrap/incremental prompts, empty-vs-absent request tools, native replay/drain, cloud fresh/bootstrap selection, and actual host prompt serialization for context files and skills. It is offline contract evidence, not a replacement for the required live platform/cloud release gates.
 
-### Native package identity regression
-
-Pi's manifest loads the shipped `src/index.ts` graph, while scripts and programmatic consumers retain `dist/`. Native ESM imports of compiled JS can bypass Pi's host-peer aliases when another Pi version is installed beside the extension. A TypeScript wrapper around compiled JS does not fix transitive ownership. Do not remove local peers or use an import hook to turn this regression green.
-
-`test/native-package-host.test.ts` packs and normally installs the package with both 0.84.0 and 0.85.1 peers, then exercises the actual manifest via the installed development host's SDK and CLI (including the bundled CLI when shipped by that host; Pi 0.84 ships only the modular CLI). It also checks a minimal native managed install. For each additional pinned host, run the same offline probe against the installed tarball (not this checkout):
-
-```bash
-node scripts/check-pi-host-runtime.mjs /path/to/pi-coding-agent /path/to/installed/pi-cursor-sdk --out=/new/evidence/sdk
-node scripts/check-pi-host-runtime.mjs /path/to/pi-coding-agent /path/to/installed/pi-cursor-sdk --cli=modular --out=/new/evidence/modular
-node scripts/check-pi-host-runtime.mjs /path/to/pi-coding-agent /path/to/installed/pi-cursor-sdk --cli=bundled --out=/new/evidence/bundled
-```
-
-The probe asserts host stream identity, ordinary prompt/tool replay, recorded native tool emission and replay execution without reading the fixture path, final drain, lazy bridge/SDK/SQLite imports and bundled ripgrep lookup. The SDK lane also invokes the actual manifest-registered provider callback with no key, requiring the expected auth preflight error before SDK execution. It uses no import redirection and makes no Cursor requests. The recorded tool fixture is offline replay evidence, not a claim of a live SDK tool call.
-
-Every host must pass the common provider, context and replay checks. Add `--verify-fork-checkpoints` only to qualify the fork's native `SystemMessage.replace` support; explicit qualification fails on hosts lacking those semantics or transcript helpers. This additional host check is not a Cursor requirement. Published Pi 0.85.1 uses its supported shorthand context instead of synthetic transcript messages. None of these probes replaces the live platform gate.
-
 ## Auth: use `auth.json`, not only env
 
 pi resolves Cursor auth in this order:
@@ -193,8 +177,6 @@ Session summaries can hide per-message usage bugs. When investigating token or c
 
 The compaction poison fixture mirrors the observed failure shape: one assistant message with `RunResult`-sized input/cache-read counts near 1M immediately before compaction. Regression coverage should prove that such usage falls back to bounded pi estimates before it reaches `AssistantMessage.usage`.
 
-Compaction continuity needs content evidence, not just a new agent ID or a successful recall reply. The compaction smoke checks the returned and persisted summaries for the exact marker before recall, verifies the original user was cut and the native kept context has no other marker source, and checks the actual bootstrap inputs too. Both post-compaction and restart recall reject tool calls: retained session/debug files must not become a filesystem fallback. Keep the raw summary and journals on failure as well as success; an unchanged later model success does not erase an earlier summary-content failure or prove a deterministic provider fix.
-
 ### False-positive edge case (2026-05-23)
 
 Plan-strip live smoke can make Cursor `read` testing docs that *document* replay failure strings. A naive whole-record JSON scan reported four failures from one successful `read` toolResult (`isError: false`).

package/docs/platform-smoke.md

@@ -206,7 +206,7 @@ The copy/switch lane copies a session file containing resume custom entries, swi
 
 The fallback lane rewrites a persisted handle to a missing local SDK `agent-*`, verifies create+bootstrap fallback, and asserts the continuity notice is emitted in `pi-stream-events.jsonl`.
 
-The compaction lane uses an isolated temp pi settings file with `compaction.keepRecentTokens: 1` to force manual compaction without huge dummy prompts. Before recall, it requires the exact marker in both the returned and native persisted summary, agreement on the kept boundary, and removal of the original marker-bearing user from the kept context. Native `get_messages` and the subsequent captured provider inputs must supply the marker only through that summary. The post-compaction agent must bootstrap without reusing the baseline or captured summarizer agents, persist `compactionGeneration: 1`, and resume as the same agent after restart. Both recall turns must return the marker without tool calls, so searching retained QA files cannot satisfy continuity. The lane retains its journals/debug artifacts and `compaction-boundary.json` on success and failure.
+The compaction lane uses an isolated temp pi settings file with `compaction.keepRecentTokens: 1` to force manual compaction without huge dummy prompts. It verifies the pre-compaction SDK agent is not reused, the new handle records `compactionGeneration: 1`, and restart resumes the post-compaction agent.
 
 The default/opt-out lane verifies the built-in local resume default resumes, then verifies `PI_CURSOR_LOCAL_RESUME=0` opts out and creates a new agent while bootstrapping the transcript.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-cursor-sdk",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "pi provider extension backed by @cursor/sdk local and cloud agents",
   "author": "Mitch Fultz (https://github.com/fitchmultz)",
   "license": "MIT",
@@ -120,6 +120,7 @@
     "node": ">=22.19.0"
   },
   "scripts": {
+    "check:compat": "npm run build && npm run verify && node --test test/native-provider.test.mjs",
     "build": "node ./scripts/build.mjs",
     "prepare": "node ./scripts/prepare.mjs",
     "typecheck": "npm run typecheck:src && npm run typecheck:tests && npm run typecheck:replay-compile",
@@ -175,9 +176,9 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.84.0",
-    "@earendil-works/pi-coding-agent": "0.84.0",
-    "@earendil-works/pi-tui": "0.84.0",
+    "@earendil-works/pi-ai": "0.86.1",
+    "@earendil-works/pi-coding-agent": "0.86.1",
+    "@earendil-works/pi-tui": "0.86.1",
     "@xterm/xterm": "^6.0.0",
     "node-pty": "^1.1.0",
     "playwright": "^1.60.0",
@@ -187,7 +188,7 @@
   },
   "pi": {
     "extensions": [
-      "./src/index.ts"
+      "./dist/index.js"
     ]
   },
   "allowScripts": {

package/scripts/build.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /**
- * Purpose: Produce compiled runtime files for scripts and programmatic consumers.
- * Pi's manifest loads the shipped source graph through its native TypeScript loader.
+ * Purpose: Produce the compiled runtime files that the Pi extension manifest loads.
  * Responsibilities: Run TypeScript emit into a staging directory, then atomically swap it
  * into dist/ so a failed TypeScript emit never destroys a previously working dist.
  * Usage: `npm run build`; also invoked by scripts/prepare.mjs during install lifecycles.

package/scripts/lib/local-resume-smoke-harness.mjs

@@ -307,7 +307,7 @@ function metadataFiles(artifactDir) {
 	return files.sort((a, b) => statSync(a).mtimeMs - statSync(b).mtimeMs);
 }
 
-export function readMetadataSince(artifactDir, seenPaths) {
+function readMetadataSince(artifactDir, seenPaths) {
 	return metadataFiles(artifactDir)
 		.filter((metadataPath) => !seenPaths.has(metadataPath))
 		.map((metadataPath) => ({
@@ -383,6 +383,11 @@ export function resumeEntryCount(entries) {
 	return resumeEntries(entries).length;
 }
 
+export function compactionEntryCount(entries) {
+	return (entries.entries ?? []).filter((entry) => entry?.type === "compaction")
+		.length;
+}
+
 function entryText(entry) {
 	const content = entry?.message?.content;
 	if (typeof content === "string") return content;

package/scripts/local-resume-smoke.mjs

@@ -8,6 +8,7 @@ import {
 	assistantEntryContaining,
 	buildLocalResumeSmokeEnv,
 	cleanupArtifactRoot,
+	compactionEntryCount,
 	createRunContext,
 	fail,
 	getEntries,
@@ -16,7 +17,6 @@ import {
 	parseTimeout,
 	promptAbortAndRead,
 	promptAndRead,
-	readMetadataSince,
 	reportFailure,
 	resumeEntries,
 	scrubSmokeText,
@@ -514,33 +514,10 @@ async function runCompactionSmoke() {
 			});
 			assertTurnMetadata("compaction baseline", baseline, { resumedAgent: false });
 			preCompactionAgentId = baseline.metadata.run.agentId;
-			const originalUser = userEntryContaining(await getEntries(rpc), marker);
-			if (!originalUser) fail("compaction baseline did not persist the marker-bearing user message");
 			const result = await rpcData(rpc, "compact", { customInstructions: `Preserve the exact marker ${marker}.` }, timeoutMs);
+			if (!result.summary || typeof result.tokensBefore !== "number") fail("manual compaction did not return a summary result", JSON.stringify(result, null, 2));
 			const compactedEntries = await getEntries(rpc);
-			const compaction = compactedEntries.entries.findLast((entry) => entry.type === "compaction");
-			const active = await rpcData(rpc, "get_messages");
-			const summarizerTurns = readMetadataSince(artifactRoot, seenMetadata);
-			// Save the native boundary before assertions or any recall turn can inspect files.
-			const boundaryPath = join(artifactRoot, "compaction-boundary.json");
-			writeFileSync(boundaryPath, JSON.stringify({ result, compaction, originalUserEntryId: originalUser.id, activeMessages: active.messages, summarizerTurns }, null, 2));
-			if (typeof result.summary !== "string" || typeof result.tokensBefore !== "number") fail("manual compaction did not return a summary result", boundaryPath);
-			if (!result.summary.includes(marker)) fail("returned compaction summary lost the exact marker", boundaryPath);
-			if (!compaction) fail("manual compaction did not append a compaction entry", boundaryPath);
-			if (typeof compaction.summary !== "string" || !compaction.summary.includes(marker)) fail("persisted compaction summary lost the exact marker", boundaryPath);
-			if (compaction.summary !== result.summary || compaction.firstKeptEntryId !== result.firstKeptEntryId) fail("returned and persisted compaction boundaries disagree", boundaryPath);
-			const originalIndex = compactedEntries.entries.findIndex((entry) => entry.id === originalUser.id);
-			const keptIndex = compactedEntries.entries.findIndex((entry) => entry.id === compaction.firstKeptEntryId);
-			const compactionIndex = compactedEntries.entries.indexOf(compaction);
-			if (originalIndex < 0 || keptIndex <= originalIndex || keptIndex >= compactionIndex) fail("compaction did not move the kept boundary past the original marker-bearing user", boundaryPath);
-			// Ask the host for its active messages; do not reproduce its cut/replay algorithm.
-			const summaryMessage = active.messages.find((message) => message.role === "compactionSummary" && message.summary === compaction.summary);
-			if (!summaryMessage) fail("native active context does not contain the persisted compaction summary", boundaryPath);
-			if (active.messages.some((message) => message !== summaryMessage && JSON.stringify(message).includes(marker))) fail("kept context independently supplies the compaction marker", boundaryPath);
-			for (const turn of summarizerTurns) {
-				assertNotResumedFrom("compaction summarizer", turn, preCompactionAgentId);
-				seenMetadata.add(turn.metadataPath);
-			}
+			if (compactionEntryCount(compactedEntries) < 1) fail("manual compaction did not append a compaction entry");
 
 			const postCompaction = await promptAndRead({
 				rpc,
@@ -550,19 +527,6 @@ async function runCompactionSmoke() {
 				seenMetadata,
 			});
 			assertNotResumedFrom("post-compaction turn", postCompaction, preCompactionAgentId);
-			for (const turn of summarizerTurns) assertNotResumedFrom("post-compaction turn versus summarizer", postCompaction, turn.metadata.run.agentId);
-			if (postCompaction.metadata.providerMeta?.sendPlan?.mode !== "bootstrap") fail("post-compaction turn did not bootstrap the compacted context", postCompaction.metadataPath);
-			// Inspect the actual provider inputs too: the native summary must be the only marker source.
-			const postDir = dirname(postCompaction.metadataPath);
-			const escapedSummary = JSON.stringify(compaction.summary).slice(1, -1);
-			for (const file of ["context-snapshot.json", "send-payload.json"]) {
-				const path = join(postDir, file);
-				const input = JSON.stringify(JSON.parse(readFileSync(path, "utf8")));
-				if (!input.includes(escapedSummary)) fail("post-compaction input omitted the persisted summary", path);
-				if (input.replace(escapedSummary, "").includes(marker)) fail("post-compaction input independently supplies the marker outside the summary", path);
-			}
-			const postSteps = readFileSync(join(postDir, "on-step.jsonl"), "utf8").split("\n").filter(Boolean).map(JSON.parse);
-			if (postSteps.some((row) => row.step?.type === "toolCall")) fail("post-compaction recall used tools instead of summary-only recall", postCompaction.metadataPath);
 			if (!postCompaction.text.includes(`MARKER=${marker}`)) fail("post-compaction turn did not recall marker", JSON.stringify({ expected: `MARKER=${marker}`, actual: postCompaction.text }, null, 2));
 			postCompactionAgentId = postCompaction.metadata.run.agentId;
 			const postHandle = latestResumeEntry(await getEntries(rpc));
@@ -580,14 +544,11 @@ async function runCompactionSmoke() {
 			});
 			assertTurnMetadata("post-compaction restart", restart, { resumedAgent: true });
 			if (restart.metadata.run.agentId !== postCompactionAgentId) fail("post-compaction restart did not resume the post-compaction agent", JSON.stringify({ expected: postCompactionAgentId, actual: restart.metadata.run.agentId }, null, 2));
-			const restartSteps = readFileSync(join(dirname(restart.metadataPath), "on-step.jsonl"), "utf8").split("\n").filter(Boolean).map(JSON.parse);
-			if (restartSteps.some((row) => row.step?.type === "toolCall")) fail("post-compaction restart used tools instead of recalling the marker", restart.metadataPath);
-			if (!restart.text.includes(`MARKER=${marker}`)) fail("post-compaction restart did not recall marker", JSON.stringify({ expected: `MARKER=${marker}`, actual: restart.text }, null, 2));
 		});
 		console.log("local-resume-compaction-smoke-ok");
 		console.error(scrubSmokeText(`[local-resume-smoke] pre-compaction ${preCompactionAgentId} replaced by and resumed post-compaction ${postCompactionAgentId}`));
 	} finally {
-		console.error(scrubSmokeText(`[local-resume-smoke] retained compaction evidence: ${artifactRoot}`));
+		cleanupArtifactRoot(artifactRoot);
 	}
 }
 

package/scripts/platform-smoke/artifact-secrets.mjs

@@ -71,6 +71,60 @@ export function redactSecrets(text) {
 	return redacted;
 }
 
+/** JSON syntax is not secret material. Scan decoded scalar values with the same
+ * canonical rules, retaining key/value context for auth fields. Never regex-scrub
+ * a serialized document: escaped quotes, numeric tokens and scoped names break. */
+export function scanArtifactSecrets(path, content) {
+	if (!/\.jsonl?$/i.test(path) || isBinaryArtifactContent(content)) return scanForSecrets(content);
+	const text = String(content);
+	const documents = /\.jsonl$/i.test(path) ? text.split(/\r?\n/).filter((line) => line.trim()) : [text];
+	try {
+		for (const document of documents) JSON.parse(document);
+	} catch {
+		// Malformed evidence is never repaired. Scan its bytes and let the
+		// structural gate report it independently (without echoing input).
+		return scanForSecrets(content);
+	}
+	const violations = new Set();
+	const scan = (value) => scanForSecrets(value).forEach((violation) => violations.add(violation));
+	for (const document of documents) {
+		// Native JSON validation above owns grammar. Scan the original tokens, not
+		// the parsed object: duplicate members (including entire subtrees) survive
+		// in transported bytes even though JSON.parse overwrites them.
+		let key;
+		for (const match of document.matchAll(/("(?:[^"\\]|\\.)*")(\s*:)?|[{}\[\],]|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/g)) {
+			const token = match[1] ?? match[0];
+			if ("{}[],".includes(token)) {
+				key = undefined;
+				continue;
+			}
+			// Decode string escapes, but retain number spelling (no rounding/overflow).
+			const value = match[1] ? JSON.parse(token) : token;
+			scan(value);
+			if (match[2]) key = value;
+			else {
+				// A space after ':' keeps syntax from looking like SCP credentials.
+				if (key !== undefined) scan(`${JSON.stringify(key)}: ${match[1] ? JSON.stringify(value) : token}`);
+				key = undefined;
+			}
+		}
+	}
+	return [...violations];
+}
+
+export function structuredArtifactViolations(path, content) {
+	if (!/\.jsonl?$/i.test(path)) return [];
+	const lines = /\.jsonl$/i.test(path) ? String(content).split(/\r?\n/) : [String(content)];
+	const violations = [];
+	for (const [index, line] of lines.entries()) {
+		if (/\.jsonl$/i.test(path) && !line.trim()) continue;
+		try { JSON.parse(line); } catch {
+			violations.push(/\.jsonl$/i.test(path) ? `invalid JSONL at line ${index + 1}` : "invalid JSON");
+		}
+	}
+	return violations;
+}
+
 export function isBinaryArtifactContent(value) {
 	return Buffer.isBuffer(value) && (!isUtf8(value) || value.includes(0));
 }

package/scripts/platform-smoke/artifacts.mjs

@@ -18,7 +18,7 @@ import {
 	boundedFileSnapshot, openRegularFileNoFollow, walkArtifactTree,
 	writeBundleSpillFile, writeExtractedFiles,
 } from "./artifact-fs-safety.mjs";
-import { isBinaryArtifactContent, redactSecrets, scanForSecrets } from "./artifact-secrets.mjs";
+import { isBinaryArtifactContent, redactSecrets, scanArtifactSecrets, scanForSecrets, structuredArtifactViolations } from "./artifact-secrets.mjs";
 
 export {
 	MAX_BUNDLE_AGGREGATE_BYTES, MAX_BUNDLE_FILE_BYTES, MAX_BUNDLE_FILE_COUNT,
@@ -182,7 +182,7 @@ export function scanArtifacts(dir) {
 				failures.push({ file, violation: `artifact scan ${snapshot.reason}` });
 				return;
 			}
-			for (const violation of scanForSecrets(snapshot.content)) findings.push({ file, violation });
+			for (const violation of [...scanArtifactSecrets(path, snapshot.content), ...structuredArtifactViolations(path, snapshot.content)]) findings.push({ file, violation });
 		},
 	});
 	return failures.length > 0 ? failures : findings;
@@ -265,7 +265,7 @@ export function buildPlatformArtifactBundle(root, pathPrefix = "") {
 				return;
 			}
 			const { content } = snapshot;
-			for (const violation of scanForSecrets(content)) findings.push({ file, violation });
+			for (const violation of scanArtifactSecrets(path, content)) findings.push({ file, violation });
 			if (pathViolations.length > 0 || !shouldTransportBundleFile(canonicalRoot, path, pathPrefix)) return;
 			if (isBinaryArtifactContent(content)) {
 				limitReasons.push("binary-content");
@@ -308,7 +308,7 @@ function validatePlatformArtifactBundle(bundle) {
 		aggregateBytes += file.size;
 		if (aggregateBytes > MAX_BUNDLE_AGGREGATE_BYTES) return undefined;
 		const content = decodeCanonicalBase64(file.contentBase64, file.size);
-		if (!content || content.length !== file.size || isBinaryArtifactContent(content) || scanForSecrets(content).length > 0) return undefined;
+		if (!content || content.length !== file.size || isBinaryArtifactContent(content) || scanArtifactSecrets(file.path, content).length > 0) return undefined;
 		files.push({ path: file.path, content });
 	}
 	for (const path of paths) {
@@ -406,9 +406,12 @@ export function extractPlatformArtifactBundle(outputDir, stdout) {
 
 	const files = [];
 	const violations = [];
+	let structuredValid = true;
 	for (const file of decodedFiles) {
 		const text = file.content.toString("utf8");
-		violations.push(...scanForSecrets(file.content).map((violation) => ({ file: file.path, violation })));
+		const malformed = structuredArtifactViolations(file.path, file.content);
+		structuredValid &&= malformed.length === 0;
+		violations.push(...malformed.map((violation) => ({ file: file.path, violation })));
 		if (file.path.endsWith("redaction-violations.json")) {
 			try {
 				const parsed = JSON.parse(text);
@@ -417,11 +420,13 @@ export function extractPlatformArtifactBundle(outputDir, stdout) {
 				})));
 			} catch {}
 		}
-		files.push({ path: file.path, content: Buffer.from(redactSecrets(text)) });
+		// validatePlatformArtifactBundle already secret-scanned these bytes.
+		// Keep even malformed evidence verbatim for diagnosis; never repair it.
+		files.push({ path: file.path, content: /\.jsonl?$/i.test(file.path) ? file.content : Buffer.from(redactSecrets(text)) });
 	}
 
 	const succeeded = writeExtractedFiles(outputDir, files);
-	return succeeded ? { ok: true, violations } : failed;
+	return succeeded ? { ok: structuredValid, violations } : failed;
 }
 
 function collectFiles(root) {

package/scripts/platform-smoke/live-suite-runner.mjs

@@ -439,7 +439,9 @@ function writeJsonlArtifacts(artifactDir, sessionDir) {
 	const jsonlFiles = findJsonlFiles(sessionDir);
 	writeRedactedTextFile(join(artifactDir, "session-jsonl-files.txt"), jsonlFiles.join("\n") + (jsonlFiles.length ? "\n" : ""));
 	if (jsonlFiles[0]) {
-		writeRedactedTextFile(join(artifactDir, "session.jsonl"), readFileSync(jsonlFiles[0], "utf8"));
+		// The bundle boundary secret-scans structured evidence before transport.
+		// Text redaction here corrupts JSON escaping and numeric fields.
+		copyFileSync(jsonlFiles[0], join(artifactDir, "session.jsonl"));
 	}
 	return jsonlFiles;
 }

package/scripts/platform-smoke/target-runtime.mjs

@@ -11,6 +11,7 @@ import {
 } from "./artifact-bundle-contract.mjs";
 import { redactSecrets } from "./artifact-secrets.mjs";
 import {
+	scanArtifacts,
 	writeCommand,
 	writeExitCode,
 	writeManifest,
@@ -29,6 +30,12 @@ export function finalizeSuiteArtifacts(
 	summaryData,
 	expectedFiles,
 ) {
+	const malformed = scanArtifacts(suiteDir).filter(({ violation }) => violation.startsWith("invalid JSON"));
+	checks = [...checks, {
+		id: "structured-artifacts-parseable",
+		fn: () => malformed.length === 0,
+		error: malformed.map(({ file, violation }) => `${file}: ${violation}`).join("; "),
+	}];
 	const assertions = runAssertions(suiteDir, checks);
 	writeSummary(suiteDir, { ...summaryData, ok: assertions.ok });
 	const expected = assertions.ok

package/scripts/platform-smoke/targets.mjs

@@ -6,6 +6,7 @@
  */
 
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { scanArtifactSecrets } from "./artifact-secrets.mjs";
 import { resolve } from "node:path";
 
 import {
@@ -604,7 +605,8 @@ async function executeLiveSuite(config, targetName, suiteName, suiteDir, slug, l
 			},
 		}));
 	const violations = [
-		...scanForSecrets(result.stdout + result.stderr + terminalText + jsonlRaw).map((violation) => ({ file: "process-output", violation })),
+		...scanForSecrets(result.stdout + result.stderr + terminalText).map((violation) => ({ file: "process-output", violation })),
+		...scanArtifactSecrets(jsonlPath, jsonlRaw).map((violation) => ({ file: "artifacts/session.jsonl", violation })),
 		...bundle.violations,
 		...scanArtifacts(suiteDir),
 	];

package/src/cursor-provider-live-run-drain.ts

@@ -28,7 +28,6 @@ import { formatCursorSdkAbortMessage, resolveCursorSdkAbortCause } from "./curso
 import { formatInactiveCursorReplayTrace } from "./cursor-native-replay-trace.js";
 import { partitionNativeToolsByActiveContext } from "./cursor-native-replay-routing.js";
 import type { CursorSdkEventDebugRecorder } from "./cursor-sdk-event-debug.js";
-import { isJsonObject } from "./cursor-record-utils.js";
 
 export const DEFAULT_CURSOR_NATIVE_REPLAY_IDLE_DISPOSE_MS = 5 * 60 * 1000;
 const CURSOR_NATIVE_REPLAY_TOOL_ID_PATTERN = /^(cursor-replay-\d+-\d+)-tool-\d+$/;
@@ -181,16 +180,17 @@ function emitCursorNativeToolUseTurn(
 ): void {
 	const shouldTerminate = run.done && !run.finalText?.trim() && !cursorLiveRuns.peekEvent(run);
 	for (const tool of tools) {
-		if (!isJsonObject(tool.args)) throw new Error("Cursor replay tool arguments must be a JSON object");
 		const contentIndex = partial.content.length;
+		// Pi persists JSON arguments: keep the completed call identical to its wire delta.
+		const serializedArgs = JSON.stringify(tool.args);
 		partial.content.push({
 			type: "toolCall",
 			id: tool.id,
 			name: tool.toolName,
-			arguments: tool.args,
+			arguments: JSON.parse(serializedArgs),
 		});
 		stream.push({ type: "toolcall_start", contentIndex, partial });
-		stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(tool.args), partial });
+		stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
 		const block = partial.content[contentIndex];
 		if (block.type === "toolCall") stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });
 		if (recordCursorNativeToolDisplay({ ...tool, terminate: shouldTerminate })) {
@@ -238,16 +238,16 @@ function emitCursorBridgeToolUseTurn(
 	requests: CursorPiBridgeToolRequest[],
 ): void {
 	for (const request of requests) {
-		if (!isJsonObject(request.args)) throw new Error("Cursor bridge tool arguments must be a JSON object");
 		const contentIndex = partial.content.length;
+		const serializedArgs = JSON.stringify(request.args);
 		partial.content.push({
 			type: "toolCall",
 			id: request.piToolCallId,
 			name: request.piToolName,
-			arguments: request.args,
+			arguments: JSON.parse(serializedArgs),
 		});
 		stream.push({ type: "toolcall_start", contentIndex, partial });
-		stream.push({ type: "toolcall_delta", contentIndex, delta: JSON.stringify(request.args), partial });
+		stream.push({ type: "toolcall_delta", contentIndex, delta: serializedArgs, partial });
 		const block = partial.content[contentIndex];
 		if (block.type === "toolCall") stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial });
 	}

package/src/cursor-record-utils.ts

@@ -1,22 +1,3 @@
-import type { JsonValue } from "@earendil-works/pi-ai";
-
-/** Narrow untyped SDK/MCP arguments at the Pi transcript boundary without rewriting them. */
-export function isJsonObject(value: unknown): value is Record<string, JsonValue> {
-	return value !== null && typeof value === "object" && !Array.isArray(value)
-		&& isJsonValue(value, new Set());
-}
-
-function isJsonValue(value: unknown, ancestors: Set<object>): boolean {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (typeof value !== "object" || ancestors.has(value)) return false;
-	if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return false;
-	ancestors.add(value);
-	const valid = Object.values(value).every(entry => isJsonValue(entry, ancestors));
-	ancestors.delete(value);
-	return valid;
-}
-
 export function asRecord(value: unknown): Record<string, unknown> | undefined {
 	return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
 }