pi-cursor-sdk 0.5.2 → 0.5.4

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+**Release preparation is not a publication receipt:** confirm the exact version, source and artifact integrity in npm/GitHub publication records before relying on availability. No issue is closed by preparation alone.
+
+## Unreleased
+
+## 0.5.4
+
+### Fixed
+
+- Identify 0.5.4 as the first candidate containing the native-tool opt-out and `/cursor-abort` from #372, and require an exact publication/installation check. Published npm 0.5.3 ignores that flag and lacks the command; a development version label is not proof of enforcement (#368).
+- Keep verified SDK bootstrap output filtered across detached rule/skill work and asynchronous reload gaps with a process-lifetime, versioned sink lease. Preserve unrelated output and expose bounded owner-scoped capability/hook warnings; unknown output is not universally suppressed (#367).
+- Isolate native auth/catalog fixtures from the official host's file-backed startup refresh-admission race. Use matching in-memory catalog state for extension-owned assertions; this is not an official-host startup repair (#357).
+- Skip credential-URL regex scans when required markers are absent, preserving the existing matching/redaction contract, including percent-encoded cases. Inputs containing both markers retain the existing regex behavior; no universal processing bound is claimed (#371).
+
+### Added
+
+- Add `/cursor-abort` as an explicit session-scoped release path for a pending local Cursor run after a native-tool policy mismatch. Ordinary mismatch remains restorable and never cancels implicitly; idle Pi abort has no active signal after the error has settled. Explicit active provider abort now also releases its captured scope's old pending run before preparation. Recovery never delivers stale Pi results, automatically sends a replacement turn, releases sibling scopes, or undoes already-executed work.
+
+- Add opt-in `PI_CURSOR_NATIVE_TOOLS=0` for MCP-only ordinary LOCAL agents using public SDK `tools: ["mcp"]`, excluding all other main tools including native task/subagents. Capture and forward the same policy for create/resume and split pooled/durable identities only on opt-out, and reject opposite-policy pending-run continuation before delivering Pi results; defaults and text-only summaries are unchanged. Cloud fails closed instead of ignoring the control. Keep Pi builtin exposure explicit, and document that native replay hooks/display flags cannot govern original execution, ambient configured MCP remains unless settings are disabled, and permitted Pi/MCP tools are not a sandbox (#368).
+
+- Add `PI_CURSOR_PI_TOOL_BRIDGE_HOST` (`localhost` or the default `127.0.0.1` in the bridge URL) and `PI_CURSOR_PI_TOOL_BRIDGE_PORT` (one port or an inclusive `N-M` range) so a Cursor team MCP allowlist such as `http://localhost:800*/mcp` can admit the pi tool bridge. The default still binds only `127.0.0.1`; opt-in `localhost` now requires owning both explicit loopbacks on the same port before advertising a URL, with partial-startup cleanup and lifetime-stable host policy. Unset settings keep the previous random-port behavior.
+
+### Changed
+
+- Refresh the fallback catalog from the authenticated SDK 1.0.37 catalog-only observation on 2026-10-22: 48 models, adding Gemini 4 Argon (`gemini-4-argon`) and Muse Wonder (`muse-wonder-1.0`) while preserving all 46 prior records. Keep the 33 bundled checkpoint-derived entries unchanged; no Agent/model turn or Cloud run was performed.
+- Prefer the currently exposed Pi tool capabilities, schemas and prompt guidelines instead of hardcoded historical MCP/delegation names. Dynamic registry mapping remains unchanged; this is not qualification of the original Windows bridge report (#206).
+- Rewrite the README around installation and everyday use, add a diagram of Cursor inside Pi, and move detailed configuration and maintainer procedures into linked reference pages.
+- Align locked development Pi snapshots and their resolved Pi cohort to 1.1.0 ([#353](https://github.com/fitchmultz/pi-cursor-sdk/pull/353)). This is development-only maintenance, not a user runtime Pi upgrade or a new npm publication. Node 24+, official Pi 0.87.1+, optional wildcard Pi/TypeBox peers, and exact unbundled Cursor SDK 1.0.37 remain unchanged; published 0.5.3 and historical qualification evidence retain their original source/version attribution.
+- Consolidate redundant tests and unused internal exports/wrappers while retaining native, installed-SDK and persistence boundary owners (#360, #363). Improve fixture contracts for user/custom start events without widening runtime APIs (#361). Make installed-SDK bootstrap-printer fixtures select and restore their terminal environment even under `TERM=dumb`, preserving ANSI and confinement assertions.
+- Use the reviewed automatic npm release workflow: an intentional versioned PR merged to main triggers qualification and publication without a new approval step. This candidate does not change publisher policy, authentication, protections or workflow pins (#362).
+
+### Security
+
+- Include the development-only Vite 8.3.1 → 8.3.4 lockfile update already merged in #369; no release-time dependency upgrade is added.
+
+### Verification and limits
+
+- The native-tool opt-out is the supported LOCAL SDK MCP-only tool surface, not interception of native replay or an OS sandbox. Configured MCP remains unless setting sources are narrowed, and permitted Pi/MCP tools can execute arbitrary work. Defaults and existing LOCAL text-only summary isolation remain unchanged; unsupported Cloud opt-out fails closed. No paid Cloud campaign is part of this release.
+- Runtime/source checks, package controls, catalog metadata, current-host offline CI and publication are distinct evidence. Preserve retained proof at its actual SDK/host/source identity. No original #173 hook rewrite, #206 Windows bridge readiness, #233 embedded loader, #247 idle recovery, #257 model narration or #339 signal-sender resolution is inferred from this candidate.
+
+## 0.5.3 - 2026-10-07
+
+### Changed
+
+- Upgrade the exact unbundled Cursor SDK and five optional platform pins to 1.0.37. Keep the SDK 1.0.36 catalog capture from 2026-10-06 and private hook canary attributed to their historical version.
+- Refresh the fallback catalog from the authenticated SDK 1.0.37 catalog-only observation on 2026-10-07: 46 models, adding Claude Haiku 5.5 (`claude-haiku-5-5`) with 20 thinking/context/effort variants while preserving all 45 prior model records. The 33 bundled checkpoint-derived entries remain unchanged; no Agent/model turn or Cloud run was performed.
+
+### Fixed
+
+- Map boolean `thinking` combined with either `effort` or `reasoning_effort` through native thinking controls. Haiku 5.5 now exposes all five catalog-supported enabled effort levels at both `@300k` and `@1m`; `off` sends `thinking=false` without the effort parameter. Verified offline against the captured SDK 1.0.37 catalog; no Agent/model turn or Cloud run was performed.
+- Select the declared TypeScript 7 entrypoint explicitly for all typechecks, matching the build and avoiding npm `tsc` shim collisions.
+- Separate SessionManager-owned runtime scopes from unchanged durable identities. A same-file sibling's reload/tree/shutdown no longer closes another manager's pool or pending bridge run; process-local claims exclude live handles from resume and cleanup (#282 reproduced trigger, not the original reporter's full qualification).
+- Label structured tool history as historical request/result/error without declaring unmatched requests completed. Preserve prose, IDs, arguments, errors and raw history; do not synthesize tool calls, strip narration or automatically resend effects (#257 mitigation).
+- Make `/cursor-tools` report current-registry exposure eligibility, not live-run connectivity. Add opt-in validated initialization and catalog-handler output receipts with explicit client/model/health ceilings (#206 diagnostics, not Windows reporter qualification).
+
+### Security
+
+- Update development-only transitive `source-map-js` to 1.2.2 for its event-loop denial-of-service fix.
+
+### Verification and limits
+
+- Document SDK 1.0.37's new public `computerUse` output through the existing bounded generic Cursor activity/summary fallback, without dedicated action/screenshot presentation or a new public local execution option.
+- Record SDK 1.0.37's vendored HTTP/2 ping/response-iteration and local retry-classification source changes. Public controls, bearer/lease/reload mechanisms, LOCAL ID/inherit-only custom agents and inspected storage layouts remain unchanged; internal definition-only MCP setters are not supported options. These source comparisons do not resolve the original #247 authentication cause, #339 signal sender, #173 rtk behavior, #233 Windows loader or #206 readiness reports.
+- Exercise real public installed-SDK first-send linking through a blocked key-exchange boundary, with a request-time missing-module negative control. Native SDK-substituted session tests remain separate; neither proves authenticated inference or every embedded loader.
+- Clarify inspected SDK hook/parser/authentication mechanisms and remaining reporter-only unknowns (#173, #339, #247, #233). Public commit/PR attribution controls remain absent (#302); no SDK-internal patch or paid test campaign is added.
+
 ## 0.5.2
 
 ### Fixed
@@ -54,7 +119,7 @@ These changes are carried into 0.5.2; this section does not record a successful
 
 ### Breaking Changes
 
-- Bare `ctx.modelRegistry.complete(...)` and `ctx.modelRegistry.streamSimple(...)` calls are unsupported for Cursor models because they lack native session ownership receipts. Custom compaction and other integrations must use the owning AgentSession's stream path or an independent child AgentSession; bind/refresh/reload does not migrate bare calls. See [embedding migration guidance](README.md#embedded-sessions-report-concurrent-cursor-turns).
+- Bare `ctx.modelRegistry.complete(...)` and `ctx.modelRegistry.streamSimple(...)` calls are unsupported for Cursor models because they lack native session ownership receipts. Custom compaction and other integrations must use the owning AgentSession's stream path or an independent child AgentSession; bind/refresh/reload does not migrate bare calls. See [embedding migration guidance](docs/reference.md#embedded-sessions-report-concurrent-cursor-turns).
 
 ### Changed