pi-cursor-sdk 0.5.3 → 0.5.5

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+**Release preparation is not a publication receipt:** confirm the exact version, source and artifact integrity in npm/GitHub publication records before relying on availability. No issue is closed by preparation alone.
+
+## 0.5.5
+
+### Fixed
+
+- Stop a failed LOCAL Cursor run's shell commands and other native tool processes. SDK 1.0.40 leaves them running after a run fails, for example when it gives up resuming a reset connection, and `Run.cancel()` stops them only while the run is still running. The provider now cancels the run while the SDK records the failure, which the SDK does before it marks the run failed, and still reports the SDK's failure message as a Pi error. A separate SDK error code, when present, is not shown after this cancellation. Explicit Pi aborts and Cloud runs are unchanged (#384).
+
+- Upgrade the exact unbundled Cursor SDK and its optional platform packages from 1.0.37 to 1.0.40 for LOCAL Claude-format hook compatibility: the SDK now enables translation of nested `hookSpecificOutput` denial/rewrite output into the fields its tool adapters consume. It also improves Windows command-hook UTF-8 input and native exit-code propagation. This is not a Pi pre-execution hook, universal policy guarantee, or resolution of the original rtk report (#173).
+
+- Supply SDK 1.0.40's required Zod peer as a direct exact `zod@4.6.6` runtime dependency, with the bundled MCP bridge's newer nested `4.6.7` copies retained by npm's lockfile. This keeps the peer outside the tarball's bundle and reachable by the unbundled SDK under Pi's `--legacy-peer-deps` installation, without peer auto-installation, overrides or SDK patches (#380). A deduplicated root `4.6.7` copy instead gets bundled and breaks that installation.
+
+- Both the SDK's v4/v4-mini parsers and the bridge's v4 parsers now include the bounded-collection fix for [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5): array, set and map size bounds are checked before parsing elements. Zod 4.6.7 differs from 4.6.6 only in version metadata. The legacy `zod/v3` implementation is unchanged, and unconstrained collections still validate every element; this is not a universal resource cap or a claim of a demonstrated SDK exploit.
+
+- Stop `smoke:steering --self-test` from rebuilding `dist/` before its offline probe. The rebuild briefly removed `dist/` while the concurrent package test packed the checkout, producing an intermittent missing `dist/index.js` failure. Live steering runs still rebuild first (fitchmultz/.github#98).
+
+### Changed
+
+- Refresh the fallback catalog from the authenticated SDK 1.0.40 catalog-only observation on 2026-10-31: 49 models, adding DeepSeek V4.1 Flash 1017 (`deepseek-v41-flash-1017`) and recording `cyber=false` on Claude Opus 5.5 variants. All 48 prior model IDs and the 33 bundled checkpoint-derived entries remain; no Agent/model turn or Cloud run was performed.
+
+### Verification and limits
+
+- **User-visible rollout:** admitted user/project Claude hooks returning only nested denial/rewrite output can now affect tool execution where SDK 1.0.37 ignored that output; this is an intended behavior change, not just a test-harness repair.
+- Add installed-package contracts for actual Claude settings loading, UTF-8 hook input, nested denial/rewrite, conflicting/mismatched output guards and native exit-2 denial. These use test-only lexical observation, not a production SDK patch, public Agent/backend run or startup canary. Preserve the dated SDK 1.0.37 catalog and older captures at their actual identities; the other original backlog causes remain unqualified and both commit/PR attribution controls remain unavailable.
+
+## 0.5.4
+
+### Fixed
+
+- Identify 0.5.4 as the first candidate containing the native-tool opt-out and `/cursor-abort` from #372, and require an exact publication/installation check. Published npm 0.5.3 ignores that flag and lacks the command; a development version label is not proof of enforcement (#368).
+- Keep verified SDK bootstrap output filtered across detached rule/skill work and asynchronous reload gaps with a process-lifetime, versioned sink lease. Preserve unrelated output and expose bounded owner-scoped capability/hook warnings; unknown output is not universally suppressed (#367).
+- Isolate native auth/catalog fixtures from the official host's file-backed startup refresh-admission race. Use matching in-memory catalog state for extension-owned assertions; this is not an official-host startup repair (#357).
+- Skip credential-URL regex scans when required markers are absent, preserving the existing matching/redaction contract, including percent-encoded cases. Inputs containing both markers retain the existing regex behavior; no universal processing bound is claimed (#371).
+
+### Added
+
+- Add `/cursor-abort` as an explicit session-scoped release path for a pending local Cursor run after a native-tool policy mismatch. Ordinary mismatch remains restorable and never cancels implicitly; idle Pi abort has no active signal after the error has settled. Explicit active provider abort now also releases its captured scope's old pending run before preparation. Recovery never delivers stale Pi results, automatically sends a replacement turn, releases sibling scopes, or undoes already-executed work.
+
+- Add opt-in `PI_CURSOR_NATIVE_TOOLS=0` for MCP-only ordinary LOCAL agents using public SDK `tools: ["mcp"]`, excluding all other main tools including native task/subagents. Capture and forward the same policy for create/resume and split pooled/durable identities only on opt-out, and reject opposite-policy pending-run continuation before delivering Pi results; defaults and text-only summaries are unchanged. Cloud fails closed instead of ignoring the control. Keep Pi builtin exposure explicit, and document that native replay hooks/display flags cannot govern original execution, ambient configured MCP remains unless settings are disabled, and permitted Pi/MCP tools are not a sandbox (#368).
+
+- Add `PI_CURSOR_PI_TOOL_BRIDGE_HOST` (`localhost` or the default `127.0.0.1` in the bridge URL) and `PI_CURSOR_PI_TOOL_BRIDGE_PORT` (one port or an inclusive `N-M` range) so a Cursor team MCP allowlist such as `http://localhost:800*/mcp` can admit the pi tool bridge. The default still binds only `127.0.0.1`; opt-in `localhost` now requires owning both explicit loopbacks on the same port before advertising a URL, with partial-startup cleanup and lifetime-stable host policy. Unset settings keep the previous random-port behavior.
+
+### Changed
+
+- Refresh the fallback catalog from the authenticated SDK 1.0.37 catalog-only observation on 2026-10-22: 48 models, adding Gemini 4 Argon (`gemini-4-argon`) and Muse Wonder (`muse-wonder-1.0`) while preserving all 46 prior records. Keep the 33 bundled checkpoint-derived entries unchanged; no Agent/model turn or Cloud run was performed.
+- Prefer the currently exposed Pi tool capabilities, schemas and prompt guidelines instead of hardcoded historical MCP/delegation names. Dynamic registry mapping remains unchanged; this is not qualification of the original Windows bridge report (#206).
+- Rewrite the README around installation and everyday use, add a diagram of Cursor inside Pi, and move detailed configuration and maintainer procedures into linked reference pages.
+- Align locked development Pi snapshots and their resolved Pi cohort to 1.1.0 ([#353](https://github.com/fitchmultz/pi-cursor-sdk/pull/353)). This is development-only maintenance, not a user runtime Pi upgrade or a new npm publication. Node 24+, official Pi 0.87.1+, optional wildcard Pi/TypeBox peers, and exact unbundled Cursor SDK 1.0.37 remain unchanged; published 0.5.3 and historical qualification evidence retain their original source/version attribution.
+- Consolidate redundant tests and unused internal exports/wrappers while retaining native, installed-SDK and persistence boundary owners (#360, #363). Improve fixture contracts for user/custom start events without widening runtime APIs (#361). Make installed-SDK bootstrap-printer fixtures select and restore their terminal environment even under `TERM=dumb`, preserving ANSI and confinement assertions.
+- Use the reviewed automatic npm release workflow: an intentional versioned PR merged to main triggers qualification and publication without a new approval step. This candidate does not change publisher policy, authentication, protections or workflow pins (#362).
+
+### Security
+
+- Include the development-only Vite 8.3.1 → 8.3.4 lockfile update already merged in #369; no release-time dependency upgrade is added.
+
+### Verification and limits
+
+- The native-tool opt-out is the supported LOCAL SDK MCP-only tool surface, not interception of native replay or an OS sandbox. Configured MCP remains unless setting sources are narrowed, and permitted Pi/MCP tools can execute arbitrary work. Defaults and existing LOCAL text-only summary isolation remain unchanged; unsupported Cloud opt-out fails closed. No paid Cloud campaign is part of this release.
+- Runtime/source checks, package controls, catalog metadata, current-host offline CI and publication are distinct evidence. Preserve retained proof at its actual SDK/host/source identity. No original #173 hook rewrite, #206 Windows bridge readiness, #233 embedded loader, #247 idle recovery, #257 model narration or #339 signal-sender resolution is inferred from this candidate.
+
 ## 0.5.3 - 2026-10-07
 
 ### Changed
@@ -80,7 +140,7 @@ These changes are carried into 0.5.2; this section does not record a successful
 
 ### Breaking Changes
 
-- Bare `ctx.modelRegistry.complete(...)` and `ctx.modelRegistry.streamSimple(...)` calls are unsupported for Cursor models because they lack native session ownership receipts. Custom compaction and other integrations must use the owning AgentSession's stream path or an independent child AgentSession; bind/refresh/reload does not migrate bare calls. See [embedding migration guidance](README.md#embedded-sessions-report-concurrent-cursor-turns).
+- Bare `ctx.modelRegistry.complete(...)` and `ctx.modelRegistry.streamSimple(...)` calls are unsupported for Cursor models because they lack native session ownership receipts. Custom compaction and other integrations must use the owning AgentSession's stream path or an independent child AgentSession; bind/refresh/reload does not migrate bare calls. See [embedding migration guidance](docs/reference.md#embedded-sessions-report-concurrent-cursor-turns).
 
 ### Changed