fix(cursor): gap program stack (gap-2..gap-9) — catalog suppression, checkpoints, quarantine, ultra mode, diagnostics, silent redirects, repetition breaker #2651
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # 090 — gap-8 silent-redirect + codex exec adversarial QA (w2) | ||
|
|
||
| Service: gap-8 stack, restarted per round (final pid after d9752bc0e). | ||
| Instrument: `codex exec -m cursor/grok-4.6` non-interactive, scratch cwds | ||
| under /tmp/ocx-qa-JStBBM. Transcripts: s1.log-s5b.log in that scratch. | ||
|
|
||
| ## Results | ||
|
|
||
| | Scenario | Round | Result | Evidence | | ||
| |---|---|---|---| | ||
| | S1 ten tool calls | 1 | PASS | 10/10 separate bridge execs (pwd,ls,date,whoami,hostname,uname-s,ls,id,echo HOME,uname-m); narration grep hits=0 | | ||
| | S2 native-tool bait | 1 | INCONCLUSIVE | run produced no agent output (0-byte response; separate G2-class incident) | | ||
| | S2b native-tool bait retry | 2 | PASS* | zero 차단/전환 narration; both requests answered via bridge on first attempt. Residual: model duplicated its commentary line + repeated the 2-call batch twice (double-batch echo, no user-visible harm) | | ||
|
Comment on lines
+12
to
+13
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- applicable repository conventions ---'
find /tmp/coderabbit-repo-knowledge/lidge-jun-opencodex-7afea732 -type f -name '*.md' -maxdepth 3 -print
printf '%s\n' '--- target file ---'
cat -n devlog/_plan/260826_cursor_responses_gap/090_gap8_codex_exec_qa.md
printf '%s\n' '--- nearby S2b references ---'
rg -n -C 4 'S2b|native-tool bait|double-batch|bridge|read-only|idempotent|non-idempotent|sentinel' devlog/_planRepository: lidge-jun/opencodex Length of output: 50378 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- target document ---'
cat -n devlog/_plan/260826_cursor_responses_gap/090_gap8_codex_exec_qa.md
printf '%s\n' '--- conventions for devlog/_plan ---'
for f in /tmp/coderabbit-repo-knowledge/lidge-jun-opencodex-7afea732/*/*.md; do
case "$f" in
*/devlog*/*|*/plan*/*|*/review*/*) printf '\n### %s\n' "$f"; head -80 "$f";;
esac
done
printf '%s\n' '--- exact related records, excluding binary evidence ---'
rg -n -C 8 --glob '*.md' 'S2b|native-tool bait|double-batch|bridge calls|zero.*차단|non-idempotent|sentinel|user-visible harm' devlog/_plan/260826_cursor_responses_gapRepository: lidge-jun/opencodex Length of output: 9845 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- wire-level follow-up ---'
cat -n devlog/_plan/260826_cursor_responses_gap/100_wire_ndjson_qa.md
printf '%s\n' '--- S2b scratch artifacts ---'
if [ -d /tmp/ocx-qa-JStBBM ]; then
find /tmp/ocx-qa-JStBBM -maxdepth 2 -type f -printf '%p\n' | sort
for f in /tmp/ocx-qa-JStBBM/s2b* /tmp/ocx-qa-JStBBM/*s2b*; do
[ -f "$f" ] || continue
printf '\n### %s\n' "$f"
cat -n "$f"
done
else
echo '/tmp/ocx-qa-JStBBM is unavailable'
fi
printf '%s\n' '--- all S2b-specific records ---'
rg -n -C 12 --glob '*.md' 'S2b|double-batch echo|repeated the 2-call|sentinel|execution count|non-idempotent' devlog/_plan/260826_cursor_responses_gapRepository: lidge-jun/opencodex Length of output: 11844 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository convention files ---'
find /tmp/coderabbit-repo-knowledge/lidge-jun-opencodex-7afea732 -type f -name '*.md' -print0 |
while IFS= read -r -d '' f; do
printf '\n### %s\n' "$f"
head -5 "$f"
done | head -300Repository: lidge-jun/opencodex Length of output: 6195 Record the S2b bridge invocation count before marking the repeated batch harmless. The S2b entry at 🤖 Prompt for AI Agents |
||
| | S3 mixed read/edit | 1 | PASS | notes.txt ALPHA->BETA lifecycle completed; narration=0 | | ||
| | S4 5-step chain | 1-2 | FAIL | stalled after step 1-2, files missing; "이전 호출은 출력이 비어 있어... 처음부터" restart loop observed | | ||
| | repair: extend empty-result normalization to codex CLI native names (shell/local_shell/container.exec) | commit d9752bc0e | — | root cause: gap-7 fix keyed on bridge tool NAMES; codex exec advertises the native `shell` tool, so empty results were unexplained again | | ||
| | S4d 5-step chain re-run | 3 | PASS* | all 5 steps done, data.csv+avg.txt=84 correct; restart-narration grep=0; model still self-recovered from two empty-looking intermediate results but WITHOUT surface-switch framing and completed | | ||
| | S5 image via /v1/responses | 1 | PASS | 32x32 red PNG -> "Red", in=12036 | | ||
| | S5b image via codex exec -i | 1 | PASS | blue.png -> "파랑", tokens 45489 | | ||
|
|
||
| ## Verdicts | ||
|
|
||
| - Silent-redirect (gap-8 core): narration '차단/전환/막혀' = 0 across all | ||
| passing rounds; native-bait prompt answered bridge-first without | ||
| announcing a switch. Fix effective. | ||
| - Empty-result loop: root-caused twice (bridge names at gap-7, codex CLI | ||
| native names at gap-8 QA round 2); after d9752bc0e the 5-step chain | ||
| completes. Residual: intermediate tool results still occasionally | ||
| ARRIVE empty on the wire (model sees nothing and retries once) — that | ||
| delivery gap is the remaining G2-class defect, now non-fatal because | ||
| the retry succeeds without derailing. | ||
| - Image input: healthy at both API and codex exec layers. The reported | ||
| app-session failure (repeated "Viewed an image" then giving up) did | ||
| not reproduce here; needs an app-session capture with the actual | ||
| clipboard file — recorded as UNKNOWN with repro steps pending. | ||
|
|
||
| ## Open follow-ups | ||
|
|
||
| 1. Wire-level empty tool-result delivery (why some exec outputs arrive | ||
| blank upstream) — needs protobuf frame capture of an affected round. | ||
| 2. App-session image loop repro. | ||
| 3. S2b double-batch echo (duplicate commentary + repeated batch). | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| # 100 — Wire/NDJSON QA (n1, 2026-08-26 오후) | ||
|
|
||
| Service: gap-8 stack (ecc9aad0d). Captures: /tmp/ocx-wire/*.sse. | ||
| NDJSON: ~/.opencodex/usage.jsonl (31,466 lines). | ||
|
|
||
| ## Scenario table | ||
|
|
||
| | # | Scenario | Result | Wire evidence | | ||
| |---|---|---|---| | ||
| | W1 | plain stream | PASS | created -> in_progress (gap-1 live) -> deltas -> completed; 29 lines | | ||
| | W2 | single tool stream | PASS | function_call args delta/done; single commentary line, no duplicate emission | | ||
| | W3 | parallel-10 stream | PASS | 11 output_item.added (1 msg + 10 calls, seq 2..47), each probe exactly once — the earlier "22" was event+data line double-count, NOT a wire duplicate. Double-batch echo NOT reproduced at the wire; 090 S2b echo attributed to model-side commentary repetition, not stream duplication | | ||
| | W4 | empty tool-result round trip | PASS* | model received empty output and answered "The tool returned this, verbatim: (blank)" — honest handling; 112 text deltas, no retry spiral at API layer | | ||
| | W5 | single image stream | PASS | "Green.", 38 lines | | ||
| | W6 | 3x same-color images | PASS* | "lime green, yellow, red" — model hallucinated variety on identical images | | ||
| | W6b | 3x distinct images (R,G,B) | PASS | "red, green, blue" correct order; 30.1s wall, in=13575 — slow but correct. App image loop NOT reproduced at API layer | | ||
| | W7 | kimi-k3-1m stream | PASS | full clean sequence incl. in_progress | | ||
| | W8 | apply_patch custom stream | PASS | custom_tool_call_input delta/done, valid envelope | | ||
|
|
||
| ## NDJSON (usage.jsonl) integrity — last 300 rows | ||
|
|
||
| - 0 malformed lines; cursor rows 238. | ||
| - usageStatus: estimated 235, unreported 1 (the single 502 row — 10.8s | ||
| upstream failure, usage honestly unreported, no fake zeros). | ||
| - true zero-input rows: 1 (= the 502). Schema: nested usage{inputTokens...}, | ||
| tierOutcome, firstOutputMs, requestedEffort all populated. | ||
| - Verdict: NDJSON pipeline healthy; no corruption class found. | ||
|
|
||
| ## 090 follow-up dispositions | ||
|
|
||
| 1. Wire-level empty exec output: NOT reproduced in W4 (deliberate empty | ||
| round-trips handled honestly). Remaining suspicion narrows to the | ||
| in-session (checkpoint/replay-depth) path, not the API surface — | ||
| signature still open, now bounded to multi-round sessions. | ||
| 2. Double-batch echo: wire ruled out (W3); model-side commentary | ||
| repetition under replay confusion — folds into G1 umbrella. | ||
| 3. App image loop: API layer healthy (W5/W6b, codex exec -i PASS in 090 | ||
| S5b). Bounded to Codex-app-side attachment handling; needs app-session | ||
| capture — out of this repo's fix surface for now. | ||
|
|
||
| ## Verdict | ||
|
|
||
| No new adapter-fixable defect surfaced in this round; gap-9 not needed. | ||
| All three follow-ups bounded with evidence; W6 same-color hallucination is | ||
| MODEL-class. Campaign continues to be green on the gap-8 stack. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| # 110 — App-route QA session + planning-time narration (m1) | ||
|
|
||
| Instrument: self-created Codex app thread 01a03c74-3d91-74f3-b060-03f521e83c6c | ||
| (cursor/grok-4.6 high, projectless cursor-app-qa), created via | ||
| codex_app__create_thread from this session — the first app-route QA driven | ||
| entirely by the agent. | ||
|
|
||
| ## Result | ||
|
|
||
| - Terminal: APP_QA_RESULT: PASS (5 read-only calls + qa.txt LINE1/LINE2 | ||
| lifecycle completed). | ||
| - Cost signatures: 13 commandExecutions for a ~8-call task; 21 | ||
| switch-mentions; 5 empty-output mentions; file writes done via shell | ||
| printf instead of apply_patch. | ||
|
Comment on lines
+10
to
+14
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Separate task completion from routing compliance. Line [10] reports 🤖 Prompt for AI Agents |
||
|
|
||
| ## Mechanism finding (key) | ||
|
|
||
| The 차단/전환 narration originates at PLANNING time: reasoning contains | ||
| "Shell 도구를 사용해 5개의 독립적인 명령을 한 번에 실행할 것이다" and | ||
| "Shell이 차단되어 브리지로 전환" BEFORE any denial payload arrives in that | ||
| round — the pattern is replayed-history-driven (G1 class), not a reaction | ||
| to our gap-8 denial text. Response-layer rewrites therefore reduce | ||
| narration in fresh sessions (codex exec rounds: 0 hits) but cannot zero it | ||
| in app sessions whose history already contains the pattern. | ||
|
|
||
| User screenshot (13:5x) independently confirms: same-day app session still | ||
| narrates 차단/전환 and fills batches via bridge after a native probe. | ||
|
|
||
| ## Increment shipped (this commit) | ||
|
|
||
| - Guidance note: "Tool-selection commentary is forbidden — FIRST visible | ||
| action is the bridge call itself; 차단/전환/blocked/switching must not | ||
| appear for tool-routing reasons." | ||
| - Guidance note: shell-redirection file writes forbidden while | ||
| apply_patch/structured-edit advertised (printf/echo >, heredoc, sed -i). | ||
| - Tests extended (cursor-tool-definitions 26 pass). | ||
|
|
||
| ## Honest bound | ||
|
|
||
| Zeroing app-session narration requires the G1 replay-representation line: | ||
| tool-suspended checkpoints (gap-3) engaging in real app threads so history | ||
| stops replaying the old pattern. Until the stack lands and sessions turn | ||
| over, existing threads keep echoing it. Re-probe after service repair | ||
| recorded below. | ||
|
|
||
| ## Re-probe after service repair (7b3dbdd55) | ||
|
|
||
| - rp1 (10-tool scenario, fresh codex exec): 10 separate bridge execs, | ||
| narration grep = 0. Tool-selection-commentary suppression holding in | ||
| fresh sessions. | ||
| - rp2 (file-edit scenario): content correct, but the model still wrote | ||
| result.md via `printf > ` — apply_patch was NOT used. Signature check: | ||
|
Contributor
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Remove the trailing space from the code span. Line [52] contains 🧰 Tools🪛 markdownlint-cli2 (0.23.2)[warning] 52-52: Spaces inside code span elements (MD038, no-space-in-code) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| 0 apply_patch mentions in the transcript, meaning the codex exec | ||
| session's advertised catalog exposes the bridge exec but the model | ||
| never considered the edit path despite the new note. Disposition: | ||
| guidance alone insufficient for write-routing in exec-style sessions; | ||
| candidate follow-up is server-side detection of redirection-writes with | ||
| a redirect-to-apply_patch tool error (deferred — aggressive, needs its | ||
| own cycle and risk review; recorded as open). | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # 120 — Repetition breaker + final stack (r1, gap-9) | ||
|
|
||
| ## Defect | ||
|
|
||
| User screenshot (kimi-k3 app session): byte-identical commentary "원격 | ||
| ocx 상태를 다시 확인합니다" + same ssh probe emitted 6+ consecutive | ||
| times. Same class as S2a's 180x tool-call loop and the 차단/전환 echo: | ||
| external full-replay presents N identical rounds as N identical lines, | ||
| priming line N+1. | ||
|
|
||
| ## Fix (gap-9, PR #2667) | ||
|
|
||
| protobuf-request.ts external replay assembly: consecutive duplicate | ||
| assistant/tool-result entries collapse to one entry + | ||
| "[note: this exact output was produced N times in a row]"; runs >=3 add | ||
| one imperative context note ("Repeating it again is a failure. Take a | ||
| DIFFERENT action now..."). User messages reset runs; native models and | ||
| structured pairing untouched. 5 regression tests; 211-test suite green. | ||
|
|
||
| ## Live proof | ||
|
|
||
| Probe: history primed with 5 identical assistant rounds -> model reply: | ||
| "이전에 같은 상태 확인만 반복했으니, 이번에는 코드와 원격 OCX 설정을 | ||
| 직접 찾아서 최신 버전으로 올립니다." — loop broken on first response. | ||
| (/tmp/ocx-wire/rep-out.json; service pid 54225 on gap-9.) | ||
|
|
||
| ## Final stack (gap-1..gap-9) | ||
|
|
||
| | PR | Branch | Fix | | ||
| |---|---|---| | ||
| | #2650 | cursor-gap-1 | call_id single-line codec + response.in_progress | | ||
| | #2651 | cursor-gap-2 | bare-caller default catalog suppression (token floor) | | ||
| | #2652 | cursor-gap-3 | tool-suspended checkpoint commit (external) | | ||
| | #2653 | cursor-gap-4 | dead-model catalog quarantine | | ||
| | #2654 | cursor-gap-5 | ultra toggle kimi-k3-1m + Max Mode wire flag | | ||
| | #2656 | cursor-gap-6 | blob integrity diagnostic + G2 capture procedure | | ||
| | #2662 | cursor-gap-7 | empty exec explanation + code-mode native ban | | ||
| | #2665 | cursor-gap-8 | silent-redirect denials + commentary/shell-write bans | | ||
| | #2667 | cursor-gap-9 | repetition breaker (this) | | ||
|
|
||
| Merge order: #2650 first; each child retargets to dev after its parent | ||
| lands (enforce-target skips stacked children). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Redact captured SSE before storing evidence.
Line 42 writes the full
/v1/responsesstream tostall.sse. Lines 45-47 then request SSE evidence in this document. Response events can contain user content and tool output. Keepstall.sselocal and record only redacted event metadata. Do not commit payloads, tokens, OAuth material, or other secrets.🤖 Prompt for AI Agents