fix(cursor): stop grok-4.6 tool-result echo from poisoning later turns

src/adapters/cursor.ts

@@ -34,9 +34,12 @@ import { estimateTokens } from "../lib/token-estimate";
 import {
   clearCursorIncompleteToolRemint,
   cursorIncompleteToolRemintScopeKey,
+  clearCursorEnvelopeEchoRemint,
+  cursorEnvelopeEchoRemintScopeKey,
   cursorOverflowRemintScopeKey,
   markCursorOverflowSurfaced,
   recordCursorIncompleteToolRemint,
+  recordCursorEnvelopeEchoRemint,
   recordCursorOverflowRemint,
   rememberCursorThreadConversation,
   shouldSkipCursorOverflowRemint,
@@ -206,6 +209,7 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         let lastTransport: { captured?: Uint8Array } | undefined;
         let emittedClientTool = false;
         let sawIncompleteToolCall = false;
+        let sawMidstreamEnvelopeEcho = false;
         // Ordering proof for tool-suspended checkpoints: true only when the newest captured
         // checkpoint bytes arrived AFTER the turn emitted a client tool call, i.e. upstream
         // serialized its suspended-on-tool-call state. Only that snapshot can safely resume
@@ -390,7 +394,9 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
                 }
                 if (event.type !== "heartbeat") emittedOutput = true;
                 if (event.type === "done") {
-                  for (const finding of midstreamObserver?.findings() ?? []) {
+                  const midstreamFindings = midstreamObserver?.findings() ?? [];
+                  if (midstreamFindings.length > 0) sawMidstreamEnvelopeEcho = true;
+                  for (const finding of midstreamFindings) {
                     debugProviderDiagnostic("cursor", "midstream-envelope-echo", {
                       wireModel: activeRequest.modelId,
                       conversationHash: activeRequest.conversationId.slice(0, 16),
@@ -564,6 +570,41 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
         } else if (!sawIncompleteToolCall && completedNormally && incompleteToolRemintScopeKey) {
           clearCursorIncompleteToolRemint(incompleteToolRemintScopeKey);
         }
+        // A mid-stream envelope echo has ALREADY reached the client — the prefix sniffer only
+        // watches the first bytes of a turn, and grok-4.6 writes a real sentence before pasting
+        // the envelope. It cannot be quarantined, so the recovery is the same as the
+        // incomplete-tool case: leave this turn alone and rotate the next turn's id, otherwise
+        // the stored echo is replayed and primes the model to echo again.
+        //
+        // Its own budget, not the incomplete-tool one: echoing is cheap and repeatable while an
+        // incomplete client-tool stream is rare and structural, so a shared counter would let a
+        // persistently echoing model spend the allowance the other recovery needs. Skipped when
+        // the incomplete-tool arm already reminted this turn — one rotation is enough.
+        const envelopeEchoRemintScopeKey =
+          _parsed._cursorIsolateConversation !== true
+          && request.contextUsageStoreCheckpoints !== false
+            ? cursorEnvelopeEchoRemintScopeKey(
+                cursorClientThreadOwner(_parsed),
+                _parsed._cursorIdentityScope,
+              )
+            : null;
+        if (sawMidstreamEnvelopeEcho && !sawIncompleteToolCall && envelopeEchoRemintScopeKey) {
+          if (recordCursorEnvelopeEchoRemint(envelopeEchoRemintScopeKey)) {
+            if (inheritedCheckpointRef) invalidateCursorCheckpoint(inheritedCheckpointRef);
+            debugProviderDiagnostic("cursor", "midstream-envelope-echo-remint", {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+            });
+            remintConversationId(request.conversationId);
+          } else {
+            debugProviderDiagnostic("cursor", "midstream-envelope-echo-remint-exhausted", {
+              wireModel: request.modelId,
+              conversationHash: request.conversationId.slice(0, 16),
+            });
+          }
+        } else if (!sawMidstreamEnvelopeEcho && completedNormally && envelopeEchoRemintScopeKey) {
+          clearCursorEnvelopeEchoRemint(envelopeEchoRemintScopeKey);
+        }
         if (
           request.checkpointInvalidationReason
           && request.checkpointInvalidationReason !== "missing_ref"

src/adapters/cursor/envelope-echo.ts

@@ -13,6 +13,58 @@
  */
 
 const ECHO_MARKERS = ["[Tool Result]", "[Tool Error]", "[tool_result]"] as const;
+
+function isEchoMarkerLine(line: string): boolean {
+  return (ECHO_MARKERS as readonly string[]).includes(line.replace(/^[ \t]+/, ""));
+}
+
+/**
+ * Drop echoed tool-result envelopes from assistant history before Cursor root replay.
+ *
+ * The prefix sniffer catches an echo that STARTS a turn, but grok-4.6 routinely writes a real
+ * sentence first and pastes the envelope after it. That text has already reached the client and
+ * is stored as assistant output, so replaying it verbatim re-primes the next turn with the very
+ * envelope the model is copying.
+ *
+ * Scope starts AT the marker line and runs to the next blank line, rather than to the end of
+ * the message. The echoed envelope has no terminator we can recognise — we build it as a marker
+ * line plus arbitrary result text (protobuf-request.ts), and the observed copies are not
+ * byte-exact, so matching against the replayed envelope is not available either. Truncating to
+ * the end of the message was the alternative, and it discards a genuine answer whenever the
+ * model resumes after the echo. A blank line is the one boundary the model reliably writes when
+ * it goes back to prose.
+ *
+ * The tradeoff is explicit: an echoed envelope whose pasted result itself contains a blank line
+ * leaves its remainder in replay. That is the safer direction to be wrong in — conversation
+ * remint, not this filter, is the primary defence against a poisoned conversation, and this only
+ * stops the transcript from feeding itself.
+ *
+ * Only whole-line markers count, so prose such as "the string [Tool Result] appeared" survives.
+ */
+export function stripAssistantEchoedToolEnvelope(text: string): string {
+  if (!text || !ECHO_MARKERS.some(marker => text.includes(marker))) return text;
+  const newline = text.includes("\r\n") ? "\r\n" : "\n";
+  const lines = text.split(/\r?\n/);
+  const kept: string[] = [];
+  let dropped = false;
+  let index = 0;
+  while (index < lines.length) {
+    const line = lines[index] ?? "";
+    if (!isEchoMarkerLine(line)) {
+      kept.push(line);
+      index += 1;
+      continue;
+    }
+    dropped = true;
+    index += 1;
+    // The envelope body is the contiguous non-blank run after the marker. The blank line that
+    // ends it is left in place, so surviving prose on either side stays separated.
+    while (index < lines.length && (lines[index] ?? "").trim() !== "") index += 1;
+  }
+  if (!dropped) return text;
+  return kept.join(newline).trimEnd();
+}
+
 const MAX_SNIFF_BYTES = 40;
 /** Mid-stream observer: max leading whitespace on a line before matching disarms. */
 const MAX_MIDSTREAM_LINE_INDENT = 128;
@@ -66,8 +118,9 @@ export interface MidstreamEchoFinding {
  * MIDDLE of an agent message — after legitimate leading text — one of them
  * carrying a whitespace-spliced call-id ("fc_x mar-y" instead of "fc_x-y").
  * Deltas at that point have already reached the client, so this observer
- * never throws and never withholds output: it records findings so the
- * adapter can emit a structured diagnostic at turn end. Only fixed marker
+ * never throws and never withholds output. It records findings so the adapter
+ * can emit a structured diagnostic and remint the conversation for the next
+ * turn at turn end. Only fixed marker
  * enums, numeric offsets, and corruption booleans are retained — never
  * content bytes.
  */

src/adapters/cursor/protobuf-request.ts

@@ -6,6 +6,7 @@ import { namespacedToolName } from "../../types";
 import type { CursorRunRequest } from "./types";
 import { decodeCursorCallId } from "./call-id";
 import { cursorNeedsExternalToolContinuation, isCursorExternalWireModel } from "./discovery";
+import { stripAssistantEchoedToolEnvelope } from "./envelope-echo";
 import { normalizeCursorToolResultText } from "./tool-result-normalize";
 import { debugProviderDiagnostic } from "../../lib/debug";
 import {
@@ -208,11 +209,13 @@ function assistantRootText(
   message: Extract<OcxMessage, { role: "assistant" }>,
   includeThinking: boolean,
 ): string {
-  if (typeof message.content === "string") return message.content;
-  return message.content
-    .map(part => (part.type === "text" ? part.text : includeThinking && part.type === "thinking" ? part.thinking : undefined))
-    .filter((value): value is string => typeof value === "string" && value.length > 0)
-    .join("\n");
+  const raw = typeof message.content === "string"
+    ? message.content
+    : message.content
+      .map(part => (part.type === "text" ? part.text : includeThinking && part.type === "thinking" ? part.thinking : undefined))
+      .filter((value): value is string => typeof value === "string" && value.length > 0)
+      .join("\n");
+  return stripAssistantEchoedToolEnvelope(raw);
 }
 
 // Cursor builds the actual model prompt from rootPromptMessagesJson (turns[] is UI/display metadata),

src/adapters/cursor/request-builder.ts

@@ -340,7 +340,13 @@ export function cursorConversationIdFromClientThread(threadId: string, identityS
 
 /**
  * Resolve the Cursor conversation id for this turn.
- * Priority: force-fresh → isolate helper → remembered → client thread owner → random.
+ * Priority: force-fresh → isolate helper → thread remint override → stored conversation id
+ * → client thread hash → random.
+ *
+ * The remint override must beat a stored `_cursorConversationId`. Only the remint path writes
+ * the thread store (cursor.ts), so a stored id that disagrees with it is the pre-remint value,
+ * and preferring it let a second Responses chain in the same Codex thread keep resuming the
+ * conversation the previous turn just rotated away from.
  * Never use OpenAI Responses `previous_response_id` (resp_*) or shared `prompt_cache_key`
  * (cache-cohort fingerprint, not conversation ownership).
  */
@@ -351,11 +357,16 @@ export function resolveCursorConversationId(
 ): string {
   if (options.forceFreshConversation === true) return generatedCursorConversationId();
   if (parsed._cursorIsolateConversation === true) return generatedCursorConversationId();
-  if (parsed._cursorConversationId) return parsed._cursorConversationId;
   const threadId = cursorClientThreadOwner(parsed);
-  if (threadId) {
+  // A compaction turn carries its own conversation id and must not be pulled onto the parent's
+  // thread override. It is isolated in effect without ever setting the isolate flag, which is why
+  // the override check has to exclude it explicitly rather than rely on that flag.
+  if (threadId && parsed._compactionRequest !== true) {
     const recovered = lookupCursorThreadConversation(threadId, parsed._cursorIdentityScope);
     if (recovered) return recovered;
+  }
+  if (parsed._cursorConversationId) return parsed._cursorConversationId;
+  if (threadId) {
     return cursorConversationIdFromClientThread(`thread:${threadId}`, parsed._cursorIdentityScope);
   }
   return generatedCursorConversationId();

src/adapters/cursor/thread-continuity.ts

@@ -169,21 +169,65 @@ type IncompleteToolRemintState = {
   updatedAt: number;
 };
 
-const incompleteToolRemintByScope = new Map<string, IncompleteToolRemintState>();
+/**
+ * One bounded next-turn remint allowance, keyed by retained thread scope.
+ *
+ * Each recovery reason owns its own instance. Sharing one budget would let a cheap, frequent
+ * failure spend the allowance that a rarer, more expensive recovery depends on.
+ */
+function createCursorRemintBudget(max: number, ttlMs: number, maxEntries: number) {
+  const byScope = new Map<string, IncompleteToolRemintState>();
 
-function pruneIncompleteToolRemints(at: number): void {
-  for (const [scopeKey, entry] of incompleteToolRemintByScope) {
-    if (at - entry.updatedAt > CURSOR_INCOMPLETE_TOOL_REMINT_TTL_MS) {
-      incompleteToolRemintByScope.delete(scopeKey);
+  const prune = (at: number): void => {
+    for (const [scopeKey, entry] of byScope) {
+      if (at - entry.updatedAt > ttlMs) byScope.delete(scopeKey);
     }
-  }
-  while (incompleteToolRemintByScope.size > CURSOR_INCOMPLETE_TOOL_REMINT_MAX_ENTRIES) {
-    const oldest = incompleteToolRemintByScope.keys().next().value;
-    if (oldest === undefined) break;
-    incompleteToolRemintByScope.delete(oldest);
-  }
+    while (byScope.size > maxEntries) {
+      const oldest = byScope.keys().next().value;
+      if (oldest === undefined) break;
+      byScope.delete(oldest);
+    }
+  };
+
+  return {
+    /** Record one remint; returns false when this budget is exhausted. */
+    record(scopeKey: string): boolean {
+      const at = now();
+      prune(at);
+      const existing = byScope.get(scopeKey);
+      if (existing && existing.remintCount >= max) {
+        existing.updatedAt = at;
+        byScope.delete(scopeKey);
+        byScope.set(scopeKey, existing);
+        return false;
+      }
+      const entry = existing ?? { remintCount: 0, updatedAt: at };
+      entry.remintCount += 1;
+      entry.updatedAt = at;
+      byScope.delete(scopeKey);
+      byScope.set(scopeKey, entry);
+      prune(at);
+      return true;
+    },
+    clear(scopeKey: string): void {
+      byScope.delete(scopeKey);
+    },
+    clearForTests(): void {
+      byScope.clear();
+    },
+    countForTests(): number {
+      prune(now());
+      return byScope.size;
+    },
+  };
 }
 
+const incompleteToolRemintBudget = createCursorRemintBudget(
+  CURSOR_INCOMPLETE_TOOL_REMINT_MAX,
+  CURSOR_INCOMPLETE_TOOL_REMINT_TTL_MS,
+  CURSOR_INCOMPLETE_TOOL_REMINT_MAX_ENTRIES,
+);
+
 /** Incomplete-tool and overflow recovery share ownership scope, but keep independent budgets. */
 export function cursorIncompleteToolRemintScopeKey(
   threadOwner: string | undefined,
@@ -194,34 +238,64 @@ export function cursorIncompleteToolRemintScopeKey(
 
 /** Record one incomplete-tool remint; returns false when the independent cap is exhausted. */
 export function recordCursorIncompleteToolRemint(scopeKey: string): boolean {
-  const at = now();
-  pruneIncompleteToolRemints(at);
-  const existing = incompleteToolRemintByScope.get(scopeKey);
-  if (existing && existing.remintCount >= CURSOR_INCOMPLETE_TOOL_REMINT_MAX) {
-    existing.updatedAt = at;
-    incompleteToolRemintByScope.delete(scopeKey);
-    incompleteToolRemintByScope.set(scopeKey, existing);
-    return false;
-  }
-  const entry = existing ?? { remintCount: 0, updatedAt: at };
-  entry.remintCount += 1;
-  entry.updatedAt = at;
-  incompleteToolRemintByScope.delete(scopeKey);
-  incompleteToolRemintByScope.set(scopeKey, entry);
-  pruneIncompleteToolRemints(at);
-  return true;
+  return incompleteToolRemintBudget.record(scopeKey);
 }
 
 /** A clean turn replenishes this recovery without changing the overflow retry budget. */
 export function clearCursorIncompleteToolRemint(scopeKey: string): void {
-  incompleteToolRemintByScope.delete(scopeKey);
+  incompleteToolRemintBudget.clear(scopeKey);
 }
 
 export function clearCursorIncompleteToolRemintForTests(): void {
-  incompleteToolRemintByScope.clear();
+  incompleteToolRemintBudget.clearForTests();
 }
 
 export function cursorIncompleteToolRemintCountForTests(): number {
-  pruneIncompleteToolRemints(now());
-  return incompleteToolRemintByScope.size;
+  return incompleteToolRemintBudget.countForTests();
+}
+
+/**
+ * Max next-turn rotations after a MID-STREAM envelope echo, per retained scope.
+ *
+ * Deliberately a separate budget from the incomplete-tool allowance. A mid-stream echo is a
+ * cheap, repeatable formatting failure, while an incomplete client-tool stream is a rarer
+ * structural one; on a shared counter a model that echoes every turn would spend the budget
+ * that incomplete-tool recovery depends on. Bounding it at all is the point: the echo has
+ * already reached the client and cannot be quarantined, so without a cap a persistently
+ * echoing model would remint the conversation on every single turn, forever.
+ */
+export const CURSOR_ENVELOPE_ECHO_REMINT_MAX = 3;
+export const CURSOR_ENVELOPE_ECHO_REMINT_TTL_MS = CURSOR_OVERFLOW_REMINT_TTL_MS;
+export const CURSOR_ENVELOPE_ECHO_REMINT_MAX_ENTRIES = CURSOR_OVERFLOW_REMINT_MAX_ENTRIES;
+
+const envelopeEchoRemintBudget = createCursorRemintBudget(
+  CURSOR_ENVELOPE_ECHO_REMINT_MAX,
+  CURSOR_ENVELOPE_ECHO_REMINT_TTL_MS,
+  CURSOR_ENVELOPE_ECHO_REMINT_MAX_ENTRIES,
+);
+
+/** Echo recovery shares ownership scope with overflow and incomplete-tool, budget apart. */
+export function cursorEnvelopeEchoRemintScopeKey(
+  threadOwner: string | undefined,
+  identityScope?: string,
+): string | null {
+  return cursorOverflowRemintScopeKey(threadOwner, identityScope);
+}
+
+/** Record one envelope-echo remint; returns false when the independent cap is exhausted. */
+export function recordCursorEnvelopeEchoRemint(scopeKey: string): boolean {
+  return envelopeEchoRemintBudget.record(scopeKey);
+}
+
+/** A turn that completed without an echo replenishes only this budget. */
+export function clearCursorEnvelopeEchoRemint(scopeKey: string): void {
+  envelopeEchoRemintBudget.clear(scopeKey);
+}
+
+export function clearCursorEnvelopeEchoRemintForTests(): void {
+  envelopeEchoRemintBudget.clearForTests();
+}
+
+export function cursorEnvelopeEchoRemintCountForTests(): number {
+  return envelopeEchoRemintBudget.countForTests();
 }