[lilinxiong]

Summary

Cursor models can stop using tools after a native Shell or Read attempt is rejected in Codex code mode. The rejection currently directs them to top-level shell_command / exec_command tools even though the request exposes a freeform exec tool and those operations are nested helpers.

Make the native-exec redirect recognize code mode and point to the advertised exec entry point with JavaScript, nested tools.exec_command(...), and explicit result output. Preserve the existing native-execution policy and flat shell-bridge behavior. Include regression coverage and documentation for the corrected redirect contract.

Verification

Validated commit 613cc84c64a8efe427c320dc45ebbf75a56ac0b6 locally:

• bun install --frozen-lockfile synchronized stale local Bun types to the committed 1.4.0 lockfile; no tracked files changed. bun run typecheck then passed.
• node_modules/.bin/bun test tests/providers/cursor/: 1,407 passed, 0 failed across 70 files, using project-pinned Bun 1.4.0.
• Focused native-exec policy, tool-definition dependency, and silent-redirect checks: 69 passed, 0 failed across 4 files.
• bun run structure:check, bun run privacy:scan, and the file-size ratchet check passed.
• cd docs-site && bun install --frozen-lockfile && bun run build: passed; 537 pages and 73,657 internal links checked.
• coderabbit review --agent --base-commit 86ac102611e86ec12b3700b8ec8db2bd4deca2ff -c AGENTS.md: completed with 0 issues across all 4 changed files. Codex source review found no outstanding issues. This is local CLI review evidence; the hosted CodeRabbit review was previously skipped while draft.

Full-suite scope exception: the repository has 1,858 test files; a full multi-platform run is disproportionate to this focused redirect change. bun run test:changed expanded into broad server/Lab coverage and was stopped while correcting stale dependencies and the non-pinned global runtime. It is NOT reported as passing. Every one of the 22 files that had failed in that attempt was rerun independently with project-pinned Bun. Fifteen passed directly; seven Lab files passed after removing inherited HTTP(S)/ALL/NO_PROXY variables (upper- and lower-case) from the test subprocess environment. The Cursor suite above and relevant source-oracle checks cover the changed behavior. Full fresh-process CI coverage remains for upstream CI.

Isolated Cursor validation

Additional validation used the same commit, an isolated source-started proxy on an ephemeral loopback port, temporary OpenCodex/Codex state directories, and a dedicated Responses client implementing the code-mode tool contract. The installed OpenCodex service was not updated or restarted.

• Deterministic source A/B passed: invoking the actual native-exec rejection handler for Shell and Read with the original base source reproduced the incorrect top-level shell/MCP alias guidance. The patched source returned the code-mode exec guidance with nested helpers and explicit output for both branches. This redirect logic is shared across Cursor models.
• cursor/grok-4.7 normal live probe passed: three sequential exec calls invoked nested tools.exec_command to read a manifest, read the referenced fixture, and obtain its line count. The final answer correctly reported the fixture's random validation token, sum (42), and line count (3).
• cursor/grok-4.7 controlled denial-recovery probe passed: the client injected the patched native-denial text as the first tool result. The model reissued the operation through exec and completed the same task correctly. This is a simulated denial followed by real model/tool execution, not an observed end-to-end Cursor-native rejection.
• cursor/claude-opus-5-5 and cursor/claude-sonnet-5-5 remain unverified live: requests failed before any tool invocation with response.failed, code rate_limit_exceeded, and Cursor Connect error resource limit exceeded. These failures neither validate nor invalidate the redirect fix for those models.

Evidence boundary: the source regression and Grok probes validate the corrected guidance and its use by Grok. They do not establish that Opus/Sonnet recover from the original rejection in a real Codex App session; that acceptance check remains outstanding. Temporary test servers were stopped and temporary credentials removed after validation.

Upstream CI and required review approvals remain separate merge gates; the local/live evidence above is not a claim that those gates have passed.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Improved guidance shown when Cursor blocks native file, shell, or fetch operations. Instructions now better match the available execution tools, including code-mode catalogs without a top-level shell bridge.
• Documentation
  • Updated the adapter reference to clarify which execution guidance applies to different tool catalog configurations.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 79cf036e-269e-4686-88c3-0db8b94efe8f

📥 Commits

Reviewing files that changed from the base of the PR and between 86ac102 and 613cc84.

📒 Files selected for processing (4)

• docs-site/src/content/docs/reference/adapters.md
• src/adapters/cursor/native-exec.ts
• structure/providers/cursor.md
• tests/providers/cursor/cursor-native-exec-policy.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Cursor native-execution denial hints now distinguish freeform unified exec catalogs without a bare shell bridge from flat execution catalogs. Denial handling, tests, and adapter documentation reflect the catalog-specific guidance.

Changes

Cursor execution redirect

Layer / File(s)	Summary
Select and build catalog-aware redirects src/adapters/cursor/native-exec.ts	The redirect function now considers whether unified exec is freeform. For code-mode catalogs, the hint directs calls through nested helpers in the JavaScript cell and uses the shared result-echo wording.
Apply and validate denial hints structure/providers/cursor.md, tests/providers/cursor/cursor-native-exec-policy.test.ts, docs-site/src/content/docs/reference/adapters.md	Denied native frames use catalog-aware hints. Tests cover catalog variants and native operation denials. The adapter documentation describes the same routing rules.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 613cc

The catalog-aware denial guidance has no established issue requiring a fix before merge. Normal validation and maintainer approval still apply.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 613cc

A denied native operation is now directed to an available execution tool rather than unavailable commands. Native execution remains separately opt-in, but the complete live redirection path has not been verified end to end.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed guidance can steer a recipient toward filesystem, shell, or network helpers inside an exec tool already advertised for that turn. Evidence does not establish new native-execution authority or exposure beyond that advertised tool.

Security Findings and Attack Paths

• inferred — No bypass of the native-execution guard is established: the changed code selects guidance, while denied native frames continue through the guarded rejection path. The authority and outcome of any later exec call have not been verified as one end-to-end flow.

Trust Boundaries and Controls

• observed — A server-supplied native-exec frame enters the transport, which passes its policy context and redirect hint to the dispatcher. Denial guidance does not itself set the native-execution opt-in flag.

Resilience and Maintainability Implications

• observed — The transport marks native-exec handling replay-unsafe before dispatch, protecting against a fallback repeating a local action. The PR does not change that handling.

Hardening Proposals

• proposed — Verify one live active turn with tool-choice filtering, denial-hint delivery, and the subsequent advertised-tool call together, including the controls applied to that call and repeated denials.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: redirecting Cursor native-tool denials through code-mode execution.

Full details: Docstring Coverage

Explanation

Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu

[lidge-jun]

리뷰 · 우선순위 56 / 80

이 PR은 Cursor가 코드 모드(freeform exec만 있고 맨 위 셸 브릿지가 없는 요청)에서 네이티브 Read/Shell/Fetch 같은 도구를 막았을 때, 예전처럼 없는 shell_command/exec_command를 가리키지 않고, 오히려 exec 안쪽의 await tools.<name>(...)와 text(...) 결과 출력으로 다시 보내게 고칩니다. cursorNativeExecRedirectHint 검사 순서를 바꿔서, 예전에는 “실행 경로가 있다”고 보고 기본 브릿지 문구(undefined)로 빠지던 freeform exec를 코드 모드 전용 안내로 분기합니다. 문서(adapters.md, structure/providers/cursor.md)와 회귀 테스트도 같이 들어 있고, 기본 base는 dev입니다.

라인 - PR body / Verification: 작성자가 테스트·typecheck·빌드·실제 Cursor 모델 확인을 일부러 안 돌렸다고 적어 두었습니다. 회귀 케이스는 있지만 실행 증거가 없어서, draft 체크리스트 0/4인 지금 상태로는 머지 근거가 될 수 없습니다.
라인 - src/adapters/cursor/native-exec.ts cursorCodeModeExecRedirectHint: 거절 안내마다 CODE_MODE_RESULT_ECHO_SENTENCE 전체를 붙입니다. 내용은 tool-guidance와 맞춰 둔 것은 맞지만, 거절이 여러 번 나면 아주 긴 “조용한” 리다이렉트가 반복되어 모델 주의/토큰을 많이 씁니다. 짧은 핵심 문장만 남길지, 지금처럼 전체 문장을 유지할지 정하면 좋습니다.
라인 - tests/providers/cursor/cursor-native-exec-policy.test.ts: 코드 모드 분기·프레임별 미실행 커버는 방향이 좋습니다. 다만 로컬/CI에서 해당 describe가 실제로 통과했다는 기록이 PR에 아직 없습니다. 최소한 이 파일만이라도 돌린 결과를 Verification에 적어 주세요.

메인테이너의 판단이 필요한 지점

검증을 미룬 draft를 리뷰 큐에 둘지, 아니면 테스트 통과 증거와 readiness 체크리스트가 채워질 때까지 대기할지. 또 거절 힌트에 result-echo 전문을 넣을지(빈 출력 재발 방지) vs 짧게 줄일지.

너의 추천

의도한 수정(코드 모드에서 없는 탑레벨 셸로 보내지 않기)과 테스트 설계는 타당합니다. 다만 지금은 draft이고 실행 검증이 없어서 머지하지 마세요. 해당 테스트 스위트를 돌리고 Verification에 명령을 적은 뒤, ready 체크리스트를 채운 다음에 다시 보면 됩니다. types.ts/config.ts 분할이나 preview deploy 이야기는 이 변경과 무관하니 여기서는 닫아도 됩니다.

이 댓글은 grok-bot이 작성했습니다