[maria-rcks]

/compact on Cursor never compacted. T3 sent /compress as an ordinary message, the Cursor model replied that it couldn't shrink its own context, and the next turn still resent everything (150,303 input tokens before, 151,826 after). The Cursor SDK has no compaction call, in 1.0.35 or the latest 1.0.38. Its protocol has a summarize action, but only the SDK's internals can send it.

Compaction now happens in the adapter. /compact (and a literal /compress) runs a hidden turn that writes a continuation summary. It then creates a fresh Cursor agent seeded with that summary in a second hidden turn, and rebinds the provider thread's native ref to the new agent. The thread switches only after both runs succeed; a failure or interrupt keeps the old agent. The chat shows only the compaction row. Cursor's provider status now also lists /compact, so the composer offers it like other providers.

Verified live in T3 with Cursor Auto: after reading adapter.ts in full, a one-word turn sent 74,496 input tokens. After /compact the same turn sent 33,571, close to Cursor's ~28k base prompt. The agent id changed, no summary text reached the chat, and the new agent still named the file and function from before.

Compaction costs two SDK runs; the summary turn reads the old context from cache. Not verified: a T3 server restart right after compaction (the binding is persisted through provider-thread.updated), and Cursor native subagents, which are not carried to the new agent. Rewind and fork stay unsupported on Cursor, as before.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This changes Cursor compaction from a single provider command into a multi-step summary-and-agent-replacement workflow, including persisted native-thread rebinding and lifecycle changes. It also makes /compact a default Cursor slash command, so the resulting behavior and default user experience warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	+7 B (+0.1%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+7 B (+0.6%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−7 B (−0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−7 B (−0.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: ab6be13 · PR result: 1850762 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: f8638972-6861-409e-87b9-03e6b10450fa

📥 Commits

Reviewing files that changed from the base of the PR and between 49b0f96 and 1850762.

📒 Files selected for processing: 3

• packages/provider-cursor/src/server/adapter.test.ts
• packages/provider-cursor/src/server/adapter.ts
• packages/provider-cursor/src/server/status.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The Cursor provider now handles /compact and attachment-free /compress commands. It captures compaction summaries, uses them to seed a staged replacement agent, and updates the provider thread after successful completion. The adapter also reports compaction status and filters compaction messages from snapshot projection.

Changes: Cursor compaction

Layer / File(s)	Summary
Command recognition and summary capture packages/provider-cursor/src/server/adapter.ts, packages/provider-cursor/src/server/status.ts, packages/provider-cursor/src/server/adapter.test.ts	The adapter recognizes attachment-free /compact and /compress, captures compaction output, and emits a compaction item. Provider snapshots include the compact command and omit messages from compaction runs. Tests update transport-diagnostic assertions.
Replacement-agent lifecycle packages/provider-cursor/src/server/adapter.ts, packages/provider-cursor/src/server/adapter.test.ts	Completed compaction runs seed a staged agent. Successful finalization installs it and updates the provider thread. Failure and interruption paths retain the existing agent; scenario tests cover completion, errors, and interruption.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant CursorAdapter
  participant CursorSDK
  participant StagedAgent
  participant ProviderThread
  User->>CursorAdapter: submits /compact or /compress
  CursorAdapter->>CursorSDK: sends compaction prompt
  CursorSDK-->>CursorAdapter: returns compaction summary
  CursorAdapter->>CursorSDK: opens staged replacement agent
  CursorAdapter->>StagedAgent: sends summary and runtime instructions
  StagedAgent-->>CursorAdapter: returns seed run result
  CursorAdapter->>ProviderThread: updates native thread reference on successful finalization

Loading

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 18507

Cursor threads can now be compacted with /compact or /compress. A summary seeds a fresh agent, and the thread switches to that agent only after both steps succeed; on failure or interruption the original agent stays in place. No concrete defect was found. One point is worth confirming as follow-up: after compaction, earlier conversation context should still be available when a thread is handed off or recovered after a restart.

Security architecture risk: 🟡 Moderate · up to 18507

Compaction retains the conversation’s existing permissions while hiding activity details. Unexpected actions during summarization could therefore be missed. Failure and interruption handling generally preserve the previous conversation, limiting the impact of an unsuccessful transition.

Retained concerns

• Medium · security · inferred: The new hidden summary and seed executions retain ordinary tool authority while suppressing tool and shell activity from normal conversation projection. If prior conversation content or the generated summary induces an unexpected action, it can execute within the existing runtime permissions without the activity rows that ordinary turns produced before this PR. The no-tool restriction is expressed as instructions rather than an adapter-enforced capability boundary. This is an inferred loss of visibility and failure containment, not a verified exploit or an increase in credentials.

Security review details

Security Blast Radius

• inferred — The directly evidenced exposure is the active conversation’s configured workspace, native tools, and MCP connections. Full-access policy can disable sandboxing and native auto-review. Broader resource reach depends on those existing permissions and connections; cross-tenant or fleet-wide exposure was not established.

Security Findings and Attack Paths

• inferred — A conditional attack path is adversarial content already present in conversation context influencing the summary or seed execution to invoke an available tool. The PR-specific worsening is suppression of normal activity projection during these executions, rather than newly granted tool permissions. Actual malicious execution was not verified.

Trust Boundaries and Controls

• observed — The replacement preserves the existing runtime controls, and both instructions explicitly forbid task execution. The SDK wrapper forwards send options without adding a compaction-specific capability restriction. Interaction updates can still reach the optional protocol logger before projection filtering, so suppression from chat does not establish absence from every diagnostic record.

Resilience and Maintainability Implications

• observed — Interruption targets the seed run once available, terminal status prioritizes interruption, and unused staged sessions are released. These controls limit replacement-identity drift during ordinary failure handling, but do not establish rollback of any external effects from unexpected tool execution.

Hardening Proposals

• proposed — Use an enforceable tool-disabled execution policy for both hidden stages where supported. If such isolation is unavailable, preserve activity metadata and fail visibly on unexpected tool use rather than treating projection suppression as execution control.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description clearly explains the problem, implementation, verification results, screenshots, and known limitations. It does not include the required Scope and approval section or provide an issue,…	Add a Scope and approval section. Include the triaged issue or maintainer approval with the approval comment, or explain why this focused fix qualifies as an obvious bug fix without prior approval.

Passed checks: 3 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: Cursor /compact now compacts into a fresh agent.

Full details: Description check

Explanation

The description clearly explains the problem, implementation, verification results, screenshots, and known limitations. It does not include the required Scope and approval section or provide an issue, approval discussion, or rationale for an exemption.

Resolution

Add a Scope and approval section. Include the triaged issue or maintainer approval with the approval comment, or explain why this focused fix qualifies as an obvious bug fix without prior approval.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}