v1.4.39

Fixed

• A terminal Cursor error after a Pi tool call no longer drops the latest checkpoint. The mid-pause save and bridge release now run before the stream is finalized.
• Pi tools whose names clash under the mcp_pi_ prefix no longer reach the wrong tool. One name map feeds discovery, catalogs, history, policy, and dispatch.
• Exec field 28 is Cursor's Task/subagent request. It is rejected with a typed SubagentError instead of an unknown-exec throw. This provider does not spawn the subagent and does not read or log the prompt or credentials that request can carry. Fixes #42.

v1.4.37

Changed

• Local file and shell operations now run through Pi registered MCP tools, with guidance for unavailable tools and a retry limit. Web search and fetch remain available.
• Pi 0.86 transcript system prompts and tool declarations are restored while preserving compatibility with older Pi versions.

Fixed

• Grok 4.7 variants now route through sibling wire IDs with empty parameters, including fast, Max Mode, and Cursor-prefixed variants. Fixes #38.

v1.4.36

Changed

• Toolchain is Node.js + Yarn. Bun is no longer required to develop, test, or publish. Package manager is Yarn 4 (node-modules linker), unit tests run on Vitest, and dist/ is bundled with tsup. Runtime HTTP/2 still uses in-process node:http2. Pi hosts should be Node.js >= 22.

Security

• CI audits the installed Yarn graph with yarn npm audit instead of npm audit (which does not read yarn.lock).
• Dev tooling pins Vitest 4.1.11 (GHSA-82fw-gwwq-j7x9), esbuild 0.28.2, and glob 13.0.6.

v1.4.35

Fixed

• Non-function / malformed tools no longer crash request preparation. slimOpenAIToolsForCursor and buildMcpToolDefinitions skip or pass through tools without a function object instead of throwing. Fixes #32.
• Pi clipboard screenshots no longer come back as permission denied. Ctrl+V writes $TMPDIR/pi-clipboard-<uuid>.<ext> and inserts that path as text. Native read now allowlists those files (read-only; write/delete/shell stay in the workspace), returns image bytes instead of UTF-8, and the request builder attaches the same files as vision images so the model can see the screenshot without a tool call. Leaf symlinks, non-image payloads, and files over Cursor's 5 MiB image cap are refused.

v1.4.32

Fixed

• Fable requests no longer fail with Connect error not_found. The Run request now sends model selection only through requested_model; model_details is a legacy alternative, and populating both fields made Cursor reject valid claude-fable-5-1 requests. Fixes #23 via #24.

v1.4.31

Changed

• Cursor-native tools now run on the open stream (read, ls, grep, write, delete, shell, fetch) instead of being rejected back to MCP. The model keeps generating on the same Run RPC; Pi MCP tools remain for anything called that way. Paths stay inside the workspace.
• Prompt history is always rebuilt from Pi's transcript, even when a checkpoint exists, so empty server-side placeholders cannot wipe earlier turns. Pi's system prompt stays on root_prompt_messages_json (<rules>). customSystemPrompt is not sent — Cursor maps that field to a --system-prompt CLI option this client path rejects (invalid_argument: unknown option '--system-prompt').
• Hosted web search / fetch permission prompts are approved by default so those turns complete instead of forcing a re-plan. Pass approveWeb: false to reject.
• Default x-cursor-client-version is cli-2026.07.23-e383d2b. Client heartbeats go out every 5s. HTTP CONNECT proxy support via PI_PROXY_CURSOR / PI_PROXY / HTTPS_PROXY.

Fixed

• A Connect invalid_argument is no longer labeled as wire-protocol drift. The protocol-hint used to match any Connect error, so a rejected --system-prompt option told people to bump PI_CURSOR_CLIENT_VERSION.
• resource_exhausted no longer retries the same dead conversation id. The conversation is rotated before the next attempt.
• A transient Cursor internal or unavailable end-stream error no longer kills the turn. These arrive as an end-stream frame with exitCode: 0; the end-stream handler now stages the error so existing recovery owns the retry. Ports #22.
• A checkpoint whose blobs the entry bound evicted is no longer kept and replayed with blank history. mergeBlobStore now drops the checkpoint whenever its trim evicts anything. Ports #21.

v1.4.30

Fixed

• Cursor 3.18.9 additive agent.v1 envelope fields no longer report as wire-drift. InteractionUpdate.message_started_at_ms, ExecServerMessage.accept_hook_additional_contexts, ConversationStateStructure start timestamp/timezone, and AgentServerMessage.ttft_breakdown are decoded so /cursor.doctor and Connect internal errors stop attaching this inventory. Fixes #16.
• Tool-schema slimming no longer drops user-defined properties named description, title, or default. Annotation keys are stripped only on schema nodes; named maps (properties, $defs, …) keep their keys. Prevents invalid schemas (dangling required) that Gemini rejected as resource_exhausted.
• GetUsableModels cursor-* rows no longer keep a guessed 200K window when Cursor already published contextTokenLimit. Parameterized discovery lists grok-4.6 at 256K; the parameterized window is now copied onto the cursor- prefixed twin. Grok 4.5/4.6 infer as 256K when metadata is missing.
• Cursor GPT-5.6 Luna/Sol/Terra no longer advertise a 1M window that OpenAI rejects at 500k. Display-name "1M" is ignored unless the id has -1m; 1m variants are capped at 500k so threshold compaction fires first. Claude 1M rows are unchanged.

v1.4.28

Security

Republish from restored main after an unauthorized force-push on 2026-08-27 rewrote this repository's default branch. npm 1.4.27 was published on 2026-08-22, before that rewrite. Install from npm or this tag, not from a clone taken during the incident.

v1.4.24

Fixed

• Unnamed InteractionQuery field 9 no longer kills the in-flight turn. Field 9 is still rejected; we now answer with a reject-shaped response so the stream continues. Fixes #10
• Idle/transport restart after a tool pause matches Pi's in-flight turn, not the bridge suffix. Duplicate re-emitted exec ids are collapsed. Ports #8 and #9
• Blob store entry bound evicts oldest-first instead of failing the conversation. Inspired by #11

npm: @rahularya01/pi-cursor@1.4.24

v1.4.23

Fixed

• Tool continuation after an idle timeout no longer discards a valid checkpoint as stale_checkpoint. Fixes #5
• /login cursor is no longer overridden by IDE/CLI credentials. Cascade is now env → Pi OAuth → Keychain → IDE DB. Rotated OAuth refresh tokens are written back to auth.json.
• WSL no longer reads every Windows user's Cursor state.vscdb. Only the current Windows account is considered.
• Unknown Cursor exec messages fail closed instead of sending a guessed empty MCP result.
• Web/search InteractionQuery is rejected by default; unnamed proto field 9 and Cursor mode-switches no longer auto-approve.
• Refresh error bodies and debug logs redact refresh tokens / JWTs.

npm: @rahularya01/pi-cursor@1.4.23