fix(cursor): stop false shell blocked reports and cmd/command mismatch (#399) by Wibias · Pull Request #402 · lidge-jun/opencodex

Wibias · 2026-07-24T10:42:51Z

Summary

Fixes [Bug] Cursor adapter: false "Shell/Read blocked" reports caused by shell-tool name mismatch + native-exec rejections #399: Cursor-backed Codex chats were reporting shell/read as blocked even with full sandbox access.
Root causes found in live sessions:
1. Tool-name thrash (shell_command / exec_command / long mcp_opencodex-responses_* aliases) plus native Shell/Read policy rejections made models invent "blocked" commentary.
2. The functional break: Cursor advertises the shell bridge with cmd, models send cmd, but Codex validates command → missing field \command``. That made the bridge actually fail, so agents switched to Node REPL / Grep and told users shell was broken.
This PR:
- Treats shell_command and exec_command as one Codex shell bridge (aliases + guidance).
- Pins the shell bridge + apply_patch through Cursor catalog truncation.
- Rewrites native-exec rejection copy so policy routing is not mistaken for a sandbox denial.
- Normalizes completed Cursor shell args against the Responses-side schema so cmd is rewritten to command before Codex validation.
Verified locally on port 10100: after restart, live Codex shell_command calls succeed again (real Exit code: 0 output); the missing field \command`` loop stops.

Test plan

bun test tests/cursor-tool-definitions.test.ts tests/cursor-protobuf-events.test.ts tests/cursor-request-builder.test.ts tests/cursor-native-exec.test.ts tests/cursor-blob.test.ts tests/cursor-arg-normalize.test.ts
bun x tsc --noEmit
Local proxy on 10100 from this branch; live Codex Cursor sessions no longer die on missing field command
Fresh Codex chat on a cursor/* model: run a simple shell command and confirm it executes without "shell access is blocked" abandonment
Confirm truncated tool catalogs still retain the shell bridge + apply_patch

Summary by CodeRabbit

New Features
- Added interoperable support for shell_command and exec_command as a single shell-bridge tool, including Responses-compatible argument normalization (e.g., cmd→command).
- Improved Cursor tool matching with alias-aware tool schemas, tool-call event rewriting, and pinned-first tool budgeting.
Bug Fixes
- Updated native execution policy and guidance text to consistently route denied operations through the active shell-bridge tool.
Tests
- Expanded coverage for alias handling, budgeting rules, and updated shell-bridge/policy prompt strings.

…aders + sideband API host)

Treat shell_command/exec_command as one Codex bridge, pin it through catalog truncation, and rewrite native-exec rejection copy so policy routing is not mistaken for a sandbox denial.

Cursor advertises cmd, but Codex validates command. Normalize completed tool args against the Responses-side schema so shell_command stops failing with missing field command.

…idge-jun#399) Accept shell_command/exec_command as one advertised bridge at the client-tool gate, force-keep the bridge through byte-budget truncation, update native-exec policy assertions, and sharpen anti-false-block guidance for Cursor-native Shell.

Share one shell-bridge alias resolver and extend budget eviction so apply_patch is force-kept like the shell bridge when filler tools crowd the Cursor catalog.

…ge-jun#399) Pin-first admission already keeps shell_command/apply_patch ahead of filler, so the recovery eviction path could never run. Remove it and assert ordinary priority-based omission instead.

…#399) Rewrite native-exec rejection and guidance copy to route silently to the Codex shell bridge without disabled/denial wording that models echo to users.

Wibias · 2026-07-24T19:19:30Z

Ready

…idge-jun#399) Keep forced shell_command/exec_command from matching namespaced remotes, and tighten native-exec denial message regressions.

…ools priority (lidge-jun#399) Make shell alias tool_choice catalog-aware, discard aliases when canonical keys are present regardless of order, and admit shell/apply_patch ahead of unrelated allowed tools under truncation.

lidge-jun and others added 7 commits July 23, 2026 23:06

release: v2.7.36-preview.20260723

bc38dab

release: v2.7.36

9eb3df5

Merge branch 'dev' into main: GPT-Live voice relay fixes (protocol he…

5c8ee00

…aders + sideband API host)

release: v2.7.37

b9a5d39

release: v2.7.39

357acee

fix(cursor): stop false shell/read blocked reports (lidge-jun#399)

dff68d0

Treat shell_command/exec_command as one Codex bridge, pin it through catalog truncation, and rewrite native-exec rejection copy so policy routing is not mistaken for a sandbox denial.

fix(cursor): rewrite shell bridge cmd args to command (lidge-jun#399)

24e34d4

Cursor advertises cmd, but Codex validates command. Normalize completed tool args against the Responses-side schema so shell_command stops failing with missing field command.