[Bug]: Cursor Auto Intelligence echoes [Tool Result] as assistant chat after native tool calls

[jeongjin0]

Client or integration

Codex App

Area

Provider adapter

Summary

After a successful Codex tool call on cursor/auto-intelligence, the next assistant turn can paste the OpenCodex Cursor adapter's history envelope as chat instead of using the structured tool result.

Observed assistant text:

[Tool Result]
[tool_result]
call_id: call-...
name: exec
is_error: false
output:
<script output>

The expected next turn is ordinary assistant text or another structured tool call. The envelope above is not a Codex-native transcript format; it is the Cursor adapter's rootPromptMessagesJson serialization.

This is not covered by a live tracker:

• [Bug] Cursor adapter injects hide-from-user policy and fake user-turn tool-result replay; downstream agents treat it as prompt injection #1992 / fix(cursor): stop hide-from-user policy and user-role tool-result replay (#1992) #1997 moved tool-result root replay from role: user to role: assistant so Cursor would not wrap it as <user_query>. That closed the injection report, but native Auto now few-shot-mimics the assistant-role marker as chat.
• The existing [Tool Call] leak guard already documents this few-shot failure mode. There is no matching guard for [Tool Result] on native resume models.
• [Bug]: Cursor client-tool continuation can return tool-call-like assistant text to Pi #2305 is a cousin (Cursor returning tool-call-like assistant text to Pi) with a different transcript shape and is currently needs-info.

Reproduction

1. Run OpenCodex 2.26.0 (or current dev) on loopback and route Codex App through the Cursor adapter.
2. Select cursor/auto-intelligence.
3. Ask for a host-side shell/process inspection that produces a real exec / exec_command tool result (for example leftover vitest trees plus a few local apps).
4. After the tool result returns, observe the next assistant message.

The assistant can reprint the adapter envelope instead of summarizing or continuing:

[Tool Result]
[tool_result]
call_id: call-921fbd01-5289-4b95-a401-ab380c66b270-0
name: exec
is_error: false
output:
Script completed
...

Code path: src/adapters/cursor/protobuf-request.ts rootPromptMessages() serializes prior toolResult messages as assistant-role text with [Tool Result]\n[tool_result]\ncall_id: .... cursor/auto-intelligence is a native resume model (auto-* → wire default), so turns[] already carries the paired MCP result. The extra assistant-role root blob is what Auto copies into chat.

Version

@bitkyc08/opencodex 2.26.0 locally; the same root-replay path is still on current dev (ffa6d46d7).

Operating system

macOS 26.6 (arm64)

Provider and model

cursor / auto-intelligence (Codex selector cursor/auto-intelligence, adapter cursor, native resume / resumeAction)

Logs or error output

[Tool Result]
[tool_result]
call_id: call-921fbd01-5289-4b95-a401-ab380c66b270-0
name: exec
is_error: false
output:
Script completed
Wall time 0.5 seconds
Output:
TARGET_APPS
  496 Agent Cat ...
VITEST_TREES
35535 1 314384 node .../vitest.mjs --run ...

OpenCodex request history for the same route records successful Cursor-adapter turns (provider: cursor, model: auto-intelligence, HTTP 200). The failure is the model-visible prompt shape, not the upstream HTTP boundary.

Redacted configuration

{
  "route": "cursor/auto-intelligence",
  "adapter": "cursor",
  "admissionKind": "loopback",
  "inboundProtocol": "responses",
  "nativeLocalExec": "off (default)"
}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.

[lidge-jun]

리뷰 · 우선순위 71 / 80

지금 dev HEAD 3a3f556e1. #2319가 #2294를 넣었음. 이 이슈는 그 위. Codex App + cursor/auto-intelligence. 툴 호출 다음 어시스턴트가 [Tool Result] / [tool_result] / call_id 봉투를 채팅으로 붙여넣음. 재현 본문이 dev ffa6d46d7을 가리킴. 그 경로 지금 헤드에도 있음. 구현 PR은 #2318. 라벨 bug/provider/tools. #2305랑 모양만 닮음. 합치지 말 것. 스플릿 이슈 아님.

현재 dev가 그 봉투를 만듦. src/adapters/cursor/protobuf-request.ts:190-254 rootPromptMessages. 주석이 모델 프롬프트는 rootPromptMessagesJson이고 turns[]는 UI라고 함. toolResult는 :245-254에서 어시스턴트 롤 텍스트. 접두사 [Tool Result] / [Tool Error] + toolResultToText. toolResultRootPayload :136-138이 role: "assistant". #1992/#1997이 user 롤을 버려서 <user_query> 래핑을 막았음. native Auto가 그 어시스턴트 마커를 few-shot으로 따라함. [Tool Call] 가드는 :244에 이미 있음. Result 쪽 가드는 없음.

cursor/auto-intelligence는 native resume. src/adapters/cursor/discovery.ts:137-147 cursorWireModelSelection. cursor/ 접두 제거. auto-intelligence는 CURSOR_ROUTING_LEVELS의 intelligence. 와이어 default. :159-163 isCursorNativeWireModel이 default/auto/composer-* true. :183-186 cursorNeedsExternalToolContinuation은 외부 모델이거나 정확히 composer-2.5일 때만 true. Auto는 false. 그런데 rootPromptMessages는 그 헬퍼를 안 씀. native여도 Result 에코를 넣음. turns[]에 MCP 페어가 있는데 루트에 같은 페이로드를 어시스턴트 텍스트로 또 넣는 게 본문 증상.

#2318이 그 헬퍼로 루트 에코를 건너뜀. composer-2.5와 외부 모델은 유지. #1992 롤을 user로 되돌리지 않음. 이 이슈를 #2318 머지 전에 닫지 말 것. #2305는 Pi로 tool-call-like 텍스트가 가는 다른 트랜스크립트. needs-info. 중복 아님. #1992/#1997 재오픈하지 말 것.

types.ts/config.ts 안 만짐. 스플릿 안 씹힘. 리베이스하지 말고 닫으라는 케이스 아님. #2188 L1–L9 사이드카 + routed vision(#2306) 이미 dev. x_search 넣지 말 것. Grok OAuth Chat 기본(#2255)이랑 다른 레인임. 프리뷰 배포 아님. #2292 윈도우 피커랑 안 겹침. 카탈로그는 Ox Alpha x-preview-f-free + deepseek-v4-flash-vision-exp. v2.29.0 태그됨. v2.30.0-preview.20260821 있음. 비전공자 유지. Auto 채팅이 툴 봉투를 그대로 찍어서 71.

해결방안: #2318로 가라. 이 이슈는 그 PR 머지 후 close. rootPromptMessages의 toolResult 에코를 cursorNeedsExternalToolContinuation이 true일 때만 남겨라. Auto/composer-2.5-fast는 생략. composer-2.5+외부 모델은 유지. 롤을 user로 되돌리지 말 것. #2305랑 머지하지 말 것. 라벨 건드리지 말 것. 스플릿이 protobuf-request.ts를 옮기면 리베이스하지 말고 닫고 다시 짜라. 지금은 그 정도 아님.

이 댓글은 grok-bot이 작성했습니다