[WRONG BRANCH] fix(cursor): bound output guard reasoning quarantine

[luvs01]

Motivation

• Prevent unbounded memory growth when an external Cursor upstream streams many pre-text reasoning frames that were previously quarantined without any aggregate cap.
• The quarantine must account for non-text thinking_delta events so an attacker or compromised provider cannot exhaust process memory during tool-result continuations.

Description

• Introduce a shared aggregate hold cap CURSOR_OUTPUT_GUARD_MAX_HOLD_BYTES and reuse it in the envelope sniffers (src/adapters/cursor/envelope-echo.ts).
• Meter every quarantined event by serialized size in createCursorAdapter by adding guardHeldBytes, guardEncoder, and holdGuardEvent(event) so reasoning frames contribute to the same 8 KiB cap and trigger a flush/disarm when exceeded (src/adapters/cursor.ts).
• When the aggregate cap is exceeded the code now calls echoSniffer?.finish() / routingCommentarySniffer?.finish() and releaseGuardHeld() to flush and disarm the quarantine so held events are emitted instead of growing unbounded.
• Add a regression test demonstrating a reasoning-only stream crosses the cap and flushes instead of retaining events indefinitely (tests/cursor-envelope-echo-retry.test.ts).

Testing

• Ran the focused unit tests: bun test tests/cursor-envelope-echo-retry.test.ts and they passed (all tests in that file passed).
• Ran bun run typecheck and bun run privacy:scan, both succeeded.
• Attempted the full test suite (bun run test); repository-wide integration/Lab tests showed unrelated environment-dependent failures (sandbox proxy env checks, some long integration timeouts and CLI help differences) and therefore are outside the scope of this focused fix.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cfd16746-df93-4ac4-93b6-01ec9c110feb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 327635678e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Inspect cap-crossing text before disarming the quarantine

When retained reasoning leaves guardHeldBytes just below 8 KiB and the next first text_delta both crosses the cap and begins with [Tool Result] or matching routing-failure commentary, this branch settles both sniffers and emits the held events before the caller feeds that text to them. The invalid marker therefore reaches the client and sets emittedOutput, preventing the corrective retry even though nothing had escaped before this delta; evaluate a cap-crossing text event with the active sniffers before deciding to flush and disarm.

AGENTS.md reference: src/AGENTS.md:L17-L19

Useful? React with 👍 / 👎.