[WRONG BRANCH] fix(cursor): preserve reserved-prefix call ids

[luvs01]

Motivation

• The Cursor call-ID codec decoded any ocxc1_-prefixed canonical base64url value even when the encoder would never produce it, which can change call identities on replay and corrupt pairing.

Description

• Restrict decodeCursorCallId so it only accepts and decodes payloads whose decoded value actually requires encoding by adding if (!needsEncoding(decoded)) return id; in src/adapters/cursor/call-id.ts.
• Add a focused regression test tests/cursor-call-id.test.ts that asserts a canonical ocxc1_... id (e.g. ocxc1_Y2FsbF8x) passes through unchanged while multiline composite ids still round-trip.

Testing

• Ran git diff --check which produced no issues.
• Ran bun test tests/cursor-call-id.test.ts and all 6 tests passed.
• Ran bun run typecheck which succeeded.
• Ran the full test suite with bun run test; the Cursor tests passed but the full run surfaced an unrelated failure in tests/server-auth.test.ts (expected 401, received 403).

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c7506bc5-35b0-4f56-a503-85d181a6034d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}