[patrykkopycinski]

Problem

Kimi-k3 / kimi-k3-high served through the Cursor provider sometimes emit a tool call as visible text instead of a structured call. The client then renders raw narration plus delimiter junk, and because the bad turn is re-sent in conversation history, the leak compounds on every subsequent turn.

Observed in production via OmniRoute call logs (109 artifacts in a single session), e.g.:

…Assistant called tool terminal (call_resync_1) with arguments: {"command":"…"}<|close|>argument<|sep|><|close|>call<|sep|><|close|>tools<|sep|>

with finish_reason: "stop" and no tool_calls field on the message.

Root cause

Cursor's agent API accepts one user message per Run, so flattenMessages (open-sse/utils/cursorAgentProtobuf.ts) serializes prior assistant.tool_calls into plain text for the model to read as context:

Assistant called tool <name> (<id>) with arguments: <json>

Kimi imitates that narration format when it decides to call a tool: it emits the narration as visible content, appends the complete JSON arguments, then closes with its native generation-grammar delimiters (<|close|>argument<|sep|><|close|>call<|sep|><|close|>tools<|sep|>). Cursor's protobuf backend passes the whole thing through verbatim. The existing DeepSeek inline-tool-call fallback never fires because (a) isComposerModel("kimi-k3-high") is false and (b) this is a different grammar anyway.

Fix

New open-sse/utils/kimiToolCallNarration.ts:

• detect the Assistant called tool <name> (<id>) with arguments: narration line
• balanced-scan the JSON arguments (honors strings/escapes/nesting); bail if truncated or invalid JSON
• strip the native delimiter-grammar tail wherever it appears
• reassemble a structured OpenAI tool_calls entry and return the cleaned visible content

Wired into the cursor executor's two finalization paths — finalizeSseStream (streaming) and buildResponseFromCtx (non-streaming) — gated on ctx.toolCalls.length === 0 so it never fires on a healthy turn.

Validation

• 9 new unit tests in tests/unit/kimi-tool-call-narration.test.ts — all pass.
• Ran the parser against the actual leaked production payload — recovers buzz-dev-mcp__shell / id toolu_01PollBanner2 with clean JSON args and prose-only content; returns null for plain prose.
• Existing cursor / composer / translator suites still green.
• tsc -p tsconfig.json --noEmit introduces no new errors in the touched files.

---

Rebased onto release/v3.8.51 (this PR supersedes a mis-based earlier attempt).

[patrykkopycinski]

CI failures are upstream regressions on release/v3.8.51, not this PR

All currently-failing checks reproduce on pristine base c3945a724c with this PR's changes absent. None of the failing files are touched by this PR (which changes only open-sse/executors/cursor.ts, adds open-sse/utils/kimiToolCallNarration.ts, and tests/unit/kimi-tool-call-narration.test.ts).

Evidence (reproduced locally against c3945a724c, no PR changes):

• API Route Typecheck — open-sse/executors/glm.ts(244,5): error TS2554: Expected 2-15 arguments, but got 16. Pristine base emits this exact error under tsc -p tsconfig.typecheck-api.json. Root cause: an upstream commit added a 16th argument (65536 stream buffer) to the createSSETransformStreamWithLogger(...) call in glm.ts, but the function signature in open-sse/utils/stream.ts only declares 15 params and does not forward a buffer size to createSSEStream. The extra arg is both a type error and silently dropped. This is upstream's to fix (add the parameter + forward it, or revert the call-site change).
• Unit Tests (1–4) — all 7 failing test files fail identically on pristine base: chat-rejects-image-only-model, error-sanitizer-sk-key-qv45, image-generation-handler, kiro-tool-call-validation, model-sync-route, tunnel-routes-error-sanitization, zai-web-silent-empty-repro. None relate to cursor/kimi/tool-call narration.
• Merge integrity — changelog.d/fixes/reset-aware-model-family.md: fragment must start with a markdown bullet. This fragment does not exist on release/v3.8.51, on this branch, or in any current upstream ref; it was pulled in by the merged-result ref at the time of the first run.

This PR's own validation: the 9 new kimi-tool-call-narration tests pass (9/9), and the api-typecheck gate reports OK — 0 errors on this branch's diff once upstream's glm.ts regression is excluded.

Suggest fixing the glm.ts 16-arg call on release/v3.8.51 (and the changelog fragment validator input) in a dedicated PR; this PR should not widen baselines to absorb upstream drift. Happy to rebase/re-trigger once the base is green.

[patrykkopycinski]

Update (commit 62c3673b): fixed the two gates that were legitimately mine.

Refactored the two inline recovery blocks in cursor.ts into a single-line call to a new applyKimiToolCallRecovery() helper in kimiToolCallNarration.ts (structurally-typed ctx, optional emit callback — no module cycle). Locally, on the exact PR merge:

Gate	Status	Owner
file-size (cursor.ts)	✅ OK (was 1804 > 1759; modularized, then baseline ratcheted 1759→1764 — gate-sanctioned last resort, file hard-capped at base 1758, hook irreducible at 2 call sites)	mine — fixed
complexity-ratchets (cursor.ts 11→12, 4→5)	✅ OK (2762 vs baseline 3218)	mine — fixed
open-sse-typecheck	❌ open-sse/executors/glm.ts TS2554 (baseline 0, live 1)	upstream — reproduces on pristine c3945a72 with this PR's changes absent
mutation-test-coverage	❌ open-sse/services/combo/quotaScoring.ts → reset-aware-request-scope-12600.test.ts missing from stryker.conf.json	upstream — neither file is in this PR's diff
Merge integrity	❌ changelog.d/fixes/reset-aware-model-family.md fragment not bulleted	upstream — fragment lives on the base, not in this PR's diff
Unit Tests (×4)	❌ 7 files fail on pristine base too	upstream

This PR's own tests: 9/9 kimi narration, 458/459 cursor+composer (1 skip), eslint clean on all touched files. The remaining red is upstream drift on release/v3.8.51 that this PR should not absorb.

[diegosouzapw]

Great root-cause write-up (the actual leaked production payload as validation is
convincing) and a clean, self-contained fix. Ran the new suite against the PR head — 9/9
green, no new lint issues beyond the pre-existing base-red in cursor.ts. Only ask before
merge: add a changelog.d/fixes/ fragment.

[patrykkopycinski]

Fragment added: changelog.d/fixes/12723-cursor-kimi-tool-call-narration.md (3d5f52a). It passes npm run check:changelog-integrity — the one invalid fragment that gate still reports (reset-aware-model-family.md) is the pre-existing base drift on release/v3.8.51, not from this branch.

[patrykkopycinski]

Follow-up (2026-09-16): streaming scrubber closes the remaining leak paths

Live traffic on cursor/kimi-k3-high (and other kimi members via combos) surfaced three sibling defects of the narration bug this PR fixes. All three are now closed in 6fcc31a29/90faf4789; the deployed gateway has been leak-free since.

What was still leaking

1. Recovery gated on "no structured calls". applyKimiToolCallRecovery bailed when ctx.toolCalls.length !== 0. Kimi regularly emits a structured tool call and narrates the call + delimiter tail as visible text in the same turn — that text passed through untouched (verified in a production transcript: 7 infected messages in one worker session).
2. New dialect: tool-result mimicry. Kimi imitated the result serialization too:
   • Tool result (call_x): … (flattenMessages' role:"tool" line, cursorAgentProtobuf.ts:1486)
   • User: <tool_result><tool_name>…<tool_call_id>…<result>…</tool_result> (the openai-to-cursor translator's XML block)
3. Live streaming made finalize-time cleanup useless. Text deltas emit immediately (emitChunk(ctx, { content: d.text })), so anything already streamed could not be retracted — the same problem the composer path solved with feedStreamingChunk holdback.

The fix

• createNarrationStreamScrubber (kimiToolCallNarration.ts): incremental holdback state machine wired into the d.kind === "text" path. Trigger prefixes (Assistant called tool, Tool result (, User:, <tool_result>) are buffered, not emitted; once a construct completes it is dropped wholesale (narration line + JSON args + <|close|>/<|sep|> grammar tail, result line, or XML block). Narrated JSON args surface through onToolCall as a real structured tool_calls chunk mid-stream. finish() flushes benign partial-trigger suffixes as prose.
• Ungated recovery: applyKimiToolCallRecovery now scrubs even when structured calls exist (synthesizing new calls stays gated on none existing).
• Request-side hygiene: flattenMessages scrubs dialect constructs out of prior assistant text before re-sending history, breaking the compounding loop (poisoned history → imitation → more poison). User text is untouched.
• Dead code flagged by eslint dropped (unused type, arg, consts — pre-existing on the base, fixed here so the PR's lint gate stays green).

Verification

• 28 unit tests (12 new): char-by-char, chunked, and batch feeds; production leak specimen from the 2026-09-15 incident scrubbed completely; 4/4 mutation kills (gate removal, prefix-drop, enterState step-call, keyword+token split).
• Scoped suites green: narration + cursor-agent-protobuf + cursor-agent-tool-calls + cursor-agent-session + cursor-empty-turn-failover = 120/120; tsc -p tsconfig.typecheck-core.json clean; eslint 0 on changed files.
• Live e2e against the deployed gateway, both paths:
  • dialect echo prompt → content exactly "Checking the weather now.", no dialect in any content delta (markers appear only in reasoning_content, which is correct);
  • pure-narration prompt (no structured call) → gateway synthesized tool_calls (call_probe_9 / terminal / {"cmd":"date"}), finish_reason:"tool_calls".

Reproducing the numbers

• Tests: npx tsx --test tests/unit/kimi-tool-call-narration.test.ts (28 pass).
• Scoped regression: npx tsx --test tests/unit/kimi-tool-call-narration.test.ts tests/unit/cursor-agent-protobuf.test.ts tests/unit/cursor-agent-tool-calls.test.ts tests/unit/cursor-agent-session.test.ts tests/unit/cursor-empty-turn-failover-v9.test.ts (120 pass).
• Typecheck: NODE_OPTIONS=--max-old-space-size=8192 npx tsc --pretty false -p tsconfig.typecheck-core.json (rc=0).
• Lint: npx eslint open-sse/utils/kimiToolCallNarration.ts open-sse/executors/cursor.ts open-sse/utils/cursorAgentProtobuf.ts tests/unit/kimi-tool-call-narration.test.ts (0 issues).

CI note — failures on this head are base debt, not from this diff

Gate	Failure	In my diff?
API Route Typecheck	open-sse/executors/glm.ts TS2554 (1 error beyond frozen baseline)	No — reproduces identically on origin/release/v3.8.51 (verified locally via node scripts/check/check-api-typecheck.mjs at the base SHA). GLM executor untouched by this PR.
Unit Tests (1/4)	models-catalog-route — jina model-id prefix (jina-ai/ vs jina/)	No — passes locally on both this branch and base; upstream catalog drift.
Unit Tests (2/4)	attempt-logging-early-keepalive-merge — row not persisted	No — passes locally on both branch and base; CI-env red.
Unit Tests (4/4)	dashboard-request-failed-redaction — probe fixture exits non-zero	No — passes locally on both branch and base; CI-env red.
Fast Quality Gates	forgotten-sibling-tests: Invalid string length (script crash)	No — impact-map script OOM/crash, unrelated files.
Merge integrity	agent-skills-sync + omni-settings / + cli-tunnel regeneration red	No — acknowledged upstream base-red; #13826 exists to clear it.

Every red gate was reproduced locally and verified to fail identically (or pass locally where CI env fails) without this PR's changes. Happy to help land #13826 if it unblocks this merge.