fix(cursor): bound output guard reasoning quarantine

[luvs01]

Motivation

• Prevent unbounded memory growth when an external Cursor upstream streams many pre-text reasoning frames that were previously quarantined without any aggregate cap.
• The quarantine must account for non-text thinking_delta events so an attacker or compromised provider cannot exhaust process memory during tool-result continuations.

Description

• Introduce a shared aggregate hold cap CURSOR_OUTPUT_GUARD_MAX_HOLD_BYTES and reuse it in the envelope sniffers (src/adapters/cursor/envelope-echo.ts).
• Meter every quarantined event by serialized size in createCursorAdapter by adding guardHeldBytes, guardEncoder, and holdGuardEvent(event) so reasoning frames contribute to the same 8 KiB cap and trigger a flush/disarm when exceeded (src/adapters/cursor.ts).
• When the aggregate cap is exceeded the code now calls echoSniffer?.finish() / routingCommentarySniffer?.finish() and releaseGuardHeld() to flush and disarm the quarantine so held events are emitted instead of growing unbounded.
• Add a regression test demonstrating a reasoning-only stream crosses the cap and flushes instead of retaining events indefinitely (tests/cursor-envelope-echo-retry.test.ts).

Testing

• Ran the focused unit tests: bun test tests/cursor-envelope-echo-retry.test.ts and they passed (all tests in that file passed).
• Ran bun run typecheck and bun run privacy:scan, both succeeded.
• Attempted the full test suite (bun run test); repository-wide integration/Lab tests showed unrelated environment-dependent failures (sandbox proxy env checks, some long integration timeouts and CLI help differences) and therefore are outside the scope of this focused fix.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b7de7244-a77e-42b5-8297-bab2f8dcc45c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 327635678e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Inspect cap-crossing text before disarming the quarantine

When retained reasoning leaves guardHeldBytes just below 8 KiB and the next first text_delta both crosses the cap and begins with [Tool Result] or matching routing-failure commentary, this branch settles both sniffers and emits the held events before the caller feeds that text to them. The invalid marker therefore reaches the client and sets emittedOutput, preventing the corrective retry even though nothing had escaped before this delta; evaluate a cap-crossing text event with the active sniffers before deciding to flush and disarm.

AGENTS.md reference: src/AGENTS.md:L17-L19

Useful? React with 👍 / 👎.

[luvs01]

Closing: superseded by combined PR #610, which carries this PR's bounded output-guard reasoning quarantine together with the echo-diagnostics retention change on current dev. Combined tests: 47 + 54 pass.

[devin-ai-integration]

Fixed at head (1aae049): text deltas are now classified by the armed echo/routing sniffers on each sniffer's bounded leading window BEFORE the aggregate-cap check, so an oversized first delta can no longer bypass detection. Regression tests cover oversized single deltas carrying each guarded pattern in tests/providers/cursor/cursor-envelope-echo-retry.test.ts.

[devin-ai-integration]

Fixed at head (1aae049): retained size is now projected from payload length plus fixed per-event overhead BEFORE any encoded copy exists; an event that cannot fit the remaining 8 KiB budget settles both sniffers, releases the held events, and is emitted directly without being serialized. A regression covers one reasoning frame larger than the cap.

[devin-ai-integration]

Done: structure/providers/cursor.md documents the aggregate limit and disarm behavior (1aae049), and c1506e3 now records the same retained-quarantine bound under Stream-buffer accounting in structure/transports/byte-accounting.md — the contract authority for adapter byte bounds (src/adapters/ is one of its covered areas).