khaliqgant · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · coderabbitai
@@ -43,6 +43,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `POST /copilot/mcp` no longer returns an unknown-route error during native Copilot initialization: it uses Desktop's managed transport when available and otherwise reports the transport as unavailable.
 - `agent-relay-node` built for its own site (`AGENT_RELAY_SITE_URL`) no longer falls back to Agent Relay's public gateways: a sign-in whose site named no valid Relaycast URL, or a CLI workspace key with no recorded server or `RELAY_BASE_URL`, is refused with a reason naming the site, and `RELAYCAST_URL` is ignored in such a build.
 - `agent-relay-node` lists Codex sessions and delivers messages to them promptly when Codex's thread database is large.
+- Relay messages now wake an idle interactive Cursor CLI (`cursor-agent`) session within seconds, as they already did for Cursor editor chats, instead of waiting for its next tool call or prompt. This keeps working after several automatic follow-ups in a row.
+- Relay messages, channel posts and Relay Connect messages to agents in the Cursor editor and Cursor CLI say to reply through the session socket (with `agent-relay-probe` in the Cursor editor on macOS, where `curl` cannot reply), never through hosted MCP tools, which cannot send as a Cursor chat.
+- A Cursor editor chat can put itself on the relay during its first turn, before Cursor has written its transcript.
+- An idle Cursor editor chat is woken by Relay messages after a turn Cursor started itself, such as one reporting that a background task finished.
 
 ## [17.2.1] - 2026-11-07
 

@@ -220,8 +220,9 @@ pub enum RelayCommands {
         /// Read Agent Relay Dev's inbox instead of Agent Relay's.
         #[arg(long)]
         dev: bool,
-        /// At the end of a Cursor editor conversation's completed turn,
-        /// wait for its next message instead of answering at once.
+        /// At the end of a Cursor editor conversation's or CLI session's
+        /// completed turn, wait for its next message instead of answering at
+        /// once.
         #[arg(long)]
         wait: bool,
     },

@@ -368,8 +368,9 @@ pub fn devin_hook(development: bool) -> Result<()> {
 /// window's extension host (which it records as running that
 /// conversation), claims that session's staged messages and prints them:
 /// `additional_context` after a tool call, `followup_message` when the turn
-/// completes. With `--wait` (the `stop` entry) an editor conversation's
-/// completed turn with nothing pending waits for its next message instead
+/// completes. With `--wait` (the `stop` entry) a completed turn with
+/// nothing pending, in the editor or a CLI session, waits for its next
+/// message instead
 /// (`cursor_cli::wait`). A claim is tombstoned once the answer is written
 /// and put back if it is not (`cursor_cli::run_hook`). Anything else exits 0
 /// with `cursor_cli::no_answer`'s output (`{}`, or `{"continue":true}` for

@@ -1687,18 +1687,34 @@ impl Core {
                         let probe = match needs_probe {
                             Some(known) => known,
                             None => {
-                                let known = session.target.kind == SessionKind::Codex && {
-                                    let thread = session.target.id.clone();
-                                    let processes = self.plugins.processes.clone();
-                                    tokio::task::spawn_blocking(move || {
-                                        needs_probe_reply_client(
-                                            processes.as_ref(),
-                                            current_uid(),
-                                            &thread,
-                                        )
-                                    })
-                                    .await
-                                    .unwrap_or(false)
+                                let known = match session.target.kind {
+                                    SessionKind::Codex => {
+                                        let thread = session.target.id.clone();
+                                        let processes = self.plugins.processes.clone();
+                                        tokio::task::spawn_blocking(move || {
+                                            needs_probe_reply_client(
+                                                processes.as_ref(),
+                                                current_uid(),
+                                                &thread,
+                                            )
+                                        })
+                                        .await
+                                        .unwrap_or(false)
+                                    }
+                                    // A Cursor editor conversation, as its
+                                    // other reply commands do.
+                                    SessionKind::CursorCli => {
+                                        let target = session.target.clone();
+                                        let injector = self.plugins.injector.clone();
+                                        tokio::task::spawn_blocking(move || {
+                                            injector
+                                                .relay_socket(&target)
+                                                .is_some_and(|(_, probe)| probe)
+                                        })
+                                        .await
+                                        .unwrap_or(false)
+                                    }
+                                    _ => false,
                                 };
                                 *needs_probe.insert(known)
                             }
@@ -2121,6 +2137,34 @@ mod tests {
         assert!(direct_cli.contains("[reply: curl -s --unix-socket"));
     }
 
+    // A Cursor editor conversation's tools are named by
+    // `CURSOR_CONVERSATION_ID`, which Apple's curl hides; a Cursor CLI
+    // session's by the `cursor-agent` holding it, which curl reaches too.
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn mac_cursor_editor_reply_uses_probe() {
+        let editor = connect_reply_line(
+            Path::new("/tmp/run.sock"),
+            "host",
+            SessionKind::CursorCli,
+            true,
+        )
+        .unwrap();
+        assert!(
+            editor.contains(" connect-send --socket /tmp/run.sock --to host "),
+            "{editor}"
+        );
+        assert!(!editor.contains("curl"), "{editor}");
+        let cli = connect_reply_line(
+            Path::new("/tmp/run.sock"),
+            "host",
+            SessionKind::CursorCli,
+            false,
+        )
+        .unwrap();
+        assert!(cli.contains("[reply: curl -s --unix-socket"), "{cli}");
+    }
+
     #[test]
     fn only_debug_loopback_origins_can_override_the_cloud_join_url() {
         assert_eq!(

@@ -26,12 +26,15 @@ pub(super) fn connect_reply_line(
     let socket = socket.to_str()?;
     let request_path = format!("/connect/send?to={}", query_encode(sender));
     // macOS hides the environment of /usr/bin/curl from KERN_PROCARGS2.
-    // Use the probe executable so an app-server command keeps its thread ID.
+    // Use the probe executable so an app-server command keeps its thread ID,
+    // and a Cursor editor tool its `CURSOR_CONVERSATION_ID`.
     // On Windows the socket is a named pipe curl cannot reach, so every
     // session gets the probe client.
     // Claude Code's permission rules from Agent Relay allow the probe's
     // client (`outbound::prefers_probe_client`); curl only when it is unknown.
-    let required = cfg!(windows) || (kind == SessionKind::Codex && probe_client(needs_probe));
+    let required = cfg!(windows)
+        || (matches!(kind, SessionKind::Codex | SessionKind::CursorCli)
+            && probe_client(needs_probe));
     if required || crate::relay::outbound::prefers_probe_client(kind) {
         let reply = crate::relay::session_cli::SessionCommand::ConnectSend {
             to: Some(sender.to_string()),

@@ -16,10 +16,10 @@
 //! - **Delivery** stages a file in Agent Relay's own inbox for the session.
 //!   Agent Relay's hooks in `~/.cursor/hooks.json` hand it to the session
 //!   at its next tool call (`postToolUse` → `additional_context`) or when
-//!   its turn ends (`stop` → `followup_message`, a new user turn). A CLI
-//!   session idle at its prompt runs no hook, so its messages wait for its
-//!   person. An editor conversation's `stop` hook waits after a completed
-//!   turn instead, and answers the next message staged for it (`wait`).
+//!   its turn ends (`stop` → `followup_message`, a new user turn). A
+//!   conversation idle at its prompt runs no hook, so its `stop` hook waits
+//!   after a completed turn instead, and answers the next message staged
+//!   for it (`wait`).
 //! - **Settlement** claims a message before the hook prints it and
 //!   tombstones it once the answer is written. A claim the hook never
 //!   finished is settled by Cursor's transcript, which records a `stop`
@@ -427,7 +427,7 @@ const HOOK_ANCESTRY: usize = 8;
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum HookCaller {
     /// The one `cursor-agent` holding the session's store.
-    Cli,
+    Cli { agent: i32 },
     /// A Cursor window's extension host (`editor`), which runs the
     /// conversation the payload names.
     Editor { host: i32 },
@@ -459,7 +459,7 @@ pub fn hook_caller(
         if process.uid == uid && is_cursor_process(table, pid) {
             let holder = held(config, table, uid, session_id).is_some_and(|held| held.pid == pid);
             if holder {
-                return Some(HookCaller::Cli);
+                return Some(HookCaller::Cli { agent: pid });
             }
             if !editor::is_editor_worker(table, pid) {
                 return None;
@@ -524,11 +524,11 @@ pub fn record_editor_hook(
 /// Then, only under the caller `hook_caller` proves, it hands the
 /// conversation's staged messages over through `write`, which says whether
 /// the answer was written in full: claims are tombstoned once it was and
-/// put back if not. With `watch` (the `stop` entry's `--wait`) an editor
-/// conversation's completed turn waits for its next message (`wait::wait`).
-/// A Cursor CLI session answers at once, and keeps Cursor's own limit of
-/// follow-ups in a row (`wait::CURSOR_LOOP_LIMIT`), which that entry lifts.
-/// `true` once it answered.
+/// put back if not. With `watch` (the `stop` entry's `--wait`) a completed
+/// turn, in the editor or a Cursor CLI session, waits for its next message
+/// (`wait::wait`), once its `stop` noted the turn ended, and named it when
+/// it ran no `beforeSubmitPrompt` (`wait::stop_seen`). `true` once it
+/// answered.
 pub fn run_hook(
     config: &CursorConfig,
     table: &dyn ProcessTable,
@@ -547,26 +547,22 @@ pub fn run_hook(
         }
         return false;
     }
-    match hook_caller(config, table, pid, session) {
-        None => false,
-        Some(HookCaller::Cli) => {
-            let looped = payload["hook_event_name"] == "stop"
-                && payload["loop_count"]
-                    .as_u64()
-                    .is_some_and(|count| count >= wait::CURSOR_LOOP_LIMIT);
-            !(watch.is_some() && looped) && answer_now(config, payload, write)
-        }
+    let holder = match hook_caller(config, table, pid, session) {
+        None => return false,
+        Some(HookCaller::Cli { agent }) => wait::Holder::Cli { agent },
         Some(HookCaller::Editor { host }) => {
             if !record_editor_hook(config, table, pid, host, payload) {
                 return false;
             }
-            match watch {
-                Some(watch) if wait::waits_after(payload) => {
-                    wait::wait(config, table, host, payload, watch, write) == wait::Ended::Answered
-                }
-                _ => answer_now(config, payload, write),
-            }
+            wait::Holder::Editor { host }
+        }
+    };
+    wait::stop_seen(config, payload);
+    match watch {
+        Some(watch) if wait::waits_after(payload) => {
+            wait::wait(config, table, holder, payload, watch, write) == wait::Ended::Answered
         }
+        _ => answer_now(config, payload, write),
     }
 }
 
@@ -599,9 +595,11 @@ fn answer_now(
 
 /// The caller a tool process `pid` of the editor's agent is, once the walk
 /// up from it reaches the extension host `host` of this user's: the
-/// conversation its `CURSOR_CONVERSATION_ID` names, when a hook of that
-/// conversation already recorded it live under this host, or nobody. A
-/// tool's environment alone never puts a conversation on a host.
+/// conversation its `CURSOR_CONVERSATION_ID` names, claimed for this host
+/// (`editor::claim`), or nobody. A tool naming its conversation vouches for
+/// it as a hook it ran itself would, so a new conversation's first tool
+/// call can put it on the relay before Cursor writes the transcript a hook
+/// that names none needs.
 pub fn editor_caller(
     config: &CursorConfig,
     table: &dyn ProcessTable,
@@ -611,13 +609,7 @@ pub fn editor_caller(
     if !platform::SUPPORTED || !editor::is_editor_host(table, host) {
         return None;
     }
-    let uid = crate::relay::peer::current_uid();
     let session_id = editor::tool_conversation(table, pid, host)?;
-    let owned = editor::live(config, table, uid, &session_id)
-        .is_some_and(|session| session.host_pid == host);
-    if !owned {
-        return None;
-    }
     let workspace = table
         .cwd(pid)
         .map(|path| path.to_string_lossy().into_owned());

@@ -133,8 +133,8 @@ pub fn is_editor_worker(table: &dyn ProcessTable, pid: i32) -> bool {
 /// wherever its data folder is (`super::held_anywhere`, so the caller's
 /// `CURSOR_DATA_DIR` cannot hide one), no record gives it to another
 /// window's host that still runs (however long it has been idle), and the processes between `pid` and `host` vouch for it
-/// (`path_vouches`). The first hook of a conversation's window establishes
-/// its record.
+/// (`path_vouches`). The first hook or tool of a conversation's window to
+/// claim it establishes its record.
 pub(super) fn may_claim(
     config: &CursorConfig,
     table: &dyn ProcessTable,

@@ -312,6 +312,9 @@ fn a_conversation_a_cursor_agent_holds_elsewhere_is_never_the_editors() {
         hook_caller(&config, &table, 700, OTHER),
         Some(HookCaller::Editor { host: HOST_PID })
     );
+    // Nor does a tool naming it take it.
+    table.insert(701, shell(HOST_PID, &[(CONVERSATION_VAR, SESSION)]));
+    assert_eq!(editor_caller(&config, &table, 701, HOST_PID), None);
 }
 
 #[test]
@@ -804,25 +807,23 @@ fn a_tool_of_the_editors_agent_is_the_conversation_its_environment_names() {
     // probe (702) → zsh (701) → extension host
     table.insert(701, shell(HOST_PID, &[]));
     table.insert(702, shell(701, &[(CONVERSATION_VAR, SESSION)]));
-    // The variable alone puts no conversation on this window.
-    assert_eq!(editor_caller(&config, &table, 702, HOST_PID), None);
+    // A new conversation's first turn: Cursor has written no transcript
+    // yet, so a hook naming no conversation may not take it up, but its
+    // tool naming it puts it on this window, and its hooks are then the
+    // window's.
+    std::fs::remove_file(own_transcript(&config, SESSION)).unwrap();
+    assert_eq!(hook_caller(&config, &table, HOST_PID, SESSION), None);
     assert!(!running(&config, &table, uid(), SESSION));
-    // Once a hook of the conversation ran here, its tools are it.
-    record_editor_hook(
-        &config,
-        &table,
-        HOST_PID,
-        HOST_PID,
-        &json!({
-            "hook_event_name": "postToolUse",
-            "conversation_id": SESSION,
-        }),
-    );
     assert_eq!(
         editor_caller(&config, &table, 702, HOST_PID).as_deref(),
         Some(SESSION)
     );
-    // A payload without folders left none; the tool's directory fills in.
+    assert!(running(&config, &table, uid(), SESSION));
+    assert_eq!(
+        hook_caller(&config, &table, HOST_PID, SESSION),
+        Some(HookCaller::Editor { host: HOST_PID })
+    );
+    // No hook named the window's folders; the tool's directory fills in.
     assert_eq!(
         live(&config, &table, uid(), SESSION).and_then(|row| row.workspace),
         Some("/work/api".to_string())
@@ -872,6 +873,13 @@ fn a_tool_of_the_editors_agent_is_the_conversation_its_environment_names() {
     assert_eq!(editor_caller(&config, &table, 703, HOST_PID), None);
     table.insert(704, shell(HOST_PID, &[(CONVERSATION_VAR, "../etc")]));
     assert_eq!(editor_caller(&config, &table, 704, HOST_PID), None);
+    // A process along the way whose environment cannot be read may be
+    // hiding another conversation: its tool claims nothing.
+    table.insert(707, shell(HOST_PID, &[]));
+    table.insert(708, shell(707, &[(CONVERSATION_VAR, OTHER)]));
+    table.unreadable_environment.lock().unwrap().insert(707);
+    assert_eq!(editor_caller(&config, &table, 708, HOST_PID), None);
+    assert!(!running(&config, &table, uid(), OTHER));
     // And never under anything but an extension host.
     assert_eq!(editor_caller(&config, &table, 702, 701), None);
 }
@@ -66,7 +66,7 @@ pub(super) fn message_file(session_id: &str, message_id: &str) -> String {
     format!("{session_id}.{nonce}.msg")
 }
 
-const STAGED: &str = "in the session's inbox; Cursor shows it at the session's next tool call or when its turn ends, or at once to a Cursor editor chat that has finished its turn";
+const STAGED: &str = "in the session's inbox; Cursor shows it at the session's next tool call or when its turn ends, or at once to a Cursor chat or CLI session that has finished its turn";
 
 /// Queues `text` for the session in its inbox file, renamed into place once
 /// written and synced, so a hook never reads half a message. `Accepted`