Skip to content

fix(cursor): stop completed-answer replay on SDK 1.3.1 - #422

Merged
shuv1337 merged 2 commits into
mainfrom
fix/cursor-sdk-1.3.1-replay-guard
Nov 7, 2026
Merged

shuv1337 merged 2 commits into
mainfrom
fix/cursor-sdk-1.3.1-replay-guard

Conversation

@shuv1337

@shuv1337 shuv1337 commented Nov 7, 2026

Copy link
Copy Markdown
Owner

Cursor could replay a completed answer and its tool calls when the SDK retried after turn-ended without a confirmed terminal checkpoint. Upgrade to SDK 1.3.1 and pin a patch at its retry boundary that stops that replay while preserving mid-turn reconnects, normal continuations, and cancellation.

Keep the answer visible, mark the uncertain Cursor session broken, and recover the next message in a fresh session with history, including after a server restart. Record bounded retry diagnostics to identify future triggering errors. The historical incident’s original exception remains unknown.

Validation: 145 Cursor package tests and 13 Cursor integration tests passed; installed CommonJS and ESM SDK loading and the server bundle build passed. The controlled 1.3.1 transport reproduction emits four answers/tool executions unpatched and one with the guard. The changed-file check covers formatting, lint, knip, typechecks, dependency patch application, GraphQL generation, and 49 adjacent tests. No paid model turn or live service restart was used.

Model: GPT-6 Astra. Harness: Codex in T3 Code.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​cursor/​sdk@​1.3.19410010098100

View full report

@shuv1337
shuv1337 merged commit 17ee859 into main Nov 7, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant