fix(cursor): route native fallbacks through code mode

[luvyoun0224-beep]

Summary

• Preserve Codex 0.147's real Responses Lite tool shape: the reserved functions namespace now flattens ordinary client functions and its nested freeform custom exec into top-level internal tools.
• Detect those code-mode turns in the live Cursor transport and retain that mode in the native-exec context.
• Replace misleading top-level shell_command / exec_command fallback instructions with the real code-mode contract: top-level exec, then nested tools.exec_command(...) or tools.apply_patch(...), with text(...) output.
• Keep the existing flat-catalog guidance unchanged for non-code-mode requests and keep native local execution disabled by default.
• Add regression coverage for the captured Codex 0.147 additional_tools shape, filesystem, shell, fetch, MCP-resource, mutation, and live-transport propagation paths.

This follows #1844. That change fixed system guidance, but two gaps remained: Codex 0.147 groups custom exec under the reserved functions namespace, which the parser dropped, and Cursor-native rejection responses still directed models to top-level tools that do not exist in code mode.

Verification

• focused Cursor/native/parser/Responses Lite suites: 162 pass
• all tests/cursor-*.test.ts files: 602 pass
• bun run typecheck
• bun run privacy:scan
• git diff --check
• bounded local live probe through Codex 0.147 + Cursor: the model successfully executed Get-Content package.json and read version 2.22.0; the following model continuation hit the account's Cursor resource limit, so the probe did not receive its requested final formatted line.
• Full bun test was attempted on Windows; it stopped making progress during unrelated integration tests and was interrupted after more than 90 seconds without output.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (No user-facing configuration changed.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

AI assistance was used for implementation and test preparation; the resulting diff and verification output were reviewed locally.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c6872267-8b86-4413-a69a-e2be5f22bbe7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.