chore: consolidate dependency updates, clear npm audit, fix per-model param docs

CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- **Docs: model param ids are per model (#119).** Cursor model param ids differ
+  per model, so a `thinking` param set on a model that doesn't advertise one
+  (e.g. grok-4.6, which takes `effort`) is ignored and Cursor falls back to its
+  own default. The README's per-request controls example, `params` row, and
+  `thinking` rows, plus the `cursor_delegate`/`cursor_cloud_agent` `thinking`
+  tool-arg descriptions, were corrected to say so (wording only — no behavior
+  change).
+
+- **Fix: README v2 install snippet points at `@next` (#126).** The
+  `plugins` example used `@latest`, which resolves to 0.9.0 — a v1-only
+  build that opencode v2 rejects with "Plugin must export a default
+  definition with an id and an effect or setup function". v2 support is
+  published under the `next` dist-tag (0.10.0-next.1+) until promoted;
+  the snippet and a note now say so, and the troubleshooting entry now
+  gives the v2 cache path (`~/.cache/opencode/npm/<spec>/`, or
+  `opencode plugin update`) instead of only the v1 `packages/` path.
+
+- **Fix: fallback catalog's composer-2.5 param matches the live one.**
+  The keyless/fallback entry advertised a `thinking` param (off/on) that
+  the live catalog does not expose, yielding a bogus `thinking` variant;
+  it now declares only `fast` (false/true), so the fallback path yields
+  exactly the `fast` variant and `{ fast: "false" }` defaults.
+
+- **Add: `cursor_refresh_models` lists param ids and values (#119).**
+  Each model line now appends the model's advertised params as
+  `[effort=low|medium|high|xhigh, fast=false|true]` (no suffix when the
+  model has none), so accepted param ids and values are readable
+  straight from the tool output.
+
+- **Chore: dependency bumps (#122, #124, #125) and audit overrides.**
+  Consolidates the three open Dependabot PRs: `@connectrpc/connect-node`
+  2.1.2 → 2.2.0 (nothing in src/, scripts/, or test/ imports it, and
+  `@cursor/sdk` declares `^1.6.1` and nests its own 1.7.0 copy, so the
+  top-level entry — added in #31 when the SDK did not declare it — no
+  longer looks needed; left in place as a removal candidate),
+  `@cursor/sdk` 1.0.31 → 1.0.32, `@opencode-ai/plugin` and
+  `@opencode-ai/sdk` 1.18.25/1.18.30 → 1.18.33 (kept on one version, one
+  sdk copy in the tree), `@ai-sdk/provider` 3.0.15 → 3.0.18,
+  `@types/node` 26.5.0 → 26.6.3, `vitest` 5.0.0 → 5.0.2.
+  `@ai-sdk/provider` v4 and TypeScript 7 stay blocked (see
+  .github/dependabot.yml). Clears both `npm audit` findings via overrides:
+  `undici` `^6.28.1` (resolves 6.29.0, GHSA-3wwx-pv8p-q78v) and a new
+  `toml` `^4.2.0` (resolves 4.3.0, GHSA-82x6-q7mm-w9cf; reached through
+  `effect` under `@opencode-ai/plugin`).
+
 ## [0.10.0-next.1] — 2026-09-29 (pre-release)
 
 Adds opencode v2 support alongside v1 (#127). Not on `latest`; install with

README.md

@@ -65,7 +65,8 @@ rm -rf ~/.cache/opencode/packages/@stablekernel/opencode-cursor@latest
 rmdir /s /q "%LocalAppData%\opencode\cache\packages\@stablekernel\opencode-cursor@latest"
 ```
 
-Then restart opencode.
+Then restart opencode. (This cache layout is opencode v1's; on v2 run
+`opencode plugin update` — see [opencode v2](#opencode-v2).)
 
 Drop `@latest` (`"@stablekernel/opencode-cursor"`) or pin a version
 (`"@stablekernel/opencode-cursor@1.2.3"`) if you prefer deterministic installs.
@@ -81,11 +82,18 @@ opencode v2 uses a `plugins` key (plural) and loads the plugin's `setup()` entry
 ```json
 {
   "$schema": "https://opencode.ai/config.json",
-  "plugins": ["@stablekernel/opencode-cursor@latest"]
+  "plugins": ["@stablekernel/opencode-cursor@next"]
 }
 ```
 
-Both generations load the same published package, so one install serves either.
+> v2 support is published under the `next` dist-tag (`0.10.0-next.1` or later)
+> until it is promoted to `latest`. `@latest` currently resolves to 0.9.0, a
+> v1-only build that opencode v2 rejects with "Plugin must export a default
+> definition with an id and an effect or setup function". Switch the spec back
+> to `@latest` once 0.10.0 is stable.
+
+From 0.10.0 onward both generations load the same published package, so one
+install serves either (0.9.x `@latest` is v1-only).
 Minimum versions: v1 >= 1.18.29 (object plugin entrypoint), v2 tested against 2.0.19.
 
 **Registry mirrors:** on v2 the provider package is installed at exactly the plugin's
@@ -246,7 +254,7 @@ See [SECURITY.md](./SECURITY.md) for the full threat model.
 | `apiKey` | `CURSOR_API_KEY` | Cursor API key |
 | `cwd` | `process.cwd()` | Directory the local agent operates in |
 | `mode` | `"agent"` | Default conversation mode (`"agent"` or `"plan"`) |
-| `params` | — | Default model params, e.g. `{ thinking: "high" }` |
+| `params` | — | Default model params, e.g. `{ effort: "high" }` (param ids are per model — see [Per-request controls](#per-request-controls-mode-thinking-level)) |
 | `settingSources` | — | Cursor settings layers to load: `["project","user","all",...]` — pulls in your Cursor skills, rules, and `.cursor/mcp.json` |
 | `sandbox` | — | Run the agent's tools in [Cursor's sandbox](https://cursor.com/docs/agent/sandbox) |
 | `autoReview` | `false` | Gate tool calls through Cursor's classifier-backed Auto review (best-effort, not a security boundary) |
@@ -306,12 +314,18 @@ variant to opt in, or set it per model under `options.params.fast` below.
 opencode's **plan agent** (`Tab`) maps to Cursor's plan mode automatically — no manual config
 needed.
 
+Param ids are **per model** — use the id the model actually advertises, or Cursor ignores the
+param and falls back to its own default (e.g. `high` effort). `grok-4.6` uses `effort`,
+`gpt-5.5` uses `reasoning`, `claude-opus-4-8` uses `effort` (plus a boolean `thinking`), and
+`composer-2.5` has only `fast`. Run `cursor_refresh_models` to list each model id
+with its param ids and accepted values.
+
 To set controls statically per model:
 
 ```json
 { "provider": { "cursor": { "models": {
-  "composer-2.5": { "options": { "params": { "thinking": "high" } } }
-} } } }
+  "grok-4.6": { "options": { "params": { "effort": "medium" } } } }
+} } }
 ```
 
 ## System prompt
@@ -560,7 +574,7 @@ non-session cwd — see [Skills limitations](#limitations)).
 | `prompt` | ✅ | The subtask to delegate |
 | `model` | ✅ | Cursor model id |
 | `mode` | — | `"agent"` or `"plan"` |
-| `thinking` | — | Thinking level (e.g. `"high"`) |
+| `thinking` | — | Sets the model's `thinking` param (`"true"`/`"false"`) — only on models that advertise it (e.g. `claude-opus-4-8`); models using `effort`/`reasoning`/`reasoning_effort` can't be set through this arg |
 | `cwd` | — | Working directory |
 | `sandbox` | — | Run in Cursor's sandbox |
 | `agentId` | — | Resume a specific Cursor agent |
@@ -577,7 +591,7 @@ open a PR.
 | `startingRef` | — | Branch/ref to start from |
 | `model` | — | Cursor model id |
 | `mode` | — | `"agent"` or `"plan"` |
-| `thinking` | — | Thinking level |
+| `thinking` | — | Sets the model's `thinking` param (`"true"`/`"false"`) — only on models that advertise it (e.g. `claude-opus-4-8`); models using `effort`/`reasoning`/`reasoning_effort` can't be set through this arg |
 | `autoCreatePR` | — | Open a PR when finished |
 | `workOnCurrentBranch` | — | Operate on the current branch instead of a new one |
 
@@ -699,8 +713,13 @@ watchdog (an empty string also disables, for backward compatibility).
   `PATH`).
 - **Plugin enabled but no `cursor` provider/models appear, or you see a stale-version warning.**
   opencode caches the `@latest` plugin install on first use and never refreshes it.
-  Exit opencode, delete `~/.cache/opencode/packages/@stablekernel/opencode-cursor@latest`
-  (or the pinned version directory), and restart.
+  On v1: exit opencode, delete `~/.cache/opencode/packages/@stablekernel/opencode-cursor@latest`
+  (or the pinned version directory), and restart. On v2: run `opencode plugin update`, or
+  exit opencode and delete `~/.cache/opencode/npm/@stablekernel/opencode-cursor@<spec>`
+  (e.g. `@next`), then restart. On v2 the spec must also resolve to a build with the v2
+  entrypoint (0.10.0-next.1 or later — see [opencode v2](#opencode-v2)): an `@latest`
+  install of 0.9.x makes opencode 2 report "Plugin must export a default definition
+  with an id and an effect or setup function".
 - **Only the four fallback models appear.** The live catalog loads after the first authenticated
   use. Restart opencode once after login, or run `cursor_refresh_models`.
 - **Invalid or expired key.** Validated on first use — that's where the error surfaces.