@code-yeongyu/senpi 2026.8.14 → 2026.8.17

package/dist/core/extensions/builtin/cursor-cli-oauth/oauth-login.js

@@ -0,0 +1,330 @@
+import { execFile as nodeExecFile } from "node:child_process";
+import { readFile as nodeReadFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { cursorProvider } from "@earendil-works/pi-ai/providers/cursor";
+import { addAccount, emptyCredential, listAccounts, SENTINEL_OAUTH_FIELDS, } from "./accounts.js";
+import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable, } from "./executable.js";
+import { CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION } from "./guardrails.js";
+import { loadCursorCliOauthProviderSettingsFromDisk, persistCursorCliNoApprovalAcknowledgement, } from "./settings.js";
+export const CURSOR_CLI_OAUTH_PROVIDER_ID = "cursor-cli-oauth";
+export const CURSOR_CLI_OAUTH_NAME = "Cursor CLI (OAuth)";
+const NO_ACCOUNTS_MESSAGE = "no accounts: run /login cursor-cli-oauth";
+const DISABLED_MESSAGE = "disabled by settings";
+const FILE_STORE_LANE = "file-store";
+const DEFAULT_IMPORTED_EXPIRY_MS = 60 * 60 * 1000;
+/**
+ * One predicate so availability and resolution cannot disagree: evaluates the
+ * same conditions for every caller and reports why the lane is unusable
+ * instead of deciding per call-site whether that is fatal.
+ */
+async function assessConfiguration(deps) {
+    const settings = deps.readSettings();
+    if (!settings.enabled)
+        return { status: "disabled" };
+    try {
+        deps.resolveExecutable(settings);
+    }
+    catch (error) {
+        return { status: "not-installed", error };
+    }
+    const accounts = usableAccounts(await deps.readCurrent());
+    if (accounts.length === 0)
+        return { status: "no-accounts" };
+    return {
+        status: "configured",
+        assessment: { accounts, message: `configured (file-store, ${accounts.length} accounts)` },
+    };
+}
+/** The throwing view used by turn-time resolution; a turn attempted on an unusable lane must still error clearly. */
+async function configuredFor(deps) {
+    const outcome = await assessConfiguration(deps);
+    switch (outcome.status) {
+        case "disabled":
+            throw new Error(DISABLED_MESSAGE);
+        case "not-installed":
+            throw cursorAgentNotInstalledError(outcome.error);
+        case "no-accounts":
+            throw new Error(NO_ACCOUNTS_MESSAGE);
+        default:
+            return outcome.assessment;
+    }
+}
+function isCursorCliOauthCredential(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const candidate = value;
+    return candidate.type === "oauth" && Array.isArray(candidate.accounts);
+}
+function usableAccounts(value) {
+    if (!isCursorCliOauthCredential(value))
+        return [];
+    return listAccounts(value).filter((slot) => typeof slot.name === "string" &&
+        typeof slot.access === "string" &&
+        slot.access.trim().length > 0 &&
+        typeof slot.refresh === "string" &&
+        slot.refresh.trim().length > 0 &&
+        typeof slot.expires === "number" &&
+        Number.isFinite(slot.expires));
+}
+function installationMessage(error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return `cursor-agent not installed: ${detail.replace(/^Cursor CLI is not installed\.\s*/, "")}`;
+}
+/**
+ * The typed turn-path error for a missing cursor-agent binary: carries the
+ * `cursor-agent not installed` marker plus the install guidance verbatim, with
+ * the underlying resolution failure preserved as `cause`.
+ */
+export function cursorAgentNotInstalledError(cause) {
+    const error = new Error(installationMessage(cause));
+    error.name = "CursorAgentNotInstalledError";
+    error.cause = cause;
+    return error;
+}
+/** Resolve credentials immediately before execution so a concurrent refresh cannot leave a stale token in memory. */
+export async function resolveCursorCliOauthLane(deps) {
+    const assessment = await configuredFor(deps);
+    const account = assessment.accounts[0];
+    if (!account)
+        throw new Error(NO_ACCOUNTS_MESSAGE);
+    return { lane: FILE_STORE_LANE, account, accounts: assessment.accounts };
+}
+async function loadCursorOAuthFlow() {
+    const flow = cursorProvider().auth.oauth;
+    if (!flow)
+        throw new Error("Cursor OAuth flow is unavailable");
+    return flow;
+}
+function providerInteraction(callbacks) {
+    return {
+        signal: callbacks.signal ?? new AbortController().signal,
+        prompt: async (prompt) => {
+            switch (prompt.type) {
+                case "select":
+                    return (await callbacks.onSelect(prompt)) ?? "";
+                case "manual_code":
+                    return callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);
+                default:
+                    return callbacks.onPrompt(prompt);
+            }
+        },
+        notify: (event) => {
+            switch (event.type) {
+                case "auth_url":
+                    callbacks.onAuth({ url: event.url, instructions: event.instructions });
+                    break;
+                case "device_code":
+                    callbacks.onDeviceCode(event);
+                    break;
+                case "progress":
+                    callbacks.onProgress?.(event.message);
+                    break;
+                case "info":
+                    callbacks.onProgress?.(event.message);
+                    break;
+            }
+        },
+    };
+}
+async function accountName(existing, onPrompt) {
+    if (existing.length === 0)
+        return "default";
+    const fallback = `account-${existing.length + 1}`;
+    if (!onPrompt)
+        return fallback;
+    const answer = (await onPrompt({
+        message: `Name for this account (existing: ${existing.map((slot) => slot.name).join(", ")})`,
+        placeholder: fallback,
+    })).trim();
+    return answer || fallback;
+}
+function slotFromCredential(credential, name, source) {
+    return {
+        name,
+        access: credential.access,
+        refresh: credential.refresh,
+        expires: credential.expires,
+        source,
+    };
+}
+/** The one-screen login explanation: what unattended Cursor CLI execution gives up, and the plan-mode alternative. */
+export const CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION = `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} Plan mode (planning only, no tool execution) is available via the executionMode setting.`;
+const ACKNOWLEDGEMENT_ACCEPTANCE = new Set(["yes", "y"]);
+/**
+ * Present the no-approval explanation exactly once and return the ISO
+ * acknowledgement timestamp on explicit confirmation, undefined otherwise.
+ * Shared by the login flow and the /cursor-account acknowledge subcommand so
+ * both surfaces present the identical explanation and persist identically.
+ */
+export async function confirmCursorCliNoApprovalAcknowledgement(onPrompt, now) {
+    if (!onPrompt)
+        return undefined;
+    const answer = (await onPrompt({
+        message: `${CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION}\nType "yes" to acknowledge and allow unattended Cursor CLI tool execution; anything else leaves it off.`,
+    }))
+        .trim()
+        .toLowerCase();
+    return ACKNOWLEDGEMENT_ACCEPTANCE.has(answer) ? now().toISOString() : undefined;
+}
+export function createCursorCliOauthConfig(deps) {
+    return {
+        name: CURSOR_CLI_OAUTH_NAME,
+        isSubscription: true,
+        async check(input) {
+            // Tolerant by contract: ModelsImpl.getAvailable runs every provider's
+            // check under Promise.all (packages/ai/src/models.ts:544-548) and turns a
+            // throw into a rejecting ModelsError, so one throwing check would reject
+            // all model listing. Not usable (disabled / not installed / no accounts)
+            // reports undefined here - as claude-sdk-oauth's check does - while
+            // turn-time resolution keeps throwing via configuredFor.
+            //
+            // One nuance: the auth-resolution path (checkAuth, resolveStoredOAuth)
+            // always passes the stored credential, while bare model listing does not.
+            // A credential-backed lane whose executable is missing stays selectable
+            // with the install guidance as its source, so a TURN reaches
+            // streamCursorCliOauth, which throws the typed not-installed error;
+            // without a credential the lane hides exactly as before.
+            const outcome = await assessConfiguration(deps);
+            if (outcome.status === "disabled" || outcome.status === "no-accounts")
+                return undefined;
+            if (outcome.status === "not-installed") {
+                return input.credential === undefined
+                    ? undefined
+                    : { type: "oauth", source: installationMessage(outcome.error) };
+            }
+            return { type: "oauth", source: outcome.assessment.message };
+        },
+        async login(callbacks) {
+            const stored = await deps.readCurrent();
+            const current = isCursorCliOauthCredential(stored) ? stored : emptyCredential();
+            const existing = listAccounts(current);
+            const flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();
+            const loggedIn = await flow.login(providerInteraction(callbacks));
+            const name = await accountName(existing, callbacks.onPrompt);
+            // After the PKCE flow succeeds and before the slot is stored: the
+            // one-screen no-approval explanation, confirmed once. Declining still
+            // stores the slot; only the acknowledgement stays unset, so force turns
+            // refuse until the user acknowledges later.
+            const acknowledgedAt = await confirmCursorCliNoApprovalAcknowledgement(callbacks.onPrompt, deps.now ?? (() => new Date()));
+            if (acknowledgedAt !== undefined)
+                deps.persistAcknowledgement?.(acknowledgedAt);
+            return addAccount(current, slotFromCredential(loggedIn, name, "login"));
+        },
+        async refreshToken(credentials, signal) {
+            if (!isCursorCliOauthCredential(credentials))
+                return credentials;
+            const flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();
+            const accounts = [];
+            for (const slot of listAccounts(credentials)) {
+                if (Date.now() < slot.expires) {
+                    accounts.push(slot);
+                    continue;
+                }
+                const refreshed = await flow.refresh({
+                    type: "oauth",
+                    access: slot.access,
+                    refresh: slot.refresh,
+                    expires: slot.expires,
+                }, signal);
+                accounts.push({
+                    ...slot,
+                    access: refreshed.access,
+                    refresh: refreshed.refresh,
+                    expires: refreshed.expires,
+                });
+            }
+            return { ...credentials, ...SENTINEL_OAUTH_FIELDS, accounts };
+        },
+        getApiKey() {
+            return SENTINEL_OAUTH_FIELDS.access;
+        },
+    };
+}
+function execFileOutput(file, args) {
+    return new Promise((resolve) => {
+        nodeExecFile(file, args, { encoding: "utf8" }, (error, stdout) => {
+            if (error) {
+                resolve(undefined);
+                return;
+            }
+            const value = stdout.trim();
+            resolve(value.length > 0 ? value : undefined);
+        });
+    });
+}
+async function defaultKeychainCredential() {
+    if (process.platform !== "darwin")
+        return undefined;
+    const [access, refresh] = await Promise.all([
+        execFileOutput("security", ["find-generic-password", "-a", "cursor-user", "-s", "cursor-access-token", "-w"]),
+        execFileOutput("security", ["find-generic-password", "-a", "cursor-user", "-s", "cursor-refresh-token", "-w"]),
+    ]);
+    return access && refresh ? { access, refresh } : undefined;
+}
+function localCursorAuthPath(platform) {
+    switch (platform) {
+        case "darwin":
+            return join(homedir(), ".cursor", "auth.json");
+        case "linux":
+            return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "cursor", "auth.json");
+        case "win32": {
+            const appData = process.env.APPDATA;
+            return appData ? join(appData, "Cursor", "auth.json") : undefined;
+        }
+        default:
+            return undefined;
+    }
+}
+async function defaultFileCredential(platform) {
+    const path = localCursorAuthPath(platform);
+    if (!path)
+        return undefined;
+    try {
+        const parsed = JSON.parse(await nodeReadFile(path, "utf8"));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return undefined;
+        const record = parsed;
+        const access = record.accessToken;
+        const refresh = record.refreshToken;
+        if (typeof access !== "string" || access.length === 0 || typeof refresh !== "string" || refresh.length === 0) {
+            return undefined;
+        }
+        return { access, refresh };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Explicitly copy the user's local Cursor credential into this provider's managed account slots. */
+export async function importLocalCursorCredential(current, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const readKeychain = deps.readCursorKeychain ?? defaultKeychainCredential;
+    const readFile = deps.readCursorFile ?? (() => defaultFileCredential(platform));
+    const imported = platform === "darwin" ? ((await readKeychain()) ?? (await readFile())) : await readFile();
+    if (!imported)
+        throw new Error("No local Cursor OAuth credential found");
+    const existing = listAccounts(current);
+    const name = await accountName(existing, deps.onPrompt);
+    return addAccount(current, slotFromCredential({
+        access: imported.access,
+        refresh: imported.refresh,
+        expires: imported.expires ?? Date.now() + DEFAULT_IMPORTED_EXPIRY_MS,
+    }, name, "import"));
+}
+export function defaultCursorCliOauthConfig(cwd, readCurrent) {
+    return createCursorCliOauthConfig({
+        readCurrent,
+        readSettings: () => loadCursorCliOauthProviderSettingsFromDisk(cwd),
+        resolveExecutable: (settings) => {
+            const executableDeps = {
+                ...defaultCursorAgentExecutableDeps(),
+                settings,
+            };
+            return resolveCursorAgentExecutable(executableDeps);
+        },
+        now: () => new Date(),
+        persistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),
+    });
+}
+//# sourceMappingURL=oauth-login.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/oauth-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-login.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/oauth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACN,UAAU,EAGV,eAAe,EACf,YAAY,EACZ,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wCAAwC,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,GACzC,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAE1D,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AACvE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6DlD;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA8B;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACrD,IAAI,CAAC;QACJ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5D,OAAO;QACN,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,QAAQ,CAAC,MAAM,YAAY,EAAE;KACzF,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,aAAa,CAAC,IAA8B;IAC1D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,UAAU;YACd,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnC,KAAK,eAAe;YACnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,KAAK,aAAa;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtC;YACC,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAClC,KAAgD;IAEhD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA0C,CAAC;IAC7D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,KAAgD;IACvE,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,+BAA+B,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAA8B;IAC7E,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IAC1D,OAAO;QACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,QAAQ;oBACZ,OAAO,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,KAAK,aAAa;oBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACtE;oBACC,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,UAAU;oBACd,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;oBACvE,MAAM;gBACP,KAAK,aAAa;oBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC9B,MAAM;gBACP,KAAK,UAAU;oBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,MAAM;gBACP,KAAK,MAAM;oBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,MAAM;YACR,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,QAAgC,EAChC,QAAqD;IAErD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,QAAQ,GAAG,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,CACd,MAAM,QAAQ,CAAC;QACd,OAAO,EAAE,oCAAoC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,WAAW,EAAE,QAAQ;KACrB,CAAC,CACF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,MAAM,IAAI,QAAQ,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAoE,EACpE,IAAY,EACZ,MAAsC;IAEtC,OAAO;QACN,IAAI;QACJ,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM;KACN,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,CAAC,MAAM,kDAAkD,GAAG,GAAG,wCAAwC,2FAA2F,CAAC;AAEzM,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC9D,QAA8F,EAC9F,GAAe;IAEf,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,CACd,MAAM,QAAQ,CAAC;QACd,OAAO,EAAE,GAAG,kDAAkD,0GAA0G;KACxK,CAAC,CACF;SACC,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IAChB,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACxE,OAAO;QACN,IAAI,EAAE,qBAAqB;QAC3B,cAAc,EAAE,IAAI;QAEpB,KAAK,CAAC,KAAK,CAAC,KAAK;YAChB,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,yDAAyD;YACzD,EAAE;YACF,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,6DAA6D;YAC7D,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YACxF,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;oBACpC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7D,kEAAkE;YAClE,sEAAsE;YACtE,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,cAAc,GAAG,MAAM,yCAAyC,CACrE,SAAS,CAAC,QAAQ,EAClB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAC9B,CAAC;YACF,IAAI,cAAc,KAAK,SAAS;gBAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,cAAc,CAAC,CAAC;YAChF,OAAO,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM;YACrC,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC;gBAAE,OAAO,WAAW,CAAC;YACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpB,SAAS;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC;oBACC,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACrB,EACD,MAAM,CACN,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC;oBACb,GAAG,IAAI;oBACP,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,CAAC;QAC/D,CAAC;QAED,SAAS;YACR,OAAO,qBAAqB,CAAC,MAAM,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAc;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACR,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,cAAc,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAC7G,cAAc,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;KAC9G,CAAC,CAAC;IACH,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAyB;IACrD,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,QAAQ;YACZ,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAChD,KAAK,OAAO;YACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/F,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACpC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QACD;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAiC,EACjC,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC;IAC3G,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,UAAU,CAChB,OAAO,EACP,kBAAkB,CACjB;QACC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B;KACpE,EACD,IAAI,EACJ,QAAQ,CACR,CACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,GAAW,EACX,WAAkD;IAElD,OAAO,0BAA0B,CAAC;QACjC,WAAW;QACX,YAAY,EAAE,GAAG,EAAE,CAAC,0CAA0C,CAAC,GAAG,CAAC;QACnE,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,cAAc,GAA8B;gBACjD,GAAG,gCAAgC,EAAE;gBACrC,QAAQ;aACR,CAAC;YACF,OAAO,4BAA4B,CAAC,cAAc,CAAC,CAAC;QACrD,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,sBAAsB,EAAE,CAAC,cAAsB,EAAE,EAAE,CAClD,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;KAC/D,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { execFile as nodeExecFile } from \"node:child_process\";\nimport { readFile as nodeReadFile } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n\tAuthCheck,\n\tAuthContext,\n\tCredential,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthCredentials,\n\tOAuthLoginCallbacks,\n\tProviderAuthInteraction,\n} from \"@earendil-works/pi-ai\";\nimport { cursorProvider } from \"@earendil-works/pi-ai/providers/cursor\";\nimport {\n\taddAccount,\n\ttype CursorCliAccountSlot,\n\ttype CursorCliOauthCredential,\n\temptyCredential,\n\tlistAccounts,\n\tSENTINEL_OAUTH_FIELDS,\n} from \"./accounts.ts\";\nimport {\n\ttype CursorAgentExecutableDeps,\n\tdefaultCursorAgentExecutableDeps,\n\tresolveCursorAgentExecutable,\n} from \"./executable.ts\";\nimport { CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION } from \"./guardrails.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n} from \"./settings.ts\";\n\nexport const CURSOR_CLI_OAUTH_PROVIDER_ID = \"cursor-cli-oauth\";\nexport const CURSOR_CLI_OAUTH_NAME = \"Cursor CLI (OAuth)\";\n\nconst NO_ACCOUNTS_MESSAGE = \"no accounts: run /login cursor-cli-oauth\";\nconst DISABLED_MESSAGE = \"disabled by settings\";\nconst FILE_STORE_LANE = \"file-store\" as const;\nconst DEFAULT_IMPORTED_EXPIRY_MS = 60 * 60 * 1000;\n\ntype CursorCliOauthSettings = Pick<CursorCliOauthProviderSettings, \"enabled\" | \"executablePath\">;\n\ntype ImportedCursorCredential = {\n\taccess: string;\n\trefresh: string;\n\texpires?: number;\n};\n\nexport type CursorCliOauthConfigDeps = {\n\treadCurrent: () => Promise<Credential | undefined>;\n\treadSettings: () => CursorCliOauthSettings;\n\tresolveExecutable: (settings: CursorCliOauthSettings) => string;\n\tloadOAuth?: () => Promise<OAuthAuth>;\n\treadCursorFile?: () => Promise<ImportedCursorCredential | undefined>;\n\treadCursorKeychain?: () => Promise<ImportedCursorCredential | undefined>;\n\t/** Clock for acknowledgement timestamps; injectable so tests stay deterministic. */\n\tnow?: () => Date;\n\t/** Persists the no-approval acknowledgement; the disk default is wired in defaultCursorCliOauthConfig. */\n\tpersistAcknowledgement?: (acknowledgedAt: string) => void;\n};\n\nexport type CursorCliOauthLaneResolution = {\n\tlane: typeof FILE_STORE_LANE;\n\taccount: CursorCliAccountSlot;\n\taccounts: CursorCliAccountSlot[];\n};\n\nexport type CursorCliOauthConfig = {\n\tname: string;\n\tisSubscription: true;\n\tcheck(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n};\n\nexport type LocalCursorImportDeps = {\n\tplatform?: NodeJS.Platform;\n\treadCursorFile?: () => Promise<ImportedCursorCredential | undefined>;\n\treadCursorKeychain?: () => Promise<ImportedCursorCredential | undefined>;\n\tonPrompt?: OAuthLoginCallbacks[\"onPrompt\"];\n};\n\ntype ConfigurationAssessment = {\n\taccounts: CursorCliAccountSlot[];\n\tmessage: string;\n};\n\n/** The single condition evaluation behind both the tolerant `check` and the throwing turn-time resolution. */\ntype ConfigurationOutcome =\n\t| { status: \"disabled\" }\n\t| { status: \"not-installed\"; error: unknown }\n\t| { status: \"no-accounts\" }\n\t| { status: \"configured\"; assessment: ConfigurationAssessment };\n\n/**\n * One predicate so availability and resolution cannot disagree: evaluates the\n * same conditions for every caller and reports why the lane is unusable\n * instead of deciding per call-site whether that is fatal.\n */\nasync function assessConfiguration(deps: CursorCliOauthConfigDeps): Promise<ConfigurationOutcome> {\n\tconst settings = deps.readSettings();\n\tif (!settings.enabled) return { status: \"disabled\" };\n\ttry {\n\t\tdeps.resolveExecutable(settings);\n\t} catch (error) {\n\t\treturn { status: \"not-installed\", error };\n\t}\n\n\tconst accounts = usableAccounts(await deps.readCurrent());\n\tif (accounts.length === 0) return { status: \"no-accounts\" };\n\treturn {\n\t\tstatus: \"configured\",\n\t\tassessment: { accounts, message: `configured (file-store, ${accounts.length} accounts)` },\n\t};\n}\n\n/** The throwing view used by turn-time resolution; a turn attempted on an unusable lane must still error clearly. */\nasync function configuredFor(deps: CursorCliOauthConfigDeps): Promise<ConfigurationAssessment> {\n\tconst outcome = await assessConfiguration(deps);\n\tswitch (outcome.status) {\n\t\tcase \"disabled\":\n\t\t\tthrow new Error(DISABLED_MESSAGE);\n\t\tcase \"not-installed\":\n\t\t\tthrow cursorAgentNotInstalledError(outcome.error);\n\t\tcase \"no-accounts\":\n\t\t\tthrow new Error(NO_ACCOUNTS_MESSAGE);\n\t\tdefault:\n\t\t\treturn outcome.assessment;\n\t}\n}\n\nfunction isCursorCliOauthCredential(\n\tvalue: Credential | OAuthCredentials | undefined,\n): value is CursorCliOauthCredential {\n\tif (typeof value !== \"object\" || value === null) return false;\n\tconst candidate = value as Partial<CursorCliOauthCredential>;\n\treturn candidate.type === \"oauth\" && Array.isArray(candidate.accounts);\n}\n\nfunction usableAccounts(value: Credential | OAuthCredentials | undefined): CursorCliAccountSlot[] {\n\tif (!isCursorCliOauthCredential(value)) return [];\n\treturn listAccounts(value).filter(\n\t\t(slot) =>\n\t\t\ttypeof slot.name === \"string\" &&\n\t\t\ttypeof slot.access === \"string\" &&\n\t\t\tslot.access.trim().length > 0 &&\n\t\t\ttypeof slot.refresh === \"string\" &&\n\t\t\tslot.refresh.trim().length > 0 &&\n\t\t\ttypeof slot.expires === \"number\" &&\n\t\t\tNumber.isFinite(slot.expires),\n\t);\n}\n\nfunction installationMessage(error: unknown): string {\n\tconst detail = error instanceof Error ? error.message : String(error);\n\treturn `cursor-agent not installed: ${detail.replace(/^Cursor CLI is not installed\\.\\s*/, \"\")}`;\n}\n\n/**\n * The typed turn-path error for a missing cursor-agent binary: carries the\n * `cursor-agent not installed` marker plus the install guidance verbatim, with\n * the underlying resolution failure preserved as `cause`.\n */\nexport function cursorAgentNotInstalledError(cause: unknown): Error {\n\tconst error = new Error(installationMessage(cause));\n\terror.name = \"CursorAgentNotInstalledError\";\n\terror.cause = cause;\n\treturn error;\n}\n\n/** Resolve credentials immediately before execution so a concurrent refresh cannot leave a stale token in memory. */\nexport async function resolveCursorCliOauthLane(deps: CursorCliOauthConfigDeps): Promise<CursorCliOauthLaneResolution> {\n\tconst assessment = await configuredFor(deps);\n\tconst account = assessment.accounts[0];\n\tif (!account) throw new Error(NO_ACCOUNTS_MESSAGE);\n\treturn { lane: FILE_STORE_LANE, account, accounts: assessment.accounts };\n}\n\nasync function loadCursorOAuthFlow(): Promise<OAuthAuth> {\n\tconst flow = cursorProvider().auth.oauth;\n\tif (!flow) throw new Error(\"Cursor OAuth flow is unavailable\");\n\treturn flow;\n}\n\nfunction providerInteraction(callbacks: OAuthLoginCallbacks): ProviderAuthInteraction {\n\treturn {\n\t\tsignal: callbacks.signal ?? new AbortController().signal,\n\t\tprompt: async (prompt) => {\n\t\t\tswitch (prompt.type) {\n\t\t\t\tcase \"select\":\n\t\t\t\t\treturn (await callbacks.onSelect(prompt)) ?? \"\";\n\t\t\t\tcase \"manual_code\":\n\t\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\t\tdefault:\n\t\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t\t}\n\t\t},\n\t\tnotify: (event) => {\n\t\t\tswitch (event.type) {\n\t\t\t\tcase \"auth_url\":\n\t\t\t\t\tcallbacks.onAuth({ url: event.url, instructions: event.instructions });\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"device_code\":\n\t\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"progress\":\n\t\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"info\":\n\t\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t},\n\t};\n}\n\nasync function accountName(\n\texisting: CursorCliAccountSlot[],\n\tonPrompt: OAuthLoginCallbacks[\"onPrompt\"] | undefined,\n): Promise<string> {\n\tif (existing.length === 0) return \"default\";\n\tconst fallback = `account-${existing.length + 1}`;\n\tif (!onPrompt) return fallback;\n\tconst answer = (\n\t\tawait onPrompt({\n\t\t\tmessage: `Name for this account (existing: ${existing.map((slot) => slot.name).join(\", \")})`,\n\t\t\tplaceholder: fallback,\n\t\t})\n\t).trim();\n\treturn answer || fallback;\n}\n\nfunction slotFromCredential(\n\tcredential: Pick<OAuthCredentials, \"access\" | \"refresh\" | \"expires\">,\n\tname: string,\n\tsource: CursorCliAccountSlot[\"source\"],\n): CursorCliAccountSlot {\n\treturn {\n\t\tname,\n\t\taccess: credential.access,\n\t\trefresh: credential.refresh,\n\t\texpires: credential.expires,\n\t\tsource,\n\t};\n}\n\n/** The one-screen login explanation: what unattended Cursor CLI execution gives up, and the plan-mode alternative. */\nexport const CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION = `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} Plan mode (planning only, no tool execution) is available via the executionMode setting.`;\n\nconst ACKNOWLEDGEMENT_ACCEPTANCE = new Set([\"yes\", \"y\"]);\n\n/**\n * Present the no-approval explanation exactly once and return the ISO\n * acknowledgement timestamp on explicit confirmation, undefined otherwise.\n * Shared by the login flow and the /cursor-account acknowledge subcommand so\n * both surfaces present the identical explanation and persist identically.\n */\nexport async function confirmCursorCliNoApprovalAcknowledgement(\n\tonPrompt: ((prompt: { message: string; placeholder?: string }) => Promise<string>) | undefined,\n\tnow: () => Date,\n): Promise<string | undefined> {\n\tif (!onPrompt) return undefined;\n\tconst answer = (\n\t\tawait onPrompt({\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION}\\nType \"yes\" to acknowledge and allow unattended Cursor CLI tool execution; anything else leaves it off.`,\n\t\t})\n\t)\n\t\t.trim()\n\t\t.toLowerCase();\n\treturn ACKNOWLEDGEMENT_ACCEPTANCE.has(answer) ? now().toISOString() : undefined;\n}\n\nexport function createCursorCliOauthConfig(deps: CursorCliOauthConfigDeps): CursorCliOauthConfig {\n\treturn {\n\t\tname: CURSOR_CLI_OAUTH_NAME,\n\t\tisSubscription: true,\n\n\t\tasync check(input) {\n\t\t\t// Tolerant by contract: ModelsImpl.getAvailable runs every provider's\n\t\t\t// check under Promise.all (packages/ai/src/models.ts:544-548) and turns a\n\t\t\t// throw into a rejecting ModelsError, so one throwing check would reject\n\t\t\t// all model listing. Not usable (disabled / not installed / no accounts)\n\t\t\t// reports undefined here - as claude-sdk-oauth's check does - while\n\t\t\t// turn-time resolution keeps throwing via configuredFor.\n\t\t\t//\n\t\t\t// One nuance: the auth-resolution path (checkAuth, resolveStoredOAuth)\n\t\t\t// always passes the stored credential, while bare model listing does not.\n\t\t\t// A credential-backed lane whose executable is missing stays selectable\n\t\t\t// with the install guidance as its source, so a TURN reaches\n\t\t\t// streamCursorCliOauth, which throws the typed not-installed error;\n\t\t\t// without a credential the lane hides exactly as before.\n\t\t\tconst outcome = await assessConfiguration(deps);\n\t\t\tif (outcome.status === \"disabled\" || outcome.status === \"no-accounts\") return undefined;\n\t\t\tif (outcome.status === \"not-installed\") {\n\t\t\t\treturn input.credential === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: { type: \"oauth\", source: installationMessage(outcome.error) };\n\t\t\t}\n\t\t\treturn { type: \"oauth\", source: outcome.assessment.message };\n\t\t},\n\n\t\tasync login(callbacks) {\n\t\t\tconst stored = await deps.readCurrent();\n\t\t\tconst current = isCursorCliOauthCredential(stored) ? stored : emptyCredential();\n\t\t\tconst existing = listAccounts(current);\n\t\t\tconst flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();\n\t\t\tconst loggedIn = await flow.login(providerInteraction(callbacks));\n\t\t\tconst name = await accountName(existing, callbacks.onPrompt);\n\t\t\t// After the PKCE flow succeeds and before the slot is stored: the\n\t\t\t// one-screen no-approval explanation, confirmed once. Declining still\n\t\t\t// stores the slot; only the acknowledgement stays unset, so force turns\n\t\t\t// refuse until the user acknowledges later.\n\t\t\tconst acknowledgedAt = await confirmCursorCliNoApprovalAcknowledgement(\n\t\t\t\tcallbacks.onPrompt,\n\t\t\t\tdeps.now ?? (() => new Date()),\n\t\t\t);\n\t\t\tif (acknowledgedAt !== undefined) deps.persistAcknowledgement?.(acknowledgedAt);\n\t\t\treturn addAccount(current, slotFromCredential(loggedIn, name, \"login\"));\n\t\t},\n\n\t\tasync refreshToken(credentials, signal) {\n\t\t\tif (!isCursorCliOauthCredential(credentials)) return credentials;\n\t\t\tconst flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();\n\t\t\tconst accounts: CursorCliAccountSlot[] = [];\n\t\t\tfor (const slot of listAccounts(credentials)) {\n\t\t\t\tif (Date.now() < slot.expires) {\n\t\t\t\t\taccounts.push(slot);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst refreshed = await flow.refresh(\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\taccess: slot.access,\n\t\t\t\t\t\trefresh: slot.refresh,\n\t\t\t\t\t\texpires: slot.expires,\n\t\t\t\t\t},\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\taccounts.push({\n\t\t\t\t\t...slot,\n\t\t\t\t\taccess: refreshed.access,\n\t\t\t\t\trefresh: refreshed.refresh,\n\t\t\t\t\texpires: refreshed.expires,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { ...credentials, ...SENTINEL_OAUTH_FIELDS, accounts };\n\t\t},\n\n\t\tgetApiKey() {\n\t\t\treturn SENTINEL_OAUTH_FIELDS.access;\n\t\t},\n\t};\n}\n\nfunction execFileOutput(file: string, args: string[]): Promise<string | undefined> {\n\treturn new Promise((resolve) => {\n\t\tnodeExecFile(file, args, { encoding: \"utf8\" }, (error, stdout) => {\n\t\t\tif (error) {\n\t\t\t\tresolve(undefined);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst value = stdout.trim();\n\t\t\tresolve(value.length > 0 ? value : undefined);\n\t\t});\n\t});\n}\n\nasync function defaultKeychainCredential(): Promise<ImportedCursorCredential | undefined> {\n\tif (process.platform !== \"darwin\") return undefined;\n\tconst [access, refresh] = await Promise.all([\n\t\texecFileOutput(\"security\", [\"find-generic-password\", \"-a\", \"cursor-user\", \"-s\", \"cursor-access-token\", \"-w\"]),\n\t\texecFileOutput(\"security\", [\"find-generic-password\", \"-a\", \"cursor-user\", \"-s\", \"cursor-refresh-token\", \"-w\"]),\n\t]);\n\treturn access && refresh ? { access, refresh } : undefined;\n}\n\nfunction localCursorAuthPath(platform: NodeJS.Platform): string | undefined {\n\tswitch (platform) {\n\t\tcase \"darwin\":\n\t\t\treturn join(homedir(), \".cursor\", \"auth.json\");\n\t\tcase \"linux\":\n\t\t\treturn join(process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"cursor\", \"auth.json\");\n\t\tcase \"win32\": {\n\t\t\tconst appData = process.env.APPDATA;\n\t\t\treturn appData ? join(appData, \"Cursor\", \"auth.json\") : undefined;\n\t\t}\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nasync function defaultFileCredential(platform: NodeJS.Platform): Promise<ImportedCursorCredential | undefined> {\n\tconst path = localCursorAuthPath(platform);\n\tif (!path) return undefined;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(await nodeReadFile(path, \"utf8\"));\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return undefined;\n\t\tconst record = parsed as Record<string, unknown>;\n\t\tconst access = record.accessToken;\n\t\tconst refresh = record.refreshToken;\n\t\tif (typeof access !== \"string\" || access.length === 0 || typeof refresh !== \"string\" || refresh.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { access, refresh };\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/** Explicitly copy the user's local Cursor credential into this provider's managed account slots. */\nexport async function importLocalCursorCredential(\n\tcurrent: CursorCliOauthCredential,\n\tdeps: LocalCursorImportDeps = {},\n): Promise<CursorCliOauthCredential> {\n\tconst platform = deps.platform ?? process.platform;\n\tconst readKeychain = deps.readCursorKeychain ?? defaultKeychainCredential;\n\tconst readFile = deps.readCursorFile ?? (() => defaultFileCredential(platform));\n\tconst imported = platform === \"darwin\" ? ((await readKeychain()) ?? (await readFile())) : await readFile();\n\tif (!imported) throw new Error(\"No local Cursor OAuth credential found\");\n\tconst existing = listAccounts(current);\n\tconst name = await accountName(existing, deps.onPrompt);\n\treturn addAccount(\n\t\tcurrent,\n\t\tslotFromCredential(\n\t\t\t{\n\t\t\t\taccess: imported.access,\n\t\t\t\trefresh: imported.refresh,\n\t\t\t\texpires: imported.expires ?? Date.now() + DEFAULT_IMPORTED_EXPIRY_MS,\n\t\t\t},\n\t\t\tname,\n\t\t\t\"import\",\n\t\t),\n\t);\n}\n\nexport function defaultCursorCliOauthConfig(\n\tcwd: string,\n\treadCurrent: () => Promise<Credential | undefined>,\n): CursorCliOauthConfig {\n\treturn createCursorCliOauthConfig({\n\t\treadCurrent,\n\t\treadSettings: () => loadCursorCliOauthProviderSettingsFromDisk(cwd),\n\t\tresolveExecutable: (settings) => {\n\t\t\tconst executableDeps: CursorAgentExecutableDeps = {\n\t\t\t\t...defaultCursorAgentExecutableDeps(),\n\t\t\t\tsettings,\n\t\t\t};\n\t\t\treturn resolveCursorAgentExecutable(executableDeps);\n\t\t},\n\t\tnow: () => new Date(),\n\t\tpersistAcknowledgement: (acknowledgedAt: string) =>\n\t\t\tpersistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t});\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/session-router.d.ts

@@ -0,0 +1,94 @@
+import { type CursorCliErrorClassification, type CursorCliErrorInput } from "./errors.ts";
+import type { CursorCliOauthResumeMode } from "./settings.ts";
+export declare const CURSOR_CLI_CONTEXT_RECAP_MAX_BYTES: number;
+export declare const CURSOR_CLI_CONTEXT_RECAP_BEGIN = "===== senpi context recap =====";
+export declare const CURSOR_CLI_CONTEXT_RECAP_END = "===== end senpi context recap =====";
+export type CursorCliSessionRecord = {
+    readonly accountName: string;
+    readonly chatId: string;
+    readonly lastModel: string;
+    readonly lastUsedAt: number;
+};
+export type CursorCliRecapExchange = {
+    readonly role: "user" | "assistant";
+    readonly text: string;
+};
+export type CursorCliSessionTurnContext = {
+    readonly senpiSessionId: string;
+    readonly accountName: string;
+};
+export type CursorCliSessionTurnInput = {
+    readonly prompt: string;
+    readonly model: string | undefined;
+    readonly recentExchanges?: readonly CursorCliRecapExchange[];
+};
+export type CursorCliSessionPolicy = {
+    readonly resumeMode?: CursorCliOauthResumeMode;
+    readonly contextRecapOnModelSwitch?: boolean;
+    readonly maxRecapBytes?: number;
+    readonly promptCeilingBytes?: number;
+};
+export type CursorCliTurnPlan = {
+    /** Chat id passed as `--resume`, or undefined for a fresh chat. */
+    readonly resumeChatId: string | undefined;
+    /** Final spawn prompt: the recap block prepended unless it had to be dropped for the ceiling. */
+    readonly prompt: string;
+    readonly contextRecap: string | undefined;
+    readonly modelSwitch: boolean;
+    readonly recapDroppedForCeiling: boolean;
+};
+export type CursorCliSessionAttempt = {
+    readonly prompt: string;
+    readonly resumeChatId: string | undefined;
+};
+export type CursorCliSessionInitObservation = {
+    readonly chatId: string;
+    readonly model: string;
+};
+export type CursorCliSessionRestartReason = "resume_failed" | "context_overflow";
+export type CursorCliSessionRestartNotice = {
+    readonly type: "cursor_chat_restarted";
+    readonly message: string;
+    readonly previousChatId: string;
+    readonly reason: CursorCliSessionRestartReason;
+};
+export type CursorCliSessionRunOptions<TEvent> = {
+    readonly senpiSessionId: string;
+    readonly accountName: string;
+    readonly runAttempt: (attempt: CursorCliSessionAttempt) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;
+    readonly now?: () => number;
+    readonly classify?: (input: CursorCliErrorInput) => CursorCliErrorClassification;
+    readonly errorFromEvent?: (event: TEvent) => CursorCliErrorInput | undefined;
+    readonly initFromEvent?: (event: TEvent) => CursorCliSessionInitObservation | undefined;
+    readonly isVisibleAssistantDelta?: (event: TEvent) => boolean;
+} & CursorCliSessionPolicy;
+export type CursorCliSessionRouterDeps = {
+    readonly now?: () => number;
+};
+/**
+ * Builds the one-turn context recap from senpi's own last exchanges, wrapped in
+ * explicit delimiters and hard-capped at `maxRecapBytes` (delimiters included).
+ * The newest exchanges are kept; older ones are dropped first.
+ */
+export declare function buildCursorCliContextRecap(model: string | undefined, exchanges: readonly CursorCliRecapExchange[] | undefined, maxRecapBytes?: number): string | undefined;
+/**
+ * Sticky per-senpi-session chat routing for the Cursor CLI lane. This lane
+ * spawns once per turn, so routing state is just the last observed
+ * `system/init` per senpi session - no resident CLI process exists to manage.
+ * The turn decision itself is pure; records change only when an init event is
+ * observed, so cancelled or failed turns leave prior routing intact.
+ */
+export declare class CursorCliSessionRouter {
+    private readonly records;
+    private readonly nowFn;
+    constructor(deps?: CursorCliSessionRouterDeps);
+    getRecord(senpiSessionId: string): Readonly<CursorCliSessionRecord> | undefined;
+    clear(senpiSessionId: string): void;
+    planTurn(context: CursorCliSessionTurnContext, input: CursorCliSessionTurnInput, policy?: CursorCliSessionPolicy): CursorCliTurnPlan;
+    /** Records the chat id and effective model reported by `system/init`. */
+    observeInit(context: CursorCliSessionTurnContext, init: CursorCliSessionInitObservation, at?: number): void;
+    runTurn<TEvent>(options: CursorCliSessionRunOptions<TEvent>, input: CursorCliSessionTurnInput): AsyncGenerator<TEvent | CursorCliSessionRestartNotice>;
+}
+/** Shared router instance; one record per senpi session, in-process. */
+export declare const cursorCliSessionRouter: CursorCliSessionRouter;
+//# sourceMappingURL=session-router.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/session-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-router.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/session-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,4BAA4B,EAAE,KAAK,mBAAmB,EAA0B,MAAM,aAAa,CAAC;AAClH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,eAAO,MAAM,kCAAkC,QAAW,CAAC;AAC3D,eAAO,MAAM,8BAA8B,oCAAoC,CAAC;AAChF,eAAO,MAAM,4BAA4B,wCAAwC,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEjF,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,MAAM,IAAI;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAClH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,4BAA4B,CAAC;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,+BAA+B,GAAG,SAAS,CAAC;IACxF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC9D,GAAG,sBAAsB,CAAC;AAE3B,MAAM,MAAM,0BAA0B,GAAG;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B,CAAC;AAoBF;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,SAAS,sBAAsB,EAAE,GAAG,SAAS,EACxD,aAAa,GAAE,MAA2C,GACxD,MAAM,GAAG,SAAS,CA4BpB;AAkGD;;;;;;GAMG;AACH,qBAAa,sBAAsB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IACrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,IAAI,GAAE,0BAA+B;IAIjD,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,SAAS;IAK/E,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAInC,QAAQ,CACP,OAAO,EAAE,2BAA2B,EACpC,KAAK,EAAE,yBAAyB,EAChC,MAAM,GAAE,sBAA2B,GACjC,iBAAiB;IAuBpB,yEAAyE;IACzE,WAAW,CACV,OAAO,EAAE,2BAA2B,EACpC,IAAI,EAAE,+BAA+B,EACrC,EAAE,GAAE,MAAqB,GACvB,IAAI;IASA,OAAO,CAAC,MAAM,EACpB,OAAO,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAC3C,KAAK,EAAE,yBAAyB,GAC9B,cAAc,CAAC,MAAM,GAAG,6BAA6B,CAAC;CAuDzD;AAED,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,wBAA+B,CAAC"}