@code-yeongyu/senpi 2026.8.16 → 2026.8.17

package/dist/core/extensions/builtin/cursor-cli-oauth/executable.js

@@ -0,0 +1,117 @@
+import { execFile as nodeExecFile } from "node:child_process";
+import { accessSync, constants, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, join } from "node:path";
+export class CursorAgentNotInstalledError extends Error {
+    constructor() {
+        super("Cursor CLI is not installed. Install it with `curl https://cursor.com/install -fsS | bash`, " +
+            "then ensure ~/.local/bin is on your PATH.");
+        this.kind = "binary_missing";
+        this.name = "CursorAgentNotInstalledError";
+    }
+}
+function executableCandidate(candidate, deps) {
+    if (!candidate)
+        return undefined;
+    try {
+        return deps.isExecutableFile(candidate) ? candidate : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function resolveFromPath(deps) {
+    const pathValue = deps.env("PATH");
+    if (!pathValue)
+        return undefined;
+    for (const directory of pathValue.split(deps.pathDelimiter)) {
+        if (!directory)
+            continue;
+        const candidate = executableCandidate(join(directory, "cursor-agent"), deps);
+        if (candidate)
+            return candidate;
+    }
+    return undefined;
+}
+function resolveFromInstalledVersions(deps) {
+    const versionsDirectory = join(deps.homeDirectory, ".local", "share", "cursor-agent", "versions");
+    let entries;
+    try {
+        entries = deps.readDirectory(versionsDirectory);
+    }
+    catch {
+        return undefined;
+    }
+    const directoryNames = entries
+        .filter((entry) => entry.isDirectory)
+        .map((entry) => entry.name)
+        .sort()
+        .reverse();
+    for (const directoryName of directoryNames) {
+        const candidate = executableCandidate(join(versionsDirectory, directoryName, "cursor-agent"), deps);
+        if (candidate)
+            return candidate;
+    }
+    return undefined;
+}
+export function resolveCursorAgentExecutable(deps) {
+    const orderedCandidates = [
+        deps.env("SENPI_CURSOR_CLI_OAUTH_EXECUTABLE"),
+        deps.env("CURSOR_AGENT_EXECUTABLE"),
+        deps.settings.executablePath,
+    ];
+    for (const candidate of orderedCandidates) {
+        const executable = executableCandidate(candidate, deps);
+        if (executable)
+            return executable;
+    }
+    const pathExecutable = resolveFromPath(deps);
+    if (pathExecutable)
+        return pathExecutable;
+    const installedExecutable = resolveFromInstalledVersions(deps);
+    if (installedExecutable)
+        return installedExecutable;
+    throw new CursorAgentNotInstalledError();
+}
+const defaultVersionProbeDeps = {
+    execFile: (file, args, options, callback) => {
+        nodeExecFile(file, args, options, (error, stdout, stderr) => {
+            callback(error, stdout, stderr);
+        });
+    },
+};
+export function probeCursorAgentVersion(executable, deps = defaultVersionProbeDeps) {
+    return new Promise((resolve, reject) => {
+        deps.execFile(executable, ["--version"], { encoding: "utf8", timeout: 10_000 }, (error, stdout) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(stdout.trim());
+        });
+    });
+}
+export function defaultCursorAgentExecutableDeps() {
+    return {
+        env: (name) => process.env[name],
+        settings: {},
+        homeDirectory: homedir(),
+        pathDelimiter: delimiter,
+        isExecutableFile: (candidate) => {
+            try {
+                if (!statSync(candidate).isFile())
+                    return false;
+                accessSync(candidate, constants.X_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        readDirectory: (directory) => readdirSync(directory, { withFileTypes: true }).map((entry) => ({
+            name: entry.name,
+            isDirectory: entry.isDirectory(),
+        })),
+    };
+}
+//# sourceMappingURL=executable.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/executable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/executable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA2B5C,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAGtD;QACC,KAAK,CACJ,8FAA8F;YAC7F,2CAA2C,CAC5C,CAAC;QANM,SAAI,GAAG,gBAAgB,CAAC;QAOhC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,mBAAmB,CAAC,SAA6B,EAAE,IAA+B;IAC1F,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAA+B;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7E,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,IAA+B;IACpE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IAClG,IAAI,OAAoC,CAAC;IACzC,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,OAAO;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;IAEZ,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAA+B;IAC3E,MAAM,iBAAiB,GAAG;QACzB,IAAI,CAAC,GAAG,CAAC,mCAAmC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,cAAc;KAC5B,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACnC,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IAEpD,MAAM,IAAI,4BAA4B,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,uBAAuB,GAAqB;IACjD,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3C,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACtC,UAAkB,EAClB,OAAyB,uBAAuB;IAEhD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjG,IAAI,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACR,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC/C,OAAO;QACN,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,OAAO,EAAE;QACxB,aAAa,EAAE,SAAS;QACxB,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE;YAC/B,IAAI,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAChD,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QACD,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAC5B,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SAChC,CAAC,CAAC;KACJ,CAAC;AACH,CAAC","sourcesContent":["import { execFile as nodeExecFile } from \"node:child_process\";\nimport { accessSync, constants, readdirSync, statSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { delimiter, join } from \"node:path\";\n\nexport type CursorAgentDirectoryEntry = {\n\tname: string;\n\tisDirectory: boolean;\n};\n\nexport type CursorAgentExecutableDeps = {\n\tenv: (name: string) => string | undefined;\n\tsettings: { executablePath?: string };\n\thomeDirectory: string;\n\tpathDelimiter: string;\n\tisExecutableFile: (candidate: string) => boolean;\n\treadDirectory: (directory: string) => CursorAgentDirectoryEntry[];\n};\n\nexport type VersionProbeOptions = {\n\tencoding: \"utf8\";\n\ttimeout: number;\n};\n\nexport type VersionProbeCallback = (error: Error | null, stdout: string, stderr: string) => void;\n\nexport type VersionProbeDeps = {\n\texecFile: (file: string, args: string[], options: VersionProbeOptions, callback: VersionProbeCallback) => void;\n};\n\nexport class CursorAgentNotInstalledError extends Error {\n\treadonly kind = \"binary_missing\";\n\n\tconstructor() {\n\t\tsuper(\n\t\t\t\"Cursor CLI is not installed. Install it with `curl https://cursor.com/install -fsS | bash`, \" +\n\t\t\t\t\"then ensure ~/.local/bin is on your PATH.\",\n\t\t);\n\t\tthis.name = \"CursorAgentNotInstalledError\";\n\t}\n}\n\nfunction executableCandidate(candidate: string | undefined, deps: CursorAgentExecutableDeps): string | undefined {\n\tif (!candidate) return undefined;\n\ttry {\n\t\treturn deps.isExecutableFile(candidate) ? candidate : undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction resolveFromPath(deps: CursorAgentExecutableDeps): string | undefined {\n\tconst pathValue = deps.env(\"PATH\");\n\tif (!pathValue) return undefined;\n\n\tfor (const directory of pathValue.split(deps.pathDelimiter)) {\n\t\tif (!directory) continue;\n\t\tconst candidate = executableCandidate(join(directory, \"cursor-agent\"), deps);\n\t\tif (candidate) return candidate;\n\t}\n\treturn undefined;\n}\n\nfunction resolveFromInstalledVersions(deps: CursorAgentExecutableDeps): string | undefined {\n\tconst versionsDirectory = join(deps.homeDirectory, \".local\", \"share\", \"cursor-agent\", \"versions\");\n\tlet entries: CursorAgentDirectoryEntry[];\n\ttry {\n\t\tentries = deps.readDirectory(versionsDirectory);\n\t} catch {\n\t\treturn undefined;\n\t}\n\n\tconst directoryNames = entries\n\t\t.filter((entry) => entry.isDirectory)\n\t\t.map((entry) => entry.name)\n\t\t.sort()\n\t\t.reverse();\n\n\tfor (const directoryName of directoryNames) {\n\t\tconst candidate = executableCandidate(join(versionsDirectory, directoryName, \"cursor-agent\"), deps);\n\t\tif (candidate) return candidate;\n\t}\n\treturn undefined;\n}\n\nexport function resolveCursorAgentExecutable(deps: CursorAgentExecutableDeps): string {\n\tconst orderedCandidates = [\n\t\tdeps.env(\"SENPI_CURSOR_CLI_OAUTH_EXECUTABLE\"),\n\t\tdeps.env(\"CURSOR_AGENT_EXECUTABLE\"),\n\t\tdeps.settings.executablePath,\n\t];\n\tfor (const candidate of orderedCandidates) {\n\t\tconst executable = executableCandidate(candidate, deps);\n\t\tif (executable) return executable;\n\t}\n\n\tconst pathExecutable = resolveFromPath(deps);\n\tif (pathExecutable) return pathExecutable;\n\n\tconst installedExecutable = resolveFromInstalledVersions(deps);\n\tif (installedExecutable) return installedExecutable;\n\n\tthrow new CursorAgentNotInstalledError();\n}\n\nconst defaultVersionProbeDeps: VersionProbeDeps = {\n\texecFile: (file, args, options, callback) => {\n\t\tnodeExecFile(file, args, options, (error, stdout, stderr) => {\n\t\t\tcallback(error, stdout, stderr);\n\t\t});\n\t},\n};\n\nexport function probeCursorAgentVersion(\n\texecutable: string,\n\tdeps: VersionProbeDeps = defaultVersionProbeDeps,\n): Promise<string> {\n\treturn new Promise((resolve, reject) => {\n\t\tdeps.execFile(executable, [\"--version\"], { encoding: \"utf8\", timeout: 10_000 }, (error, stdout) => {\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tresolve(stdout.trim());\n\t\t});\n\t});\n}\n\nexport function defaultCursorAgentExecutableDeps(): CursorAgentExecutableDeps {\n\treturn {\n\t\tenv: (name) => process.env[name],\n\t\tsettings: {},\n\t\thomeDirectory: homedir(),\n\t\tpathDelimiter: delimiter,\n\t\tisExecutableFile: (candidate) => {\n\t\t\ttry {\n\t\t\t\tif (!statSync(candidate).isFile()) return false;\n\t\t\t\taccessSync(candidate, constants.X_OK);\n\t\t\t\treturn true;\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t},\n\t\treadDirectory: (directory) =>\n\t\t\treaddirSync(directory, { withFileTypes: true }).map((entry) => ({\n\t\t\t\tname: entry.name,\n\t\t\t\tisDirectory: entry.isDirectory(),\n\t\t\t})),\n\t};\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/failover.d.ts

@@ -0,0 +1,39 @@
+import type { CredentialStore } from "@earendil-works/pi-ai";
+import { type CursorCliAccountSlot } from "./accounts.ts";
+import { type CursorAffinityOptions } from "./affinity.ts";
+import { type CursorCliErrorClassification, type CursorCliErrorInput } from "./errors.ts";
+export type CursorCliFailoverNotice = {
+    type: "cursor_account_changed";
+    message: string;
+    fromAccount: string;
+    toAccount: string;
+    freshChat: true;
+    priorContextCarriedOver: false;
+};
+export type CursorCliAttemptOptions = {
+    /** Cross-account Cursor chats cannot be resumed because each account has its own HOME. */
+    freshChat: boolean;
+};
+export type CursorCliFailoverOptions<TEvent> = {
+    store: CredentialStore;
+    providerId: string;
+    affinity?: CursorAffinityOptions;
+    runAttempt: (account: CursorCliAccountSlot, options: CursorCliAttemptOptions) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;
+    now?: () => number;
+    classify?: (input: CursorCliErrorInput) => CursorCliErrorClassification;
+    errorFromEvent?: (event: TEvent) => CursorCliErrorInput | undefined;
+    isVisibleAssistantDelta?: (event: TEvent) => boolean;
+};
+export declare class CursorCliFailoverError extends Error {
+    readonly classification: CursorCliErrorClassification;
+    readonly original: unknown;
+    readonly visibleAssistantDeltaEmitted: boolean;
+    constructor(classification: CursorCliErrorClassification, original: unknown, visibleAssistantDeltaEmitted: boolean);
+}
+/**
+ * Runs one Cursor CLI stream at a time and rotates accounts only before any
+ * assistant text is visible. Replacement accounts always start a fresh chat;
+ * this module never accepts or transfers a chat id or transcript context.
+ */
+export declare function runCursorCliFailover<TEvent>(options: CursorCliFailoverOptions<TEvent>): AsyncGenerator<TEvent | CursorCliFailoverNotice>;
+//# sourceMappingURL=failover.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/failover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failover.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/failover.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,oBAAoB,EAA+C,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,KAAK,qBAAqB,EAAiB,MAAM,eAAe,CAAC;AAC1E,OAAO,EACN,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EAIxB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,uBAAuB,EAAE,KAAK,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,0FAA0F;IAC1F,SAAS,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,wBAAwB,CAAC,MAAM,IAAI;IAC9C,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,UAAU,EAAE,CACX,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,uBAAuB,KAC5B,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,4BAA4B,CAAC;IACxE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,mBAAmB,GAAG,SAAS,CAAC;IACpE,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD,CAAC;AAEF,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC;gBAEnC,cAAc,EAAE,4BAA4B,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO;CAOlH;AAyHD;;;;GAIG;AACH,wBAAuB,oBAAoB,CAAC,MAAM,EACjD,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,GACvC,cAAc,CAAC,MAAM,GAAG,uBAAuB,CAAC,CAmClD"}

package/dist/core/extensions/builtin/cursor-cli-oauth/failover.js

@@ -0,0 +1,155 @@
+import { listAccounts } from "./accounts.js";
+import { selectAccount } from "./affinity.js";
+import { classifyCursorCliError, DEFAULT_RATE_LIMIT_BLOCK_MS, MAX_RATE_LIMIT_BLOCK_MS, } from "./errors.js";
+export class CursorCliFailoverError extends Error {
+    constructor(classification, original, visibleAssistantDeltaEmitted) {
+        super(errorMessage(original));
+        this.name = "CursorCliFailoverError";
+        this.classification = classification;
+        this.original = original;
+        this.visibleAssistantDeltaEmitted = visibleAssistantDeltaEmitted;
+    }
+}
+class CursorCliNoAssistantOutputError extends Error {
+    constructor() {
+        super("Cursor CLI attempt completed without visible assistant text");
+        this.name = "CursorCliNoAssistantOutputError";
+    }
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function errorMessage(error) {
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === "string")
+        return error;
+    const message = record(error)?.message;
+    return typeof message === "string" ? message : "Cursor CLI attempt failed";
+}
+function errorInput(error) {
+    const value = record(error);
+    if (value && ("exitCode" in value || "stderr" in value || "resultEvent" in value || "thrown" in value)) {
+        return error;
+    }
+    return { thrown: error };
+}
+function defaultErrorFromEvent(event) {
+    const value = record(event);
+    if (value?.type === "malformed_stream")
+        return { thrown: event };
+    if (value?.type === "result" && (value.is_error === true || value.subtype === "error")) {
+        return { resultEvent: event };
+    }
+    return undefined;
+}
+function defaultIsVisibleAssistantDelta(event) {
+    const value = record(event);
+    if (!value)
+        return false;
+    if (value.type === "assistant") {
+        const message = record(value.message);
+        if (!Array.isArray(message?.content))
+            return false;
+        return message.content.some((item) => {
+            const block = record(item);
+            return block?.type === "text" && typeof block.text === "string" && block.text.length > 0;
+        });
+    }
+    return ((value.type === "assistant_delta" || value.type === "text_delta") &&
+        typeof value.delta === "string" &&
+        value.delta.length > 0);
+}
+function notice(fromAccount, toAccount) {
+    return {
+        type: "cursor_account_changed",
+        message: `Cursor account changed from '${fromAccount}' to '${toAccount}'; a fresh chat was started and prior context was not carried over.`,
+        fromAccount,
+        toAccount,
+        freshChat: true,
+        priorContextCarriedOver: false,
+    };
+}
+async function readCredential(store, providerId) {
+    const current = await store.read(providerId);
+    return current?.type === "oauth" ? current : undefined;
+}
+async function selectStoredAccount(options, now) {
+    const credential = await readCredential(options.store, options.providerId);
+    const accounts = credential ? listAccounts(credential) : [];
+    return selectAccount(accounts, {
+        ...options.affinity,
+        pinnedAccount: options.affinity?.pinnedAccount ?? credential?.pinned,
+        now,
+    });
+}
+function blockedAccount(account, classification, now) {
+    if (classification.kind === "auth_error") {
+        const { blockedUntil: _blockedUntil, ...withoutExpiry } = account;
+        return { ...withoutExpiry, blockReason: "auth_error" };
+    }
+    const duration = Math.min(MAX_RATE_LIMIT_BLOCK_MS, classification.blockMs ?? DEFAULT_RATE_LIMIT_BLOCK_MS);
+    return { ...account, blockedUntil: now + duration, blockReason: "rate_limit" };
+}
+async function persistBlock(store, providerId, account) {
+    await store.modify(providerId, async (current) => {
+        if (current?.type !== "oauth")
+            return current;
+        const credential = current;
+        return {
+            ...credential,
+            accounts: (credential.accounts ?? []).map((existing) => existing.name === account.name
+                ? { ...existing, blockedUntil: account.blockedUntil, blockReason: account.blockReason }
+                : existing),
+        };
+    });
+}
+function isFailoverKind(classification) {
+    return classification.kind === "rate_limit" || classification.kind === "auth_error";
+}
+/**
+ * Runs one Cursor CLI stream at a time and rotates accounts only before any
+ * assistant text is visible. Replacement accounts always start a fresh chat;
+ * this module never accepts or transfers a chat id or transcript context.
+ */
+export async function* runCursorCliFailover(options) {
+    const now = options.now ?? Date.now;
+    const classify = options.classify ?? classifyCursorCliError;
+    const errorFromEvent = options.errorFromEvent ?? defaultErrorFromEvent;
+    const isVisibleAssistantDelta = options.isVisibleAssistantDelta ?? defaultIsVisibleAssistantDelta;
+    let account = await selectStoredAccount(options, now());
+    let freshChat = false;
+    while (true) {
+        let visibleAssistantDeltaEmitted = false;
+        try {
+            const attemptStream = await options.runAttempt(account, { freshChat });
+            for await (const event of attemptStream) {
+                const failure = errorFromEvent(event);
+                if (failure !== undefined)
+                    throw failure;
+                visibleAssistantDeltaEmitted ||= isVisibleAssistantDelta(event);
+                yield event;
+            }
+            if (!visibleAssistantDeltaEmitted)
+                throw new CursorCliNoAssistantOutputError();
+            return;
+        }
+        catch (error) {
+            const classification = classify(errorInput(error));
+            const surfaced = new CursorCliFailoverError(classification, error, visibleAssistantDeltaEmitted);
+            if (!isFailoverKind(classification))
+                throw surfaced;
+            const blocked = blockedAccount(account, classification, now());
+            await persistBlock(options.store, options.providerId, blocked);
+            if (visibleAssistantDeltaEmitted)
+                throw surfaced;
+            const nextAccount = await selectStoredAccount(options, now());
+            yield notice(account.name, nextAccount.name);
+            account = nextAccount;
+            freshChat = true;
+        }
+    }
+}
+//# sourceMappingURL=failover.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/failover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failover.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/failover.ts"],"names":[],"mappings":"AACA,OAAO,EAA4D,YAAY,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAA8B,aAAa,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAGN,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACvB,MAAM,aAAa,CAAC;AA8BrB,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAKhD,YAAY,cAA4C,EAAE,QAAiB,EAAE,4BAAqC;QACjH,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,4BAA4B,GAAG,4BAA4B,CAAC;IAClE,CAAC;CACD;AAED,MAAM,+BAAgC,SAAQ,KAAK;IAClD;QACC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAC/C,CAAC;CACD;AAED,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,aAAa,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;QACxG,OAAO,KAA4B,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAS,KAAa;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,KAAK,EAAE,IAAI,KAAK,kBAAkB;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjE,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,8BAA8B,CAAS,KAAa;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,KAAK,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,CACN,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QACjE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CACtB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,WAAmB,EAAE,SAAiB;IACrD,OAAO;QACN,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,gCAAgC,WAAW,SAAS,SAAS,qEAAqE;QAC3I,WAAW;QACX,SAAS;QACT,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,KAAK;KAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,KAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,OAAO,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,OAAoC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,mBAAmB,CACjC,OAAmF,EACnF,GAAW;IAEX,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,OAAO,aAAa,CAAC,QAAQ,EAAE;QAC9B,GAAG,OAAO,CAAC,QAAQ;QACnB,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM;QACpE,GAAG;KACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACtB,OAA6B,EAC7B,cAA4C,EAC5C,GAAW;IAEX,IAAI,cAAc,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAClE,OAAO,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,cAAc,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAC;IAC1G,OAAO,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAsB,EAAE,UAAkB,EAAE,OAA6B;IACpG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAC9C,MAAM,UAAU,GAAG,OAAmC,CAAC;QACvD,OAAO;YACN,GAAG,UAAU;YACb,QAAQ,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtD,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;gBAC7B,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;gBACvF,CAAC,CAAC,QAAQ,CACX;SACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,cAA4C;IACnE,OAAO,cAAc,CAAC,IAAI,KAAK,YAAY,IAAI,cAAc,CAAC,IAAI,KAAK,YAAY,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,oBAAoB,CAC1C,OAAyC;IAEzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC5D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;IACvE,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,IAAI,8BAA8B,CAAC;IAClG,IAAI,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,4BAA4B,GAAG,KAAK,CAAC;QACzC,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACvE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,OAAO,KAAK,SAAS;oBAAE,MAAM,OAAO,CAAC;gBACzC,4BAA4B,KAAK,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBAChE,MAAM,KAAK,CAAC;YACb,CAAC;YACD,IAAI,CAAC,4BAA4B;gBAAE,MAAM,IAAI,+BAA+B,EAAE,CAAC;YAC/E,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC,cAAc,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;YACjG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAAE,MAAM,QAAQ,CAAC;YAEpD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,4BAA4B;gBAAE,MAAM,QAAQ,CAAC;YAEjD,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,GAAG,WAAW,CAAC;YACtB,SAAS,GAAG,IAAI,CAAC;QAClB,CAAC;IACF,CAAC;AACF,CAAC","sourcesContent":["import type { CredentialStore } from \"@earendil-works/pi-ai\";\nimport { type CursorCliAccountSlot, type CursorCliOauthCredential, listAccounts } from \"./accounts.ts\";\nimport { type CursorAffinityOptions, selectAccount } from \"./affinity.ts\";\nimport {\n\ttype CursorCliErrorClassification,\n\ttype CursorCliErrorInput,\n\tclassifyCursorCliError,\n\tDEFAULT_RATE_LIMIT_BLOCK_MS,\n\tMAX_RATE_LIMIT_BLOCK_MS,\n} from \"./errors.ts\";\n\nexport type CursorCliFailoverNotice = {\n\ttype: \"cursor_account_changed\";\n\tmessage: string;\n\tfromAccount: string;\n\ttoAccount: string;\n\tfreshChat: true;\n\tpriorContextCarriedOver: false;\n};\n\nexport type CursorCliAttemptOptions = {\n\t/** Cross-account Cursor chats cannot be resumed because each account has its own HOME. */\n\tfreshChat: boolean;\n};\n\nexport type CursorCliFailoverOptions<TEvent> = {\n\tstore: CredentialStore;\n\tproviderId: string;\n\taffinity?: CursorAffinityOptions;\n\trunAttempt: (\n\t\taccount: CursorCliAccountSlot,\n\t\toptions: CursorCliAttemptOptions,\n\t) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;\n\tnow?: () => number;\n\tclassify?: (input: CursorCliErrorInput) => CursorCliErrorClassification;\n\terrorFromEvent?: (event: TEvent) => CursorCliErrorInput | undefined;\n\tisVisibleAssistantDelta?: (event: TEvent) => boolean;\n};\n\nexport class CursorCliFailoverError extends Error {\n\treadonly classification: CursorCliErrorClassification;\n\treadonly original: unknown;\n\treadonly visibleAssistantDeltaEmitted: boolean;\n\n\tconstructor(classification: CursorCliErrorClassification, original: unknown, visibleAssistantDeltaEmitted: boolean) {\n\t\tsuper(errorMessage(original));\n\t\tthis.name = \"CursorCliFailoverError\";\n\t\tthis.classification = classification;\n\t\tthis.original = original;\n\t\tthis.visibleAssistantDeltaEmitted = visibleAssistantDeltaEmitted;\n\t}\n}\n\nclass CursorCliNoAssistantOutputError extends Error {\n\tconstructor() {\n\t\tsuper(\"Cursor CLI attempt completed without visible assistant text\");\n\t\tthis.name = \"CursorCliNoAssistantOutputError\";\n\t}\n}\n\nfunction record(value: unknown): Record<string, unknown> | undefined {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value)\n\t\t? (value as Record<string, unknown>)\n\t\t: undefined;\n}\n\nfunction errorMessage(error: unknown): string {\n\tif (error instanceof Error) return error.message;\n\tif (typeof error === \"string\") return error;\n\tconst message = record(error)?.message;\n\treturn typeof message === \"string\" ? message : \"Cursor CLI attempt failed\";\n}\n\nfunction errorInput(error: unknown): CursorCliErrorInput {\n\tconst value = record(error);\n\tif (value && (\"exitCode\" in value || \"stderr\" in value || \"resultEvent\" in value || \"thrown\" in value)) {\n\t\treturn error as CursorCliErrorInput;\n\t}\n\treturn { thrown: error };\n}\n\nfunction defaultErrorFromEvent<TEvent>(event: TEvent): CursorCliErrorInput | undefined {\n\tconst value = record(event);\n\tif (value?.type === \"malformed_stream\") return { thrown: event };\n\tif (value?.type === \"result\" && (value.is_error === true || value.subtype === \"error\")) {\n\t\treturn { resultEvent: event };\n\t}\n\treturn undefined;\n}\n\nfunction defaultIsVisibleAssistantDelta<TEvent>(event: TEvent): boolean {\n\tconst value = record(event);\n\tif (!value) return false;\n\tif (value.type === \"assistant\") {\n\t\tconst message = record(value.message);\n\t\tif (!Array.isArray(message?.content)) return false;\n\t\treturn message.content.some((item) => {\n\t\t\tconst block = record(item);\n\t\t\treturn block?.type === \"text\" && typeof block.text === \"string\" && block.text.length > 0;\n\t\t});\n\t}\n\treturn (\n\t\t(value.type === \"assistant_delta\" || value.type === \"text_delta\") &&\n\t\ttypeof value.delta === \"string\" &&\n\t\tvalue.delta.length > 0\n\t);\n}\n\nfunction notice(fromAccount: string, toAccount: string): CursorCliFailoverNotice {\n\treturn {\n\t\ttype: \"cursor_account_changed\",\n\t\tmessage: `Cursor account changed from '${fromAccount}' to '${toAccount}'; a fresh chat was started and prior context was not carried over.`,\n\t\tfromAccount,\n\t\ttoAccount,\n\t\tfreshChat: true,\n\t\tpriorContextCarriedOver: false,\n\t};\n}\n\nasync function readCredential(\n\tstore: CredentialStore,\n\tproviderId: string,\n): Promise<CursorCliOauthCredential | undefined> {\n\tconst current = await store.read(providerId);\n\treturn current?.type === \"oauth\" ? (current as CursorCliOauthCredential) : undefined;\n}\n\nasync function selectStoredAccount(\n\toptions: Pick<CursorCliFailoverOptions<never>, \"store\" | \"providerId\" | \"affinity\">,\n\tnow: number,\n): Promise<CursorCliAccountSlot> {\n\tconst credential = await readCredential(options.store, options.providerId);\n\tconst accounts = credential ? listAccounts(credential) : [];\n\treturn selectAccount(accounts, {\n\t\t...options.affinity,\n\t\tpinnedAccount: options.affinity?.pinnedAccount ?? credential?.pinned,\n\t\tnow,\n\t});\n}\n\nfunction blockedAccount(\n\taccount: CursorCliAccountSlot,\n\tclassification: CursorCliErrorClassification,\n\tnow: number,\n): CursorCliAccountSlot {\n\tif (classification.kind === \"auth_error\") {\n\t\tconst { blockedUntil: _blockedUntil, ...withoutExpiry } = account;\n\t\treturn { ...withoutExpiry, blockReason: \"auth_error\" };\n\t}\n\tconst duration = Math.min(MAX_RATE_LIMIT_BLOCK_MS, classification.blockMs ?? DEFAULT_RATE_LIMIT_BLOCK_MS);\n\treturn { ...account, blockedUntil: now + duration, blockReason: \"rate_limit\" };\n}\n\nasync function persistBlock(store: CredentialStore, providerId: string, account: CursorCliAccountSlot): Promise<void> {\n\tawait store.modify(providerId, async (current) => {\n\t\tif (current?.type !== \"oauth\") return current;\n\t\tconst credential = current as CursorCliOauthCredential;\n\t\treturn {\n\t\t\t...credential,\n\t\t\taccounts: (credential.accounts ?? []).map((existing) =>\n\t\t\t\texisting.name === account.name\n\t\t\t\t\t? { ...existing, blockedUntil: account.blockedUntil, blockReason: account.blockReason }\n\t\t\t\t\t: existing,\n\t\t\t),\n\t\t};\n\t});\n}\n\nfunction isFailoverKind(classification: CursorCliErrorClassification): boolean {\n\treturn classification.kind === \"rate_limit\" || classification.kind === \"auth_error\";\n}\n\n/**\n * Runs one Cursor CLI stream at a time and rotates accounts only before any\n * assistant text is visible. Replacement accounts always start a fresh chat;\n * this module never accepts or transfers a chat id or transcript context.\n */\nexport async function* runCursorCliFailover<TEvent>(\n\toptions: CursorCliFailoverOptions<TEvent>,\n): AsyncGenerator<TEvent | CursorCliFailoverNotice> {\n\tconst now = options.now ?? Date.now;\n\tconst classify = options.classify ?? classifyCursorCliError;\n\tconst errorFromEvent = options.errorFromEvent ?? defaultErrorFromEvent;\n\tconst isVisibleAssistantDelta = options.isVisibleAssistantDelta ?? defaultIsVisibleAssistantDelta;\n\tlet account = await selectStoredAccount(options, now());\n\tlet freshChat = false;\n\n\twhile (true) {\n\t\tlet visibleAssistantDeltaEmitted = false;\n\t\ttry {\n\t\t\tconst attemptStream = await options.runAttempt(account, { freshChat });\n\t\t\tfor await (const event of attemptStream) {\n\t\t\t\tconst failure = errorFromEvent(event);\n\t\t\t\tif (failure !== undefined) throw failure;\n\t\t\t\tvisibleAssistantDeltaEmitted ||= isVisibleAssistantDelta(event);\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\tif (!visibleAssistantDeltaEmitted) throw new CursorCliNoAssistantOutputError();\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tconst classification = classify(errorInput(error));\n\t\t\tconst surfaced = new CursorCliFailoverError(classification, error, visibleAssistantDeltaEmitted);\n\t\t\tif (!isFailoverKind(classification)) throw surfaced;\n\n\t\t\tconst blocked = blockedAccount(account, classification, now());\n\t\t\tawait persistBlock(options.store, options.providerId, blocked);\n\t\t\tif (visibleAssistantDeltaEmitted) throw surfaced;\n\n\t\t\tconst nextAccount = await selectStoredAccount(options, now());\n\t\t\tyield notice(account.name, nextAccount.name);\n\t\t\taccount = nextAccount;\n\t\t\tfreshChat = true;\n\t\t}\n\t}\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts

@@ -0,0 +1,89 @@
+import { type CursorCliOauthExecutionMode } from "./settings.ts";
+/**
+ * Guardrails for unattended Cursor CLI execution.
+ *
+ * The Cursor CLI runs its own tools the moment `--force` is on the argv, so
+ * that decision is never implicit: it requires the explicit
+ * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a
+ * disabled force merely warns. Command denylists ride along through the
+ * per-account HOME's `cli-config.json`, strictly in the probe-proven shape
+ * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).
+ */
+/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */
+export declare const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly ["enabled", "disabled"];
+export declare const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION = "The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.";
+export declare const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP = "Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.";
+/** One warning per session when force is disabled in agent mode (contracts block, task 18). */
+export declare const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING = "cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.";
+export type CursorCliGuardrailWarningCode = "force_execution_disabled" | "sandbox_mode_ignored" | "deny_command_rejected";
+export type CursorCliGuardrailWarning = {
+    readonly kind: "warning";
+    readonly code: CursorCliGuardrailWarningCode;
+    readonly message: string;
+};
+export type CursorCliExecutionRefusal = {
+    readonly kind: "refusal";
+    readonly code: "no_approval_acknowledgement_required";
+    readonly message: string;
+    readonly acknowledgementStep: string;
+};
+export type CursorCliGuardrailSession = {
+    /** Every warning emitted so far in this session; one-time gates live here. */
+    readonly warnings: readonly CursorCliGuardrailWarning[];
+    /** Emit a warning once per deduplication key; returns whether it was emitted. */
+    warn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;
+    /** Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. */
+    validateSandboxMode(value: string | undefined): string | undefined;
+};
+export declare function createCursorCliGuardrailSession(): CursorCliGuardrailSession;
+export type CursorCliExecutionPolicyInput = {
+    readonly forceExecution: boolean;
+    readonly noApprovalAcknowledgedAt: string | undefined;
+    readonly executionMode: CursorCliOauthExecutionMode;
+    readonly sandboxMode: string | undefined;
+};
+export type CursorCliExecutionDecision = {
+    readonly status: "refused";
+    readonly refusal: CursorCliExecutionRefusal;
+} | {
+    readonly status: "allowed";
+    readonly force: boolean;
+    readonly executionMode: CursorCliOauthExecutionMode;
+    readonly sandboxMode: string | undefined;
+    readonly denyCommands: readonly string[];
+    /** Warnings accumulated in the session so far (not only this decision). */
+    readonly warnings: readonly CursorCliGuardrailWarning[];
+};
+/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */
+export declare class CursorCliExecutionRefusalError extends Error {
+    readonly code: "no_approval_acknowledgement_required";
+    readonly refusal: CursorCliExecutionRefusal;
+    constructor(refusal: CursorCliExecutionRefusal);
+}
+export declare function sanitizeCursorCliDenyCommands(entries: readonly string[], warn?: (message: string) => void): readonly string[];
+/**
+ * Decide whether a turn may run unattended.
+ *
+ * - `--force` is emitted only in agent mode, only when force is requested, and
+ *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a
+ *   typed refusal naming the acknowledgement step.
+ * - Plan mode never emits `--force` (the CLI only plans), so it needs no
+ *   acknowledgement.
+ * - Force disabled in agent mode is allowed but warns once per session.
+ * - Unproven sandbox modes are ignored with one warning per distinct value.
+ */
+export declare function resolveCursorCliExecutionPolicy(input: CursorCliExecutionPolicyInput, session: CursorCliGuardrailSession, denyCommands?: readonly string[]): CursorCliExecutionDecision;
+/**
+ * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's
+ * `cli-config.json`.
+ *
+ * The CLI rewrites this file during every invocation (task 2 observed its own
+ * keys appearing and `cli-config.json.bad` sidecars for malformed content), so
+ * this must run immediately before each spawn, composing with the home-store
+ * prepare pass that re-writes `auth.json` on the same cadence. Writes only the
+ * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`
+ * entries) and preserves every CLI-owned key already present. Writes nothing
+ * when no deny commands are configured.
+ */
+export declare function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void;
+//# sourceMappingURL=guardrails.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAA4C,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAA2B,CAAC;AAExG,eAAO,MAAM,wCAAwC,gKACyG,CAAC;AAE/J,eAAO,MAAM,qCAAqC,qLAC6H,CAAC;AAEhL,+FAA+F;AAC/F,eAAO,MAAM,uCAAuC,iMACyI,CAAC;AAE9L,MAAM,MAAM,6BAA6B,GACtC,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,sCAAsC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClF,mGAAmG;IACnG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,wBAAgB,+BAA+B,IAAI,yBAAyB,CAoB3E;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACA,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD,CAAC;AAEL,wFAAwF;AACxF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAG,sCAAsC,CAAU;IAChE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEhC,OAAO,EAAE,yBAAyB;CAK9C;AAKD,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,yBAAyB,EAClC,YAAY,GAAE,SAAS,MAAM,EAAO,GAClC,0BAA0B,CA2B5B;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmB5F"}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js

@@ -0,0 +1,147 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createCursorCliOauthSandboxModeValidator } from "./settings.js";
+/**
+ * Guardrails for unattended Cursor CLI execution.
+ *
+ * The Cursor CLI runs its own tools the moment `--force` is on the argv, so
+ * that decision is never implicit: it requires the explicit
+ * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a
+ * disabled force merely warns. Command denylists ride along through the
+ * per-account HOME's `cli-config.json`, strictly in the probe-proven shape
+ * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).
+ */
+/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */
+export const CURSOR_CLI_OAUTH_SANDBOX_MODES = ["enabled", "disabled"];
+export const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION = "The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.";
+export const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP = 'Set "cursorCliOauthProvider.noApprovalAcknowledgedAt" to the current ISO-8601 timestamp (for example "2026-08-17T12:00:00.000Z") in senpi settings to acknowledge this once.';
+/** One warning per session when force is disabled in agent mode (contracts block, task 18). */
+export const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING = 'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to "plan" for planning turns that do not need execution.';
+export function createCursorCliGuardrailSession() {
+    const warnings = [];
+    const emitted = new Set();
+    const warn = (code, message, key = code) => {
+        if (emitted.has(key))
+            return false;
+        emitted.add(key);
+        warnings.push({ kind: "warning", code, message });
+        return true;
+    };
+    const validateSandboxMode = createCursorCliOauthSandboxModeValidator(new Set(CURSOR_CLI_OAUTH_SANDBOX_MODES), (message) => {
+        warn("sandbox_mode_ignored", message, `sandbox_mode_ignored:${message}`);
+    });
+    return {
+        warnings,
+        warn,
+        validateSandboxMode,
+    };
+}
+/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */
+export class CursorCliExecutionRefusalError extends Error {
+    constructor(refusal) {
+        super(refusal.message);
+        this.code = "no_approval_acknowledgement_required";
+        this.name = "CursorCliExecutionRefusalError";
+        this.refusal = refusal;
+    }
+}
+/** Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. */
+const GLOB_METACHARACTERS = /[*?[]/u;
+export function sanitizeCursorCliDenyCommands(entries, warn) {
+    const kept = [];
+    for (const entry of entries) {
+        const command = entry.trim();
+        if (command.length === 0) {
+            warn?.("Ignoring an empty Cursor CLI deny command entry (exact full commands only)");
+            continue;
+        }
+        if (GLOB_METACHARACTERS.test(command)) {
+            warn?.(`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`);
+            continue;
+        }
+        kept.push(command);
+    }
+    return kept;
+}
+/**
+ * Decide whether a turn may run unattended.
+ *
+ * - `--force` is emitted only in agent mode, only when force is requested, and
+ *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a
+ *   typed refusal naming the acknowledgement step.
+ * - Plan mode never emits `--force` (the CLI only plans), so it needs no
+ *   acknowledgement.
+ * - Force disabled in agent mode is allowed but warns once per session.
+ * - Unproven sandbox modes are ignored with one warning per distinct value.
+ */
+export function resolveCursorCliExecutionPolicy(input, session, denyCommands = []) {
+    const planMode = input.executionMode === "plan";
+    const wantsForce = !planMode && input.forceExecution;
+    if (wantsForce && input.noApprovalAcknowledgedAt === undefined) {
+        const refusal = {
+            kind: "refusal",
+            code: "no_approval_acknowledgement_required",
+            message: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,
+            acknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,
+        };
+        return { status: "refused", refusal };
+    }
+    if (!planMode && !input.forceExecution) {
+        session.warn("force_execution_disabled", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);
+    }
+    const sandboxMode = session.validateSandboxMode(input.sandboxMode);
+    const sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {
+        session.warn("deny_command_rejected", message, `deny_command_rejected:${message}`);
+    });
+    return {
+        status: "allowed",
+        force: wantsForce,
+        executionMode: input.executionMode,
+        sandboxMode,
+        denyCommands: sanitizedDenyCommands,
+        warnings: [...session.warnings],
+    };
+}
+const CLI_CONFIG_RELATIVE_PATH = join(".cursor", "cli-config.json");
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function shellDenyEntry(command) {
+    return `Shell(${command})`;
+}
+/**
+ * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's
+ * `cli-config.json`.
+ *
+ * The CLI rewrites this file during every invocation (task 2 observed its own
+ * keys appearing and `cli-config.json.bad` sidecars for malformed content), so
+ * this must run immediately before each spawn, composing with the home-store
+ * prepare pass that re-writes `auth.json` on the same cadence. Writes only the
+ * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`
+ * entries) and preserves every CLI-owned key already present. Writes nothing
+ * when no deny commands are configured.
+ */
+export function applyCursorCliDenyConfig(home, denyCommands) {
+    if (denyCommands.length === 0)
+        return;
+    const configPath = join(home, CLI_CONFIG_RELATIVE_PATH);
+    let existing = {};
+    if (existsSync(configPath)) {
+        try {
+            const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+            if (isRecord(parsed))
+                existing = parsed;
+        }
+        catch {
+            // The CLI quarantines unparseable config as cli-config.json.bad and
+            // proceeds with defaults; start from the proven minimal shape.
+        }
+    }
+    const permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};
+    const config = {
+        ...existing,
+        permissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },
+    };
+    writeFileSync(configPath, `${JSON.stringify(config, null, "\t")}\n`, "utf8");
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoC,wCAAwC,EAAE,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAqC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,wCAAwC,GACpD,6JAA6J,CAAC;AAE/J,MAAM,CAAC,MAAM,qCAAqC,GACjD,8KAA8K,CAAC;AAEhL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uCAAuC,GACnD,4LAA4L,CAAC;AA6B9L,MAAM,UAAU,+BAA+B;IAC9C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,OAAe,EAAE,MAAc,IAAI,EAAW,EAAE;QAClG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,wCAAwC,CACnE,IAAI,GAAG,CAAC,8BAA8B,CAAC,EACvC,CAAC,OAAO,EAAE,EAAE;QACX,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CACD,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,mBAAmB;KACnB,CAAC;AACH,CAAC;AAqBD,wFAAwF;AACxF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAIxD,YAAY,OAAkC;QAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAJf,SAAI,GAAG,sCAA+C,CAAC;QAK/D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAC5C,OAA0B,EAC1B,IAAgC;IAEhC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,4EAA4E,CAAC,CAAC;YACrF,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CACL,uGAAuG,OAAO,EAAE,CAChH,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC9C,KAAoC,EACpC,OAAkC,EAClC,eAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,UAAU,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,OAAO,GAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,GAAG,wCAAwC,IAAI,qCAAqC,EAAE;YAC/F,mBAAmB,EAAE,qCAAqC;SAC1D,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACrF,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,UAAU;QACjB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW;QACX,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,OAAO,SAAS,OAAO,GAAG,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAA+B;IACrF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,+DAA+D;QAChE,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,MAAM,GAA4B;QACvC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;KACvE,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type CursorCliOauthExecutionMode, createCursorCliOauthSandboxModeValidator } from \"./settings.ts\";\n\n/**\n * Guardrails for unattended Cursor CLI execution.\n *\n * The Cursor CLI runs its own tools the moment `--force` is on the argv, so\n * that decision is never implicit: it requires the explicit\n * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a\n * disabled force merely warns. Command denylists ride along through the\n * per-account HOME's `cli-config.json`, strictly in the probe-proven shape\n * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).\n */\n\n/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */\nexport const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly [\"enabled\", \"disabled\"] = [\"enabled\", \"disabled\"];\n\nexport const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION =\n\t\"The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.\";\n\nexport const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP =\n\t'Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.';\n\n/** One warning per session when force is disabled in agent mode (contracts block, task 18). */\nexport const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING =\n\t'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.';\n\nexport type CursorCliGuardrailWarningCode =\n\t| \"force_execution_disabled\"\n\t| \"sandbox_mode_ignored\"\n\t| \"deny_command_rejected\";\n\nexport type CursorCliGuardrailWarning = {\n\treadonly kind: \"warning\";\n\treadonly code: CursorCliGuardrailWarningCode;\n\treadonly message: string;\n};\n\nexport type CursorCliExecutionRefusal = {\n\treadonly kind: \"refusal\";\n\treadonly code: \"no_approval_acknowledgement_required\";\n\treadonly message: string;\n\treadonly acknowledgementStep: string;\n};\n\nexport type CursorCliGuardrailSession = {\n\t/** Every warning emitted so far in this session; one-time gates live here. */\n\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t/** Emit a warning once per deduplication key; returns whether it was emitted. */\n\twarn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;\n\t/** Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. */\n\tvalidateSandboxMode(value: string | undefined): string | undefined;\n};\n\nexport function createCursorCliGuardrailSession(): CursorCliGuardrailSession {\n\tconst warnings: CursorCliGuardrailWarning[] = [];\n\tconst emitted = new Set<string>();\n\tconst warn = (code: CursorCliGuardrailWarningCode, message: string, key: string = code): boolean => {\n\t\tif (emitted.has(key)) return false;\n\t\temitted.add(key);\n\t\twarnings.push({ kind: \"warning\", code, message });\n\t\treturn true;\n\t};\n\tconst validateSandboxMode = createCursorCliOauthSandboxModeValidator(\n\t\tnew Set(CURSOR_CLI_OAUTH_SANDBOX_MODES),\n\t\t(message) => {\n\t\t\twarn(\"sandbox_mode_ignored\", message, `sandbox_mode_ignored:${message}`);\n\t\t},\n\t);\n\treturn {\n\t\twarnings,\n\t\twarn,\n\t\tvalidateSandboxMode,\n\t};\n}\n\nexport type CursorCliExecutionPolicyInput = {\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string | undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly sandboxMode: string | undefined;\n};\n\nexport type CursorCliExecutionDecision =\n\t| { readonly status: \"refused\"; readonly refusal: CursorCliExecutionRefusal }\n\t| {\n\t\t\treadonly status: \"allowed\";\n\t\t\treadonly force: boolean;\n\t\t\treadonly executionMode: CursorCliOauthExecutionMode;\n\t\t\treadonly sandboxMode: string | undefined;\n\t\t\treadonly denyCommands: readonly string[];\n\t\t\t/** Warnings accumulated in the session so far (not only this decision). */\n\t\t\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t  };\n\n/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */\nexport class CursorCliExecutionRefusalError extends Error {\n\treadonly code = \"no_approval_acknowledgement_required\" as const;\n\treadonly refusal: CursorCliExecutionRefusal;\n\n\tconstructor(refusal: CursorCliExecutionRefusal) {\n\t\tsuper(refusal.message);\n\t\tthis.name = \"CursorCliExecutionRefusalError\";\n\t\tthis.refusal = refusal;\n\t}\n}\n\n/** Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. */\nconst GLOB_METACHARACTERS = /[*?[]/u;\n\nexport function sanitizeCursorCliDenyCommands(\n\tentries: readonly string[],\n\twarn?: (message: string) => void,\n): readonly string[] {\n\tconst kept: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst command = entry.trim();\n\t\tif (command.length === 0) {\n\t\t\twarn?.(\"Ignoring an empty Cursor CLI deny command entry (exact full commands only)\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (GLOB_METACHARACTERS.test(command)) {\n\t\t\twarn?.(\n\t\t\t\t`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tkept.push(command);\n\t}\n\treturn kept;\n}\n\n/**\n * Decide whether a turn may run unattended.\n *\n * - `--force` is emitted only in agent mode, only when force is requested, and\n *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a\n *   typed refusal naming the acknowledgement step.\n * - Plan mode never emits `--force` (the CLI only plans), so it needs no\n *   acknowledgement.\n * - Force disabled in agent mode is allowed but warns once per session.\n * - Unproven sandbox modes are ignored with one warning per distinct value.\n */\nexport function resolveCursorCliExecutionPolicy(\n\tinput: CursorCliExecutionPolicyInput,\n\tsession: CursorCliGuardrailSession,\n\tdenyCommands: readonly string[] = [],\n): CursorCliExecutionDecision {\n\tconst planMode = input.executionMode === \"plan\";\n\tconst wantsForce = !planMode && input.forceExecution;\n\tif (wantsForce && input.noApprovalAcknowledgedAt === undefined) {\n\t\tconst refusal: CursorCliExecutionRefusal = {\n\t\t\tkind: \"refusal\",\n\t\t\tcode: \"no_approval_acknowledgement_required\",\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,\n\t\t\tacknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,\n\t\t};\n\t\treturn { status: \"refused\", refusal };\n\t}\n\tif (!planMode && !input.forceExecution) {\n\t\tsession.warn(\"force_execution_disabled\", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);\n\t}\n\tconst sandboxMode = session.validateSandboxMode(input.sandboxMode);\n\tconst sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {\n\t\tsession.warn(\"deny_command_rejected\", message, `deny_command_rejected:${message}`);\n\t});\n\treturn {\n\t\tstatus: \"allowed\",\n\t\tforce: wantsForce,\n\t\texecutionMode: input.executionMode,\n\t\tsandboxMode,\n\t\tdenyCommands: sanitizedDenyCommands,\n\t\twarnings: [...session.warnings],\n\t};\n}\n\nconst CLI_CONFIG_RELATIVE_PATH = join(\".cursor\", \"cli-config.json\");\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction shellDenyEntry(command: string): string {\n\treturn `Shell(${command})`;\n}\n\n/**\n * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's\n * `cli-config.json`.\n *\n * The CLI rewrites this file during every invocation (task 2 observed its own\n * keys appearing and `cli-config.json.bad` sidecars for malformed content), so\n * this must run immediately before each spawn, composing with the home-store\n * prepare pass that re-writes `auth.json` on the same cadence. Writes only the\n * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`\n * entries) and preserves every CLI-owned key already present. Writes nothing\n * when no deny commands are configured.\n */\nexport function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void {\n\tif (denyCommands.length === 0) return;\n\tconst configPath = join(home, CLI_CONFIG_RELATIVE_PATH);\n\tlet existing: Record<string, unknown> = {};\n\tif (existsSync(configPath)) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(readFileSync(configPath, \"utf8\"));\n\t\t\tif (isRecord(parsed)) existing = parsed;\n\t\t} catch {\n\t\t\t// The CLI quarantines unparseable config as cli-config.json.bad and\n\t\t\t// proceeds with defaults; start from the proven minimal shape.\n\t\t}\n\t}\n\tconst permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};\n\tconst config: Record<string, unknown> = {\n\t\t...existing,\n\t\tpermissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },\n\t};\n\twriteFileSync(configPath, `${JSON.stringify(config, null, \"\\t\")}\\n`, \"utf8\");\n}\n"]}