@code-yeongyu/senpi 2026.8.16 → 2026.8.18

package/dist/core/extensions/builtin/cursor-cli-oauth/account-command.js

@@ -0,0 +1,298 @@
+import { emitProviderAccountsChanged } from "../claude-sdk-oauth/account-events.js";
+import { emptyCredential, listAccounts, pinAccount, removeAccount, } from "./accounts.js";
+import { selectAccount } from "./affinity.js";
+import { collectCursorCliStatus, NATIVE_CURSOR_PROVIDER_ID, registerCursorCliShutdownSafety, renderCursorCliStatus, } from "./diagnostics.js";
+import { CURSOR_CLI_OAUTH_PROVIDER_ID, confirmCursorCliNoApprovalAcknowledgement, importLocalCursorCredential, importNativeCursorCredential, } from "./oauth-login.js";
+import { cursorCliSessionRouter } from "./session-router.js";
+import { loadCursorCliOauthProviderSettingsFromDisk, persistCursorCliNoApprovalAcknowledgement, persistCursorCliOauthEnabled, } from "./settings.js";
+const USAGE = "Usage: /cursor-account [list | add | remove <name> | pin <name> | unpin | import [local | native] | acknowledge | status]";
+function asCursorCredential(value) {
+    return value !== undefined && value.type === "oauth" ? value : emptyCredential();
+}
+function parseArgs(rawArgs) {
+    return rawArgs.trim().split(/\s+/).filter(Boolean);
+}
+function slotStatus(slot, now) {
+    if (slot.blockReason === "auth_error")
+        return "blocked until re-login";
+    if (slot.blockedUntil !== undefined && slot.blockedUntil > now) {
+        return `blocked until ${new Date(slot.blockedUntil).toISOString()} (${slot.blockReason ?? "rate_limit"})`;
+    }
+    return "available";
+}
+function authEventMessage(event) {
+    if (event === null || typeof event !== "object")
+        return "Cursor CLI (OAuth) authentication update.";
+    const value = event;
+    if (value.type === "auth_url" && typeof value.url === "string") {
+        return `Open this URL to authorize Cursor CLI (OAuth):\n${value.url}`;
+    }
+    if (value.type === "device_code" && typeof value.verificationUri === "string") {
+        return `Open this URL to authorize Cursor CLI (OAuth):\n${value.verificationUri}`;
+    }
+    return typeof value.message === "string" ? value.message : "Cursor CLI (OAuth) authentication update.";
+}
+/**
+ * Registers `/cursor-account` plus the reload/shutdown teardown for this
+ * extension generation: the command reads account state fresh from the
+ * credential store on every invocation, and every deferred continuation is
+ * fenced so a retired generation is never touched after a reload.
+ */
+export function registerCursorCliAccountCommand(pi, deps = {}) {
+    const loadSettings = deps.loadSettings ?? ((cwd) => loadCursorCliOauthProviderSettingsFromDisk(cwd));
+    const now = deps.now ?? Date.now;
+    // One guard per registration: a reload rebuilds the extension and gets a
+    // fresh fence, while the child registry stays process-wide.
+    const generation = registerCursorCliShutdownSafety(pi, { generation: deps.generation });
+    pi.registerCommand("cursor-account", {
+        description: "List and manage Cursor CLI (OAuth) accounts.",
+        argumentHint: "[list | add | remove <name> | pin <name> | unpin | import | acknowledge | status]",
+        handler: async (rawArgs, ctx) => {
+            try {
+                const args = parseArgs(rawArgs);
+                const action = args[0] ?? "list";
+                if (action === "list") {
+                    showAccounts(ctx, loadSettings(ctx.cwd), generation, now);
+                    return;
+                }
+                if (action === "add") {
+                    await addAccount(ctx);
+                    return;
+                }
+                if (action === "remove") {
+                    await removeNamedAccount(ctx, args[1]);
+                    return;
+                }
+                if (action === "pin" && args[1] !== undefined) {
+                    await pinNamedAccount(ctx, args[1]);
+                    return;
+                }
+                if (action === "unpin") {
+                    await unpinAccount(ctx);
+                    return;
+                }
+                if (action === "import") {
+                    const source = args[1] ?? "local";
+                    if (source !== "local" && source !== "native") {
+                        ctx.ui.notify(USAGE, "error");
+                        return;
+                    }
+                    await importAccount(ctx, deps, source);
+                    return;
+                }
+                if (action === "acknowledge") {
+                    await acknowledgeNoApproval(ctx, deps, generation);
+                    return;
+                }
+                if (action === "status") {
+                    await showStatus(ctx, deps, { loadSettings, generation, now });
+                    return;
+                }
+                ctx.ui.notify(USAGE, "error");
+            }
+            catch (error) {
+                ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+            }
+        },
+    });
+}
+function showAccounts(ctx, settings, generation, now) {
+    const credential = asCursorCredential(ctx.modelRegistry.authStorage.get(CURSOR_CLI_OAUTH_PROVIDER_ID));
+    const accounts = listAccounts(credential);
+    const pinned = settings.pinnedAccount ?? credential.pinned;
+    const pinSource = settings.pinnedAccount !== undefined ? "settings" : "stored";
+    let affinityPick;
+    let affinityError;
+    if (accounts.length > 0) {
+        try {
+            affinityPick = selectAccount(accounts, {
+                sessionId: ctx.sessionManager.getSessionId(),
+                pinnedAccount: pinned,
+                now: now(),
+            }).name;
+        }
+        catch (error) {
+            affinityError = error instanceof Error ? error.message : String(error);
+        }
+    }
+    const lines = ["Cursor CLI (OAuth) accounts:"];
+    if (accounts.length === 0)
+        lines.push("  (none)");
+    for (const account of accounts) {
+        const states = [account.name, account.source, slotStatus(account, now())];
+        if (account.name === pinned)
+            states.push("pinned");
+        if (account.name === affinityPick)
+            states.push("affinity pick");
+        lines.push(`  ${states.join(" | ")}`);
+    }
+    lines.push(`Pinned account: ${pinned === undefined ? "none" : `${pinned} (${pinSource})`}`);
+    lines.push(`Affinity pick: ${affinityPick ?? (affinityError ? `unavailable - ${affinityError}` : "none")}`);
+    generation.runFencedSync(ctx, () => ctx.ui.notify(lines.join("\n"), "info"));
+}
+async function addAccount(ctx) {
+    if (!ctx.hasUI) {
+        ctx.ui.notify("/cursor-account add requires an interactive UI.", "error");
+        return;
+    }
+    try {
+        await ctx.modelRegistry.modelRuntime.login(CURSOR_CLI_OAUTH_PROVIDER_ID, "oauth", {
+            signal: ctx.signal,
+            prompt: async (prompt) => {
+                const answer = await ctx.ui.input(prompt.message);
+                if (answer === undefined)
+                    throw new Error("Login cancelled");
+                return answer;
+            },
+            notify: (event) => ctx.ui.notify(authEventMessage(event), "info"),
+        });
+        emitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);
+        ctx.ui.notify("Cursor CLI (OAuth) account added.", "info");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message !== "Login cancelled") {
+            ctx.ui.notify(`Failed to add Cursor CLI (OAuth) account: ${message}`, "error");
+        }
+    }
+}
+async function removeNamedAccount(ctx, name) {
+    if (!name) {
+        ctx.ui.notify("Usage: /cursor-account remove <name>", "error");
+        return;
+    }
+    let removed = false;
+    try {
+        await ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {
+            const credential = asCursorCredential(current);
+            if (!listAccounts(credential).some((account) => account.name === name))
+                return current;
+            removed = true;
+            return removeAccount(credential, name);
+        });
+    }
+    catch (error) {
+        ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+        return;
+    }
+    if (!removed) {
+        ctx.ui.notify(`Cursor CLI (OAuth) account '${name}' does not exist.`, "error");
+        return;
+    }
+    emitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);
+    ctx.ui.notify(`Removed Cursor CLI (OAuth) account: ${name}.`, "info");
+}
+async function pinNamedAccount(ctx, name) {
+    try {
+        await ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {
+            const credential = asCursorCredential(current);
+            if (!listAccounts(credential).some((account) => account.name === name)) {
+                throw new Error(`Cursor CLI (OAuth) account '${name}' does not exist.`);
+            }
+            return pinAccount(credential, name);
+        });
+    }
+    catch (error) {
+        ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+        return;
+    }
+    emitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);
+    ctx.ui.notify(`Pinned Cursor CLI (OAuth) account: ${name}.`, "info");
+}
+async function unpinAccount(ctx) {
+    let hadPin = false;
+    try {
+        await ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {
+            const credential = asCursorCredential(current);
+            if (credential.pinned === undefined)
+                return current;
+            hadPin = true;
+            const { pinned: _pinned, ...unpinned } = credential;
+            return unpinned;
+        });
+    }
+    catch (error) {
+        ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+        return;
+    }
+    if (!hadPin) {
+        ctx.ui.notify("No stored Cursor CLI (OAuth) account pin is set.", "info");
+        return;
+    }
+    emitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);
+    ctx.ui.notify("Unpinned Cursor CLI (OAuth) account.", "info");
+}
+async function importAccount(ctx, deps, source) {
+    const importCredential = deps.importCredential ?? importLocalCursorCredential;
+    const importNativeCredential = deps.importNativeCredential ?? importNativeCursorCredential;
+    const importDeps = { ...deps.importDeps };
+    if (importDeps.onPrompt === undefined && ctx.hasUI) {
+        importDeps.onPrompt = async (prompt) => {
+            const answer = await ctx.ui.input(prompt.message);
+            if (answer === undefined)
+                throw new Error("Import cancelled");
+            return answer;
+        };
+    }
+    let importedName;
+    try {
+        await ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {
+            const before = asCursorCredential(current);
+            const updated = source === "native"
+                ? await importNativeCredential(before, deps.readNativeCredential ?? (() => ctx.modelRegistry.authStorage.get(NATIVE_CURSOR_PROVIDER_ID)))
+                : await importCredential(before, importDeps);
+            const existing = new Set(listAccounts(before).map((account) => account.name));
+            importedName = listAccounts(updated).find((account) => !existing.has(account.name))?.name;
+            return updated;
+        });
+    }
+    catch (error) {
+        ctx.ui.notify(`Failed to import local Cursor credential: ${error instanceof Error ? error.message : String(error)}`, "error");
+        return;
+    }
+    const persistEnabled = deps.persistEnabled ?? persistCursorCliOauthEnabled;
+    try {
+        persistEnabled(ctx.cwd, true);
+        await ctx.modelRegistry.modelRuntime.refresh({
+            allowNetwork: false,
+            providers: [CURSOR_CLI_OAUTH_PROVIDER_ID],
+        });
+    }
+    catch (error) {
+        ctx.ui.notify(`Imported ${source === "native" ? "native " : ""}Cursor credential, but provider activation failed: ${error instanceof Error ? error.message : String(error)}`, "warning");
+        return;
+    }
+    emitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);
+    ctx.ui.notify(`Imported ${source === "native" ? "native " : "local "}Cursor credential as '${importedName ?? "a new account"}' (copied into this provider's store).`, "info");
+}
+async function acknowledgeNoApproval(ctx, deps, generation) {
+    if (!ctx.hasUI) {
+        ctx.ui.notify("/cursor-account acknowledge requires an interactive UI.", "error");
+        return;
+    }
+    const persist = deps.persistAcknowledgement ?? persistCursorCliNoApprovalAcknowledgement;
+    const acknowledgedAt = await confirmCursorCliNoApprovalAcknowledgement(async (ask) => (await ctx.ui.input(ask.message)) ?? "", () => new Date((deps.now ?? Date.now)()));
+    if (acknowledgedAt === undefined) {
+        generation.runFencedSync(ctx, () => ctx.ui.notify("No acknowledgement written: unattended Cursor CLI execution stays off until you acknowledge.", "info"));
+        return;
+    }
+    persist(ctx.cwd, acknowledgedAt);
+    generation.runFencedSync(ctx, () => ctx.ui.notify(`Acknowledged unattended Cursor CLI tool execution at ${acknowledgedAt}.`, "info"));
+}
+async function showStatus(ctx, deps, bound) {
+    // Context reads happen before any await; the render continuation is fenced
+    // so a reload during the version probe can never touch a retired context.
+    const sessionId = ctx.sessionManager.getSessionId();
+    const report = await collectCursorCliStatus({
+        sessionId,
+        settings: bound.loadSettings(ctx.cwd),
+        readCredential: () => ctx.modelRegistry.authStorage.get(CURSOR_CLI_OAUTH_PROVIDER_ID),
+        readNativeCredential: deps.readNativeCredential ?? (() => ctx.modelRegistry.authStorage.get(NATIVE_CURSOR_PROVIDER_ID)),
+        router: deps.router ?? cursorCliSessionRouter,
+        resolveExecutable: deps.resolveExecutable,
+        probeVersion: deps.probeVersion,
+        now: bound.now,
+    });
+    bound.generation.runFencedSync(ctx, () => ctx.ui.notify(renderCursorCliStatus(report), "info"));
+}
+//# sourceMappingURL=account-command.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/account-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-command.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/account-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAGN,eAAe,EACf,YAAY,EACZ,UAAU,EACV,aAAa,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAEN,sBAAsB,EACtB,yBAAyB,EACzB,+BAA+B,EAC/B,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,4BAA4B,EAC5B,yCAAyC,EACzC,2BAA2B,EAC3B,4BAA4B,GAE5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAA+B,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AAoBvB,MAAM,KAAK,GACV,2HAA2H,CAAC;AAE7H,SAAS,kBAAkB,CAAC,KAA6B;IACxD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAE,KAAkC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B,EAAE,GAAW;IAC1D,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;QAAE,OAAO,wBAAwB,CAAC;IACvE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;QAChE,OAAO,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,IAAI,YAAY,GAAG,CAAC;IAC3G,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,2CAA2C,CAAC;IACpG,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,mDAAmD,KAAK,CAAC,GAAG,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,mDAAmD,KAAK,CAAC,eAAe,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2CAA2C,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAgB,EAAE,OAAoC,EAAE;IACvG,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,0CAA0C,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,UAAU,GAAG,+BAA+B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAExF,EAAE,CAAC,eAAe,CAAC,gBAAgB,EAAE;QACpC,WAAW,EAAE,8CAA8C;QAC3D,YAAY,EAAE,mFAAmF;QACjG,OAAO,EAAE,KAAK,EAAE,OAAe,EAAE,GAA4B,EAAiB,EAAE;YAC/E,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;gBACjC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACvB,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;oBAC1D,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACtB,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;oBACtB,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzB,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC/C,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACxB,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;oBACxB,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;oBAClC,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;wBAC/C,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;wBAC9B,OAAO;oBACR,CAAC;oBACD,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBACvC,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;oBAC9B,MAAM,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;oBACnD,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzB,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC/D,OAAO;gBACR,CAAC;gBACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YAChF,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACpB,GAA4B,EAC5B,QAAwC,EACxC,UAAoC,EACpC,GAAiB;IAEjB,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,IAAI,UAAU,CAAC,MAAM,CAAC;IAC3D,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/E,IAAI,YAAgC,CAAC;IACrC,IAAI,aAAiC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACJ,YAAY,GAAG,aAAa,CAAC,QAAQ,EAAE;gBACtC,SAAS,EAAE,GAAG,CAAC,cAAc,CAAC,YAAY,EAAE;gBAC5C,aAAa,EAAE,MAAM;gBACrB,GAAG,EAAE,GAAG,EAAE;aACV,CAAC,CAAC,IAAI,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAa,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,SAAS,GAAG,EAAE,CAAC,CAAC;IAC5F,KAAK,CAAC,IAAI,CAAC,kBAAkB,YAAY,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5G,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAA4B;IACrD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iDAAiD,EAAE,OAAO,CAAC,CAAC;QAC1E,OAAO;IACR,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,4BAA4B,EAAE,OAAO,EAAE;YACjF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,KAAK,EAAE,MAA2B,EAAE,EAAE;gBAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC;YACf,CAAC;YACD,MAAM,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;SAC1E,CAAC,CAAC;QACH,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;QAC1D,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,6CAA6C,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAChF,CAAC;IACF,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAA4B,EAAE,IAAwB;IACvF,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO;IACR,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC;YACvF,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO;IACR,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,+BAA+B,IAAI,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO;IACR,CAAC;IACD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uCAAuC,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAA4B,EAAE,IAAY;IACxE,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,mBAAmB,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO;IACR,CAAC;IACD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sCAAsC,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAA4B;IACvD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACpD,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC;YACpD,OAAO,QAAQ,CAAC;QACjB,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO;IACR,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO;IACR,CAAC;IACD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,GAA4B,EAC5B,IAAiC,EACjC,MAA0B;IAE1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;IAC9E,MAAM,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,IAAI,4BAA4B,CAAC;IAC3F,MAAM,UAAU,GAA0B,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACpD,UAAU,CAAC,QAAQ,GAAG,KAAK,EAAE,MAA2B,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC9D,OAAO,MAAM,CAAC;QACf,CAAC,CAAC;IACH,CAAC;IACD,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC;QACJ,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1F,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,OAAO,GACZ,MAAM,KAAK,QAAQ;gBAClB,CAAC,CAAC,MAAM,sBAAsB,CAC5B,MAAM,EACN,IAAI,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CACjG;gBACF,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;YAC1F,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CACZ,6CAA6C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACrG,OAAO,CACP,CAAC;QACF,OAAO;IACR,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,4BAA4B,CAAC;IAC3E,IAAI,CAAC;QACJ,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC;YAC5C,YAAY,EAAE,KAAK;YACnB,SAAS,EAAE,CAAC,4BAA4B,CAAC;SACzC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CACZ,YAAY,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,sDAAsD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9J,SAAS,CACT,CAAC;QACF,OAAO;IACR,CAAC;IACD,2BAA2B,CAAC,4BAA4B,CAAC,CAAC;IAC1D,GAAG,CAAC,EAAE,CAAC,MAAM,CACZ,YAAY,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,yBAAyB,YAAY,IAAI,eAAe,wCAAwC,EACtJ,MAAM,CACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CACnC,GAA4B,EAC5B,IAAiC,EACjC,UAAoC;IAEpC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,yDAAyD,EAAE,OAAO,CAAC,CAAC;QAClF,OAAO;IACR,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,IAAI,yCAAyC,CAAC;IACzF,MAAM,cAAc,GAAG,MAAM,yCAAyC,CACrE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EACtD,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CACxC,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,CAClC,GAAG,CAAC,EAAE,CAAC,MAAM,CACZ,8FAA8F,EAC9F,MAAM,CACN,CACD,CAAC;QACF,OAAO;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,CAClC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,wDAAwD,cAAc,GAAG,EAAE,MAAM,CAAC,CAChG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,GAA4B,EAC5B,IAAiC,EACjC,KAIC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;QAC3C,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QACrC,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACrF,oBAAoB,EACnB,IAAI,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAClG,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;KACd,CAAC,CAAC;IACH,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,CAAC","sourcesContent":["import type { Credential } from \"@earendil-works/pi-ai\";\nimport type { ExtensionAPI, ExtensionCommandContext } from \"../../types.ts\";\nimport { emitProviderAccountsChanged } from \"../claude-sdk-oauth/account-events.ts\";\nimport {\n\ttype CursorCliAccountSlot,\n\ttype CursorCliOauthCredential,\n\temptyCredential,\n\tlistAccounts,\n\tpinAccount,\n\tremoveAccount,\n} from \"./accounts.ts\";\nimport { selectAccount } from \"./affinity.ts\";\nimport {\n\ttype CursorCliGenerationGuard,\n\tcollectCursorCliStatus,\n\tNATIVE_CURSOR_PROVIDER_ID,\n\tregisterCursorCliShutdownSafety,\n\trenderCursorCliStatus,\n} from \"./diagnostics.ts\";\nimport {\n\tCURSOR_CLI_OAUTH_PROVIDER_ID,\n\tconfirmCursorCliNoApprovalAcknowledgement,\n\timportLocalCursorCredential,\n\timportNativeCursorCredential,\n\ttype LocalCursorImportDeps,\n} from \"./oauth-login.ts\";\nimport { type CursorCliSessionRouter, cursorCliSessionRouter } from \"./session-router.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\n\n/** Injectable seams; every default resolves real on-disk state at invocation time. */\nexport type CursorCliAccountCommandDeps = {\n\treadonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;\n\treadonly router?: CursorCliSessionRouter;\n\treadonly resolveExecutable?: (settings: CursorCliOauthProviderSettings) => string;\n\treadonly probeVersion?: (executable: string) => Promise<string>;\n\treadonly readNativeCredential?: () => Credential | undefined | Promise<Credential | undefined>;\n\treadonly importCredential?: typeof importLocalCursorCredential;\n\treadonly importNativeCredential?: typeof importNativeCursorCredential;\n\treadonly importDeps?: LocalCursorImportDeps;\n\t/** Acknowledgement persistence seam; the default read-modify-writes the global settings file. */\n\treadonly persistAcknowledgement?: (cwd: string, acknowledgedAt: string) => void;\n\t/** Enablement persistence seam; explicit login/import actions activate the fallback lane. */\n\treadonly persistEnabled?: (cwd: string, enabled: boolean) => void;\n\treadonly now?: () => number;\n\treadonly generation?: CursorCliGenerationGuard;\n};\n\nconst USAGE =\n\t\"Usage: /cursor-account [list | add | remove <name> | pin <name> | unpin | import [local | native] | acknowledge | status]\";\n\nfunction asCursorCredential(value: Credential | undefined): CursorCliOauthCredential {\n\treturn value !== undefined && value.type === \"oauth\" ? (value as CursorCliOauthCredential) : emptyCredential();\n}\n\nfunction parseArgs(rawArgs: string): string[] {\n\treturn rawArgs.trim().split(/\\s+/).filter(Boolean);\n}\n\nfunction slotStatus(slot: CursorCliAccountSlot, now: number): string {\n\tif (slot.blockReason === \"auth_error\") return \"blocked until re-login\";\n\tif (slot.blockedUntil !== undefined && slot.blockedUntil > now) {\n\t\treturn `blocked until ${new Date(slot.blockedUntil).toISOString()} (${slot.blockReason ?? \"rate_limit\"})`;\n\t}\n\treturn \"available\";\n}\n\nfunction authEventMessage(event: unknown): string {\n\tif (event === null || typeof event !== \"object\") return \"Cursor CLI (OAuth) authentication update.\";\n\tconst value = event as Record<string, unknown>;\n\tif (value.type === \"auth_url\" && typeof value.url === \"string\") {\n\t\treturn `Open this URL to authorize Cursor CLI (OAuth):\\n${value.url}`;\n\t}\n\tif (value.type === \"device_code\" && typeof value.verificationUri === \"string\") {\n\t\treturn `Open this URL to authorize Cursor CLI (OAuth):\\n${value.verificationUri}`;\n\t}\n\treturn typeof value.message === \"string\" ? value.message : \"Cursor CLI (OAuth) authentication update.\";\n}\n\n/**\n * Registers `/cursor-account` plus the reload/shutdown teardown for this\n * extension generation: the command reads account state fresh from the\n * credential store on every invocation, and every deferred continuation is\n * fenced so a retired generation is never touched after a reload.\n */\nexport function registerCursorCliAccountCommand(pi: ExtensionAPI, deps: CursorCliAccountCommandDeps = {}): void {\n\tconst loadSettings = deps.loadSettings ?? ((cwd: string) => loadCursorCliOauthProviderSettingsFromDisk(cwd));\n\tconst now = deps.now ?? Date.now;\n\t// One guard per registration: a reload rebuilds the extension and gets a\n\t// fresh fence, while the child registry stays process-wide.\n\tconst generation = registerCursorCliShutdownSafety(pi, { generation: deps.generation });\n\n\tpi.registerCommand(\"cursor-account\", {\n\t\tdescription: \"List and manage Cursor CLI (OAuth) accounts.\",\n\t\targumentHint: \"[list | add | remove <name> | pin <name> | unpin | import | acknowledge | status]\",\n\t\thandler: async (rawArgs: string, ctx: ExtensionCommandContext): Promise<void> => {\n\t\t\ttry {\n\t\t\t\tconst args = parseArgs(rawArgs);\n\t\t\t\tconst action = args[0] ?? \"list\";\n\t\t\t\tif (action === \"list\") {\n\t\t\t\t\tshowAccounts(ctx, loadSettings(ctx.cwd), generation, now);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"add\") {\n\t\t\t\t\tawait addAccount(ctx);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"remove\") {\n\t\t\t\t\tawait removeNamedAccount(ctx, args[1]);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"pin\" && args[1] !== undefined) {\n\t\t\t\t\tawait pinNamedAccount(ctx, args[1]);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"unpin\") {\n\t\t\t\t\tawait unpinAccount(ctx);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"import\") {\n\t\t\t\t\tconst source = args[1] ?? \"local\";\n\t\t\t\t\tif (source !== \"local\" && source !== \"native\") {\n\t\t\t\t\t\tctx.ui.notify(USAGE, \"error\");\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\tawait importAccount(ctx, deps, source);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"acknowledge\") {\n\t\t\t\t\tawait acknowledgeNoApproval(ctx, deps, generation);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (action === \"status\") {\n\t\t\t\t\tawait showStatus(ctx, deps, { loadSettings, generation, now });\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tctx.ui.notify(USAGE, \"error\");\n\t\t\t} catch (error) {\n\t\t\t\tctx.ui.notify(error instanceof Error ? error.message : String(error), \"error\");\n\t\t\t}\n\t\t},\n\t});\n}\n\nfunction showAccounts(\n\tctx: ExtensionCommandContext,\n\tsettings: CursorCliOauthProviderSettings,\n\tgeneration: CursorCliGenerationGuard,\n\tnow: () => number,\n): void {\n\tconst credential = asCursorCredential(ctx.modelRegistry.authStorage.get(CURSOR_CLI_OAUTH_PROVIDER_ID));\n\tconst accounts = listAccounts(credential);\n\tconst pinned = settings.pinnedAccount ?? credential.pinned;\n\tconst pinSource = settings.pinnedAccount !== undefined ? \"settings\" : \"stored\";\n\tlet affinityPick: string | undefined;\n\tlet affinityError: string | undefined;\n\tif (accounts.length > 0) {\n\t\ttry {\n\t\t\taffinityPick = selectAccount(accounts, {\n\t\t\t\tsessionId: ctx.sessionManager.getSessionId(),\n\t\t\t\tpinnedAccount: pinned,\n\t\t\t\tnow: now(),\n\t\t\t}).name;\n\t\t} catch (error) {\n\t\t\taffinityError = error instanceof Error ? error.message : String(error);\n\t\t}\n\t}\n\tconst lines = [\"Cursor CLI (OAuth) accounts:\"];\n\tif (accounts.length === 0) lines.push(\"  (none)\");\n\tfor (const account of accounts) {\n\t\tconst states = [account.name, account.source, slotStatus(account, now())];\n\t\tif (account.name === pinned) states.push(\"pinned\");\n\t\tif (account.name === affinityPick) states.push(\"affinity pick\");\n\t\tlines.push(`  ${states.join(\" | \")}`);\n\t}\n\tlines.push(`Pinned account: ${pinned === undefined ? \"none\" : `${pinned} (${pinSource})`}`);\n\tlines.push(`Affinity pick: ${affinityPick ?? (affinityError ? `unavailable - ${affinityError}` : \"none\")}`);\n\tgeneration.runFencedSync(ctx, () => ctx.ui.notify(lines.join(\"\\n\"), \"info\"));\n}\n\nasync function addAccount(ctx: ExtensionCommandContext): Promise<void> {\n\tif (!ctx.hasUI) {\n\t\tctx.ui.notify(\"/cursor-account add requires an interactive UI.\", \"error\");\n\t\treturn;\n\t}\n\ttry {\n\t\tawait ctx.modelRegistry.modelRuntime.login(CURSOR_CLI_OAUTH_PROVIDER_ID, \"oauth\", {\n\t\t\tsignal: ctx.signal,\n\t\t\tprompt: async (prompt: { message: string }) => {\n\t\t\t\tconst answer = await ctx.ui.input(prompt.message);\n\t\t\t\tif (answer === undefined) throw new Error(\"Login cancelled\");\n\t\t\t\treturn answer;\n\t\t\t},\n\t\t\tnotify: (event: unknown) => ctx.ui.notify(authEventMessage(event), \"info\"),\n\t\t});\n\t\temitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);\n\t\tctx.ui.notify(\"Cursor CLI (OAuth) account added.\", \"info\");\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tif (message !== \"Login cancelled\") {\n\t\t\tctx.ui.notify(`Failed to add Cursor CLI (OAuth) account: ${message}`, \"error\");\n\t\t}\n\t}\n}\n\nasync function removeNamedAccount(ctx: ExtensionCommandContext, name: string | undefined): Promise<void> {\n\tif (!name) {\n\t\tctx.ui.notify(\"Usage: /cursor-account remove <name>\", \"error\");\n\t\treturn;\n\t}\n\tlet removed = false;\n\ttry {\n\t\tawait ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {\n\t\t\tconst credential = asCursorCredential(current);\n\t\t\tif (!listAccounts(credential).some((account) => account.name === name)) return current;\n\t\t\tremoved = true;\n\t\t\treturn removeAccount(credential, name);\n\t\t});\n\t} catch (error) {\n\t\tctx.ui.notify(error instanceof Error ? error.message : String(error), \"error\");\n\t\treturn;\n\t}\n\tif (!removed) {\n\t\tctx.ui.notify(`Cursor CLI (OAuth) account '${name}' does not exist.`, \"error\");\n\t\treturn;\n\t}\n\temitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);\n\tctx.ui.notify(`Removed Cursor CLI (OAuth) account: ${name}.`, \"info\");\n}\n\nasync function pinNamedAccount(ctx: ExtensionCommandContext, name: string): Promise<void> {\n\ttry {\n\t\tawait ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {\n\t\t\tconst credential = asCursorCredential(current);\n\t\t\tif (!listAccounts(credential).some((account) => account.name === name)) {\n\t\t\t\tthrow new Error(`Cursor CLI (OAuth) account '${name}' does not exist.`);\n\t\t\t}\n\t\t\treturn pinAccount(credential, name);\n\t\t});\n\t} catch (error) {\n\t\tctx.ui.notify(error instanceof Error ? error.message : String(error), \"error\");\n\t\treturn;\n\t}\n\temitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);\n\tctx.ui.notify(`Pinned Cursor CLI (OAuth) account: ${name}.`, \"info\");\n}\n\nasync function unpinAccount(ctx: ExtensionCommandContext): Promise<void> {\n\tlet hadPin = false;\n\ttry {\n\t\tawait ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {\n\t\t\tconst credential = asCursorCredential(current);\n\t\t\tif (credential.pinned === undefined) return current;\n\t\t\thadPin = true;\n\t\t\tconst { pinned: _pinned, ...unpinned } = credential;\n\t\t\treturn unpinned;\n\t\t});\n\t} catch (error) {\n\t\tctx.ui.notify(error instanceof Error ? error.message : String(error), \"error\");\n\t\treturn;\n\t}\n\tif (!hadPin) {\n\t\tctx.ui.notify(\"No stored Cursor CLI (OAuth) account pin is set.\", \"info\");\n\t\treturn;\n\t}\n\temitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);\n\tctx.ui.notify(\"Unpinned Cursor CLI (OAuth) account.\", \"info\");\n}\n\nasync function importAccount(\n\tctx: ExtensionCommandContext,\n\tdeps: CursorCliAccountCommandDeps,\n\tsource: \"local\" | \"native\",\n): Promise<void> {\n\tconst importCredential = deps.importCredential ?? importLocalCursorCredential;\n\tconst importNativeCredential = deps.importNativeCredential ?? importNativeCursorCredential;\n\tconst importDeps: LocalCursorImportDeps = { ...deps.importDeps };\n\tif (importDeps.onPrompt === undefined && ctx.hasUI) {\n\t\timportDeps.onPrompt = async (prompt: { message: string }) => {\n\t\t\tconst answer = await ctx.ui.input(prompt.message);\n\t\t\tif (answer === undefined) throw new Error(\"Import cancelled\");\n\t\t\treturn answer;\n\t\t};\n\t}\n\tlet importedName: string | undefined;\n\ttry {\n\t\tawait ctx.modelRegistry.authStorage.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (current) => {\n\t\t\tconst before = asCursorCredential(current);\n\t\t\tconst updated =\n\t\t\t\tsource === \"native\"\n\t\t\t\t\t? await importNativeCredential(\n\t\t\t\t\t\t\tbefore,\n\t\t\t\t\t\t\tdeps.readNativeCredential ?? (() => ctx.modelRegistry.authStorage.get(NATIVE_CURSOR_PROVIDER_ID)),\n\t\t\t\t\t\t)\n\t\t\t\t\t: await importCredential(before, importDeps);\n\t\t\tconst existing = new Set(listAccounts(before).map((account) => account.name));\n\t\t\timportedName = listAccounts(updated).find((account) => !existing.has(account.name))?.name;\n\t\t\treturn updated;\n\t\t});\n\t} catch (error) {\n\t\tctx.ui.notify(\n\t\t\t`Failed to import local Cursor credential: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\"error\",\n\t\t);\n\t\treturn;\n\t}\n\tconst persistEnabled = deps.persistEnabled ?? persistCursorCliOauthEnabled;\n\ttry {\n\t\tpersistEnabled(ctx.cwd, true);\n\t\tawait ctx.modelRegistry.modelRuntime.refresh({\n\t\t\tallowNetwork: false,\n\t\t\tproviders: [CURSOR_CLI_OAUTH_PROVIDER_ID],\n\t\t});\n\t} catch (error) {\n\t\tctx.ui.notify(\n\t\t\t`Imported ${source === \"native\" ? \"native \" : \"\"}Cursor credential, but provider activation failed: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\"warning\",\n\t\t);\n\t\treturn;\n\t}\n\temitProviderAccountsChanged(CURSOR_CLI_OAUTH_PROVIDER_ID);\n\tctx.ui.notify(\n\t\t`Imported ${source === \"native\" ? \"native \" : \"local \"}Cursor credential as '${importedName ?? \"a new account\"}' (copied into this provider's store).`,\n\t\t\"info\",\n\t);\n}\n\nasync function acknowledgeNoApproval(\n\tctx: ExtensionCommandContext,\n\tdeps: CursorCliAccountCommandDeps,\n\tgeneration: CursorCliGenerationGuard,\n): Promise<void> {\n\tif (!ctx.hasUI) {\n\t\tctx.ui.notify(\"/cursor-account acknowledge requires an interactive UI.\", \"error\");\n\t\treturn;\n\t}\n\tconst persist = deps.persistAcknowledgement ?? persistCursorCliNoApprovalAcknowledgement;\n\tconst acknowledgedAt = await confirmCursorCliNoApprovalAcknowledgement(\n\t\tasync (ask) => (await ctx.ui.input(ask.message)) ?? \"\",\n\t\t() => new Date((deps.now ?? Date.now)()),\n\t);\n\tif (acknowledgedAt === undefined) {\n\t\tgeneration.runFencedSync(ctx, () =>\n\t\t\tctx.ui.notify(\n\t\t\t\t\"No acknowledgement written: unattended Cursor CLI execution stays off until you acknowledge.\",\n\t\t\t\t\"info\",\n\t\t\t),\n\t\t);\n\t\treturn;\n\t}\n\tpersist(ctx.cwd, acknowledgedAt);\n\tgeneration.runFencedSync(ctx, () =>\n\t\tctx.ui.notify(`Acknowledged unattended Cursor CLI tool execution at ${acknowledgedAt}.`, \"info\"),\n\t);\n}\n\nasync function showStatus(\n\tctx: ExtensionCommandContext,\n\tdeps: CursorCliAccountCommandDeps,\n\tbound: {\n\t\tloadSettings: (cwd: string) => CursorCliOauthProviderSettings;\n\t\tgeneration: CursorCliGenerationGuard;\n\t\tnow: () => number;\n\t},\n): Promise<void> {\n\t// Context reads happen before any await; the render continuation is fenced\n\t// so a reload during the version probe can never touch a retired context.\n\tconst sessionId = ctx.sessionManager.getSessionId();\n\tconst report = await collectCursorCliStatus({\n\t\tsessionId,\n\t\tsettings: bound.loadSettings(ctx.cwd),\n\t\treadCredential: () => ctx.modelRegistry.authStorage.get(CURSOR_CLI_OAUTH_PROVIDER_ID),\n\t\treadNativeCredential:\n\t\t\tdeps.readNativeCredential ?? (() => ctx.modelRegistry.authStorage.get(NATIVE_CURSOR_PROVIDER_ID)),\n\t\trouter: deps.router ?? cursorCliSessionRouter,\n\t\tresolveExecutable: deps.resolveExecutable,\n\t\tprobeVersion: deps.probeVersion,\n\t\tnow: bound.now,\n\t});\n\tbound.generation.runFencedSync(ctx, () => ctx.ui.notify(renderCursorCliStatus(report), \"info\"));\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/accounts.d.ts

@@ -0,0 +1,38 @@
+import type { Credential, CredentialStore, OAuthCredential } from "@earendil-works/pi-ai";
+export type CursorCliAccountSlot = {
+    name: string;
+    access: string;
+    refresh: string;
+    expires: number;
+    source: "login" | "import";
+    blockedUntil?: number;
+    blockReason?: "rate_limit" | "auth_error";
+};
+export type CursorCliSlotState = Record<string, {
+    blockedUntil?: number;
+    blockReason?: "rate_limit" | "auth_error";
+}>;
+export type CursorCliOauthCredential = OAuthCredential & {
+    accounts?: CursorCliAccountSlot[];
+    pinned?: string;
+    slotState?: CursorCliSlotState;
+};
+export declare const SENTINEL_OAUTH_FIELDS: {
+    readonly access: "cursor-cli-oauth-managed";
+    readonly refresh: "cursor-cli-oauth-managed";
+    readonly expires: 4102444800000;
+};
+export declare function emptyCredential(): CursorCliOauthCredential;
+export declare function listAccounts(credential: CursorCliOauthCredential): CursorCliAccountSlot[];
+export declare function assertValidAccountName(name: string): void;
+export declare function addAccount(credential: CursorCliOauthCredential, slot: CursorCliAccountSlot): CursorCliOauthCredential;
+export declare function removeAccount(credential: CursorCliOauthCredential, name: string): CursorCliOauthCredential;
+export declare function pinAccount(credential: CursorCliOauthCredential, name: string): CursorCliOauthCredential;
+export declare function assertSentinelInvariant(credential: CursorCliOauthCredential): void;
+export type CursorCliSlotRefresher = (refreshToken: string, signal: AbortSignal) => Promise<{
+    refresh: string;
+    access: string;
+    expires: number;
+}>;
+export declare function refreshSlot(store: CredentialStore, providerId: string, slotName: string, refresher: CursorCliSlotRefresher, signal: AbortSignal): Promise<Credential | undefined>;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE1F,MAAM,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,YAAY,GAAG,YAAY,CAAA;CAAE,CAAC,CAAC;AAEtH,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG;IACxD,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX,wBAAgB,eAAe,IAAI,wBAAwB,CAE1D;AAMD,wBAAgB,YAAY,CAAC,UAAU,EAAE,wBAAwB,GAAG,oBAAoB,EAAE,CAEzF;AAID,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,GAAG,wBAAwB,CAUrH;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAS1G;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAGvG;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAQlF;AAED,MAAM,MAAM,sBAAsB,GAAG,CACpC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,KACf,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEnE,wBAAsB,WAAW,CAChC,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,sBAAsB,EACjC,MAAM,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAoBjC"}

package/dist/core/extensions/builtin/cursor-cli-oauth/accounts.js

@@ -0,0 +1,75 @@
+export const SENTINEL_OAUTH_FIELDS = {
+    access: "cursor-cli-oauth-managed",
+    refresh: "cursor-cli-oauth-managed",
+    expires: 4_102_444_800_000,
+};
+export function emptyCredential() {
+    return { type: "oauth", ...SENTINEL_OAUTH_FIELDS, accounts: [] };
+}
+function storedAccounts(credential) {
+    return credential.accounts ?? [];
+}
+export function listAccounts(credential) {
+    return [...storedAccounts(credential)];
+}
+const ACCOUNT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+export function assertValidAccountName(name) {
+    if (!ACCOUNT_NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid account name '${name}': use letters, digits, '-' or '_', starting with a letter or digit`);
+    }
+}
+export function addAccount(credential, slot) {
+    assertValidAccountName(slot.name);
+    if (storedAccounts(credential).some((existing) => existing.name === slot.name)) {
+        throw new Error(`Account '${slot.name}' already exists`);
+    }
+    return {
+        ...credential,
+        ...SENTINEL_OAUTH_FIELDS,
+        accounts: [...storedAccounts(credential), slot],
+    };
+}
+export function removeAccount(credential, name) {
+    const accounts = storedAccounts(credential).filter((slot) => slot.name !== name);
+    const next = {
+        ...credential,
+        ...SENTINEL_OAUTH_FIELDS,
+        accounts,
+    };
+    if (credential.pinned === name)
+        delete next.pinned;
+    return next;
+}
+export function pinAccount(credential, name) {
+    assertValidAccountName(name);
+    return { ...credential, ...SENTINEL_OAUTH_FIELDS, pinned: name };
+}
+export function assertSentinelInvariant(credential) {
+    if (credential.access !== SENTINEL_OAUTH_FIELDS.access ||
+        credential.refresh !== SENTINEL_OAUTH_FIELDS.refresh ||
+        credential.expires !== SENTINEL_OAUTH_FIELDS.expires) {
+        throw new Error("top-level OAuth fields must remain sentinel values");
+    }
+}
+export async function refreshSlot(store, providerId, slotName, refresher, signal) {
+    return store.modify(providerId, async (current) => {
+        if (current?.type !== "oauth")
+            return undefined;
+        const credential = current;
+        assertSentinelInvariant(credential);
+        const slot = storedAccounts(credential).find((candidate) => candidate.name === slotName);
+        if (!slot || Date.now() < slot.expires)
+            return current;
+        const refreshed = await refresher(slot.refresh, signal);
+        const accounts = storedAccounts(credential).map((candidate) => candidate.name === slotName
+            ? {
+                ...candidate,
+                access: refreshed.access,
+                refresh: refreshed.refresh,
+                expires: refreshed.expires,
+            }
+            : candidate);
+        return { ...credential, ...SENTINEL_OAUTH_FIELDS, accounts };
+    });
+}
+//# sourceMappingURL=accounts.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/accounts.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,MAAM,EAAE,0BAA0B;IAClC,OAAO,EAAE,0BAA0B;IACnC,OAAO,EAAE,iBAAiB;CACjB,CAAC;AAEX,MAAM,UAAU,eAAe;IAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,UAAoC;IAC3D,OAAO,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAoC;IAChE,OAAO,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACd,yBAAyB,IAAI,qEAAqE,CAClG,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAoC,EAAE,IAA0B;IAC1F,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO;QACN,GAAG,UAAU;QACb,GAAG,qBAAqB;QACxB,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAoC,EAAE,IAAY;IAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjF,MAAM,IAAI,GAA6B;QACtC,GAAG,UAAU;QACb,GAAG,qBAAqB;QACxB,QAAQ;KACR,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACnD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAoC,EAAE,IAAY;IAC5E,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAoC;IAC3E,IACC,UAAU,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;QAClD,UAAU,CAAC,OAAO,KAAK,qBAAqB,CAAC,OAAO;QACpD,UAAU,CAAC,OAAO,KAAK,qBAAqB,CAAC,OAAO,EACnD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;AACF,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,KAAsB,EACtB,UAAkB,EAClB,QAAgB,EAChB,SAAiC,EACjC,MAAmB;IAEnB,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,UAAU,GAAG,OAAmC,CAAC;QACvD,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC7D,SAAS,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,CAAC;gBACA,GAAG,SAAS;gBACZ,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;aAC1B;YACF,CAAC,CAAC,SAAS,CACZ,CAAC;QACF,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import type { Credential, CredentialStore, OAuthCredential } from \"@earendil-works/pi-ai\";\n\nexport type CursorCliAccountSlot = {\n\tname: string;\n\taccess: string;\n\trefresh: string;\n\texpires: number;\n\tsource: \"login\" | \"import\";\n\tblockedUntil?: number;\n\tblockReason?: \"rate_limit\" | \"auth_error\";\n};\n\nexport type CursorCliSlotState = Record<string, { blockedUntil?: number; blockReason?: \"rate_limit\" | \"auth_error\" }>;\n\nexport type CursorCliOauthCredential = OAuthCredential & {\n\taccounts?: CursorCliAccountSlot[];\n\tpinned?: string;\n\tslotState?: CursorCliSlotState;\n};\n\nexport const SENTINEL_OAUTH_FIELDS = {\n\taccess: \"cursor-cli-oauth-managed\",\n\trefresh: \"cursor-cli-oauth-managed\",\n\texpires: 4_102_444_800_000,\n} as const;\n\nexport function emptyCredential(): CursorCliOauthCredential {\n\treturn { type: \"oauth\", ...SENTINEL_OAUTH_FIELDS, accounts: [] };\n}\n\nfunction storedAccounts(credential: CursorCliOauthCredential): CursorCliAccountSlot[] {\n\treturn credential.accounts ?? [];\n}\n\nexport function listAccounts(credential: CursorCliOauthCredential): CursorCliAccountSlot[] {\n\treturn [...storedAccounts(credential)];\n}\n\nconst ACCOUNT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;\n\nexport function assertValidAccountName(name: string): void {\n\tif (!ACCOUNT_NAME_PATTERN.test(name)) {\n\t\tthrow new Error(\n\t\t\t`Invalid account name '${name}': use letters, digits, '-' or '_', starting with a letter or digit`,\n\t\t);\n\t}\n}\n\nexport function addAccount(credential: CursorCliOauthCredential, slot: CursorCliAccountSlot): CursorCliOauthCredential {\n\tassertValidAccountName(slot.name);\n\tif (storedAccounts(credential).some((existing) => existing.name === slot.name)) {\n\t\tthrow new Error(`Account '${slot.name}' already exists`);\n\t}\n\treturn {\n\t\t...credential,\n\t\t...SENTINEL_OAUTH_FIELDS,\n\t\taccounts: [...storedAccounts(credential), slot],\n\t};\n}\n\nexport function removeAccount(credential: CursorCliOauthCredential, name: string): CursorCliOauthCredential {\n\tconst accounts = storedAccounts(credential).filter((slot) => slot.name !== name);\n\tconst next: CursorCliOauthCredential = {\n\t\t...credential,\n\t\t...SENTINEL_OAUTH_FIELDS,\n\t\taccounts,\n\t};\n\tif (credential.pinned === name) delete next.pinned;\n\treturn next;\n}\n\nexport function pinAccount(credential: CursorCliOauthCredential, name: string): CursorCliOauthCredential {\n\tassertValidAccountName(name);\n\treturn { ...credential, ...SENTINEL_OAUTH_FIELDS, pinned: name };\n}\n\nexport function assertSentinelInvariant(credential: CursorCliOauthCredential): void {\n\tif (\n\t\tcredential.access !== SENTINEL_OAUTH_FIELDS.access ||\n\t\tcredential.refresh !== SENTINEL_OAUTH_FIELDS.refresh ||\n\t\tcredential.expires !== SENTINEL_OAUTH_FIELDS.expires\n\t) {\n\t\tthrow new Error(\"top-level OAuth fields must remain sentinel values\");\n\t}\n}\n\nexport type CursorCliSlotRefresher = (\n\trefreshToken: string,\n\tsignal: AbortSignal,\n) => Promise<{ refresh: string; access: string; expires: number }>;\n\nexport async function refreshSlot(\n\tstore: CredentialStore,\n\tproviderId: string,\n\tslotName: string,\n\trefresher: CursorCliSlotRefresher,\n\tsignal: AbortSignal,\n): Promise<Credential | undefined> {\n\treturn store.modify(providerId, async (current) => {\n\t\tif (current?.type !== \"oauth\") return undefined;\n\t\tconst credential = current as CursorCliOauthCredential;\n\t\tassertSentinelInvariant(credential);\n\t\tconst slot = storedAccounts(credential).find((candidate) => candidate.name === slotName);\n\t\tif (!slot || Date.now() < slot.expires) return current;\n\t\tconst refreshed = await refresher(slot.refresh, signal);\n\t\tconst accounts = storedAccounts(credential).map((candidate) =>\n\t\t\tcandidate.name === slotName\n\t\t\t\t? {\n\t\t\t\t\t\t...candidate,\n\t\t\t\t\t\taccess: refreshed.access,\n\t\t\t\t\t\trefresh: refreshed.refresh,\n\t\t\t\t\t\texpires: refreshed.expires,\n\t\t\t\t\t}\n\t\t\t\t: candidate,\n\t\t);\n\t\treturn { ...credential, ...SENTINEL_OAUTH_FIELDS, accounts };\n\t});\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/affinity.d.ts

@@ -0,0 +1,24 @@
+export declare const DEFAULT_CURSOR_AFFINITY_KEY = "cursor-cli-oauth-default";
+export type CursorAffinityAccountSlot = {
+    name: string;
+    blockedUntil?: number;
+    blockReason?: string;
+};
+export type CursorAffinityOptions = {
+    affinityKey?: string;
+    sessionId?: string;
+    pinnedAccount?: string;
+    now?: number;
+};
+export declare class AllCursorAccountsBlockedError extends Error {
+    readonly soonestUnblockAt: number | undefined;
+    constructor(soonestUnblockAt: number | undefined);
+}
+export declare function getAffinityKey(options: Pick<CursorAffinityOptions, "affinityKey" | "sessionId">): string;
+/** Orders accounts by descending highest-random-weight score for the session key. */
+export declare function rendezvousOrder<T extends CursorAffinityAccountSlot>(key: string, accounts: readonly T[]): T[];
+/** Clears elapsed temporary blocks while retaining auth failures until the account logs in again. */
+export declare function clearExpiredBlocks<T extends CursorAffinityAccountSlot>(accounts: readonly T[], now?: number): T[];
+/** Selects the pinned account or the first available account in session-stable HRW order. */
+export declare function selectAccount<T extends CursorAffinityAccountSlot>(accounts: readonly T[], options?: CursorAffinityOptions): T;
+//# sourceMappingURL=affinity.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/affinity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"affinity.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/affinity.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,2BAA2B,6BAA6B,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,qBAAa,6BAA8B,SAAQ,KAAK;IACvD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;gBAElC,gBAAgB,EAAE,MAAM,GAAG,SAAS;CAShD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,WAAW,CAAC,GAAG,MAAM,CAExG;AAMD,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,CAAC,SAAS,yBAAyB,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAK7G;AAMD,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,yBAAyB,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,SAAa,GAAG,CAAC,EAAE,CAQrH;AAsBD,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,CAAC,SAAS,yBAAyB,EAChE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,OAAO,GAAE,qBAA0B,GACjC,CAAC,CASH"}

package/dist/core/extensions/builtin/cursor-cli-oauth/affinity.js

@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+export const DEFAULT_CURSOR_AFFINITY_KEY = "cursor-cli-oauth-default";
+export class AllCursorAccountsBlockedError extends Error {
+    constructor(soonestUnblockAt) {
+        super(soonestUnblockAt === undefined
+            ? "All Cursor CLI OAuth accounts are blocked until re-login."
+            : `All Cursor CLI OAuth accounts are blocked until ${new Date(soonestUnblockAt).toISOString()}.`);
+        this.name = "AllCursorAccountsBlockedError";
+        this.soonestUnblockAt = soonestUnblockAt;
+    }
+}
+export function getAffinityKey(options) {
+    return options.affinityKey ?? options.sessionId ?? DEFAULT_CURSOR_AFFINITY_KEY;
+}
+function score(key, accountName) {
+    return createHash("sha256").update(`${key}\0${accountName}`).digest().readBigUInt64BE(0);
+}
+/** Orders accounts by descending highest-random-weight score for the session key. */
+export function rendezvousOrder(key, accounts) {
+    return [...accounts]
+        .map((account) => ({ account, score: score(key, account.name) }))
+        .sort((left, right) => (right.score > left.score ? 1 : right.score < left.score ? -1 : 0))
+        .map(({ account }) => account);
+}
+function isBlocked(account, now) {
+    return account.blockReason === "auth_error" || (account.blockedUntil !== undefined && account.blockedUntil > now);
+}
+/** Clears elapsed temporary blocks while retaining auth failures until the account logs in again. */
+export function clearExpiredBlocks(accounts, now = Date.now()) {
+    return accounts.map((account) => {
+        if (account.blockReason !== "auth_error" && account.blockedUntil !== undefined && account.blockedUntil <= now) {
+            const { blockedUntil: _blockedUntil, blockReason: _blockReason, ...available } = account;
+            return available;
+        }
+        return account;
+    });
+}
+function selectUnblocked(accounts, options, now) {
+    const pinned = options.pinnedAccount === undefined
+        ? undefined
+        : accounts.find((account) => account.name === options.pinnedAccount);
+    if (pinned && !isBlocked(pinned, now))
+        return pinned;
+    return rendezvousOrder(getAffinityKey(options), accounts).find((account) => !isBlocked(account, now));
+}
+function soonestUnblockAt(accounts, now) {
+    const candidates = accounts
+        .map((account) => account.blockedUntil)
+        .filter((value) => value !== undefined && value > now);
+    return candidates.length === 0 ? undefined : Math.min(...candidates);
+}
+/** Selects the pinned account or the first available account in session-stable HRW order. */
+export function selectAccount(accounts, options = {}) {
+    const now = options.now ?? Date.now();
+    const selected = selectUnblocked(accounts, options, now);
+    if (selected)
+        return selected;
+    const cleared = clearExpiredBlocks(accounts, now);
+    const afterClear = selectUnblocked(cleared, options, now);
+    if (afterClear)
+        return afterClear;
+    throw new AllCursorAccountsBlockedError(soonestUnblockAt(accounts, now));
+}
+//# sourceMappingURL=affinity.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/affinity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"affinity.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/affinity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAetE,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAGvD,YAAY,gBAAoC;QAC/C,KAAK,CACJ,gBAAgB,KAAK,SAAS;YAC7B,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,mDAAmD,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,GAAG,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC1C,CAAC;CACD;AAED,MAAM,UAAU,cAAc,CAAC,OAAiE;IAC/F,OAAO,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,2BAA2B,CAAC;AAChF,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,WAAmB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAsC,GAAW,EAAE,QAAsB;IACvG,OAAO,CAAC,GAAG,QAAQ,CAAC;SAClB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAChE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,OAAkC,EAAE,GAAW;IACjE,OAAO,OAAO,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAsC,QAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/G,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;YAC/G,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;YACzF,OAAO,SAAc,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACvB,QAAsB,EACtB,OAA8B,EAC9B,GAAW;IAEX,MAAM,MAAM,GACX,OAAO,CAAC,aAAa,KAAK,SAAS;QAClC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,OAAO,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA8C,EAAE,GAAW;IACpF,MAAM,UAAU,GAAG,QAAQ;SACzB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;SACtC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC;IACzE,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;AACtE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAC5B,QAAsB,EACtB,UAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,IAAI,6BAA6B,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nexport const DEFAULT_CURSOR_AFFINITY_KEY = \"cursor-cli-oauth-default\";\n\nexport type CursorAffinityAccountSlot = {\n\tname: string;\n\tblockedUntil?: number;\n\tblockReason?: string;\n};\n\nexport type CursorAffinityOptions = {\n\taffinityKey?: string;\n\tsessionId?: string;\n\tpinnedAccount?: string;\n\tnow?: number;\n};\n\nexport class AllCursorAccountsBlockedError extends Error {\n\treadonly soonestUnblockAt: number | undefined;\n\n\tconstructor(soonestUnblockAt: number | undefined) {\n\t\tsuper(\n\t\t\tsoonestUnblockAt === undefined\n\t\t\t\t? \"All Cursor CLI OAuth accounts are blocked until re-login.\"\n\t\t\t\t: `All Cursor CLI OAuth accounts are blocked until ${new Date(soonestUnblockAt).toISOString()}.`,\n\t\t);\n\t\tthis.name = \"AllCursorAccountsBlockedError\";\n\t\tthis.soonestUnblockAt = soonestUnblockAt;\n\t}\n}\n\nexport function getAffinityKey(options: Pick<CursorAffinityOptions, \"affinityKey\" | \"sessionId\">): string {\n\treturn options.affinityKey ?? options.sessionId ?? DEFAULT_CURSOR_AFFINITY_KEY;\n}\n\nfunction score(key: string, accountName: string): bigint {\n\treturn createHash(\"sha256\").update(`${key}\\0${accountName}`).digest().readBigUInt64BE(0);\n}\n\n/** Orders accounts by descending highest-random-weight score for the session key. */\nexport function rendezvousOrder<T extends CursorAffinityAccountSlot>(key: string, accounts: readonly T[]): T[] {\n\treturn [...accounts]\n\t\t.map((account) => ({ account, score: score(key, account.name) }))\n\t\t.sort((left, right) => (right.score > left.score ? 1 : right.score < left.score ? -1 : 0))\n\t\t.map(({ account }) => account);\n}\n\nfunction isBlocked(account: CursorAffinityAccountSlot, now: number): boolean {\n\treturn account.blockReason === \"auth_error\" || (account.blockedUntil !== undefined && account.blockedUntil > now);\n}\n\n/** Clears elapsed temporary blocks while retaining auth failures until the account logs in again. */\nexport function clearExpiredBlocks<T extends CursorAffinityAccountSlot>(accounts: readonly T[], now = Date.now()): T[] {\n\treturn accounts.map((account) => {\n\t\tif (account.blockReason !== \"auth_error\" && account.blockedUntil !== undefined && account.blockedUntil <= now) {\n\t\t\tconst { blockedUntil: _blockedUntil, blockReason: _blockReason, ...available } = account;\n\t\t\treturn available as T;\n\t\t}\n\t\treturn account;\n\t});\n}\n\nfunction selectUnblocked<T extends CursorAffinityAccountSlot>(\n\taccounts: readonly T[],\n\toptions: CursorAffinityOptions,\n\tnow: number,\n): T | undefined {\n\tconst pinned =\n\t\toptions.pinnedAccount === undefined\n\t\t\t? undefined\n\t\t\t: accounts.find((account) => account.name === options.pinnedAccount);\n\tif (pinned && !isBlocked(pinned, now)) return pinned;\n\treturn rendezvousOrder(getAffinityKey(options), accounts).find((account) => !isBlocked(account, now));\n}\n\nfunction soonestUnblockAt(accounts: readonly CursorAffinityAccountSlot[], now: number): number | undefined {\n\tconst candidates = accounts\n\t\t.map((account) => account.blockedUntil)\n\t\t.filter((value): value is number => value !== undefined && value > now);\n\treturn candidates.length === 0 ? undefined : Math.min(...candidates);\n}\n\n/** Selects the pinned account or the first available account in session-stable HRW order. */\nexport function selectAccount<T extends CursorAffinityAccountSlot>(\n\taccounts: readonly T[],\n\toptions: CursorAffinityOptions = {},\n): T {\n\tconst now = options.now ?? Date.now();\n\tconst selected = selectUnblocked(accounts, options, now);\n\tif (selected) return selected;\n\n\tconst cleared = clearExpiredBlocks(accounts, now);\n\tconst afterClear = selectUnblocked(cleared, options, now);\n\tif (afterClear) return afterClear;\n\tthrow new AllCursorAccountsBlockedError(soonestUnblockAt(accounts, now));\n}\n"]}