@code-yeongyu/senpi 2026.8.16 → 2026.8.18

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAA4C,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAA2B,CAAC;AAExG,eAAO,MAAM,wCAAwC,gKACyG,CAAC;AAE/J,eAAO,MAAM,qCAAqC,qLAC6H,CAAC;AAEhL,+FAA+F;AAC/F,eAAO,MAAM,uCAAuC,iMACyI,CAAC;AAE9L,MAAM,MAAM,6BAA6B,GACtC,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,sCAAsC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClF,mGAAmG;IACnG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,wBAAgB,+BAA+B,IAAI,yBAAyB,CAoB3E;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACA,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD,CAAC;AAEL,wFAAwF;AACxF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAG,sCAAsC,CAAU;IAChE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEhC,OAAO,EAAE,yBAAyB;CAK9C;AAKD,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,yBAAyB,EAClC,YAAY,GAAE,SAAS,MAAM,EAAO,GAClC,0BAA0B,CA2B5B;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmB5F"}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js

@@ -0,0 +1,147 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createCursorCliOauthSandboxModeValidator } from "./settings.js";
+/**
+ * Guardrails for unattended Cursor CLI execution.
+ *
+ * The Cursor CLI runs its own tools the moment `--force` is on the argv, so
+ * that decision is never implicit: it requires the explicit
+ * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a
+ * disabled force merely warns. Command denylists ride along through the
+ * per-account HOME's `cli-config.json`, strictly in the probe-proven shape
+ * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).
+ */
+/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */
+export const CURSOR_CLI_OAUTH_SANDBOX_MODES = ["enabled", "disabled"];
+export const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION = "The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.";
+export const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP = 'Set "cursorCliOauthProvider.noApprovalAcknowledgedAt" to the current ISO-8601 timestamp (for example "2026-08-17T12:00:00.000Z") in senpi settings to acknowledge this once.';
+/** One warning per session when force is disabled in agent mode (contracts block, task 18). */
+export const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING = 'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to "plan" for planning turns that do not need execution.';
+export function createCursorCliGuardrailSession() {
+    const warnings = [];
+    const emitted = new Set();
+    const warn = (code, message, key = code) => {
+        if (emitted.has(key))
+            return false;
+        emitted.add(key);
+        warnings.push({ kind: "warning", code, message });
+        return true;
+    };
+    const validateSandboxMode = createCursorCliOauthSandboxModeValidator(new Set(CURSOR_CLI_OAUTH_SANDBOX_MODES), (message) => {
+        warn("sandbox_mode_ignored", message, `sandbox_mode_ignored:${message}`);
+    });
+    return {
+        warnings,
+        warn,
+        validateSandboxMode,
+    };
+}
+/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */
+export class CursorCliExecutionRefusalError extends Error {
+    constructor(refusal) {
+        super(refusal.message);
+        this.code = "no_approval_acknowledgement_required";
+        this.name = "CursorCliExecutionRefusalError";
+        this.refusal = refusal;
+    }
+}
+/** Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. */
+const GLOB_METACHARACTERS = /[*?[]/u;
+export function sanitizeCursorCliDenyCommands(entries, warn) {
+    const kept = [];
+    for (const entry of entries) {
+        const command = entry.trim();
+        if (command.length === 0) {
+            warn?.("Ignoring an empty Cursor CLI deny command entry (exact full commands only)");
+            continue;
+        }
+        if (GLOB_METACHARACTERS.test(command)) {
+            warn?.(`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`);
+            continue;
+        }
+        kept.push(command);
+    }
+    return kept;
+}
+/**
+ * Decide whether a turn may run unattended.
+ *
+ * - `--force` is emitted only in agent mode, only when force is requested, and
+ *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a
+ *   typed refusal naming the acknowledgement step.
+ * - Plan mode never emits `--force` (the CLI only plans), so it needs no
+ *   acknowledgement.
+ * - Force disabled in agent mode is allowed but warns once per session.
+ * - Unproven sandbox modes are ignored with one warning per distinct value.
+ */
+export function resolveCursorCliExecutionPolicy(input, session, denyCommands = []) {
+    const planMode = input.executionMode === "plan";
+    const wantsForce = !planMode && input.forceExecution;
+    if (wantsForce && input.noApprovalAcknowledgedAt === undefined) {
+        const refusal = {
+            kind: "refusal",
+            code: "no_approval_acknowledgement_required",
+            message: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,
+            acknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,
+        };
+        return { status: "refused", refusal };
+    }
+    if (!planMode && !input.forceExecution) {
+        session.warn("force_execution_disabled", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);
+    }
+    const sandboxMode = session.validateSandboxMode(input.sandboxMode);
+    const sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {
+        session.warn("deny_command_rejected", message, `deny_command_rejected:${message}`);
+    });
+    return {
+        status: "allowed",
+        force: wantsForce,
+        executionMode: input.executionMode,
+        sandboxMode,
+        denyCommands: sanitizedDenyCommands,
+        warnings: [...session.warnings],
+    };
+}
+const CLI_CONFIG_RELATIVE_PATH = join(".cursor", "cli-config.json");
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function shellDenyEntry(command) {
+    return `Shell(${command})`;
+}
+/**
+ * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's
+ * `cli-config.json`.
+ *
+ * The CLI rewrites this file during every invocation (task 2 observed its own
+ * keys appearing and `cli-config.json.bad` sidecars for malformed content), so
+ * this must run immediately before each spawn, composing with the home-store
+ * prepare pass that re-writes `auth.json` on the same cadence. Writes only the
+ * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`
+ * entries) and preserves every CLI-owned key already present. Writes nothing
+ * when no deny commands are configured.
+ */
+export function applyCursorCliDenyConfig(home, denyCommands) {
+    if (denyCommands.length === 0)
+        return;
+    const configPath = join(home, CLI_CONFIG_RELATIVE_PATH);
+    let existing = {};
+    if (existsSync(configPath)) {
+        try {
+            const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+            if (isRecord(parsed))
+                existing = parsed;
+        }
+        catch {
+            // The CLI quarantines unparseable config as cli-config.json.bad and
+            // proceeds with defaults; start from the proven minimal shape.
+        }
+    }
+    const permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};
+    const config = {
+        ...existing,
+        permissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },
+    };
+    writeFileSync(configPath, `${JSON.stringify(config, null, "\t")}\n`, "utf8");
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoC,wCAAwC,EAAE,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAqC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,wCAAwC,GACpD,6JAA6J,CAAC;AAE/J,MAAM,CAAC,MAAM,qCAAqC,GACjD,8KAA8K,CAAC;AAEhL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uCAAuC,GACnD,4LAA4L,CAAC;AA6B9L,MAAM,UAAU,+BAA+B;IAC9C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,OAAe,EAAE,MAAc,IAAI,EAAW,EAAE;QAClG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,wCAAwC,CACnE,IAAI,GAAG,CAAC,8BAA8B,CAAC,EACvC,CAAC,OAAO,EAAE,EAAE;QACX,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CACD,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,mBAAmB;KACnB,CAAC;AACH,CAAC;AAqBD,wFAAwF;AACxF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAIxD,YAAY,OAAkC;QAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAJf,SAAI,GAAG,sCAA+C,CAAC;QAK/D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAC5C,OAA0B,EAC1B,IAAgC;IAEhC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,4EAA4E,CAAC,CAAC;YACrF,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CACL,uGAAuG,OAAO,EAAE,CAChH,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC9C,KAAoC,EACpC,OAAkC,EAClC,eAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,UAAU,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,OAAO,GAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,GAAG,wCAAwC,IAAI,qCAAqC,EAAE;YAC/F,mBAAmB,EAAE,qCAAqC;SAC1D,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACrF,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,UAAU;QACjB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW;QACX,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,OAAO,SAAS,OAAO,GAAG,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAA+B;IACrF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,+DAA+D;QAChE,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,MAAM,GAA4B;QACvC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;KACvE,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type CursorCliOauthExecutionMode, createCursorCliOauthSandboxModeValidator } from \"./settings.ts\";\n\n/**\n * Guardrails for unattended Cursor CLI execution.\n *\n * The Cursor CLI runs its own tools the moment `--force` is on the argv, so\n * that decision is never implicit: it requires the explicit\n * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a\n * disabled force merely warns. Command denylists ride along through the\n * per-account HOME's `cli-config.json`, strictly in the probe-proven shape\n * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).\n */\n\n/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */\nexport const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly [\"enabled\", \"disabled\"] = [\"enabled\", \"disabled\"];\n\nexport const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION =\n\t\"The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.\";\n\nexport const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP =\n\t'Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.';\n\n/** One warning per session when force is disabled in agent mode (contracts block, task 18). */\nexport const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING =\n\t'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.';\n\nexport type CursorCliGuardrailWarningCode =\n\t| \"force_execution_disabled\"\n\t| \"sandbox_mode_ignored\"\n\t| \"deny_command_rejected\";\n\nexport type CursorCliGuardrailWarning = {\n\treadonly kind: \"warning\";\n\treadonly code: CursorCliGuardrailWarningCode;\n\treadonly message: string;\n};\n\nexport type CursorCliExecutionRefusal = {\n\treadonly kind: \"refusal\";\n\treadonly code: \"no_approval_acknowledgement_required\";\n\treadonly message: string;\n\treadonly acknowledgementStep: string;\n};\n\nexport type CursorCliGuardrailSession = {\n\t/** Every warning emitted so far in this session; one-time gates live here. */\n\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t/** Emit a warning once per deduplication key; returns whether it was emitted. */\n\twarn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;\n\t/** Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. */\n\tvalidateSandboxMode(value: string | undefined): string | undefined;\n};\n\nexport function createCursorCliGuardrailSession(): CursorCliGuardrailSession {\n\tconst warnings: CursorCliGuardrailWarning[] = [];\n\tconst emitted = new Set<string>();\n\tconst warn = (code: CursorCliGuardrailWarningCode, message: string, key: string = code): boolean => {\n\t\tif (emitted.has(key)) return false;\n\t\temitted.add(key);\n\t\twarnings.push({ kind: \"warning\", code, message });\n\t\treturn true;\n\t};\n\tconst validateSandboxMode = createCursorCliOauthSandboxModeValidator(\n\t\tnew Set(CURSOR_CLI_OAUTH_SANDBOX_MODES),\n\t\t(message) => {\n\t\t\twarn(\"sandbox_mode_ignored\", message, `sandbox_mode_ignored:${message}`);\n\t\t},\n\t);\n\treturn {\n\t\twarnings,\n\t\twarn,\n\t\tvalidateSandboxMode,\n\t};\n}\n\nexport type CursorCliExecutionPolicyInput = {\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string | undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly sandboxMode: string | undefined;\n};\n\nexport type CursorCliExecutionDecision =\n\t| { readonly status: \"refused\"; readonly refusal: CursorCliExecutionRefusal }\n\t| {\n\t\t\treadonly status: \"allowed\";\n\t\t\treadonly force: boolean;\n\t\t\treadonly executionMode: CursorCliOauthExecutionMode;\n\t\t\treadonly sandboxMode: string | undefined;\n\t\t\treadonly denyCommands: readonly string[];\n\t\t\t/** Warnings accumulated in the session so far (not only this decision). */\n\t\t\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t  };\n\n/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */\nexport class CursorCliExecutionRefusalError extends Error {\n\treadonly code = \"no_approval_acknowledgement_required\" as const;\n\treadonly refusal: CursorCliExecutionRefusal;\n\n\tconstructor(refusal: CursorCliExecutionRefusal) {\n\t\tsuper(refusal.message);\n\t\tthis.name = \"CursorCliExecutionRefusalError\";\n\t\tthis.refusal = refusal;\n\t}\n}\n\n/** Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. */\nconst GLOB_METACHARACTERS = /[*?[]/u;\n\nexport function sanitizeCursorCliDenyCommands(\n\tentries: readonly string[],\n\twarn?: (message: string) => void,\n): readonly string[] {\n\tconst kept: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst command = entry.trim();\n\t\tif (command.length === 0) {\n\t\t\twarn?.(\"Ignoring an empty Cursor CLI deny command entry (exact full commands only)\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (GLOB_METACHARACTERS.test(command)) {\n\t\t\twarn?.(\n\t\t\t\t`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tkept.push(command);\n\t}\n\treturn kept;\n}\n\n/**\n * Decide whether a turn may run unattended.\n *\n * - `--force` is emitted only in agent mode, only when force is requested, and\n *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a\n *   typed refusal naming the acknowledgement step.\n * - Plan mode never emits `--force` (the CLI only plans), so it needs no\n *   acknowledgement.\n * - Force disabled in agent mode is allowed but warns once per session.\n * - Unproven sandbox modes are ignored with one warning per distinct value.\n */\nexport function resolveCursorCliExecutionPolicy(\n\tinput: CursorCliExecutionPolicyInput,\n\tsession: CursorCliGuardrailSession,\n\tdenyCommands: readonly string[] = [],\n): CursorCliExecutionDecision {\n\tconst planMode = input.executionMode === \"plan\";\n\tconst wantsForce = !planMode && input.forceExecution;\n\tif (wantsForce && input.noApprovalAcknowledgedAt === undefined) {\n\t\tconst refusal: CursorCliExecutionRefusal = {\n\t\t\tkind: \"refusal\",\n\t\t\tcode: \"no_approval_acknowledgement_required\",\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,\n\t\t\tacknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,\n\t\t};\n\t\treturn { status: \"refused\", refusal };\n\t}\n\tif (!planMode && !input.forceExecution) {\n\t\tsession.warn(\"force_execution_disabled\", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);\n\t}\n\tconst sandboxMode = session.validateSandboxMode(input.sandboxMode);\n\tconst sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {\n\t\tsession.warn(\"deny_command_rejected\", message, `deny_command_rejected:${message}`);\n\t});\n\treturn {\n\t\tstatus: \"allowed\",\n\t\tforce: wantsForce,\n\t\texecutionMode: input.executionMode,\n\t\tsandboxMode,\n\t\tdenyCommands: sanitizedDenyCommands,\n\t\twarnings: [...session.warnings],\n\t};\n}\n\nconst CLI_CONFIG_RELATIVE_PATH = join(\".cursor\", \"cli-config.json\");\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction shellDenyEntry(command: string): string {\n\treturn `Shell(${command})`;\n}\n\n/**\n * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's\n * `cli-config.json`.\n *\n * The CLI rewrites this file during every invocation (task 2 observed its own\n * keys appearing and `cli-config.json.bad` sidecars for malformed content), so\n * this must run immediately before each spawn, composing with the home-store\n * prepare pass that re-writes `auth.json` on the same cadence. Writes only the\n * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`\n * entries) and preserves every CLI-owned key already present. Writes nothing\n * when no deny commands are configured.\n */\nexport function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void {\n\tif (denyCommands.length === 0) return;\n\tconst configPath = join(home, CLI_CONFIG_RELATIVE_PATH);\n\tlet existing: Record<string, unknown> = {};\n\tif (existsSync(configPath)) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(readFileSync(configPath, \"utf8\"));\n\t\t\tif (isRecord(parsed)) existing = parsed;\n\t\t} catch {\n\t\t\t// The CLI quarantines unparseable config as cli-config.json.bad and\n\t\t\t// proceeds with defaults; start from the proven minimal shape.\n\t\t}\n\t}\n\tconst permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};\n\tconst config: Record<string, unknown> = {\n\t\t...existing,\n\t\tpermissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },\n\t};\n\twriteFileSync(configPath, `${JSON.stringify(config, null, \"\\t\")}\\n`, \"utf8\");\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/home-store.d.ts

@@ -0,0 +1,20 @@
+import { type CursorCliAccountSlot } from "./accounts.ts";
+export type CursorAccountHomeLogger = (line: string) => void;
+export type CursorAccountHomeRunContext = {
+    home: string;
+    authPath: string;
+};
+export type CursorAccountHomeRunResult<T> = {
+    result: T;
+    slot: CursorCliAccountSlot;
+    home: string;
+};
+/**
+ * Runs one Cursor CLI invocation inside a durable per-account HOME.
+ *
+ * The credential is deliberately rewritten immediately before `run` because
+ * cursor-agent may modify other files under `.cursor` during an invocation.
+ * Nothing in the HOME is removed after the run, preserving CLI chat history.
+ */
+export declare function runInCursorAccountHome<T>(agentDir: string, slot: CursorCliAccountSlot, run: (context: CursorAccountHomeRunContext) => Promise<T>, log?: CursorAccountHomeLogger): Promise<CursorAccountHomeRunResult<T>>;
+//# sourceMappingURL=home-store.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/home-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-store.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/home-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAKlF,MAAM,MAAM,uBAAuB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAE7D,MAAM,MAAM,2BAA2B,GAAG;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC3C,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACb,CAAC;AAqHF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC7C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,oBAAoB,EAC1B,GAAG,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,OAAO,CAAC,CAAC,CAAC,EACzD,GAAG,CAAC,EAAE,uBAAuB,GAC3B,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAMxC"}

package/dist/core/extensions/builtin/cursor-cli-oauth/home-store.js

@@ -0,0 +1,99 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { assertValidAccountName } from "./accounts.js";
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isInside(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return (pathFromRoot !== "" && !isAbsolute(pathFromRoot) && pathFromRoot !== ".." && !pathFromRoot.startsWith(`..${sep}`));
+}
+function accountPaths(agentDir, accountName) {
+    assertValidAccountName(accountName);
+    const extensionRoot = resolve(agentDir, "cursor-cli-oauth");
+    const accountsRoot = resolve(extensionRoot, "accounts");
+    const slotRoot = resolve(accountsRoot, accountName);
+    const home = resolve(slotRoot, "home");
+    if (!isInside(accountsRoot, slotRoot) || !isInside(accountsRoot, home)) {
+        throw new Error(`Cursor account HOME for '${accountName}' escapes the accounts root`);
+    }
+    const cursorDirectory = resolve(home, ".cursor");
+    if (!isInside(home, cursorDirectory)) {
+        throw new Error(`Cursor credential directory for '${accountName}' escapes its HOME`);
+    }
+    return {
+        home,
+        authPath: resolve(cursorDirectory, "auth.json"),
+        directories: [extensionRoot, accountsRoot, slotRoot, home, cursorDirectory],
+    };
+}
+function ensurePrivateDirectories(directories) {
+    for (const directory of directories) {
+        mkdirSync(directory, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+        chmodSync(directory, PRIVATE_DIRECTORY_MODE);
+    }
+}
+function serializeCredential(slot) {
+    const credential = {
+        accessToken: slot.access,
+        refreshToken: slot.refresh,
+        apiKey: null,
+        bedrockCredentials: null,
+    };
+    return JSON.stringify(credential);
+}
+function parseCredential(contents) {
+    let parsed;
+    try {
+        parsed = JSON.parse(contents);
+    }
+    catch {
+        throw new Error("Invalid Cursor credential: auth.json is not valid JSON");
+    }
+    if (!isRecord(parsed) ||
+        typeof parsed.accessToken !== "string" ||
+        parsed.accessToken.length === 0 ||
+        typeof parsed.refreshToken !== "string" ||
+        parsed.refreshToken.length === 0 ||
+        parsed.apiKey !== null ||
+        parsed.bedrockCredentials !== null) {
+        throw new Error("Invalid Cursor credential: auth.json does not match the file-store contract");
+    }
+    return {
+        accessToken: parsed.accessToken,
+        refreshToken: parsed.refreshToken,
+        apiKey: null,
+        bedrockCredentials: null,
+    };
+}
+function prepareAccountHome(paths, slot, log) {
+    ensurePrivateDirectories(paths.directories);
+    writeFileSync(paths.authPath, serializeCredential(slot), {
+        encoding: "utf8",
+        mode: PRIVATE_FILE_MODE,
+    });
+    chmodSync(paths.authPath, PRIVATE_FILE_MODE);
+    log?.(`cursor_cli_oauth_credential_written accessBytes=${Buffer.byteLength(slot.access, "utf8")} refreshBytes=${Buffer.byteLength(slot.refresh, "utf8")}`);
+}
+function readBackSlot(paths, slot, log) {
+    const credential = parseCredential(readFileSync(paths.authPath, "utf8"));
+    log?.(`cursor_cli_oauth_credential_read accessBytes=${Buffer.byteLength(credential.accessToken, "utf8")} refreshBytes=${Buffer.byteLength(credential.refreshToken, "utf8")} rotated=${credential.refreshToken !== slot.refresh}`);
+    return credential.refreshToken === slot.refresh ? slot : { ...slot, refresh: credential.refreshToken };
+}
+/**
+ * Runs one Cursor CLI invocation inside a durable per-account HOME.
+ *
+ * The credential is deliberately rewritten immediately before `run` because
+ * cursor-agent may modify other files under `.cursor` during an invocation.
+ * Nothing in the HOME is removed after the run, preserving CLI chat history.
+ */
+export async function runInCursorAccountHome(agentDir, slot, run, log) {
+    const paths = accountPaths(agentDir, slot.name);
+    prepareAccountHome(paths, slot, log);
+    const result = await run({ home: paths.home, authPath: paths.authPath });
+    const updatedSlot = readBackSlot(paths, slot, log);
+    return { result, slot: updatedSlot, home: paths.home };
+}
+//# sourceMappingURL=home-store.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/home-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-store.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/home-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAA6B,MAAM,eAAe,CAAC;AAElF,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AA0BhC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO,CACN,YAAY,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CACjH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,WAAmB;IAC1D,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAEpC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAW,oBAAoB,CAAC,CAAC;IACtF,CAAC;IAED,OAAO;QACN,IAAI;QACJ,QAAQ,EAAE,OAAO,CAAC,eAAe,EAAE,WAAW,CAAC;QAC/C,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC;KAC3E,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,WAA8B;IAC/D,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACxE,SAAS,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0B;IACtD,MAAM,UAAU,GAAyB;QACxC,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,YAAY,EAAE,IAAI,CAAC,OAAO;QAC1B,MAAM,EAAE,IAAI;QACZ,kBAAkB,EAAE,IAAI;KACxB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IACD,IACC,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjB,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,CAAC,MAAM,KAAK,IAAI;QACtB,MAAM,CAAC,kBAAkB,KAAK,IAAI,EACjC,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM,EAAE,IAAI;QACZ,kBAAkB,EAAE,IAAI;KACxB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,KAAyB,EACzB,IAA0B,EAC1B,GAA6B;IAE7B,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE;QACxD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,iBAAiB;KACvB,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC7C,GAAG,EAAE,CACJ,mDAAmD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CACnJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,KAAyB,EACzB,IAA0B,EAC1B,GAA6B;IAE7B,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,GAAG,EAAE,CACJ,gDAAgD,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,iBAAiB,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,EAAE,CAC1N,CAAC;IACF,OAAO,UAAU,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;AACxG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,QAAgB,EAChB,IAA0B,EAC1B,GAAyD,EACzD,GAA6B;IAE7B,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { isAbsolute, relative, resolve, sep } from \"node:path\";\nimport { assertValidAccountName, type CursorCliAccountSlot } from \"./accounts.ts\";\n\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport type CursorAccountHomeLogger = (line: string) => void;\n\nexport type CursorAccountHomeRunContext = {\n\thome: string;\n\tauthPath: string;\n};\n\nexport type CursorAccountHomeRunResult<T> = {\n\tresult: T;\n\tslot: CursorCliAccountSlot;\n\thome: string;\n};\n\ntype CursorFileCredential = {\n\taccessToken: string;\n\trefreshToken: string;\n\tapiKey: null;\n\tbedrockCredentials: null;\n};\n\ntype CursorAccountPaths = CursorAccountHomeRunContext & {\n\tdirectories: readonly string[];\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isInside(root: string, candidate: string): boolean {\n\tconst pathFromRoot = relative(root, candidate);\n\treturn (\n\t\tpathFromRoot !== \"\" && !isAbsolute(pathFromRoot) && pathFromRoot !== \"..\" && !pathFromRoot.startsWith(`..${sep}`)\n\t);\n}\n\nfunction accountPaths(agentDir: string, accountName: string): CursorAccountPaths {\n\tassertValidAccountName(accountName);\n\n\tconst extensionRoot = resolve(agentDir, \"cursor-cli-oauth\");\n\tconst accountsRoot = resolve(extensionRoot, \"accounts\");\n\tconst slotRoot = resolve(accountsRoot, accountName);\n\tconst home = resolve(slotRoot, \"home\");\n\tif (!isInside(accountsRoot, slotRoot) || !isInside(accountsRoot, home)) {\n\t\tthrow new Error(`Cursor account HOME for '${accountName}' escapes the accounts root`);\n\t}\n\tconst cursorDirectory = resolve(home, \".cursor\");\n\tif (!isInside(home, cursorDirectory)) {\n\t\tthrow new Error(`Cursor credential directory for '${accountName}' escapes its HOME`);\n\t}\n\n\treturn {\n\t\thome,\n\t\tauthPath: resolve(cursorDirectory, \"auth.json\"),\n\t\tdirectories: [extensionRoot, accountsRoot, slotRoot, home, cursorDirectory],\n\t};\n}\n\nfunction ensurePrivateDirectories(directories: readonly string[]): void {\n\tfor (const directory of directories) {\n\t\tmkdirSync(directory, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n\t\tchmodSync(directory, PRIVATE_DIRECTORY_MODE);\n\t}\n}\n\nfunction serializeCredential(slot: CursorCliAccountSlot): string {\n\tconst credential: CursorFileCredential = {\n\t\taccessToken: slot.access,\n\t\trefreshToken: slot.refresh,\n\t\tapiKey: null,\n\t\tbedrockCredentials: null,\n\t};\n\treturn JSON.stringify(credential);\n}\n\nfunction parseCredential(contents: string): CursorFileCredential {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(contents);\n\t} catch {\n\t\tthrow new Error(\"Invalid Cursor credential: auth.json is not valid JSON\");\n\t}\n\tif (\n\t\t!isRecord(parsed) ||\n\t\ttypeof parsed.accessToken !== \"string\" ||\n\t\tparsed.accessToken.length === 0 ||\n\t\ttypeof parsed.refreshToken !== \"string\" ||\n\t\tparsed.refreshToken.length === 0 ||\n\t\tparsed.apiKey !== null ||\n\t\tparsed.bedrockCredentials !== null\n\t) {\n\t\tthrow new Error(\"Invalid Cursor credential: auth.json does not match the file-store contract\");\n\t}\n\treturn {\n\t\taccessToken: parsed.accessToken,\n\t\trefreshToken: parsed.refreshToken,\n\t\tapiKey: null,\n\t\tbedrockCredentials: null,\n\t};\n}\n\nfunction prepareAccountHome(\n\tpaths: CursorAccountPaths,\n\tslot: CursorCliAccountSlot,\n\tlog?: CursorAccountHomeLogger,\n): void {\n\tensurePrivateDirectories(paths.directories);\n\twriteFileSync(paths.authPath, serializeCredential(slot), {\n\t\tencoding: \"utf8\",\n\t\tmode: PRIVATE_FILE_MODE,\n\t});\n\tchmodSync(paths.authPath, PRIVATE_FILE_MODE);\n\tlog?.(\n\t\t`cursor_cli_oauth_credential_written accessBytes=${Buffer.byteLength(slot.access, \"utf8\")} refreshBytes=${Buffer.byteLength(slot.refresh, \"utf8\")}`,\n\t);\n}\n\nfunction readBackSlot(\n\tpaths: CursorAccountPaths,\n\tslot: CursorCliAccountSlot,\n\tlog?: CursorAccountHomeLogger,\n): CursorCliAccountSlot {\n\tconst credential = parseCredential(readFileSync(paths.authPath, \"utf8\"));\n\tlog?.(\n\t\t`cursor_cli_oauth_credential_read accessBytes=${Buffer.byteLength(credential.accessToken, \"utf8\")} refreshBytes=${Buffer.byteLength(credential.refreshToken, \"utf8\")} rotated=${credential.refreshToken !== slot.refresh}`,\n\t);\n\treturn credential.refreshToken === slot.refresh ? slot : { ...slot, refresh: credential.refreshToken };\n}\n\n/**\n * Runs one Cursor CLI invocation inside a durable per-account HOME.\n *\n * The credential is deliberately rewritten immediately before `run` because\n * cursor-agent may modify other files under `.cursor` during an invocation.\n * Nothing in the HOME is removed after the run, preserving CLI chat history.\n */\nexport async function runInCursorAccountHome<T>(\n\tagentDir: string,\n\tslot: CursorCliAccountSlot,\n\trun: (context: CursorAccountHomeRunContext) => Promise<T>,\n\tlog?: CursorAccountHomeLogger,\n): Promise<CursorAccountHomeRunResult<T>> {\n\tconst paths = accountPaths(agentDir, slot.name);\n\tprepareAccountHome(paths, slot, log);\n\tconst result = await run({ home: paths.home, authPath: paths.authPath });\n\tconst updatedSlot = readBackSlot(paths, slot, log);\n\treturn { result, slot: updatedSlot, home: paths.home };\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/index.d.ts

@@ -0,0 +1,25 @@
+import type { Credential, CredentialStore } from "@earendil-works/pi-ai";
+import type { ExtensionAPI } from "../../types.ts";
+import { type CursorCliOauthProviderSettings } from "./settings.ts";
+export { CURSOR_CLI_OAUTH_PROVIDER_ID } from "./oauth-login.ts";
+export type { CursorCliStreamDeps } from "./stream.ts";
+/** Injectable seams; every default resolves real on-disk state. */
+export type CursorCliOauthExtensionDeps = {
+    readonly cwd?: string;
+    readonly agentDir?: string;
+    readonly store?: CredentialStore;
+    readonly readCurrent?: () => Promise<Credential | undefined>;
+    readonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;
+    readonly resolveExecutable?: (settings: {
+        executablePath?: string;
+    }) => string;
+};
+/**
+ * Registers the cursor-cli-oauth provider lane. Registration is unconditional:
+ * the provider ships with the offline model fallback and reports availability
+ * through the oauth `check`, so a missing cursor-agent binary never hides the
+ * lane - it only makes `check` name the install guidance.
+ */
+export declare function registerCursorCliOauthExtension(pi: ExtensionAPI, deps?: CursorCliOauthExtensionDeps): void;
+export default function cursorCliOauthExtension(pi: ExtensionAPI): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AAKxE,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,mEAAmE;AACnE,MAAM,MAAM,2BAA2B,GAAG;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,8BAA8B,CAAC;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CAC/E,CAAC;AAKF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,GAAE,2BAAgC,GAAG,IAAI,CAmD9G;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAEtE"}

package/dist/core/extensions/builtin/cursor-cli-oauth/index.js

@@ -0,0 +1,69 @@
+import { getAgentDir } from "../../../../config.js";
+import { AuthStorage } from "../../../auth-storage.js";
+import { registerCursorCliAccountCommand } from "./account-command.js";
+import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from "./executable.js";
+import { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from "./models.js";
+import { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from "./oauth-login.js";
+import { loadCursorCliOauthProviderSettingsFromDisk, persistCursorCliNoApprovalAcknowledgement, persistCursorCliOauthEnabled, } from "./settings.js";
+import { streamCursorCliOauth } from "./stream.js";
+export { CURSOR_CLI_OAUTH_PROVIDER_ID } from "./oauth-login.js";
+const defaultResolveExecutable = (settings) => resolveCursorAgentExecutable({ ...defaultCursorAgentExecutableDeps(), settings });
+/**
+ * Registers the cursor-cli-oauth provider lane. Registration is unconditional:
+ * the provider ships with the offline model fallback and reports availability
+ * through the oauth `check`, so a missing cursor-agent binary never hides the
+ * lane - it only makes `check` name the install guidance.
+ */
+export function registerCursorCliOauthExtension(pi, deps = {}) {
+    const cwd = deps.cwd ?? process.cwd();
+    const agentDir = deps.agentDir ?? getAgentDir();
+    const store = deps.store ?? AuthStorage.create();
+    const readCurrent = deps.readCurrent ?? (async () => store.read(CURSOR_CLI_OAUTH_PROVIDER_ID));
+    const loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;
+    const resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;
+    // Todo 21: /cursor-account command plus the reload/shutdown teardown for
+    // this extension generation (minimal additive wiring).
+    registerCursorCliAccountCommand(pi);
+    const register = (models) => {
+        pi.registerProvider(CURSOR_CLI_OAUTH_PROVIDER_ID, {
+            baseUrl: CURSOR_CLI_OAUTH_PROVIDER_ID,
+            api: CURSOR_CLI_OAUTH_PROVIDER_ID,
+            models: models.map((entry) => ({ ...entry })),
+            // Settings, accounts, and the executable are re-resolved inside every
+            // turn; nothing captured here outlives a settings or credential change.
+            streamSimple: (model, context, options) => streamCursorCliOauth(model, context, options, { cwd, agentDir, store }),
+            oauth: createCursorCliOauthConfig({
+                readCurrent,
+                readSettings: () => loadSettings(cwd),
+                resolveExecutable,
+                persistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),
+                persistEnabled: (enabled) => persistCursorCliOauthEnabled(cwd, enabled),
+            }),
+        });
+    };
+    // Register immediately with the offline fallback so a missing, hanging, or
+    // broken cursor-agent can never delay or block provider registration; the
+    // probe-backed catalog replaces it once resolved.
+    register(STATIC_CURSOR_CLI_MODELS);
+    const settings = loadSettings(cwd);
+    void resolveCursorCliModelCatalog({
+        agentDir,
+        settings: {
+            modelCatalogTtlHours: settings.modelCatalogTtlHours,
+            executablePath: settings.executablePath,
+        },
+        deps: { resolveExecutable: () => resolveExecutable({ executablePath: settings.executablePath }) },
+    })
+        .then((models) => {
+        const resolved = models.map((entry) => entry.id).join("\n");
+        if (resolved !== STATIC_CURSOR_CLI_MODELS.map((entry) => entry.id).join("\n"))
+            register(models);
+    })
+        .catch(() => {
+        // The loader degrades to the static fallback itself; keep the registered fallback.
+    });
+}
+export default function cursorCliOauthExtension(pi) {
+    registerCursorCliOauthExtension(pi);
+}
+//# sourceMappingURL=index.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAahE,MAAM,wBAAwB,GAAG,CAAC,QAAqC,EAAU,EAAE,CAClF,4BAA4B,CAAC,EAAE,GAAG,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAgB,EAAE,OAAoC,EAAE;IACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0CAA0C,CAAC;IACrF,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;IAE7E,yEAAyE;IACzE,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAQ,EAAE;QACjE,EAAE,CAAC,gBAAgB,CAAC,4BAA4B,EAAE;YACjD,OAAO,EAAE,4BAA4B;YACrC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,sEAAsE;YACtE,wEAAwE;YACxE,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxE,KAAK,EAAE,0BAA0B,CAAC;gBACjC,WAAW;gBACX,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;gBACrC,iBAAiB;gBACjB,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC1G,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;aACvE,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAkD;IAClD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,4BAA4B,CAAC;QACjC,QAAQ;QACR,QAAQ,EAAE;YACT,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;SACvC;QACD,IAAI,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE;KACjG,CAAC;SACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACX,mFAAmF;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAgB;IAC/D,+BAA+B,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport type { ExtensionAPI, ProviderModelConfig } from \"../../types.ts\";\nimport { registerCursorCliAccountCommand } from \"./account-command.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\nimport { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from \"./models.ts\";\nimport { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from \"./oauth-login.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\nimport { streamCursorCliOauth } from \"./stream.ts\";\n\nexport { CURSOR_CLI_OAUTH_PROVIDER_ID } from \"./oauth-login.ts\";\nexport type { CursorCliStreamDeps } from \"./stream.ts\";\n\n/** Injectable seams; every default resolves real on-disk state. */\nexport type CursorCliOauthExtensionDeps = {\n\treadonly cwd?: string;\n\treadonly agentDir?: string;\n\treadonly store?: CredentialStore;\n\treadonly readCurrent?: () => Promise<Credential | undefined>;\n\treadonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;\n\treadonly resolveExecutable?: (settings: { executablePath?: string }) => string;\n};\n\nconst defaultResolveExecutable = (settings: { executablePath?: string }): string =>\n\tresolveCursorAgentExecutable({ ...defaultCursorAgentExecutableDeps(), settings });\n\n/**\n * Registers the cursor-cli-oauth provider lane. Registration is unconditional:\n * the provider ships with the offline model fallback and reports availability\n * through the oauth `check`, so a missing cursor-agent binary never hides the\n * lane - it only makes `check` name the install guidance.\n */\nexport function registerCursorCliOauthExtension(pi: ExtensionAPI, deps: CursorCliOauthExtensionDeps = {}): void {\n\tconst cwd = deps.cwd ?? process.cwd();\n\tconst agentDir = deps.agentDir ?? getAgentDir();\n\tconst store = deps.store ?? AuthStorage.create();\n\tconst readCurrent = deps.readCurrent ?? (async () => store.read(CURSOR_CLI_OAUTH_PROVIDER_ID));\n\tconst loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;\n\tconst resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;\n\n\t// Todo 21: /cursor-account command plus the reload/shutdown teardown for\n\t// this extension generation (minimal additive wiring).\n\tregisterCursorCliAccountCommand(pi);\n\n\tconst register = (models: readonly ProviderModelConfig[]): void => {\n\t\tpi.registerProvider(CURSOR_CLI_OAUTH_PROVIDER_ID, {\n\t\t\tbaseUrl: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tapi: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tmodels: models.map((entry) => ({ ...entry })),\n\t\t\t// Settings, accounts, and the executable are re-resolved inside every\n\t\t\t// turn; nothing captured here outlives a settings or credential change.\n\t\t\tstreamSimple: (model, context, options) =>\n\t\t\t\tstreamCursorCliOauth(model, context, options, { cwd, agentDir, store }),\n\t\t\toauth: createCursorCliOauthConfig({\n\t\t\t\treadCurrent,\n\t\t\t\treadSettings: () => loadSettings(cwd),\n\t\t\t\tresolveExecutable,\n\t\t\t\tpersistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\t\t\tpersistEnabled: (enabled) => persistCursorCliOauthEnabled(cwd, enabled),\n\t\t\t}),\n\t\t});\n\t};\n\n\t// Register immediately with the offline fallback so a missing, hanging, or\n\t// broken cursor-agent can never delay or block provider registration; the\n\t// probe-backed catalog replaces it once resolved.\n\tregister(STATIC_CURSOR_CLI_MODELS);\n\tconst settings = loadSettings(cwd);\n\tvoid resolveCursorCliModelCatalog({\n\t\tagentDir,\n\t\tsettings: {\n\t\t\tmodelCatalogTtlHours: settings.modelCatalogTtlHours,\n\t\t\texecutablePath: settings.executablePath,\n\t\t},\n\t\tdeps: { resolveExecutable: () => resolveExecutable({ executablePath: settings.executablePath }) },\n\t})\n\t\t.then((models) => {\n\t\t\tconst resolved = models.map((entry) => entry.id).join(\"\\n\");\n\t\t\tif (resolved !== STATIC_CURSOR_CLI_MODELS.map((entry) => entry.id).join(\"\\n\")) register(models);\n\t\t})\n\t\t.catch(() => {\n\t\t\t// The loader degrades to the static fallback itself; keep the registered fallback.\n\t\t});\n}\n\nexport default function cursorCliOauthExtension(pi: ExtensionAPI): void {\n\tregisterCursorCliOauthExtension(pi);\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/models.d.ts

@@ -0,0 +1,27 @@
+import type { ProviderModelConfig } from "../../types.ts";
+export type CursorCliModelCatalogSettings = {
+    readonly modelCatalogTtlHours?: number;
+    readonly executablePath?: string;
+};
+export type CursorCliModelCatalogDeps = {
+    now: () => number;
+    resolveExecutable: () => string;
+    runProbe: (executable: string, stdoutPath: string, timeoutMs: number) => Promise<void>;
+    makeTemporaryDirectory: (prefix: string) => Promise<string>;
+    readTextFile: (path: string) => Promise<string>;
+    makeDirectory: (path: string) => Promise<void>;
+    writeTextFile: (path: string, contents: string) => Promise<void>;
+    renameFile: (from: string, to: string) => Promise<void>;
+    removeDirectory: (path: string) => Promise<void>;
+};
+export type ResolveCursorCliModelCatalogOptions = {
+    readonly agentDir: string;
+    readonly settings?: CursorCliModelCatalogSettings;
+    readonly deps?: Partial<CursorCliModelCatalogDeps>;
+};
+export declare const STATIC_CURSOR_CLI_MODELS: readonly ProviderModelConfig[];
+/** Parse the complete `cursor-agent models` listing into extension provider entries. */
+export declare function parseCursorAgentModelsListing(listing: string): ProviderModelConfig[];
+/** Resolve a cached or probed catalog, always degrading to the exact offline fallback. */
+export declare function resolveCursorCliModelCatalog(options: ResolveCursorCliModelCatalogOptions): Promise<readonly ProviderModelConfig[]>;
+//# sourceMappingURL=models.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAW1D,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAqDF,eAAO,MAAM,wBAAwB,EAAE,SAAS,mBAAmB,EAElE,CAAC;AAEF,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAiBpF;AA6ID,0FAA0F;AAC1F,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,mCAAmC,GAC1C,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAkCzC"}