npm - @code-yeongyu/senpi - Versions diffs - 2026.8.18 → 2026.8.19 - Mend

@code-yeongyu/senpi 2026.8.18 → 2026.8.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1899) hide show

package/dist/core/extensions/builtin/claude-sdk-oauth/settings.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAiB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AA8B9E,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAyC,CAAC;AAErF,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAyB;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,OAAO,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,kBAAkB,GAAG,OAAO,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,OAAO,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,OAAO;QACN,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAwB;IACzD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACtG,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,8BAA8B,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAC1G,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC7F,OAAO;QACN,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAwC;IAC/E,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,gBAAgB;YAC/B,MAAM,EAAE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;YAC1D,QAAQ,EAAE,QAAQ,CAAC,kBAAkB,KAAK,SAAS;SACnD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;YAC5D,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;SACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,kCAAkC,CACjD,eAAgC,EAChC,cAA2B,OAAO,CAAC,GAAG;IAEtC,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAwC,CAAC;IACzF,MAAM,OAAO,GAAG,eAAe,CAAC,kBAAkB,EAAwC,CAAC;IAC3F,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG;QAChB,GAAG,qBAAqB,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACvD,GAAG,qBAAqB,CAAC,OAAO,CAAC,sBAAsB,CAAC;QACxD,GAAG,mBAAmB;KACtB,CAAC;IACF,IAAI,mBAAmB,CAAC,gBAAgB,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0CAA0C,CAAC,GAAW;IACrE,OAAO,kCAAkC,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { getAgentDir } from \"../../../../config.ts\";\nimport { type Settings, SettingsManager } from \"../../../settings-manager.ts\";\nimport type { SettingSource } from \"./sdk-boundary.ts\";\n\nexport type ClaudeSdkOauthSystemPromptMode = \"preset-append\" \| \"full\" \| \"override\";\nexport type ClaudeSdkOauthResumeMode = \"auto\" \| \"off\";\nexport type ClaudeSdkOauthTokenInjection = \"oauth-slots\" \| \"config-dir\" \| \"ambient\";\n\nexport interface ClaudeSdkOauthProviderSettings {\n\treadonly appendSystemPrompt?: boolean;\n\treadonly systemPromptMode?: ClaudeSdkOauthSystemPromptMode;\n\treadonly systemPromptFile?: string;\n\treadonly resumeMode?: ClaudeSdkOauthResumeMode;\n\treadonly settingSources?: SettingSource[];\n\treadonly strictMcpConfig?: boolean;\n\treadonly pinnedAccount?: string;\n\treadonly tokenInjection?: ClaudeSdkOauthTokenInjection;\n}\n\nexport type ResolvedSystemPromptMode = {\n\tmode: ClaudeSdkOauthSystemPromptMode;\n\tsource: string;\n\tconflict: boolean;\n};\n\ntype SettingsWithClaudeSdkOauthProvider = Settings & {\n\tclaudeSdkOauthProvider?: unknown;\n};\n\ntype Environment = Readonly<Record<string, string \| undefined>>;\n\nconst systemPromptModeSources = new WeakMap<ClaudeSdkOauthProviderSettings, \"env\">();\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseSettingSources(value: unknown): SettingSource[] \| undefined {\n\tif (!Array.isArray(value)) return undefined;\n\tif (!value.every((source) => source === \"user\" \|\| source === \"project\" \|\| source === \"local\")) {\n\t\treturn undefined;\n\t}\n\treturn [...value];\n}\n\nfunction parseEnvironmentSettingSources(value: string \| undefined): SettingSource[] \| undefined {\n\tif (value === undefined) return undefined;\n\tif (value === \"\") return [];\n\treturn parseSettingSources(value.split(\",\").map((source) => source.trim()));\n}\n\nfunction parseSystemPromptMode(value: unknown): ClaudeSdkOauthSystemPromptMode \| undefined {\n\treturn value === \"preset-append\" \|\| value === \"full\" \|\| value === \"override\" ? value : undefined;\n}\n\nfunction parseResumeMode(value: unknown): ClaudeSdkOauthResumeMode \| undefined {\n\treturn value === \"auto\" \|\| value === \"off\" ? value : undefined;\n}\n\nfunction parseTokenInjection(value: unknown): ClaudeSdkOauthTokenInjection \| undefined {\n\treturn value === \"oauth-slots\" \|\| value === \"config-dir\" \|\| value === \"ambient\" ? value : undefined;\n}\n\nfunction parseNonEmptyString(value: unknown): string \| undefined {\n\treturn typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\nfunction parseProviderSettings(value: unknown): ClaudeSdkOauthProviderSettings {\n\tif (!isRecord(value)) return {};\n\tconst appendSystemPrompt = typeof value.appendSystemPrompt === \"boolean\" ? value.appendSystemPrompt : undefined;\n\tconst systemPromptMode = parseSystemPromptMode(value.systemPromptMode);\n\tconst systemPromptFile = parseNonEmptyString(value.systemPromptFile);\n\tconst resumeMode = parseResumeMode(value.resumeMode);\n\tconst settingSources = parseSettingSources(value.settingSources);\n\tconst strictMcpConfig = typeof value.strictMcpConfig === \"boolean\" ? value.strictMcpConfig : undefined;\n\tconst pinnedAccount = parseNonEmptyString(value.pinnedAccount);\n\tconst tokenInjection = parseTokenInjection(value.tokenInjection);\n\treturn {\n\t\t...(appendSystemPrompt !== undefined ? { appendSystemPrompt } : {}),\n\t\t...(systemPromptMode !== undefined ? { systemPromptMode } : {}),\n\t\t...(systemPromptFile !== undefined ? { systemPromptFile } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(settingSources !== undefined ? { settingSources } : {}),\n\t\t...(strictMcpConfig !== undefined ? { strictMcpConfig } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t\t...(tokenInjection !== undefined ? { tokenInjection } : {}),\n\t};\n}\n\nfunction parseEnvironmentSettings(environment: Environment): ClaudeSdkOauthProviderSettings {\n\tconst systemPromptMode = parseSystemPromptMode(environment.SENPI_CLAUDE_SDK_OAUTH_SYSTEM_PROMPT_MODE);\n\tconst systemPromptFile = parseNonEmptyString(environment.SENPI_CLAUDE_SDK_OAUTH_SYSTEM_PROMPT_FILE);\n\tconst resumeMode = parseResumeMode(environment.SENPI_CLAUDE_SDK_OAUTH_RESUME);\n\tconst tokenInjection = parseTokenInjection(environment.SENPI_CLAUDE_SDK_OAUTH_TOKEN_INJECTION);\n\tconst settingSources = parseEnvironmentSettingSources(environment.SENPI_CLAUDE_SDK_OAUTH_SETTING_SOURCES);\n\tconst pinnedAccount = parseNonEmptyString(environment.SENPI_CLAUDE_SDK_OAUTH_PINNED_ACCOUNT);\n\treturn {\n\t\t...(systemPromptMode !== undefined ? { systemPromptMode } : {}),\n\t\t...(systemPromptFile !== undefined ? { systemPromptFile } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(tokenInjection !== undefined ? { tokenInjection } : {}),\n\t\t...(settingSources !== undefined ? { settingSources } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t};\n}\n\nexport function resolveSystemPromptMode(settings: ClaudeSdkOauthProviderSettings): ResolvedSystemPromptMode {\n\tif (settings.systemPromptMode !== undefined) {\n\t\treturn {\n\t\t\tmode: settings.systemPromptMode,\n\t\t\tsource: systemPromptModeSources.get(settings) ?? \"setting\",\n\t\t\tconflict: settings.appendSystemPrompt !== undefined,\n\t\t};\n\t}\n\tif (settings.appendSystemPrompt !== undefined) {\n\t\treturn {\n\t\t\tmode: settings.appendSystemPrompt ? \"full\" : \"preset-append\",\n\t\t\tsource: \"legacy\",\n\t\t\tconflict: false,\n\t\t};\n\t}\n\treturn { mode: \"full\", source: \"default\", conflict: false };\n}\n\n/** Load the provider block with env values taking precedence over project and global values. /\nexport function loadClaudeSdkOauthProviderSettings(\n\tsettingsManager: SettingsManager,\n\tenvironment: Environment = process.env,\n): ClaudeSdkOauthProviderSettings {\n\tconst global = settingsManager.getGlobalSettings() as SettingsWithClaudeSdkOauthProvider;\n\tconst project = settingsManager.getProjectSettings() as SettingsWithClaudeSdkOauthProvider;\n\tconst environmentSettings = parseEnvironmentSettings(environment);\n\tconst settings = {\n\t\t...parseProviderSettings(global.claudeSdkOauthProvider),\n\t\t...parseProviderSettings(project.claudeSdkOauthProvider),\n\t\t...environmentSettings,\n\t};\n\tif (environmentSettings.systemPromptMode !== undefined) systemPromptModeSources.set(settings, \"env\");\n\treturn settings;\n}\n\n/* Load settings from Senpi's configured global and project settings.json paths. */\nexport function loadClaudeSdkOauthProviderSettingsFromDisk(cwd: string): ClaudeSdkOauthProviderSettings {\n\treturn loadClaudeSdkOauthProviderSettings(SettingsManager.create(cwd, getAgentDir()));\n}\n"]}
1	+ {"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/claude-sdk-oauth/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAiB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAsC9E,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAyC,CAAC;AAErF,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;QAC/F,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAyB;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,OAAO,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC;QACT,KAAK,MAAM;YACV,OAAO,IAAI,CAAC;QACb,KAAK,GAAG,CAAC;QACT,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,kBAAkB,GAAG,OAAO,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,eAAe,GAAG,OAAO,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAwB;IACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACpF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACtG,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,8BAA8B,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAC1G,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC7F,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAwC;IAC/E,IAAI,QAAQ,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,gBAAgB;YAC/B,MAAM,EAAE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;YAC1D,QAAQ,EAAE,QAAQ,CAAC,kBAAkB,KAAK,SAAS;SACnD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;YAC5D,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,KAAK;SACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,kCAAkC,CACjD,eAAgC,EAChC,cAA2B,OAAO,CAAC,GAAG;IAEtC,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAwC,CAAC;IACzF,MAAM,OAAO,GAAG,eAAe,CAAC,kBAAkB,EAAwC,CAAC;IAC3F,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG;QAChB,GAAG,qBAAqB,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACvD,GAAG,qBAAqB,CAAC,OAAO,CAAC,sBAAsB,CAAC;QACxD,GAAG,mBAAmB;KACtB,CAAC;IACF,IAAI,mBAAmB,CAAC,gBAAgB,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrG,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0CAA0C,CAAC,GAAW;IACrE,OAAO,kCAAkC,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { getAgentDir } from \"../../../../config.ts\";\nimport { type Settings, SettingsManager } from \"../../../settings-manager.ts\";\nimport type { SettingSource } from \"./sdk-boundary.ts\";\n\nexport type ClaudeSdkOauthSystemPromptMode = \"preset-append\" \| \"full\" \| \"override\";\nexport type ClaudeSdkOauthResumeMode = \"auto\" \| \"off\";\nexport type ClaudeSdkOauthTokenInjection = \"oauth-slots\" \| \"config-dir\" \| \"ambient\";\n\nexport interface ClaudeSdkOauthProviderSettings {\n\t/*\n\t Explicit opt-in for the ambient (host Claude CLI) auth lane. Absent means\n\t * false: a logged-in host CLI alone never makes this provider available,\n\t * because that would silently spend the user's Claude subscription. Stored\n\t * accounts and `CLAUDE_CODE_OAUTH_TOKEN` are themselves explicit opt-ins\n\t and stay available without this flag.\n\t /\n\treadonly enabled?: boolean;\n\treadonly appendSystemPrompt?: boolean;\n\treadonly systemPromptMode?: ClaudeSdkOauthSystemPromptMode;\n\treadonly systemPromptFile?: string;\n\treadonly resumeMode?: ClaudeSdkOauthResumeMode;\n\treadonly settingSources?: SettingSource[];\n\treadonly strictMcpConfig?: boolean;\n\treadonly pinnedAccount?: string;\n\treadonly tokenInjection?: ClaudeSdkOauthTokenInjection;\n}\n\nexport type ResolvedSystemPromptMode = {\n\tmode: ClaudeSdkOauthSystemPromptMode;\n\tsource: string;\n\tconflict: boolean;\n};\n\ntype SettingsWithClaudeSdkOauthProvider = Settings & {\n\tclaudeSdkOauthProvider?: unknown;\n};\n\ntype Environment = Readonly<Record<string, string \| undefined>>;\n\nconst systemPromptModeSources = new WeakMap<ClaudeSdkOauthProviderSettings, \"env\">();\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseSettingSources(value: unknown): SettingSource[] \| undefined {\n\tif (!Array.isArray(value)) return undefined;\n\tif (!value.every((source) => source === \"user\" \|\| source === \"project\" \|\| source === \"local\")) {\n\t\treturn undefined;\n\t}\n\treturn [...value];\n}\n\nfunction parseEnvironmentSettingSources(value: string \| undefined): SettingSource[] \| undefined {\n\tif (value === undefined) return undefined;\n\tif (value === \"\") return [];\n\treturn parseSettingSources(value.split(\",\").map((source) => source.trim()));\n}\n\nfunction parseSystemPromptMode(value: unknown): ClaudeSdkOauthSystemPromptMode \| undefined {\n\treturn value === \"preset-append\" \|\| value === \"full\" \|\| value === \"override\" ? value : undefined;\n}\n\nfunction parseResumeMode(value: unknown): ClaudeSdkOauthResumeMode \| undefined {\n\treturn value === \"auto\" \|\| value === \"off\" ? value : undefined;\n}\n\nfunction parseTokenInjection(value: unknown): ClaudeSdkOauthTokenInjection \| undefined {\n\treturn value === \"oauth-slots\" \|\| value === \"config-dir\" \|\| value === \"ambient\" ? value : undefined;\n}\n\nfunction parseEnvironmentBoolean(value: string \| undefined): boolean \| undefined {\n\tif (value === undefined) return undefined;\n\tswitch (value.toLowerCase()) {\n\t\tcase \"1\":\n\t\tcase \"true\":\n\t\t\treturn true;\n\t\tcase \"0\":\n\t\tcase \"false\":\n\t\t\treturn false;\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nfunction parseNonEmptyString(value: unknown): string \| undefined {\n\treturn typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\nfunction parseProviderSettings(value: unknown): ClaudeSdkOauthProviderSettings {\n\tif (!isRecord(value)) return {};\n\tconst enabled = typeof value.enabled === \"boolean\" ? value.enabled : undefined;\n\tconst appendSystemPrompt = typeof value.appendSystemPrompt === \"boolean\" ? value.appendSystemPrompt : undefined;\n\tconst systemPromptMode = parseSystemPromptMode(value.systemPromptMode);\n\tconst systemPromptFile = parseNonEmptyString(value.systemPromptFile);\n\tconst resumeMode = parseResumeMode(value.resumeMode);\n\tconst settingSources = parseSettingSources(value.settingSources);\n\tconst strictMcpConfig = typeof value.strictMcpConfig === \"boolean\" ? value.strictMcpConfig : undefined;\n\tconst pinnedAccount = parseNonEmptyString(value.pinnedAccount);\n\tconst tokenInjection = parseTokenInjection(value.tokenInjection);\n\treturn {\n\t\t...(enabled !== undefined ? { enabled } : {}),\n\t\t...(appendSystemPrompt !== undefined ? { appendSystemPrompt } : {}),\n\t\t...(systemPromptMode !== undefined ? { systemPromptMode } : {}),\n\t\t...(systemPromptFile !== undefined ? { systemPromptFile } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(settingSources !== undefined ? { settingSources } : {}),\n\t\t...(strictMcpConfig !== undefined ? { strictMcpConfig } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t\t...(tokenInjection !== undefined ? { tokenInjection } : {}),\n\t};\n}\n\nfunction parseEnvironmentSettings(environment: Environment): ClaudeSdkOauthProviderSettings {\n\tconst enabled = parseEnvironmentBoolean(environment.SENPI_CLAUDE_SDK_OAUTH_ENABLED);\n\tconst systemPromptMode = parseSystemPromptMode(environment.SENPI_CLAUDE_SDK_OAUTH_SYSTEM_PROMPT_MODE);\n\tconst systemPromptFile = parseNonEmptyString(environment.SENPI_CLAUDE_SDK_OAUTH_SYSTEM_PROMPT_FILE);\n\tconst resumeMode = parseResumeMode(environment.SENPI_CLAUDE_SDK_OAUTH_RESUME);\n\tconst tokenInjection = parseTokenInjection(environment.SENPI_CLAUDE_SDK_OAUTH_TOKEN_INJECTION);\n\tconst settingSources = parseEnvironmentSettingSources(environment.SENPI_CLAUDE_SDK_OAUTH_SETTING_SOURCES);\n\tconst pinnedAccount = parseNonEmptyString(environment.SENPI_CLAUDE_SDK_OAUTH_PINNED_ACCOUNT);\n\treturn {\n\t\t...(enabled !== undefined ? { enabled } : {}),\n\t\t...(systemPromptMode !== undefined ? { systemPromptMode } : {}),\n\t\t...(systemPromptFile !== undefined ? { systemPromptFile } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(tokenInjection !== undefined ? { tokenInjection } : {}),\n\t\t...(settingSources !== undefined ? { settingSources } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t};\n}\n\nexport function resolveSystemPromptMode(settings: ClaudeSdkOauthProviderSettings): ResolvedSystemPromptMode {\n\tif (settings.systemPromptMode !== undefined) {\n\t\treturn {\n\t\t\tmode: settings.systemPromptMode,\n\t\t\tsource: systemPromptModeSources.get(settings) ?? \"setting\",\n\t\t\tconflict: settings.appendSystemPrompt !== undefined,\n\t\t};\n\t}\n\tif (settings.appendSystemPrompt !== undefined) {\n\t\treturn {\n\t\t\tmode: settings.appendSystemPrompt ? \"full\" : \"preset-append\",\n\t\t\tsource: \"legacy\",\n\t\t\tconflict: false,\n\t\t};\n\t}\n\treturn { mode: \"full\", source: \"default\", conflict: false };\n}\n\n/* Load the provider block with env values taking precedence over project and global values. /\nexport function loadClaudeSdkOauthProviderSettings(\n\tsettingsManager: SettingsManager,\n\tenvironment: Environment = process.env,\n): ClaudeSdkOauthProviderSettings {\n\tconst global = settingsManager.getGlobalSettings() as SettingsWithClaudeSdkOauthProvider;\n\tconst project = settingsManager.getProjectSettings() as SettingsWithClaudeSdkOauthProvider;\n\tconst environmentSettings = parseEnvironmentSettings(environment);\n\tconst settings = {\n\t\t...parseProviderSettings(global.claudeSdkOauthProvider),\n\t\t...parseProviderSettings(project.claudeSdkOauthProvider),\n\t\t...environmentSettings,\n\t};\n\tif (environmentSettings.systemPromptMode !== undefined) systemPromptModeSources.set(settings, \"env\");\n\treturn settings;\n}\n\n/* Load settings from Senpi's configured global and project settings.json paths. */\nexport function loadClaudeSdkOauthProviderSettingsFromDisk(cwd: string): ClaudeSdkOauthProviderSettings {\n\treturn loadClaudeSdkOauthProviderSettings(SettingsManager.create(cwd, getAgentDir()));\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts CHANGED Viewed

@@ -72,6 +72,13 @@ export declare function sanitizeCursorCliDenyCommands(entries: readonly string[]
  * - Force disabled in agent mode is allowed but warns once per session.
  * - Unproven sandbox modes are ignored with one warning per distinct value.
  */
+/**
+ * True while the settings guarantee an unattended agent-mode refusal: force is
+ * requested outside plan mode but `noApprovalAcknowledgedAt` was never set.
+ * Shared by the execution policy and the fallback-eligibility hook so the two
+ * can never disagree about when the lane refuses.
+ */
+export declare function cursorCliForceRefusalPending(input: Pick<CursorCliExecutionPolicyInput, "forceExecution" | "noApprovalAcknowledgedAt" | "executionMode">): boolean;
 export declare function resolveCursorCliExecutionPolicy(input: CursorCliExecutionPolicyInput, session: CursorCliGuardrailSession, denyCommands?: readonly string[]): CursorCliExecutionDecision;
 /**
  * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAA4C,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAA2B,CAAC;AAExG,eAAO,MAAM,wCAAwC,gKACyG,CAAC;AAE/J,eAAO,MAAM,qCAAqC,qLAC6H,CAAC;AAEhL,+FAA+F;AAC/F,eAAO,MAAM,uCAAuC,iMACyI,CAAC;AAE9L,MAAM,MAAM,6BAA6B,GACtC,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,sCAAsC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClF,mGAAmG;IACnG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,wBAAgB,+BAA+B,IAAI,yBAAyB,CAoB3E;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACA,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD,CAAC;AAEL,wFAAwF;AACxF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAG,sCAAsC,CAAU;IAChE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEhC,OAAO,EAAE,yBAAyB;CAK9C;AAKD,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,yBAAyB,EAClC,YAAY,GAAE,SAAS,MAAM,EAAO,GAClC,0BAA0B,CA2B5B;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmB5F"}
1	+ {"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAA4C,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAA2B,CAAC;AAExG,eAAO,MAAM,wCAAwC,gKACyG,CAAC;AAE/J,eAAO,MAAM,qCAAqC,qLAC6H,CAAC;AAEhL,+FAA+F;AAC/F,eAAO,MAAM,uCAAuC,iMACyI,CAAC;AAE9L,MAAM,MAAM,6BAA6B,GACtC,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,sCAAsC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClF,mGAAmG;IACnG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,wBAAgB,+BAA+B,IAAI,yBAAyB,CAoB3E;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACA,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD,CAAC;AAEL,wFAAwF;AACxF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAG,sCAAsC,CAAU;IAChE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEhC,OAAO,EAAE,yBAAyB;CAK9C;AAKD,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;GAUG;AACH;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,IAAI,CAAC,6BAA6B,EAAE,gBAAgB,GAAG,0BAA0B,GAAG,eAAe,CAAC,GACzG,OAAO,CAET;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,yBAAyB,EAClC,YAAY,GAAE,SAAS,MAAM,EAAO,GAClC,0BAA0B,CA2B5B;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmB5F"}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js CHANGED Viewed

@@ -74,10 +74,19 @@ export function sanitizeCursorCliDenyCommands(entries, warn) {
  * - Force disabled in agent mode is allowed but warns once per session.
  * - Unproven sandbox modes are ignored with one warning per distinct value.
  */
+/**
+ * True while the settings guarantee an unattended agent-mode refusal: force is
+ * requested outside plan mode but `noApprovalAcknowledgedAt` was never set.
+ * Shared by the execution policy and the fallback-eligibility hook so the two
+ * can never disagree about when the lane refuses.
+ */
+export function cursorCliForceRefusalPending(input) {
+    return input.executionMode !== "plan" && input.forceExecution && input.noApprovalAcknowledgedAt === undefined;
+}
 export function resolveCursorCliExecutionPolicy(input, session, denyCommands = []) {
     const planMode = input.executionMode === "plan";
     const wantsForce = !planMode && input.forceExecution;
-    if (wantsForce && input.noApprovalAcknowledgedAt === undefined) {
+    if (cursorCliForceRefusalPending(input)) {
         const refusal = {
             kind: "refusal",
             code: "no_approval_acknowledgement_required",

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoC,wCAAwC,EAAE,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAqC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,wCAAwC,GACpD,6JAA6J,CAAC;AAE/J,MAAM,CAAC,MAAM,qCAAqC,GACjD,8KAA8K,CAAC;AAEhL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uCAAuC,GACnD,4LAA4L,CAAC;AA6B9L,MAAM,UAAU,+BAA+B;IAC9C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,OAAe,EAAE,MAAc,IAAI,EAAW,EAAE;QAClG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,wCAAwC,CACnE,IAAI,GAAG,CAAC,8BAA8B,CAAC,EACvC,CAAC,OAAO,EAAE,EAAE;QACX,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CACD,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,mBAAmB;KACnB,CAAC;AACH,CAAC;AAqBD,wFAAwF;AACxF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAIxD,YAAY,OAAkC;QAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAJf,SAAI,GAAG,sCAA+C,CAAC;QAK/D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAC5C,OAA0B,EAC1B,IAAgC;IAEhC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,4EAA4E,CAAC,CAAC;YACrF,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CACL,uGAAuG,OAAO,EAAE,CAChH,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC9C,KAAoC,EACpC,OAAkC,EAClC,eAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,UAAU,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,OAAO,GAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,GAAG,wCAAwC,IAAI,qCAAqC,EAAE;YAC/F,mBAAmB,EAAE,qCAAqC;SAC1D,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACrF,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,UAAU;QACjB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW;QACX,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,OAAO,SAAS,OAAO,GAAG,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAA+B;IACrF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,+DAA+D;QAChE,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,MAAM,GAA4B;QACvC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;KACvE,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type CursorCliOauthExecutionMode, createCursorCliOauthSandboxModeValidator } from \"./settings.ts\";\n\n/*\n Guardrails for unattended Cursor CLI execution.\n \n The Cursor CLI runs its own tools the moment `--force` is on the argv, so\n * that decision is never implicit: it requires the explicit\n * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a\n * disabled force merely warns. Command denylists ride along through the\n * per-account HOME's `cli-config.json`, strictly in the probe-proven shape\n * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).\n /\n\n/* Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). /\nexport const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly [\"enabled\", \"disabled\"] = [\"enabled\", \"disabled\"];\n\nexport const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION =\n\t\"The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.\";\n\nexport const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP =\n\t'Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.';\n\n/* One warning per session when force is disabled in agent mode (contracts block, task 18). /\nexport const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING =\n\t'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.';\n\nexport type CursorCliGuardrailWarningCode =\n\t\| \"force_execution_disabled\"\n\t\| \"sandbox_mode_ignored\"\n\t\| \"deny_command_rejected\";\n\nexport type CursorCliGuardrailWarning = {\n\treadonly kind: \"warning\";\n\treadonly code: CursorCliGuardrailWarningCode;\n\treadonly message: string;\n};\n\nexport type CursorCliExecutionRefusal = {\n\treadonly kind: \"refusal\";\n\treadonly code: \"no_approval_acknowledgement_required\";\n\treadonly message: string;\n\treadonly acknowledgementStep: string;\n};\n\nexport type CursorCliGuardrailSession = {\n\t/* Every warning emitted so far in this session; one-time gates live here. /\n\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t/* Emit a warning once per deduplication key; returns whether it was emitted. /\n\twarn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;\n\t/* Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. /\n\tvalidateSandboxMode(value: string \| undefined): string \| undefined;\n};\n\nexport function createCursorCliGuardrailSession(): CursorCliGuardrailSession {\n\tconst warnings: CursorCliGuardrailWarning[] = [];\n\tconst emitted = new Set<string>();\n\tconst warn = (code: CursorCliGuardrailWarningCode, message: string, key: string = code): boolean => {\n\t\tif (emitted.has(key)) return false;\n\t\temitted.add(key);\n\t\twarnings.push({ kind: \"warning\", code, message });\n\t\treturn true;\n\t};\n\tconst validateSandboxMode = createCursorCliOauthSandboxModeValidator(\n\t\tnew Set(CURSOR_CLI_OAUTH_SANDBOX_MODES),\n\t\t(message) => {\n\t\t\twarn(\"sandbox_mode_ignored\", message, `sandbox_mode_ignored:${message}`);\n\t\t},\n\t);\n\treturn {\n\t\twarnings,\n\t\twarn,\n\t\tvalidateSandboxMode,\n\t};\n}\n\nexport type CursorCliExecutionPolicyInput = {\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string \| undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly sandboxMode: string \| undefined;\n};\n\nexport type CursorCliExecutionDecision =\n\t\| { readonly status: \"refused\"; readonly refusal: CursorCliExecutionRefusal }\n\t\| {\n\t\t\treadonly status: \"allowed\";\n\t\t\treadonly force: boolean;\n\t\t\treadonly executionMode: CursorCliOauthExecutionMode;\n\t\t\treadonly sandboxMode: string \| undefined;\n\t\t\treadonly denyCommands: readonly string[];\n\t\t\t/* Warnings accumulated in the session so far (not only this decision). /\n\t\t\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t };\n\n/* Typed refusal for an unacknowledged force attempt; never confused with a warning. /\nexport class CursorCliExecutionRefusalError extends Error {\n\treadonly code = \"no_approval_acknowledgement_required\" as const;\n\treadonly refusal: CursorCliExecutionRefusal;\n\n\tconstructor(refusal: CursorCliExecutionRefusal) {\n\t\tsuper(refusal.message);\n\t\tthis.name = \"CursorCliExecutionRefusalError\";\n\t\tthis.refusal = refusal;\n\t}\n}\n\n/* Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. /\nconst GLOB_METACHARACTERS = /[?[]/u;\n\nexport function sanitizeCursorCliDenyCommands(\n\tentries: readonly string[],\n\twarn?: (message: string) => void,\n): readonly string[] {\n\tconst kept: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst command = entry.trim();\n\t\tif (command.length === 0) {\n\t\t\twarn?.(\"Ignoring an empty Cursor CLI deny command entry (exact full commands only)\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (GLOB_METACHARACTERS.test(command)) {\n\t\t\twarn?.(\n\t\t\t\t`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tkept.push(command);\n\t}\n\treturn kept;\n}\n\n/*\n Decide whether a turn may run unattended.\n \n - `--force` is emitted only in agent mode, only when force is requested, and\n * only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a\n * typed refusal naming the acknowledgement step.\n * - Plan mode never emits `--force` (the CLI only plans), so it needs no\n * acknowledgement.\n * - Force disabled in agent mode is allowed but warns once per session.\n * - Unproven sandbox modes are ignored with one warning per distinct value.\n /\nexport function resolveCursorCliExecutionPolicy(\n\tinput: CursorCliExecutionPolicyInput,\n\tsession: CursorCliGuardrailSession,\n\tdenyCommands: readonly string[] = [],\n): CursorCliExecutionDecision {\n\tconst planMode = input.executionMode === \"plan\";\n\tconst wantsForce = !planMode && input.forceExecution;\n\tif (wantsForce && input.noApprovalAcknowledgedAt === undefined) {\n\t\tconst refusal: CursorCliExecutionRefusal = {\n\t\t\tkind: \"refusal\",\n\t\t\tcode: \"no_approval_acknowledgement_required\",\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,\n\t\t\tacknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,\n\t\t};\n\t\treturn { status: \"refused\", refusal };\n\t}\n\tif (!planMode && !input.forceExecution) {\n\t\tsession.warn(\"force_execution_disabled\", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);\n\t}\n\tconst sandboxMode = session.validateSandboxMode(input.sandboxMode);\n\tconst sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {\n\t\tsession.warn(\"deny_command_rejected\", message, `deny_command_rejected:${message}`);\n\t});\n\treturn {\n\t\tstatus: \"allowed\",\n\t\tforce: wantsForce,\n\t\texecutionMode: input.executionMode,\n\t\tsandboxMode,\n\t\tdenyCommands: sanitizedDenyCommands,\n\t\twarnings: [...session.warnings],\n\t};\n}\n\nconst CLI_CONFIG_RELATIVE_PATH = join(\".cursor\", \"cli-config.json\");\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction shellDenyEntry(command: string): string {\n\treturn `Shell(${command})`;\n}\n\n/\n Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's\n * `cli-config.json`.\n \n The CLI rewrites this file during every invocation (task 2 observed its own\n * keys appearing and `cli-config.json.bad` sidecars for malformed content), so\n * this must run immediately before each spawn, composing with the home-store\n * prepare pass that re-writes `auth.json` on the same cadence. Writes only the\n * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`\n * entries) and preserves every CLI-owned key already present. Writes nothing\n * when no deny commands are configured.\n */\nexport function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void {\n\tif (denyCommands.length === 0) return;\n\tconst configPath = join(home, CLI_CONFIG_RELATIVE_PATH);\n\tlet existing: Record<string, unknown> = {};\n\tif (existsSync(configPath)) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(readFileSync(configPath, \"utf8\"));\n\t\t\tif (isRecord(parsed)) existing = parsed;\n\t\t} catch {\n\t\t\t// The CLI quarantines unparseable config as cli-config.json.bad and\n\t\t\t// proceeds with defaults; start from the proven minimal shape.\n\t\t}\n\t}\n\tconst permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};\n\tconst config: Record<string, unknown> = {\n\t\t...existing,\n\t\tpermissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },\n\t};\n\twriteFileSync(configPath, `${JSON.stringify(config, null, \"\\t\")}\\n`, \"utf8\");\n}\n"]}
1	+ {"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoC,wCAAwC,EAAE,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAqC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,wCAAwC,GACpD,6JAA6J,CAAC;AAE/J,MAAM,CAAC,MAAM,qCAAqC,GACjD,8KAA8K,CAAC;AAEhL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uCAAuC,GACnD,4LAA4L,CAAC;AA6B9L,MAAM,UAAU,+BAA+B;IAC9C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,OAAe,EAAE,MAAc,IAAI,EAAW,EAAE;QAClG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,wCAAwC,CACnE,IAAI,GAAG,CAAC,8BAA8B,CAAC,EACvC,CAAC,OAAO,EAAE,EAAE;QACX,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CACD,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,mBAAmB;KACnB,CAAC;AACH,CAAC;AAqBD,wFAAwF;AACxF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAIxD,YAAY,OAAkC;QAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAJf,SAAI,GAAG,sCAA+C,CAAC;QAK/D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAC5C,OAA0B,EAC1B,IAAgC;IAEhC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,4EAA4E,CAAC,CAAC;YACrF,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CACL,uGAAuG,OAAO,EAAE,CAChH,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC3C,KAA2G;IAE3G,OAAO,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAAoC,EACpC,OAAkC,EAClC,eAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,GAAG,wCAAwC,IAAI,qCAAqC,EAAE;YAC/F,mBAAmB,EAAE,qCAAqC;SAC1D,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACrF,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,UAAU;QACjB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW;QACX,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,OAAO,SAAS,OAAO,GAAG,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAA+B;IACrF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,+DAA+D;QAChE,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,MAAM,GAA4B;QACvC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;KACvE,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type CursorCliOauthExecutionMode, createCursorCliOauthSandboxModeValidator } from \"./settings.ts\";\n\n/*\n Guardrails for unattended Cursor CLI execution.\n \n The Cursor CLI runs its own tools the moment `--force` is on the argv, so\n * that decision is never implicit: it requires the explicit\n * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a\n * disabled force merely warns. Command denylists ride along through the\n * per-account HOME's `cli-config.json`, strictly in the probe-proven shape\n * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).\n /\n\n/* Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). /\nexport const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly [\"enabled\", \"disabled\"] = [\"enabled\", \"disabled\"];\n\nexport const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION =\n\t\"The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.\";\n\nexport const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP =\n\t'Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.';\n\n/* One warning per session when force is disabled in agent mode (contracts block, task 18). /\nexport const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING =\n\t'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.';\n\nexport type CursorCliGuardrailWarningCode =\n\t\| \"force_execution_disabled\"\n\t\| \"sandbox_mode_ignored\"\n\t\| \"deny_command_rejected\";\n\nexport type CursorCliGuardrailWarning = {\n\treadonly kind: \"warning\";\n\treadonly code: CursorCliGuardrailWarningCode;\n\treadonly message: string;\n};\n\nexport type CursorCliExecutionRefusal = {\n\treadonly kind: \"refusal\";\n\treadonly code: \"no_approval_acknowledgement_required\";\n\treadonly message: string;\n\treadonly acknowledgementStep: string;\n};\n\nexport type CursorCliGuardrailSession = {\n\t/* Every warning emitted so far in this session; one-time gates live here. /\n\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t/* Emit a warning once per deduplication key; returns whether it was emitted. /\n\twarn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;\n\t/* Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. /\n\tvalidateSandboxMode(value: string \| undefined): string \| undefined;\n};\n\nexport function createCursorCliGuardrailSession(): CursorCliGuardrailSession {\n\tconst warnings: CursorCliGuardrailWarning[] = [];\n\tconst emitted = new Set<string>();\n\tconst warn = (code: CursorCliGuardrailWarningCode, message: string, key: string = code): boolean => {\n\t\tif (emitted.has(key)) return false;\n\t\temitted.add(key);\n\t\twarnings.push({ kind: \"warning\", code, message });\n\t\treturn true;\n\t};\n\tconst validateSandboxMode = createCursorCliOauthSandboxModeValidator(\n\t\tnew Set(CURSOR_CLI_OAUTH_SANDBOX_MODES),\n\t\t(message) => {\n\t\t\twarn(\"sandbox_mode_ignored\", message, `sandbox_mode_ignored:${message}`);\n\t\t},\n\t);\n\treturn {\n\t\twarnings,\n\t\twarn,\n\t\tvalidateSandboxMode,\n\t};\n}\n\nexport type CursorCliExecutionPolicyInput = {\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string \| undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly sandboxMode: string \| undefined;\n};\n\nexport type CursorCliExecutionDecision =\n\t\| { readonly status: \"refused\"; readonly refusal: CursorCliExecutionRefusal }\n\t\| {\n\t\t\treadonly status: \"allowed\";\n\t\t\treadonly force: boolean;\n\t\t\treadonly executionMode: CursorCliOauthExecutionMode;\n\t\t\treadonly sandboxMode: string \| undefined;\n\t\t\treadonly denyCommands: readonly string[];\n\t\t\t/* Warnings accumulated in the session so far (not only this decision). /\n\t\t\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t };\n\n/* Typed refusal for an unacknowledged force attempt; never confused with a warning. /\nexport class CursorCliExecutionRefusalError extends Error {\n\treadonly code = \"no_approval_acknowledgement_required\" as const;\n\treadonly refusal: CursorCliExecutionRefusal;\n\n\tconstructor(refusal: CursorCliExecutionRefusal) {\n\t\tsuper(refusal.message);\n\t\tthis.name = \"CursorCliExecutionRefusalError\";\n\t\tthis.refusal = refusal;\n\t}\n}\n\n/* Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. /\nconst GLOB_METACHARACTERS = /[?[]/u;\n\nexport function sanitizeCursorCliDenyCommands(\n\tentries: readonly string[],\n\twarn?: (message: string) => void,\n): readonly string[] {\n\tconst kept: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst command = entry.trim();\n\t\tif (command.length === 0) {\n\t\t\twarn?.(\"Ignoring an empty Cursor CLI deny command entry (exact full commands only)\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (GLOB_METACHARACTERS.test(command)) {\n\t\t\twarn?.(\n\t\t\t\t`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tkept.push(command);\n\t}\n\treturn kept;\n}\n\n/*\n Decide whether a turn may run unattended.\n \n - `--force` is emitted only in agent mode, only when force is requested, and\n * only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a\n * typed refusal naming the acknowledgement step.\n * - Plan mode never emits `--force` (the CLI only plans), so it needs no\n * acknowledgement.\n * - Force disabled in agent mode is allowed but warns once per session.\n * - Unproven sandbox modes are ignored with one warning per distinct value.\n /\n/\n True while the settings guarantee an unattended agent-mode refusal: force is\n * requested outside plan mode but `noApprovalAcknowledgedAt` was never set.\n * Shared by the execution policy and the fallback-eligibility hook so the two\n * can never disagree about when the lane refuses.\n /\nexport function cursorCliForceRefusalPending(\n\tinput: Pick<CursorCliExecutionPolicyInput, \"forceExecution\" \| \"noApprovalAcknowledgedAt\" \| \"executionMode\">,\n): boolean {\n\treturn input.executionMode !== \"plan\" && input.forceExecution && input.noApprovalAcknowledgedAt === undefined;\n}\n\nexport function resolveCursorCliExecutionPolicy(\n\tinput: CursorCliExecutionPolicyInput,\n\tsession: CursorCliGuardrailSession,\n\tdenyCommands: readonly string[] = [],\n): CursorCliExecutionDecision {\n\tconst planMode = input.executionMode === \"plan\";\n\tconst wantsForce = !planMode && input.forceExecution;\n\tif (cursorCliForceRefusalPending(input)) {\n\t\tconst refusal: CursorCliExecutionRefusal = {\n\t\t\tkind: \"refusal\",\n\t\t\tcode: \"no_approval_acknowledgement_required\",\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,\n\t\t\tacknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,\n\t\t};\n\t\treturn { status: \"refused\", refusal };\n\t}\n\tif (!planMode && !input.forceExecution) {\n\t\tsession.warn(\"force_execution_disabled\", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);\n\t}\n\tconst sandboxMode = session.validateSandboxMode(input.sandboxMode);\n\tconst sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {\n\t\tsession.warn(\"deny_command_rejected\", message, `deny_command_rejected:${message}`);\n\t});\n\treturn {\n\t\tstatus: \"allowed\",\n\t\tforce: wantsForce,\n\t\texecutionMode: input.executionMode,\n\t\tsandboxMode,\n\t\tdenyCommands: sanitizedDenyCommands,\n\t\twarnings: [...session.warnings],\n\t};\n}\n\nconst CLI_CONFIG_RELATIVE_PATH = join(\".cursor\", \"cli-config.json\");\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction shellDenyEntry(command: string): string {\n\treturn `Shell(${command})`;\n}\n\n/\n Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's\n * `cli-config.json`.\n \n The CLI rewrites this file during every invocation (task 2 observed its own\n * keys appearing and `cli-config.json.bad` sidecars for malformed content), so\n * this must run immediately before each spawn, composing with the home-store\n * prepare pass that re-writes `auth.json` on the same cadence. Writes only the\n * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`\n * entries) and preserves every CLI-owned key already present. Writes nothing\n * when no deny commands are configured.\n */\nexport function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void {\n\tif (denyCommands.length === 0) return;\n\tconst configPath = join(home, CLI_CONFIG_RELATIVE_PATH);\n\tlet existing: Record<string, unknown> = {};\n\tif (existsSync(configPath)) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(readFileSync(configPath, \"utf8\"));\n\t\t\tif (isRecord(parsed)) existing = parsed;\n\t\t} catch {\n\t\t\t// The CLI quarantines unparseable config as cli-config.json.bad and\n\t\t\t// proceeds with defaults; start from the proven minimal shape.\n\t\t}\n\t}\n\tconst permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};\n\tconst config: Record<string, unknown> = {\n\t\t...existing,\n\t\tpermissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },\n\t};\n\twriteFileSync(configPath, `${JSON.stringify(config, null, \"\\t\")}\\n`, \"utf8\");\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/index.d.ts CHANGED Viewed

@@ -9,6 +9,7 @@ export type CursorCliOauthExtensionDeps = {
     readonly agentDir?: string;
     readonly store?: CredentialStore;
     readonly readCurrent?: () => Promise<Credential | undefined>;
+    readonly readNativeCredential?: () => Credential | undefined | Promise<Credential | undefined>;
     readonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;
     readonly resolveExecutable?: (settings: {
         executablePath?: string;

package/dist/core/extensions/builtin/cursor-cli-oauth/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;~~AAKxE~~,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,mEAAmE;AACnE,MAAM,MAAM,2BAA2B,GAAG;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,8BAA8B,CAAC;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CAC/E,CAAC;AAKF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,GAAE,2BAAgC,GAAG,IAAI,~~CAmD9G~~;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAEtE"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AAOxE,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,mEAAmE;AACnE,MAAM,MAAM,2BAA2B,GAAG;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC/F,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,8BAA8B,CAAC;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CAC/E,CAAC;AAKF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,GAAE,2BAAgC,GAAG,IAAI,CA4E9G;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAEtE"}

package/dist/core/extensions/builtin/cursor-cli-oauth/index.js CHANGED Viewed

@@ -2,7 +2,9 @@ import { getAgentDir } from "../../../../config.js";
 import { AuthStorage } from "../../../auth-storage.js";
 import { registerCursorCliAccountCommand } from "./account-command.js";
 import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from "./executable.js";
+import { cursorCliForceRefusalPending } from "./guardrails.js";
 import { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from "./models.js";
+import { createCursorCliOauthCredentialReader } from "./native-bootstrap.js";
 import { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from "./oauth-login.js";
 import { loadCursorCliOauthProviderSettingsFromDisk, persistCursorCliNoApprovalAcknowledgement, persistCursorCliOauthEnabled, } from "./settings.js";
 import { streamCursorCliOauth } from "./stream.js";
@@ -18,7 +20,25 @@ export function registerCursorCliOauthExtension(pi, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const agentDir = deps.agentDir ?? getAgentDir();
     const store = deps.store ?? AuthStorage.create();
-    const readCurrent = deps.readCurrent ?? (async () => store.read(CURSOR_CLI_OAUTH_PROVIDER_ID));
+    const readCurrent = deps.readCurrent ??
+        createCursorCliOauthCredentialReader({
+            store,
+            readNativeCredential: deps.readNativeCredential ?? (() => store.read("cursor")),
+            // Copying the host's native Cursor credential IS the ambient lane, so it
+            // requires the explicit flag - never merely a logged-in cursor-agent.
+            canBootstrap: () => {
+                const settings = loadSettings(cwd);
+                if (!settings.enabled || settings.explicitlyDisabled)
+                    return false;
+                try {
+                    resolveExecutable(settings);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            },
+        });
     const loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;
     const resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;
     // Todo 21: /cursor-account command plus the reload/shutdown teardown for
@@ -32,6 +52,14 @@ export function registerCursorCliOauthExtension(pi, deps = {}) {
             // Settings, accounts, and the executable are re-resolved inside every
             // turn; nothing captured here outlives a settings or credential change.
             streamSimple: (model, context, options) => streamCursorCliOauth(model, context, options, { cwd, agentDir, store }),
+            // A kill-switched lane, or one whose unacknowledged --force gate
+            // guarantees a refusal, must not consume an implicit fallback-expansion
+            // slot it can never serve. Only deterministic settings-level states
+            // exclude; explicit selection and /login stay available either way.
+            fallbackEligible: () => {
+                const current = loadSettings(cwd);
+                return !current.explicitlyDisabled && !cursorCliForceRefusalPending(current);
+            },
             oauth: createCursorCliOauthConfig({
                 readCurrent,
                 readSettings: () => loadSettings(cwd),

package/dist/core/extensions/builtin/cursor-cli-oauth/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;~~AAahE~~,MAAM,wBAAwB,GAAG,CAAC,QAAqC,EAAU,EAAE,CAClF,4BAA4B,CAAC,EAAE,GAAG,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAgB,EAAE,OAAoC,EAAE;IACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACjD,MAAM,WAAW,~~GAAG~~,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,~~4BAA4B~~,CAAC,CAAC,CAAC;~~IAC/F~~,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0CAA0C,CAAC;IACrF,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;IAE7E,yEAAyE;IACzE,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAQ,EAAE;QACjE,EAAE,CAAC,gBAAgB,CAAC,4BAA4B,EAAE;YACjD,OAAO,EAAE,4BAA4B;YACrC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,sEAAsE;YACtE,wEAAwE;YACxE,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxE,KAAK,EAAE,0BAA0B,CAAC;gBACjC,WAAW;gBACX,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;gBACrC,iBAAiB;gBACjB,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC1G,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;aACvE,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAkD;IAClD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,4BAA4B,CAAC;QACjC,QAAQ;QACR,QAAQ,EAAE;YACT,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;SACvC;QACD,IAAI,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE;KACjG,CAAC;SACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACX,mFAAmF;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAgB;IAC/D,+BAA+B,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport type { ExtensionAPI, ProviderModelConfig } from \"../../types.ts\";\nimport { registerCursorCliAccountCommand } from \"./account-command.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\nimport { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from \"./models.ts\";\nimport { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from \"./oauth-login.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\nimport { streamCursorCliOauth } from \"./stream.ts\";\n\nexport { CURSOR_CLI_OAUTH_PROVIDER_ID } from \"./oauth-login.ts\";\nexport type { CursorCliStreamDeps } from \"./stream.ts\";\n\n/** Injectable seams; every default resolves real on-disk state. /\nexport type CursorCliOauthExtensionDeps = {\n\treadonly cwd?: string;\n\treadonly agentDir?: string;\n\treadonly store?: CredentialStore;\n\treadonly readCurrent?: () => Promise<Credential \| undefined>;\n\treadonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;\n\treadonly resolveExecutable?: (settings: { executablePath?: string }) => string;\n};\n\nconst defaultResolveExecutable = (settings: { executablePath?: string }): string =>\n\tresolveCursorAgentExecutable({ ...defaultCursorAgentExecutableDeps(), settings });\n\n/\n Registers the cursor-cli-oauth provider lane. Registration is unconditional:\n * the provider ships with the offline model fallback and reports availability\n * through the oauth `check`, so a missing cursor-agent binary never hides the\n * lane - it only makes `check` name the install guidance.\n */\nexport function registerCursorCliOauthExtension(pi: ExtensionAPI, deps: CursorCliOauthExtensionDeps = {}): void {\n\tconst cwd = deps.cwd ?? process.cwd();\n\tconst agentDir = deps.agentDir ?? getAgentDir();\n\tconst store = deps.store ?? AuthStorage.create();\n\tconst readCurrent = deps.~~readCurrent~~ ?? (~~async~~ () => store.read(~~CURSOR_CLI_OAUTH_PROVIDER_ID~~));\n\tconst loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;\n\tconst resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;\n\n\t// Todo 21: /cursor-account command plus the reload/shutdown teardown for\n\t// this extension generation (minimal additive wiring).\n\tregisterCursorCliAccountCommand(pi);\n\n\tconst register = (models: readonly ProviderModelConfig[]): void => {\n\t\tpi.registerProvider(CURSOR_CLI_OAUTH_PROVIDER_ID, {\n\t\t\tbaseUrl: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tapi: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tmodels: models.map((entry) => ({ ...entry })),\n\t\t\t// Settings, accounts, and the executable are re-resolved inside every\n\t\t\t// turn; nothing captured here outlives a settings or credential change.\n\t\t\tstreamSimple: (model, context, options) =>\n\t\t\t\tstreamCursorCliOauth(model, context, options, { cwd, agentDir, store }),\n\t\t\toauth: createCursorCliOauthConfig({\n\t\t\t\treadCurrent,\n\t\t\t\treadSettings: () => loadSettings(cwd),\n\t\t\t\tresolveExecutable,\n\t\t\t\tpersistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\t\t\tpersistEnabled: (enabled) => persistCursorCliOauthEnabled(cwd, enabled),\n\t\t\t}),\n\t\t});\n\t};\n\n\t// Register immediately with the offline fallback so a missing, hanging, or\n\t// broken cursor-agent can never delay or block provider registration; the\n\t// probe-backed catalog replaces it once resolved.\n\tregister(STATIC_CURSOR_CLI_MODELS);\n\tconst settings = loadSettings(cwd);\n\tvoid resolveCursorCliModelCatalog({\n\t\tagentDir,\n\t\tsettings: {\n\t\t\tmodelCatalogTtlHours: settings.modelCatalogTtlHours,\n\t\t\texecutablePath: settings.executablePath,\n\t\t},\n\t\tdeps: { resolveExecutable: () => resolveExecutable({ executablePath: settings.executablePath }) },\n\t})\n\t\t.then((models) => {\n\t\t\tconst resolved = models.map((entry) => entry.id).join(\"\\n\");\n\t\t\tif (resolved !== STATIC_CURSOR_CLI_MODELS.map((entry) => entry.id).join(\"\\n\")) register(models);\n\t\t})\n\t\t.catch(() => {\n\t\t\t// The loader degrades to the static fallback itself; keep the registered fallback.\n\t\t});\n}\n\nexport default function cursorCliOauthExtension(pi: ExtensionAPI): void {\n\tregisterCursorCliOauthExtension(pi);\n}\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAchE,MAAM,wBAAwB,GAAG,CAAC,QAAqC,EAAU,EAAE,CAClF,4BAA4B,CAAC,EAAE,GAAG,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAgB,EAAE,OAAoC,EAAE;IACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACjD,MAAM,WAAW,GAChB,IAAI,CAAC,WAAW;QAChB,oCAAoC,CAAC;YACpC,KAAK;YACL,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/E,yEAAyE;YACzE,sEAAsE;YACtE,YAAY,EAAE,GAAG,EAAE;gBAClB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB;oBAAE,OAAO,KAAK,CAAC;gBACnE,IAAI,CAAC;oBACJ,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBAC5B,OAAO,IAAI,CAAC;gBACb,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;SACD,CAAC,CAAC;IACJ,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0CAA0C,CAAC;IACrF,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;IAE7E,yEAAyE;IACzE,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAQ,EAAE;QACjE,EAAE,CAAC,gBAAgB,CAAC,4BAA4B,EAAE;YACjD,OAAO,EAAE,4BAA4B;YACrC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,sEAAsE;YACtE,wEAAwE;YACxE,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxE,iEAAiE;YACjE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,gBAAgB,EAAE,GAAG,EAAE;gBACtB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClC,OAAO,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;YAC9E,CAAC;YACD,KAAK,EAAE,0BAA0B,CAAC;gBACjC,WAAW;gBACX,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;gBACrC,iBAAiB;gBACjB,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC1G,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;aACvE,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAkD;IAClD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,4BAA4B,CAAC;QACjC,QAAQ;QACR,QAAQ,EAAE;YACT,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;SACvC;QACD,IAAI,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE;KACjG,CAAC;SACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACX,mFAAmF;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAgB;IAC/D,+BAA+B,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport type { ExtensionAPI, ProviderModelConfig } from \"../../types.ts\";\nimport { registerCursorCliAccountCommand } from \"./account-command.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\nimport { cursorCliForceRefusalPending } from \"./guardrails.ts\";\nimport { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from \"./models.ts\";\nimport { createCursorCliOauthCredentialReader } from \"./native-bootstrap.ts\";\nimport { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from \"./oauth-login.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\nimport { streamCursorCliOauth } from \"./stream.ts\";\n\nexport { CURSOR_CLI_OAUTH_PROVIDER_ID } from \"./oauth-login.ts\";\nexport type { CursorCliStreamDeps } from \"./stream.ts\";\n\n/** Injectable seams; every default resolves real on-disk state. /\nexport type CursorCliOauthExtensionDeps = {\n\treadonly cwd?: string;\n\treadonly agentDir?: string;\n\treadonly store?: CredentialStore;\n\treadonly readCurrent?: () => Promise<Credential \| undefined>;\n\treadonly readNativeCredential?: () => Credential \| undefined \| Promise<Credential \| undefined>;\n\treadonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;\n\treadonly resolveExecutable?: (settings: { executablePath?: string }) => string;\n};\n\nconst defaultResolveExecutable = (settings: { executablePath?: string }): string =>\n\tresolveCursorAgentExecutable({ ...defaultCursorAgentExecutableDeps(), settings });\n\n/\n Registers the cursor-cli-oauth provider lane. Registration is unconditional:\n * the provider ships with the offline model fallback and reports availability\n * through the oauth `check`, so a missing cursor-agent binary never hides the\n * lane - it only makes `check` name the install guidance.\n */\nexport function registerCursorCliOauthExtension(pi: ExtensionAPI, deps: CursorCliOauthExtensionDeps = {}): void {\n\tconst cwd = deps.cwd ?? process.cwd();\n\tconst agentDir = deps.agentDir ?? getAgentDir();\n\tconst store = deps.store ?? AuthStorage.create();\n\tconst readCurrent =\n\t\tdeps.readCurrent ??\n\t\tcreateCursorCliOauthCredentialReader({\n\t\t\tstore,\n\t\t\treadNativeCredential: deps.readNativeCredential ?? (() => store.read(\"cursor\")),\n\t\t\t// Copying the host's native Cursor credential IS the ambient lane, so it\n\t\t\t// requires the explicit flag - never merely a logged-in cursor-agent.\n\t\t\tcanBootstrap: () => {\n\t\t\t\tconst settings = loadSettings(cwd);\n\t\t\t\tif (!settings.enabled \|\| settings.explicitlyDisabled) return false;\n\t\t\t\ttry {\n\t\t\t\t\tresolveExecutable(settings);\n\t\t\t\t\treturn true;\n\t\t\t\t} catch {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t},\n\t\t});\n\tconst loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;\n\tconst resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;\n\n\t// Todo 21: /cursor-account command plus the reload/shutdown teardown for\n\t// this extension generation (minimal additive wiring).\n\tregisterCursorCliAccountCommand(pi);\n\n\tconst register = (models: readonly ProviderModelConfig[]): void => {\n\t\tpi.registerProvider(CURSOR_CLI_OAUTH_PROVIDER_ID, {\n\t\t\tbaseUrl: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tapi: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tmodels: models.map((entry) => ({ ...entry })),\n\t\t\t// Settings, accounts, and the executable are re-resolved inside every\n\t\t\t// turn; nothing captured here outlives a settings or credential change.\n\t\t\tstreamSimple: (model, context, options) =>\n\t\t\t\tstreamCursorCliOauth(model, context, options, { cwd, agentDir, store }),\n\t\t\t// A kill-switched lane, or one whose unacknowledged --force gate\n\t\t\t// guarantees a refusal, must not consume an implicit fallback-expansion\n\t\t\t// slot it can never serve. Only deterministic settings-level states\n\t\t\t// exclude; explicit selection and /login stay available either way.\n\t\t\tfallbackEligible: () => {\n\t\t\t\tconst current = loadSettings(cwd);\n\t\t\t\treturn !current.explicitlyDisabled && !cursorCliForceRefusalPending(current);\n\t\t\t},\n\t\t\toauth: createCursorCliOauthConfig({\n\t\t\t\treadCurrent,\n\t\t\t\treadSettings: () => loadSettings(cwd),\n\t\t\t\tresolveExecutable,\n\t\t\t\tpersistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\t\t\tpersistEnabled: (enabled) => persistCursorCliOauthEnabled(cwd, enabled),\n\t\t\t}),\n\t\t});\n\t};\n\n\t// Register immediately with the offline fallback so a missing, hanging, or\n\t// broken cursor-agent can never delay or block provider registration; the\n\t// probe-backed catalog replaces it once resolved.\n\tregister(STATIC_CURSOR_CLI_MODELS);\n\tconst settings = loadSettings(cwd);\n\tvoid resolveCursorCliModelCatalog({\n\t\tagentDir,\n\t\tsettings: {\n\t\t\tmodelCatalogTtlHours: settings.modelCatalogTtlHours,\n\t\t\texecutablePath: settings.executablePath,\n\t\t},\n\t\tdeps: { resolveExecutable: () => resolveExecutable({ executablePath: settings.executablePath }) },\n\t})\n\t\t.then((models) => {\n\t\t\tconst resolved = models.map((entry) => entry.id).join(\"\\n\");\n\t\t\tif (resolved !== STATIC_CURSOR_CLI_MODELS.map((entry) => entry.id).join(\"\\n\")) register(models);\n\t\t})\n\t\t.catch(() => {\n\t\t\t// The loader degrades to the static fallback itself; keep the registered fallback.\n\t\t});\n}\n\nexport default function cursorCliOauthExtension(pi: ExtensionAPI): void {\n\tregisterCursorCliOauthExtension(pi);\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/models.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;~~AAW1D~~,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;~~AAqDF~~,eAAO,MAAM,wBAAwB,EAAE,SAAS,mBAAmB,~~EAElE~~,CAAC;~~AAEF~~,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAiBpF;AA6ID,0FAA0F;AAC1F,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,mCAAmC,GAC1C,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAkCzC"}
1	+ {"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAU1D,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AA+DF,eAAO,MAAM,wBAAwB,EAAE,SAAS,mBAAmB,EAA+C,CAAC;AAEnH,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAiBpF;AA6ID,0FAA0F;AAC1F,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,mCAAmC,GAC1C,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAkCzC"}

package/dist/core/extensions/builtin/cursor-cli-oauth/models.js CHANGED Viewed

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { mkdir, mkdtemp, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { normalizeCursorCatalog } from "@earendil-works/pi-ai";
 import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from "./executable.js";
 const MODEL_PROBE_TIMEOUT_MS = 15_000;
 const DEFAULT_MODEL_CATALOG_TTL_HOURS = 24;
@@ -9,7 +10,6 @@ const ANSI_ESCAPE_SEQUENCE = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
 const MODEL_LINE = /^(\S+)\s+-\s+(.+)$/;
 const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._/:+-]*$/;
 const MISLEADING_ERROR_LINE = /^\s*(?:error|failed|failure)(?=\s|:|-|$)/i;
-const REASONING_SUFFIX = /(?:^|-)(?:thinking(?:-(?:low|medium|high|xhigh|max))?|low|medium|high|xhigh|max)(?:-fast)?$/i;
 const STATIC_MODEL_DEFINITIONS = [
     { id: "auto", label: "Auto" },
     { id: "composer-2.5", label: "Composer 2.5 (200K context)" },
@@ -30,27 +30,33 @@ const STATIC_MODEL_DEFINITIONS = [
 function stripAnsi(value) {
     return value.replace(ANSI_ESCAPE_SEQUENCE, "");
 }
-function contextWindowFor(id, label) {
-    if (/\b1\s*M\b/i.test(label))
-        return 1_000_000;
-    if (id.toLowerCase().startsWith("claude-") && /\b300\s*K\b/i.test(label))
-        return 300_000;
-    if (id.toLowerCase().startsWith("gpt-") && /\b272\s*K\b/i.test(label))
-        return 272_000;
-    return 200_000;
-}
-function modelEntry(id, label) {
-    return {
-        id,
-        name: label,
-        reasoning: REASONING_SUFFIX.test(id),
+function normalizeEntries(raw) {
+    return normalizeCursorCatalog(raw.map(({ id, label }) => ({ id, name: label, input: ["text"], cursorMaxMode: false }))).map((entry) => ({
+        id: entry.id,
+        name: entry.name,
+        reasoning: entry.reasoning,
+        ...(entry.thinkingLevelMap ? { thinkingLevelMap: entry.thinkingLevelMap } : {}),
         input: ["text"],
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: contextWindowFor(id, label),
+        contextWindow: entry.window,
         maxTokens: 64_000,
-    };
+        ...(entry.representativeVariantId !== undefined && entry.representativeVariantId !== entry.id
+            ? { upstreamModelId: entry.representativeVariantId }
+            : {}),
+        compat: {
+            ...(entry.capabilityId !== undefined && entry.representativeVariantId !== undefined
+                ? {
+                    cursorReasoning: {
+                        capabilityId: entry.capabilityId,
+                        ...(entry.thinkingMode !== undefined ? { thinkingMode: entry.thinkingMode } : {}),
+                        representativeVariantId: entry.representativeVariantId,
+                    },
+                }
+                : {}),
+        },
+    }));
 }
-export const STATIC_CURSOR_CLI_MODELS = STATIC_MODEL_DEFINITIONS.map(({ id, label }) => modelEntry(id, label));
+export const STATIC_CURSOR_CLI_MODELS = normalizeEntries(STATIC_MODEL_DEFINITIONS);
 /** Parse the complete `cursor-agent models` listing into extension provider entries. */
 export function parseCursorAgentModelsListing(listing) {
     const plainListing = stripAnsi(listing);
@@ -58,7 +64,7 @@ export function parseCursorAgentModelsListing(listing) {
     if (lines.some((line) => MISLEADING_ERROR_LINE.test(line)))
         return [];
     const seen = new Set();
-    const models = [];
+    const raw = [];
     for (const rawLine of lines) {
         const match = MODEL_LINE.exec(rawLine.trim());
         if (!match)
@@ -68,9 +74,9 @@ export function parseCursorAgentModelsListing(listing) {
         if (!MODEL_ID.test(id) || label.length === 0 || seen.has(id))
             continue;
         seen.add(id);
-        models.push(modelEntry(id, label));
+        raw.push({ id, label });
     }
-    return models;
+    return normalizeEntries(raw);
 }
 async function runModelsProbe(executable, stdoutPath, timeoutMs) {
     const output = await open(stdoutPath, "w");
@@ -161,7 +167,7 @@ function parseCachedCatalog(contents) {
     if (typeof cachedAt !== "number" || !Number.isFinite(cachedAt) || !Array.isArray(models) || models.length === 0) {
         return undefined;
     }
-    const normalized = [];
+    const rawCached = [];
     const seen = new Set();
     for (const candidate of models) {
         if (typeof candidate !== "object" || candidate === null || !("id" in candidate) || !("name" in candidate)) {
@@ -177,9 +183,9 @@ function parseCachedCatalog(contents) {
             return undefined;
         }
         seen.add(id);
-        normalized.push(modelEntry(id, name));
+        rawCached.push({ id, label: name });
     }
-    return { cachedAt, models: normalized };
+    return { cachedAt, models: normalizeEntries(rawCached) };
 }
 async function readFreshCache(cachePath, now, ttlMs, deps) {
     try {

package/dist/core/extensions/builtin/cursor-cli-oauth/models.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAEjG,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,qBAAqB,GAAG,2CAA2C,CAAC;AAC1E,MAAM,gBAAgB,GAAG,8FAA8F,CAAC;AAmCxH,MAAM,wBAAwB,GAAqC;IAClE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7B,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC5D,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACtE,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACtE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC5D,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC9D,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAClD,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,4CAA4C,EAAE;IAC1F,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC9F,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,6CAA6C,EAAE;IAC5F,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC9F,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,oCAAoC,EAAE;IAC5E,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,qCAAqC,EAAE;CAC5E,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAU,EAAE,KAAa;IAClD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzF,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACtF,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,KAAa;IAC5C,OAAO;QACN,EAAE;QACF,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,KAAK,EAAE,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;QAC1D,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC;QAC1C,SAAS,EAAE,MAAM;KACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAmC,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CACtH,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CACrB,CAAC;AAEF,wFAAwF;AACxF,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,UAAkB,EAAE,SAAiB;IACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC3C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,OAAO,EAAE,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACpC,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,SAAS,aAAa,CAAC,CAAC,CAAC;oBAC9E,OAAO;gBACR,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;oBACvG,OAAO;gBACR,CAAC;gBACD,MAAM,EAAE,CAAC;YACV,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,QAAuC;IAC3D,OAAO;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,iBAAiB,EAAE,GAAG,EAAE;YACvB,MAAM,cAAc,GAAG,gCAAgC,EAAE,CAAC;YAC1D,OAAO,4BAA4B,CAAC;gBACnC,GAAG,cAAc;gBACjB,QAAQ,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;aACrD,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,cAAc;QACxB,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACnD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC9B,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAuC;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC5C,MAAM,UAAU,GACf,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC;IAC5G,OAAO,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC;QACvG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjH,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;YAC3G,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5B,IACC,OAAO,EAAE,KAAK,QAAQ;YACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EACX,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAW,EACX,KAAa,EACb,IAA+B;IAE/B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,cAAsB,EACtB,SAAiB,EACjB,OAA2B,EAC3B,IAA+B;IAE/B,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,MAAM,CAAC;IAC5E,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAA4C;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,kBAAsC,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,wBAAwB,CAAC;QACzD,IAAI,CAAC;YACJ,MAAM,UAAU,CAAC,cAAc,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACR,sEAAsE;QACvE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,wBAAwB,CAAC;IACjC,CAAC;YAAS,CAAC;QACV,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACR,2DAA2D;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { mkdir, mkdtemp, open, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { ProviderModelConfig } from \"../../types.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\n\nconst MODEL_PROBE_TIMEOUT_MS = 15_000;\nconst DEFAULT_MODEL_CATALOG_TTL_HOURS = 24;\nconst ANSI_ESCAPE_SEQUENCE = /\\u001B(?:[@-Z\\\\-_]\|\\[[0-?][ -/][@-~])/g;\nconst MODEL_LINE = /^(\\S+)\\s+-\\s+(.+)$/;\nconst MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._/:+-]$/;\nconst MISLEADING_ERROR_LINE = /^\\s(?:error\|failed\|failure)(?=\\s\|:\|-\|$)/i;\nconst REASONING_SUFFIX = /(?:^\|-)(?:thinking(?:-(?:low\|medium\|high\|xhigh\|max))?\|low\|medium\|high\|xhigh\|max)(?:-fast)?$/i;\n\nexport type CursorCliModelCatalogSettings = {\n\treadonly modelCatalogTtlHours?: number;\n\treadonly executablePath?: string;\n};\n\nexport type CursorCliModelCatalogDeps = {\n\tnow: () => number;\n\tresolveExecutable: () => string;\n\trunProbe: (executable: string, stdoutPath: string, timeoutMs: number) => Promise<void>;\n\tmakeTemporaryDirectory: (prefix: string) => Promise<string>;\n\treadTextFile: (path: string) => Promise<string>;\n\tmakeDirectory: (path: string) => Promise<void>;\n\twriteTextFile: (path: string, contents: string) => Promise<void>;\n\trenameFile: (from: string, to: string) => Promise<void>;\n\tremoveDirectory: (path: string) => Promise<void>;\n};\n\nexport type ResolveCursorCliModelCatalogOptions = {\n\treadonly agentDir: string;\n\treadonly settings?: CursorCliModelCatalogSettings;\n\treadonly deps?: Partial<CursorCliModelCatalogDeps>;\n};\n\ntype CachedModelCatalog = {\n\treadonly cachedAt: number;\n\treadonly models: readonly ProviderModelConfig[];\n};\n\ntype StaticModelDefinition = {\n\treadonly id: string;\n\treadonly label: string;\n};\n\nconst STATIC_MODEL_DEFINITIONS: readonly StaticModelDefinition[] = [\n\t{ id: \"auto\", label: \"Auto\" },\n\t{ id: \"composer-2.5\", label: \"Composer 2.5 (200K context)\" },\n\t{ id: \"composer-2.5-fast\", label: \"Composer 2.5 Fast (200K context)\" },\n\t{ id: \"gpt-5.6-sol-high\", label: \"GPT 5.6 SOL High (272K context)\" },\n\t{ id: \"gpt-5.6-luna-high\", label: \"GPT 5.6 Luna High (272K context)\" },\n\t{ id: \"gpt-5.5-high\", label: \"GPT 5.5 High (272K context)\" },\n\t{ id: \"gpt-5.3-codex\", label: \"GPT 5.3 Codex (272K context)\" },\n\t{ id: \"gpt-5.2\", label: \"GPT 5.2 (272K context)\" },\n\t{ id: \"claude-opus-5-high\", label: \"Claude Opus 5 High (300K context)\" },\n\t{ id: \"claude-opus-5-thinking-high\", label: \"Claude Opus 5 Thinking High (300K context)\" },\n\t{ id: \"claude-opus-4-8-thinking-high\", label: \"Claude Opus 4.8 Thinking High (300K context)\" },\n\t{ id: \"claude-fable-5-thinking-high\", label: \"Claude Fable 5 Thinking High (300K context)\" },\n\t{ id: \"claude-sonnet-5-thinking-high\", label: \"Claude Sonnet 5 Thinking High (300K context)\" },\n\t{ id: \"gemini-3.7-flash-high\", label: \"Gemini 3.7 Flash High (1M context)\" },\n\t{ id: \"cursor-grok-4.6-high\", label: \"Cursor Grok 4.6 High (200K context)\" },\n];\n\nfunction stripAnsi(value: string): string {\n\treturn value.replace(ANSI_ESCAPE_SEQUENCE, \"\");\n}\n\nfunction contextWindowFor(id: string, label: string): number {\n\tif (/\\b1\\sM\\b/i.test(label)) return 1_000_000;\n\tif (id.toLowerCase().startsWith(\"claude-\") && /\\b300\\sK\\b/i.test(label)) return 300_000;\n\tif (id.toLowerCase().startsWith(\"gpt-\") && /\\b272\\sK\\b/i.test(label)) return 272_000;\n\treturn 200_000;\n}\n\nfunction modelEntry(id: string, label: string): ProviderModelConfig {\n\treturn {\n\t\tid,\n\t\tname: label,\n\t\treasoning: REASONING_SUFFIX.test(id),\n\t\tinput: [\"text\"],\n\t\tcost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\tcontextWindow: contextWindowFor(id, label),\n\t\tmaxTokens: 64_000,\n\t};\n}\n\nexport const STATIC_CURSOR_CLI_MODELS: readonly ProviderModelConfig[] = STATIC_MODEL_DEFINITIONS.map(({ id, label }) =>\n\tmodelEntry(id, label),\n);\n\n/* Parse the complete `cursor-agent models` listing into extension provider entries. /\nexport function parseCursorAgentModelsListing(listing: string): ProviderModelConfig[] {\n\tconst plainListing = stripAnsi(listing);\n\tconst lines = plainListing.split(/\\r?\\n/);\n\tif (lines.some((line) => MISLEADING_ERROR_LINE.test(line))) return [];\n\n\tconst seen = new Set<string>();\n\tconst models: ProviderModelConfig[] = [];\n\tfor (const rawLine of lines) {\n\t\tconst match = MODEL_LINE.exec(rawLine.trim());\n\t\tif (!match) continue;\n\t\tconst id = match[1];\n\t\tconst label = match[2].trim();\n\t\tif (!MODEL_ID.test(id) \|\| label.length === 0 \|\| seen.has(id)) continue;\n\t\tseen.add(id);\n\t\tmodels.push(modelEntry(id, label));\n\t}\n\treturn models;\n}\n\nasync function runModelsProbe(executable: string, stdoutPath: string, timeoutMs: number): Promise<void> {\n\tconst output = await open(stdoutPath, \"w\");\n\ttry {\n\t\tawait new Promise<void>((resolve, reject) => {\n\t\t\tconst child = spawn(executable, [\"models\"], {\n\t\t\t\tstdio: [\"ignore\", output.fd, \"ignore\"],\n\t\t\t});\n\t\t\tlet timedOut = false;\n\t\t\tlet settled = false;\n\t\t\tconst finish = (error?: Error): void => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tclearTimeout(deadline);\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolve();\n\t\t\t};\n\t\t\tconst deadline = setTimeout(() => {\n\t\t\t\ttimedOut = true;\n\t\t\t\tchild.kill(\"SIGKILL\");\n\t\t\t}, timeoutMs);\n\t\t\tchild.once(\"error\", (error) => finish(error));\n\t\t\tchild.once(\"close\", (code, signal) => {\n\t\t\t\tif (timedOut) {\n\t\t\t\t\tfinish(new Error(`cursor-agent models exceeded its ${timeoutMs}ms deadline`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (code !== 0) {\n\t\t\t\t\tfinish(new Error(`cursor-agent models failed with code ${String(code)} and signal ${String(signal)}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tfinish();\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tawait output.close();\n\t}\n}\n\nfunction defaultDeps(settings: CursorCliModelCatalogSettings): CursorCliModelCatalogDeps {\n\treturn {\n\t\tnow: Date.now,\n\t\tresolveExecutable: () => {\n\t\t\tconst executableDeps = defaultCursorAgentExecutableDeps();\n\t\t\treturn resolveCursorAgentExecutable({\n\t\t\t\t...executableDeps,\n\t\t\t\tsettings: { executablePath: settings.executablePath },\n\t\t\t});\n\t\t},\n\t\trunProbe: runModelsProbe,\n\t\tmakeTemporaryDirectory: (prefix) => mkdtemp(prefix),\n\t\treadTextFile: (path) => readFile(path, \"utf8\"),\n\t\tmakeDirectory: async (path) => {\n\t\t\tawait mkdir(path, { recursive: true });\n\t\t},\n\t\twriteTextFile: async (path, contents) => {\n\t\t\tawait writeFile(path, contents, \"utf8\");\n\t\t},\n\t\trenameFile: async (from, to) => {\n\t\t\tawait rename(from, to);\n\t\t},\n\t\tremoveDirectory: async (path) => {\n\t\t\tawait rm(path, { recursive: true, force: true });\n\t\t},\n\t};\n}\n\nfunction catalogTtlMs(settings: CursorCliModelCatalogSettings): number {\n\tconst hours = settings.modelCatalogTtlHours;\n\tconst validHours =\n\t\ttypeof hours === \"number\" && Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_MODEL_CATALOG_TTL_HOURS;\n\treturn validHours 60 * 60 * 1_000;\n}\n\nfunction parseCachedCatalog(contents: string): CachedModelCatalog \| undefined {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(contents);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (typeof parsed !== \"object\" \|\| parsed === null \|\| !(\"cachedAt\" in parsed) \|\| !(\"models\" in parsed)) {\n\t\treturn undefined;\n\t}\n\tconst cachedAt = parsed.cachedAt;\n\tconst models = parsed.models;\n\tif (typeof cachedAt !== \"number\" \|\| !Number.isFinite(cachedAt) \|\| !Array.isArray(models) \|\| models.length === 0) {\n\t\treturn undefined;\n\t}\n\n\tconst normalized: ProviderModelConfig[] = [];\n\tconst seen = new Set<string>();\n\tfor (const candidate of models) {\n\t\tif (typeof candidate !== \"object\" \|\| candidate === null \|\| !(\"id\" in candidate) \|\| !(\"name\" in candidate)) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst id = candidate.id;\n\t\tconst name = candidate.name;\n\t\tif (\n\t\t\ttypeof id !== \"string\" \|\|\n\t\t\t!MODEL_ID.test(id) \|\|\n\t\t\ttypeof name !== \"string\" \|\|\n\t\t\tname.length === 0 \|\|\n\t\t\tseen.has(id)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tseen.add(id);\n\t\tnormalized.push(modelEntry(id, name));\n\t}\n\treturn { cachedAt, models: normalized };\n}\n\nasync function readFreshCache(\n\tcachePath: string,\n\tnow: number,\n\tttlMs: number,\n\tdeps: CursorCliModelCatalogDeps,\n): Promise<readonly ProviderModelConfig[] \| undefined> {\n\ttry {\n\t\tconst cached = parseCachedCatalog(await deps.readTextFile(cachePath));\n\t\tif (!cached \|\| now < cached.cachedAt \|\| now - cached.cachedAt >= ttlMs) return undefined;\n\t\treturn cached.models;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nasync function writeCache(\n\tcacheDirectory: string,\n\tcachePath: string,\n\tcatalog: CachedModelCatalog,\n\tdeps: CursorCliModelCatalogDeps,\n): Promise<void> {\n\tconst temporaryPath = `${cachePath}.${process.pid}.${catalog.cachedAt}.tmp`;\n\tawait deps.makeDirectory(cacheDirectory);\n\tawait deps.writeTextFile(temporaryPath, `${JSON.stringify(catalog, null, 2)}\\n`);\n\tawait deps.renameFile(temporaryPath, cachePath);\n}\n\n/** Resolve a cached or probed catalog, always degrading to the exact offline fallback. */\nexport async function resolveCursorCliModelCatalog(\n\toptions: ResolveCursorCliModelCatalogOptions,\n): Promise<readonly ProviderModelConfig[]> {\n\tconst settings = options.settings ?? {};\n\tconst deps = { ...defaultDeps(settings), ...options.deps };\n\tconst cacheDirectory = join(options.agentDir, \"cursor-cli-oauth\");\n\tconst cachePath = join(cacheDirectory, \"models.json\");\n\tconst now = deps.now();\n\tconst cached = await readFreshCache(cachePath, now, catalogTtlMs(settings), deps);\n\tif (cached) return cached;\n\n\tlet temporaryDirectory: string \| undefined;\n\ttry {\n\t\tconst executable = deps.resolveExecutable();\n\t\ttemporaryDirectory = await deps.makeTemporaryDirectory(join(tmpdir(), \"senpi-cursor-models-\"));\n\t\tconst stdoutPath = join(temporaryDirectory, \"stdout.txt\");\n\t\tawait deps.runProbe(executable, stdoutPath, MODEL_PROBE_TIMEOUT_MS);\n\t\tconst models = parseCursorAgentModelsListing(await deps.readTextFile(stdoutPath));\n\t\tif (models.length === 0) return STATIC_CURSOR_CLI_MODELS;\n\t\ttry {\n\t\t\tawait writeCache(cacheDirectory, cachePath, { cachedAt: now, models }, deps);\n\t\t} catch {\n\t\t\t// A read-only cache directory must not prevent provider registration.\n\t\t}\n\t\treturn models;\n\t} catch {\n\t\treturn STATIC_CURSOR_CLI_MODELS;\n\t} finally {\n\t\tif (temporaryDirectory !== undefined) {\n\t\t\ttry {\n\t\t\t\tawait deps.removeDirectory(temporaryDirectory);\n\t\t\t} catch {\n\t\t\t\t// Best-effort cleanup must not replace the catalog result.\n\t\t\t}\n\t\t}\n\t}\n}\n"]}
1	+ {"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAEjG,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,qBAAqB,GAAG,2CAA2C,CAAC;AAmC1E,MAAM,wBAAwB,GAAqC;IAClE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC7B,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC5D,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACtE,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACpE,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACtE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC5D,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC9D,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAClD,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,mCAAmC,EAAE;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,4CAA4C,EAAE;IAC1F,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC9F,EAAE,EAAE,EAAE,8BAA8B,EAAE,KAAK,EAAE,6CAA6C,EAAE;IAC5F,EAAE,EAAE,EAAE,+BAA+B,EAAE,KAAK,EAAE,8CAA8C,EAAE;IAC9F,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,oCAAoC,EAAE;IAC5E,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,qCAAqC,EAAE;CAC5E,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA6C;IACtE,OAAO,sBAAsB,CAC5B,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAU,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CACjG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,KAAK,EAAE,CAAC,MAAM,CAAyB;QACvC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;QAC1D,aAAa,EAAE,KAAK,CAAC,MAAM;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS,IAAI,KAAK,CAAC,uBAAuB,KAAK,KAAK,CAAC,EAAE;YAC5F,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,uBAAuB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACN,MAAM,EAAE;YACP,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS;gBAClF,CAAC,CAAC;oBACA,eAAe,EAAE;wBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;wBAChC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;qBACtD;iBACD;gBACF,CAAC,CAAC,EAAE,CAAC;SACN;KACD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAmC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;AAEnH,wFAAwF;AACxF,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAoC,EAAE,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,UAAkB,EAAE,SAAiB;IACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC3C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAC;YACH,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;gBACtC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,OAAO,EAAE,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBACpC,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,SAAS,aAAa,CAAC,CAAC,CAAC;oBAC9E,OAAO;gBACR,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;oBACvG,OAAO;gBACR,CAAC;gBACD,MAAM,EAAE,CAAC;YACV,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,QAAuC;IAC3D,OAAO;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,iBAAiB,EAAE,GAAG,EAAE;YACvB,MAAM,cAAc,GAAG,gCAAgC,EAAE,CAAC;YAC1D,OAAO,4BAA4B,CAAC;gBACnC,GAAG,cAAc;gBACjB,QAAQ,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;aACrD,CAAC,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,cAAc;QACxB,sBAAsB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACnD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YAC9B,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAuC;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC5C,MAAM,UAAU,GACf,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC;IAC5G,OAAO,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC;QACvG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjH,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;YAC3G,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAC5B,IACC,OAAO,EAAE,KAAK,QAAQ;YACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EACX,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,SAAiB,EACjB,GAAW,EACX,KAAa,EACb,IAA+B;IAE/B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,cAAsB,EACtB,SAAiB,EACjB,OAA2B,EAC3B,IAA+B;IAE/B,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,MAAM,CAAC;IAC5E,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAA4C;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,kBAAsC,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,wBAAwB,CAAC;QACzD,IAAI,CAAC;YACJ,MAAM,UAAU,CAAC,cAAc,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACR,sEAAsE;QACvE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,wBAAwB,CAAC;IACjC,CAAC;YAAS,CAAC;QACV,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACR,2DAA2D;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { mkdir, mkdtemp, open, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { normalizeCursorCatalog } from \"@earendil-works/pi-ai\";\nimport type { ProviderModelConfig } from \"../../types.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\n\nconst MODEL_PROBE_TIMEOUT_MS = 15_000;\nconst DEFAULT_MODEL_CATALOG_TTL_HOURS = 24;\nconst ANSI_ESCAPE_SEQUENCE = /\\u001B(?:[@-Z\\\\-_]\|\\[[0-?][ -/][@-~])/g;\nconst MODEL_LINE = /^(\\S+)\\s+-\\s+(.+)$/;\nconst MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._/:+-]$/;\nconst MISLEADING_ERROR_LINE = /^\\s(?:error\|failed\|failure)(?=\\s\|:\|-\|$)/i;\n\nexport type CursorCliModelCatalogSettings = {\n\treadonly modelCatalogTtlHours?: number;\n\treadonly executablePath?: string;\n};\n\nexport type CursorCliModelCatalogDeps = {\n\tnow: () => number;\n\tresolveExecutable: () => string;\n\trunProbe: (executable: string, stdoutPath: string, timeoutMs: number) => Promise<void>;\n\tmakeTemporaryDirectory: (prefix: string) => Promise<string>;\n\treadTextFile: (path: string) => Promise<string>;\n\tmakeDirectory: (path: string) => Promise<void>;\n\twriteTextFile: (path: string, contents: string) => Promise<void>;\n\trenameFile: (from: string, to: string) => Promise<void>;\n\tremoveDirectory: (path: string) => Promise<void>;\n};\n\nexport type ResolveCursorCliModelCatalogOptions = {\n\treadonly agentDir: string;\n\treadonly settings?: CursorCliModelCatalogSettings;\n\treadonly deps?: Partial<CursorCliModelCatalogDeps>;\n};\n\ntype CachedModelCatalog = {\n\treadonly cachedAt: number;\n\treadonly models: readonly ProviderModelConfig[];\n};\n\ntype StaticModelDefinition = {\n\treadonly id: string;\n\treadonly label: string;\n};\n\nconst STATIC_MODEL_DEFINITIONS: readonly StaticModelDefinition[] = [\n\t{ id: \"auto\", label: \"Auto\" },\n\t{ id: \"composer-2.5\", label: \"Composer 2.5 (200K context)\" },\n\t{ id: \"composer-2.5-fast\", label: \"Composer 2.5 Fast (200K context)\" },\n\t{ id: \"gpt-5.6-sol-high\", label: \"GPT 5.6 SOL High (272K context)\" },\n\t{ id: \"gpt-5.6-luna-high\", label: \"GPT 5.6 Luna High (272K context)\" },\n\t{ id: \"gpt-5.5-high\", label: \"GPT 5.5 High (272K context)\" },\n\t{ id: \"gpt-5.3-codex\", label: \"GPT 5.3 Codex (272K context)\" },\n\t{ id: \"gpt-5.2\", label: \"GPT 5.2 (272K context)\" },\n\t{ id: \"claude-opus-5-high\", label: \"Claude Opus 5 High (300K context)\" },\n\t{ id: \"claude-opus-5-thinking-high\", label: \"Claude Opus 5 Thinking High (300K context)\" },\n\t{ id: \"claude-opus-4-8-thinking-high\", label: \"Claude Opus 4.8 Thinking High (300K context)\" },\n\t{ id: \"claude-fable-5-thinking-high\", label: \"Claude Fable 5 Thinking High (300K context)\" },\n\t{ id: \"claude-sonnet-5-thinking-high\", label: \"Claude Sonnet 5 Thinking High (300K context)\" },\n\t{ id: \"gemini-3.7-flash-high\", label: \"Gemini 3.7 Flash High (1M context)\" },\n\t{ id: \"cursor-grok-4.6-high\", label: \"Cursor Grok 4.6 High (200K context)\" },\n];\n\nfunction stripAnsi(value: string): string {\n\treturn value.replace(ANSI_ESCAPE_SEQUENCE, \"\");\n}\n\nfunction normalizeEntries(raw: readonly { id: string; label: string }[]): ProviderModelConfig[] {\n\treturn normalizeCursorCatalog(\n\t\traw.map(({ id, label }) => ({ id, name: label, input: [\"text\"] as const, cursorMaxMode: false })),\n\t).map((entry) => ({\n\t\tid: entry.id,\n\t\tname: entry.name,\n\t\treasoning: entry.reasoning,\n\t\t...(entry.thinkingLevelMap ? { thinkingLevelMap: entry.thinkingLevelMap } : {}),\n\t\tinput: [\"text\"] as (\"text\" \| \"image\")[],\n\t\tcost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\tcontextWindow: entry.window,\n\t\tmaxTokens: 64_000,\n\t\t...(entry.representativeVariantId !== undefined && entry.representativeVariantId !== entry.id\n\t\t\t? { upstreamModelId: entry.representativeVariantId }\n\t\t\t: {}),\n\t\tcompat: {\n\t\t\t...(entry.capabilityId !== undefined && entry.representativeVariantId !== undefined\n\t\t\t\t? {\n\t\t\t\t\t\tcursorReasoning: {\n\t\t\t\t\t\t\tcapabilityId: entry.capabilityId,\n\t\t\t\t\t\t\t...(entry.thinkingMode !== undefined ? { thinkingMode: entry.thinkingMode } : {}),\n\t\t\t\t\t\t\trepresentativeVariantId: entry.representativeVariantId,\n\t\t\t\t\t\t},\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t}));\n}\n\nexport const STATIC_CURSOR_CLI_MODELS: readonly ProviderModelConfig[] = normalizeEntries(STATIC_MODEL_DEFINITIONS);\n\n/** Parse the complete `cursor-agent models` listing into extension provider entries. /\nexport function parseCursorAgentModelsListing(listing: string): ProviderModelConfig[] {\n\tconst plainListing = stripAnsi(listing);\n\tconst lines = plainListing.split(/\\r?\\n/);\n\tif (lines.some((line) => MISLEADING_ERROR_LINE.test(line))) return [];\n\n\tconst seen = new Set<string>();\n\tconst raw: { id: string; label: string }[] = [];\n\tfor (const rawLine of lines) {\n\t\tconst match = MODEL_LINE.exec(rawLine.trim());\n\t\tif (!match) continue;\n\t\tconst id = match[1];\n\t\tconst label = match[2].trim();\n\t\tif (!MODEL_ID.test(id) \|\| label.length === 0 \|\| seen.has(id)) continue;\n\t\tseen.add(id);\n\t\traw.push({ id, label });\n\t}\n\treturn normalizeEntries(raw);\n}\n\nasync function runModelsProbe(executable: string, stdoutPath: string, timeoutMs: number): Promise<void> {\n\tconst output = await open(stdoutPath, \"w\");\n\ttry {\n\t\tawait new Promise<void>((resolve, reject) => {\n\t\t\tconst child = spawn(executable, [\"models\"], {\n\t\t\t\tstdio: [\"ignore\", output.fd, \"ignore\"],\n\t\t\t});\n\t\t\tlet timedOut = false;\n\t\t\tlet settled = false;\n\t\t\tconst finish = (error?: Error): void => {\n\t\t\t\tif (settled) return;\n\t\t\t\tsettled = true;\n\t\t\t\tclearTimeout(deadline);\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolve();\n\t\t\t};\n\t\t\tconst deadline = setTimeout(() => {\n\t\t\t\ttimedOut = true;\n\t\t\t\tchild.kill(\"SIGKILL\");\n\t\t\t}, timeoutMs);\n\t\t\tchild.once(\"error\", (error) => finish(error));\n\t\t\tchild.once(\"close\", (code, signal) => {\n\t\t\t\tif (timedOut) {\n\t\t\t\t\tfinish(new Error(`cursor-agent models exceeded its ${timeoutMs}ms deadline`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tif (code !== 0) {\n\t\t\t\t\tfinish(new Error(`cursor-agent models failed with code ${String(code)} and signal ${String(signal)}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tfinish();\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tawait output.close();\n\t}\n}\n\nfunction defaultDeps(settings: CursorCliModelCatalogSettings): CursorCliModelCatalogDeps {\n\treturn {\n\t\tnow: Date.now,\n\t\tresolveExecutable: () => {\n\t\t\tconst executableDeps = defaultCursorAgentExecutableDeps();\n\t\t\treturn resolveCursorAgentExecutable({\n\t\t\t\t...executableDeps,\n\t\t\t\tsettings: { executablePath: settings.executablePath },\n\t\t\t});\n\t\t},\n\t\trunProbe: runModelsProbe,\n\t\tmakeTemporaryDirectory: (prefix) => mkdtemp(prefix),\n\t\treadTextFile: (path) => readFile(path, \"utf8\"),\n\t\tmakeDirectory: async (path) => {\n\t\t\tawait mkdir(path, { recursive: true });\n\t\t},\n\t\twriteTextFile: async (path, contents) => {\n\t\t\tawait writeFile(path, contents, \"utf8\");\n\t\t},\n\t\trenameFile: async (from, to) => {\n\t\t\tawait rename(from, to);\n\t\t},\n\t\tremoveDirectory: async (path) => {\n\t\t\tawait rm(path, { recursive: true, force: true });\n\t\t},\n\t};\n}\n\nfunction catalogTtlMs(settings: CursorCliModelCatalogSettings): number {\n\tconst hours = settings.modelCatalogTtlHours;\n\tconst validHours =\n\t\ttypeof hours === \"number\" && Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_MODEL_CATALOG_TTL_HOURS;\n\treturn validHours 60 * 60 * 1_000;\n}\n\nfunction parseCachedCatalog(contents: string): CachedModelCatalog \| undefined {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(contents);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (typeof parsed !== \"object\" \|\| parsed === null \|\| !(\"cachedAt\" in parsed) \|\| !(\"models\" in parsed)) {\n\t\treturn undefined;\n\t}\n\tconst cachedAt = parsed.cachedAt;\n\tconst models = parsed.models;\n\tif (typeof cachedAt !== \"number\" \|\| !Number.isFinite(cachedAt) \|\| !Array.isArray(models) \|\| models.length === 0) {\n\t\treturn undefined;\n\t}\n\n\tconst rawCached: { id: string; label: string }[] = [];\n\tconst seen = new Set<string>();\n\tfor (const candidate of models) {\n\t\tif (typeof candidate !== \"object\" \|\| candidate === null \|\| !(\"id\" in candidate) \|\| !(\"name\" in candidate)) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst id = candidate.id;\n\t\tconst name = candidate.name;\n\t\tif (\n\t\t\ttypeof id !== \"string\" \|\|\n\t\t\t!MODEL_ID.test(id) \|\|\n\t\t\ttypeof name !== \"string\" \|\|\n\t\t\tname.length === 0 \|\|\n\t\t\tseen.has(id)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tseen.add(id);\n\t\trawCached.push({ id, label: name });\n\t}\n\treturn { cachedAt, models: normalizeEntries(rawCached) };\n}\n\nasync function readFreshCache(\n\tcachePath: string,\n\tnow: number,\n\tttlMs: number,\n\tdeps: CursorCliModelCatalogDeps,\n): Promise<readonly ProviderModelConfig[] \| undefined> {\n\ttry {\n\t\tconst cached = parseCachedCatalog(await deps.readTextFile(cachePath));\n\t\tif (!cached \|\| now < cached.cachedAt \|\| now - cached.cachedAt >= ttlMs) return undefined;\n\t\treturn cached.models;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nasync function writeCache(\n\tcacheDirectory: string,\n\tcachePath: string,\n\tcatalog: CachedModelCatalog,\n\tdeps: CursorCliModelCatalogDeps,\n): Promise<void> {\n\tconst temporaryPath = `${cachePath}.${process.pid}.${catalog.cachedAt}.tmp`;\n\tawait deps.makeDirectory(cacheDirectory);\n\tawait deps.writeTextFile(temporaryPath, `${JSON.stringify(catalog, null, 2)}\\n`);\n\tawait deps.renameFile(temporaryPath, cachePath);\n}\n\n/** Resolve a cached or probed catalog, always degrading to the exact offline fallback. */\nexport async function resolveCursorCliModelCatalog(\n\toptions: ResolveCursorCliModelCatalogOptions,\n): Promise<readonly ProviderModelConfig[]> {\n\tconst settings = options.settings ?? {};\n\tconst deps = { ...defaultDeps(settings), ...options.deps };\n\tconst cacheDirectory = join(options.agentDir, \"cursor-cli-oauth\");\n\tconst cachePath = join(cacheDirectory, \"models.json\");\n\tconst now = deps.now();\n\tconst cached = await readFreshCache(cachePath, now, catalogTtlMs(settings), deps);\n\tif (cached) return cached;\n\n\tlet temporaryDirectory: string \| undefined;\n\ttry {\n\t\tconst executable = deps.resolveExecutable();\n\t\ttemporaryDirectory = await deps.makeTemporaryDirectory(join(tmpdir(), \"senpi-cursor-models-\"));\n\t\tconst stdoutPath = join(temporaryDirectory, \"stdout.txt\");\n\t\tawait deps.runProbe(executable, stdoutPath, MODEL_PROBE_TIMEOUT_MS);\n\t\tconst models = parseCursorAgentModelsListing(await deps.readTextFile(stdoutPath));\n\t\tif (models.length === 0) return STATIC_CURSOR_CLI_MODELS;\n\t\ttry {\n\t\t\tawait writeCache(cacheDirectory, cachePath, { cachedAt: now, models }, deps);\n\t\t} catch {\n\t\t\t// A read-only cache directory must not prevent provider registration.\n\t\t}\n\t\treturn models;\n\t} catch {\n\t\treturn STATIC_CURSOR_CLI_MODELS;\n\t} finally {\n\t\tif (temporaryDirectory !== undefined) {\n\t\t\ttry {\n\t\t\t\tawait deps.removeDirectory(temporaryDirectory);\n\t\t\t} catch {\n\t\t\t\t// Best-effort cleanup must not replace the catalog result.\n\t\t\t}\n\t\t}\n\t}\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+import type { Credential, CredentialStore } from "@earendil-works/pi-ai";
+export type CursorCliNativeBootstrapDeps = {
+    store: CredentialStore;
+    readNativeCredential: () => Credential | undefined | Promise<Credential | undefined>;
+    canBootstrap?: () => boolean | Promise<boolean>;
+};
+/**
+ * Read the managed credential afresh and bootstrap it once from the native
+ * Cursor OAuth credential when empty. Concurrent reads share only the
+ * in-flight operation; later turns re-read storage so login/import changes are
+ * immediately visible.
+ */
+export declare function createCursorCliOauthCredentialReader(deps: CursorCliNativeBootstrapDeps): () => Promise<Credential | undefined>;
+//# sourceMappingURL=native-bootstrap.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"native-bootstrap.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAIzE,MAAM,MAAM,4BAA4B,GAAG;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,oBAAoB,EAAE,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACrF,YAAY,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChD,CAAC;AAoCF;;;;;GAKG;AACH,wBAAgB,oCAAoC,CACnD,IAAI,EAAE,4BAA4B,GAChC,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CASvC"}

package/dist/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.js ADDED Viewed

@@ -0,0 +1,58 @@
+import { emptyCredential, listAccounts, SENTINEL_OAUTH_FIELDS } from "./accounts.js";
+import { CURSOR_CLI_OAUTH_PROVIDER_ID, importNativeCursorCredential } from "./oauth-login.js";
+function asManagedCredential(credential) {
+    if (credential?.type !== "oauth")
+        return undefined;
+    const managed = credential;
+    return Array.isArray(managed.accounts) &&
+        managed.access === SENTINEL_OAUTH_FIELDS.access &&
+        managed.refresh === SENTINEL_OAUTH_FIELDS.refresh &&
+        managed.expires === SENTINEL_OAUTH_FIELDS.expires
+        ? managed
+        : undefined;
+}
+async function bootstrapNativeCredential(deps) {
+    let current;
+    try {
+        current = await deps.store.read(CURSOR_CLI_OAUTH_PROVIDER_ID);
+        const managed = asManagedCredential(current);
+        if (managed && listAccounts(managed).length > 0)
+            return current;
+        if (current !== undefined && !managed)
+            return current;
+        if (deps.canBootstrap !== undefined && !(await deps.canBootstrap()))
+            return current;
+        const native = await deps.readNativeCredential();
+        if (native === undefined)
+            return current;
+        return await deps.store.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (latest) => {
+            const latestManaged = asManagedCredential(latest);
+            if (latestManaged && listAccounts(latestManaged).length > 0)
+                return latest;
+            if (latest !== undefined && !latestManaged)
+                return latest;
+            return importNativeCursorCredential(latestManaged ?? emptyCredential(), async () => native);
+        });
+    }
+    catch {
+        return current;
+    }
+}
+/**
+ * Read the managed credential afresh and bootstrap it once from the native
+ * Cursor OAuth credential when empty. Concurrent reads share only the
+ * in-flight operation; later turns re-read storage so login/import changes are
+ * immediately visible.
+ */
+export function createCursorCliOauthCredentialReader(deps) {
+    let inFlight;
+    return () => {
+        if (inFlight)
+            return inFlight;
+        inFlight = bootstrapNativeCredential(deps).finally(() => {
+            inFlight = undefined;
+        });
+        return inFlight;
+    };
+}
+//# sourceMappingURL=native-bootstrap.js.map