npm - @code-yeongyu/senpi - Versions diffs - 2026.8.18 → 2026.8.19 - Mend

@code-yeongyu/senpi 2026.8.18 → 2026.8.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1899) hide show

package/dist/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"native-bootstrap.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/native-bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,eAAe,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAQ9F,SAAS,mBAAmB,CAAC,UAAkC;IAC9D,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,UAAsC,CAAC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,OAAO,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;QAC/C,OAAO,CAAC,OAAO,KAAK,qBAAqB,CAAC,OAAO;QACjD,OAAO,CAAC,OAAO,KAAK,qBAAqB,CAAC,OAAO;QACjD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,IAAkC;IAC1E,IAAI,OAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;QAChE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QACtD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC;QAEpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAEzC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7E,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,aAAa,IAAI,YAAY,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC3E,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa;gBAAE,OAAO,MAAM,CAAC;YAC1D,OAAO,4BAA4B,CAAC,aAAa,IAAI,eAAe,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CACnD,IAAkC;IAElC,IAAI,QAAqD,CAAC;IAC1D,OAAO,GAAG,EAAE;QACX,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACvD,QAAQ,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;AACH,CAAC","sourcesContent":["import type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { type CursorCliOauthCredential, emptyCredential, listAccounts, SENTINEL_OAUTH_FIELDS } from \"./accounts.ts\";\nimport { CURSOR_CLI_OAUTH_PROVIDER_ID, importNativeCursorCredential } from \"./oauth-login.ts\";\n\nexport type CursorCliNativeBootstrapDeps = {\n\tstore: CredentialStore;\n\treadNativeCredential: () => Credential | undefined | Promise<Credential | undefined>;\n\tcanBootstrap?: () => boolean | Promise<boolean>;\n};\n\nfunction asManagedCredential(credential: Credential | undefined): CursorCliOauthCredential | undefined {\n\tif (credential?.type !== \"oauth\") return undefined;\n\tconst managed = credential as CursorCliOauthCredential;\n\treturn Array.isArray(managed.accounts) &&\n\t\tmanaged.access === SENTINEL_OAUTH_FIELDS.access &&\n\t\tmanaged.refresh === SENTINEL_OAUTH_FIELDS.refresh &&\n\t\tmanaged.expires === SENTINEL_OAUTH_FIELDS.expires\n\t\t? managed\n\t\t: undefined;\n}\n\nasync function bootstrapNativeCredential(deps: CursorCliNativeBootstrapDeps): Promise<Credential | undefined> {\n\tlet current: Credential | undefined;\n\ttry {\n\t\tcurrent = await deps.store.read(CURSOR_CLI_OAUTH_PROVIDER_ID);\n\t\tconst managed = asManagedCredential(current);\n\t\tif (managed && listAccounts(managed).length > 0) return current;\n\t\tif (current !== undefined && !managed) return current;\n\t\tif (deps.canBootstrap !== undefined && !(await deps.canBootstrap())) return current;\n\n\t\tconst native = await deps.readNativeCredential();\n\t\tif (native === undefined) return current;\n\n\t\treturn await deps.store.modify(CURSOR_CLI_OAUTH_PROVIDER_ID, async (latest) => {\n\t\t\tconst latestManaged = asManagedCredential(latest);\n\t\t\tif (latestManaged && listAccounts(latestManaged).length > 0) return latest;\n\t\t\tif (latest !== undefined && !latestManaged) return latest;\n\t\t\treturn importNativeCursorCredential(latestManaged ?? emptyCredential(), async () => native);\n\t\t});\n\t} catch {\n\t\treturn current;\n\t}\n}\n\n/**\n * Read the managed credential afresh and bootstrap it once from the native\n * Cursor OAuth credential when empty. Concurrent reads share only the\n * in-flight operation; later turns re-read storage so login/import changes are\n * immediately visible.\n */\nexport function createCursorCliOauthCredentialReader(\n\tdeps: CursorCliNativeBootstrapDeps,\n): () => Promise<Credential | undefined> {\n\tlet inFlight: Promise<Credential | undefined> | undefined;\n\treturn () => {\n\t\tif (inFlight) return inFlight;\n\t\tinFlight = bootstrapNativeCredential(deps).finally(() => {\n\t\t\tinFlight = undefined;\n\t\t});\n\t\treturn inFlight;\n\t};\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/oauth-login.d.ts CHANGED Viewed

@@ -4,7 +4,18 @@ import { type CursorCliOauthProviderSettings } from "./settings.ts";
 export declare const CURSOR_CLI_OAUTH_PROVIDER_ID = "cursor-cli-oauth";
 export declare const CURSOR_CLI_OAUTH_NAME = "Cursor CLI (OAuth)";
 declare const FILE_STORE_LANE: "file-store";
-type CursorCliOauthSettings = Pick<CursorCliOauthProviderSettings, "enabled" | "executablePath">;
+type CursorCliOauthSettings = Pick<CursorCliOauthProviderSettings, "enabled" | "executablePath"> & Partial<Pick<CursorCliOauthProviderSettings, "explicitlyDisabled">>;
+/**
+ * The opt-in rule, in one place so availability, turn-time resolution, and the
+ * host-derived bootstrap gate cannot disagree.
+ *
+ * - `enabled: false` written verbatim in settings or the environment is a kill
+ *   switch: the lane is off regardless of what is stored.
+ * - Otherwise the flag gates only the host-CLI-derived opt-in. Stored senpi account slots
+ *   exist only because the user ran `/login cursor-cli-oauth` or
+ *   `/cursor-account import`, and that explicit action IS the opt-in.
+ */
+export declare function isCursorCliOauthLaneEnabled(settings: CursorCliOauthSettings, storedAccountCount: number): boolean;
 type ImportedCursorCredential = {
     access: string;
     refresh: string;

package/dist/core/extensions/builtin/cursor-cli-oauth/oauth-login.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-login.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/oauth-login.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACX,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EAEnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEN,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAI7B,MAAM,eAAe,CAAC;AAOvB,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAC/D,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAI1D,QAAA,MAAM,eAAe,EAAG,YAAqB,CAAC;AAG9C,KAAK,sBAAsB,GAAG,IAAI,CAAC,8BAA8B,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAC;~~AAEjG~~,KAAK,wBAAwB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACnD,YAAY,EAAE,MAAM,sBAAsB,CAAC;IAC3C,iBAAiB,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,MAAM,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACzE,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,0GAA0G;IAC1G,sBAAsB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,sEAAsE;IACtE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IAC1C,IAAI,EAAE,OAAO,eAAe,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,IAAI,CAAC;IACrB,KAAK,CAAC,KAAK,EAAE;QACZ,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;KACrB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnC,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,YAAY,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5F,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACzE,QAAQ,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;CAC3C,CAAC;~~AA8EF~~;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAKlE;AAED,qHAAqH;AACrH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAKrH;AAsED,sHAAsH;AACtH,eAAO,MAAM,kDAAkD,yPAAyI,CAAC;AAIzM;;;;;GAKG;AACH,wBAAsB,yCAAyC,CAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAC9F,GAAG,EAAE,MAAM,IAAI,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB,CAkF/F;AAyDD,qGAAqG;AACrG,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,qBAA0B,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAoBnC;AAwBD,gGAAgG;AAChG,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,wBAAwB,EACjC,oBAAoB,EAAE,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAClF,OAAO,CAAC,wBAAwB,CAAC,CAMnC;AAED,wBAAgB,2BAA2B,CAC1C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAChD,oBAAoB,CAgBtB"}
1	+ {"version":3,"file":"oauth-login.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/oauth-login.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACX,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EAEnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEN,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAI7B,MAAM,eAAe,CAAC;AAOvB,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,4BAA4B,qBAAqB,CAAC;AAC/D,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAI1D,QAAA,MAAM,eAAe,EAAG,YAAqB,CAAC;AAG9C,KAAK,sBAAsB,GAAG,IAAI,CAAC,8BAA8B,EAAE,SAAS,GAAG,gBAAgB,CAAC,GAC/F,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAGjH;AAED,KAAK,wBAAwB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACtC,WAAW,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACnD,YAAY,EAAE,MAAM,sBAAsB,CAAC;IAC3C,iBAAiB,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,MAAM,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACzE,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,0GAA0G;IAC1G,sBAAsB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,sEAAsE;IACtE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IAC1C,IAAI,EAAE,OAAO,eAAe,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,IAAI,CAAC;IACrB,KAAK,CAAC,KAAK,EAAE;QACZ,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,MAAM,CAAC,EAAE,WAAW,CAAC;KACrB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnC,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,YAAY,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5F,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACzE,QAAQ,CAAC,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;CAC3C,CAAC;AAiFF;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAKlE;AAED,qHAAqH;AACrH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAKrH;AAsED,sHAAsH;AACtH,eAAO,MAAM,kDAAkD,yPAAyI,CAAC;AAIzM;;;;;GAKG;AACH,wBAAsB,yCAAyC,CAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAC9F,GAAG,EAAE,MAAM,IAAI,GACb,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB,CAkF/F;AAyDD,qGAAqG;AACrG,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,qBAA0B,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAoBnC;AAwBD,gGAAgG;AAChG,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,wBAAwB,EACjC,oBAAoB,EAAE,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAClF,OAAO,CAAC,wBAAwB,CAAC,CAMnC;AAED,wBAAgB,2BAA2B,CAC1C,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAChD,oBAAoB,CAgBtB"}

package/dist/core/extensions/builtin/cursor-cli-oauth/oauth-login.js CHANGED Viewed

@@ -13,6 +13,21 @@ const NO_ACCOUNTS_MESSAGE = "no accounts: run /login cursor-cli-oauth";
 const DISABLED_MESSAGE = "disabled by settings";
 const FILE_STORE_LANE = "file-store";
 const DEFAULT_IMPORTED_EXPIRY_MS = 60 * 60 * 1000;
+/**
+ * The opt-in rule, in one place so availability, turn-time resolution, and the
+ * host-derived bootstrap gate cannot disagree.
+ *
+ * - `enabled: false` written verbatim in settings or the environment is a kill
+ *   switch: the lane is off regardless of what is stored.
+ * - Otherwise the flag gates only the host-CLI-derived opt-in. Stored senpi account slots
+ *   exist only because the user ran `/login cursor-cli-oauth` or
+ *   `/cursor-account import`, and that explicit action IS the opt-in.
+ */
+export function isCursorCliOauthLaneEnabled(settings, storedAccountCount) {
+    if (settings.explicitlyDisabled === true)
+        return false;
+    return settings.enabled || storedAccountCount > 0;
+}
 /**
  * One predicate so availability and resolution cannot disagree: evaluates the
  * same conditions for every caller and reports why the lane is unusable
@@ -20,7 +35,7 @@ const DEFAULT_IMPORTED_EXPIRY_MS = 60 * 60 * 1000;
  */
 async function assessConfiguration(deps) {
     const settings = deps.readSettings();
-    if (!settings.enabled)
+    if (settings.explicitlyDisabled === true)
         return { status: "disabled" };
     try {
         deps.resolveExecutable(settings);
@@ -28,7 +43,11 @@ async function assessConfiguration(deps) {
     catch (error) {
         return { status: "not-installed", error };
     }
+    // Read the stored slots before applying the flag: an explicit senpi-side login
+    // is itself the opt-in, so only the flagless host-derived shape reports disabled.
     const accounts = usableAccounts(await deps.readCurrent());
+    if (!isCursorCliOauthLaneEnabled(settings, accounts.length))
+        return { status: "disabled" };
     if (accounts.length === 0)
         return { status: "no-accounts" };
     return {

package/dist/core/extensions/builtin/cursor-cli-oauth/oauth-login.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth-login.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/oauth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACN,UAAU,EAGV,eAAe,EACf,YAAY,EACZ,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wCAAwC,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAE1D,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AACvE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA+DlD;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA8B;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACrD,IAAI,CAAC;QACJ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5D,OAAO;QACN,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,QAAQ,CAAC,MAAM,YAAY,EAAE;KACzF,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,aAAa,CAAC,IAA8B;IAC1D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,UAAU;YACd,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnC,KAAK,eAAe;YACnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,KAAK,aAAa;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtC;YACC,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAClC,KAAgD;IAEhD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA0C,CAAC;IAC7D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,KAAgD;IACvE,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,+BAA+B,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAA8B;IAC7E,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IAC1D,OAAO;QACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,QAAQ;oBACZ,OAAO,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,KAAK,aAAa;oBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACtE;oBACC,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,UAAU;oBACd,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;oBACvE,MAAM;gBACP,KAAK,aAAa;oBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC9B,MAAM;gBACP,KAAK,UAAU;oBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,MAAM;gBACP,KAAK,MAAM;oBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,MAAM;YACR,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,QAAgC,EAChC,QAAqD;IAErD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,QAAQ,GAAG,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,CACd,MAAM,QAAQ,CAAC;QACd,OAAO,EAAE,oCAAoC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,WAAW,EAAE,QAAQ;KACrB,CAAC,CACF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,MAAM,IAAI,QAAQ,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAoE,EACpE,IAAY,EACZ,MAAsC;IAEtC,OAAO;QACN,IAAI;QACJ,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM;KACN,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,CAAC,MAAM,kDAAkD,GAAG,GAAG,wCAAwC,2FAA2F,CAAC;AAEzM,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC9D,QAA8F,EAC9F,GAAe;IAEf,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,CACd,MAAM,QAAQ,CAAC;QACd,OAAO,EAAE,GAAG,kDAAkD,0GAA0G;KACxK,CAAC,CACF;SACC,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IAChB,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACxE,OAAO;QACN,IAAI,EAAE,qBAAqB;QAC3B,cAAc,EAAE,IAAI;QAEpB,KAAK,CAAC,KAAK,CAAC,KAAK;YAChB,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,yDAAyD;YACzD,EAAE;YACF,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,6DAA6D;YAC7D,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YACxF,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;oBACpC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7D,kEAAkE;YAClE,sEAAsE;YACtE,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,cAAc,GAAG,MAAM,yCAAyC,CACrE,SAAS,CAAC,QAAQ,EAClB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAC9B,CAAC;YACF,IAAI,cAAc,KAAK,SAAS;gBAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,cAAc,CAAC,CAAC;YAChF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM;YACrC,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC;gBAAE,OAAO,WAAW,CAAC;YACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpB,SAAS;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC;oBACC,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACrB,EACD,MAAM,CACN,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC;oBACb,GAAG,IAAI;oBACP,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,CAAC;QAC/D,CAAC;QAED,SAAS;YACR,OAAO,qBAAqB,CAAC,MAAM,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAc;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACR,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,cAAc,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAC7G,cAAc,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;KAC9G,CAAC,CAAC;IACH,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAyB;IACrD,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,QAAQ;YACZ,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAChD,KAAK,OAAO;YACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/F,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACpC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QACD;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAiC,EACjC,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC;IAC3G,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,UAAU,CAChB,OAAO,EACP,kBAAkB,CACjB;QACC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B;KACpE,EACD,IAAI,EACJ,QAAQ,CACR,CACD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAA6B;IACjE,OAAO,CACN,KAAK,EAAE,IAAI,KAAK,OAAO;QACvB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAC9B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAyC;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,UAAU,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAiC,EACjC,oBAAoF;IAEpF,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,GAAW,EACX,WAAkD;IAElD,OAAO,0BAA0B,CAAC;QACjC,WAAW;QACX,YAAY,EAAE,GAAG,EAAE,CAAC,0CAA0C,CAAC,GAAG,CAAC;QACnE,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,cAAc,GAA8B;gBACjD,GAAG,gCAAgC,EAAE;gBACrC,QAAQ;aACR,CAAC;YACF,OAAO,4BAA4B,CAAC,cAAc,CAAC,CAAC;QACrD,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,sBAAsB,EAAE,CAAC,cAAsB,EAAE,EAAE,CAClD,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;QAC/D,cAAc,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;KAChF,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { execFile as nodeExecFile } from \"node:child_process\";\nimport { readFile as nodeReadFile } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n\tAuthCheck,\n\tAuthContext,\n\tCredential,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthCredentials,\n\tOAuthLoginCallbacks,\n\tProviderAuthInteraction,\n} from \"@earendil-works/pi-ai\";\nimport { cursorProvider } from \"@earendil-works/pi-ai/providers/cursor\";\nimport {\n\taddAccount,\n\ttype CursorCliAccountSlot,\n\ttype CursorCliOauthCredential,\n\temptyCredential,\n\tlistAccounts,\n\tSENTINEL_OAUTH_FIELDS,\n} from \"./accounts.ts\";\nimport {\n\ttype CursorAgentExecutableDeps,\n\tdefaultCursorAgentExecutableDeps,\n\tresolveCursorAgentExecutable,\n} from \"./executable.ts\";\nimport { CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION } from \"./guardrails.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\n\nexport const CURSOR_CLI_OAUTH_PROVIDER_ID = \"cursor-cli-oauth\";\nexport const CURSOR_CLI_OAUTH_NAME = \"Cursor CLI (OAuth)\";\n\nconst NO_ACCOUNTS_MESSAGE = \"no accounts: run /login cursor-cli-oauth\";\nconst DISABLED_MESSAGE = \"disabled by settings\";\nconst FILE_STORE_LANE = \"file-store\" as const;\nconst DEFAULT_IMPORTED_EXPIRY_MS = 60 * 60 * 1000;\n\ntype CursorCliOauthSettings = Pick<CursorCliOauthProviderSettings, \"enabled\" \| \"executablePath\">;\n\ntype ImportedCursorCredential = {\n\taccess: string;\n\trefresh: string;\n\texpires?: number;\n};\n\nexport type CursorCliOauthConfigDeps = {\n\treadCurrent: () => Promise<Credential \| undefined>;\n\treadSettings: () => CursorCliOauthSettings;\n\tresolveExecutable: (settings: CursorCliOauthSettings) => string;\n\tloadOAuth?: () => Promise<OAuthAuth>;\n\treadCursorFile?: () => Promise<ImportedCursorCredential \| undefined>;\n\treadCursorKeychain?: () => Promise<ImportedCursorCredential \| undefined>;\n\t/** Clock for acknowledgement timestamps; injectable so tests stay deterministic. /\n\tnow?: () => Date;\n\t/* Persists the no-approval acknowledgement; the disk default is wired in defaultCursorCliOauthConfig. /\n\tpersistAcknowledgement?: (acknowledgedAt: string) => void;\n\t/* Persists explicit provider activation after a successful login. /\n\tpersistEnabled?: (enabled: boolean) => void;\n};\n\nexport type CursorCliOauthLaneResolution = {\n\tlane: typeof FILE_STORE_LANE;\n\taccount: CursorCliAccountSlot;\n\taccounts: CursorCliAccountSlot[];\n};\n\nexport type CursorCliOauthConfig = {\n\tname: string;\n\tisSubscription: true;\n\tcheck(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthCheck \| undefined>;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n};\n\nexport type LocalCursorImportDeps = {\n\tplatform?: NodeJS.Platform;\n\treadCursorFile?: () => Promise<ImportedCursorCredential \| undefined>;\n\treadCursorKeychain?: () => Promise<ImportedCursorCredential \| undefined>;\n\tonPrompt?: OAuthLoginCallbacks[\"onPrompt\"];\n};\n\ntype ConfigurationAssessment = {\n\taccounts: CursorCliAccountSlot[];\n\tmessage: string;\n};\n\n/* The single condition evaluation behind both the tolerant `check` and the throwing turn-time resolution. /\ntype ConfigurationOutcome =\n\t\| { status: \"disabled\" }\n\t\| { status: \"not-installed\"; error: unknown }\n\t\| { status: \"no-accounts\" }\n\t\| { status: \"configured\"; assessment: ConfigurationAssessment };\n\n/\n One predicate so availability and resolution cannot disagree: evaluates the\n * same conditions for every caller and reports why the lane is unusable\n * instead of deciding per call-site whether that is fatal.\n /\nasync function assessConfiguration(deps: CursorCliOauthConfigDeps): Promise<ConfigurationOutcome> {\n\tconst settings = deps.readSettings();\n\tif (!settings.enabled) return { status: \"disabled\" };\n\ttry {\n\t\tdeps.resolveExecutable(settings);\n\t} catch (error) {\n\t\treturn { status: \"not-installed\", error };\n\t}\n\n\tconst accounts = usableAccounts(await deps.readCurrent());\n\tif (accounts.length === 0) return { status: \"no-accounts\" };\n\treturn {\n\t\tstatus: \"configured\",\n\t\tassessment: { accounts, message: `configured (file-store, ${accounts.length} accounts)` },\n\t};\n}\n\n/* The throwing view used by turn-time resolution; a turn attempted on an unusable lane must still error clearly. /\nasync function configuredFor(deps: CursorCliOauthConfigDeps): Promise<ConfigurationAssessment> {\n\tconst outcome = await assessConfiguration(deps);\n\tswitch (outcome.status) {\n\t\tcase \"disabled\":\n\t\t\tthrow new Error(DISABLED_MESSAGE);\n\t\tcase \"not-installed\":\n\t\t\tthrow cursorAgentNotInstalledError(outcome.error);\n\t\tcase \"no-accounts\":\n\t\t\tthrow new Error(NO_ACCOUNTS_MESSAGE);\n\t\tdefault:\n\t\t\treturn outcome.assessment;\n\t}\n}\n\nfunction isCursorCliOauthCredential(\n\tvalue: Credential \| OAuthCredentials \| undefined,\n): value is CursorCliOauthCredential {\n\tif (typeof value !== \"object\" \|\| value === null) return false;\n\tconst candidate = value as Partial<CursorCliOauthCredential>;\n\treturn candidate.type === \"oauth\" && Array.isArray(candidate.accounts);\n}\n\nfunction usableAccounts(value: Credential \| OAuthCredentials \| undefined): CursorCliAccountSlot[] {\n\tif (!isCursorCliOauthCredential(value)) return [];\n\treturn listAccounts(value).filter(\n\t\t(slot) =>\n\t\t\ttypeof slot.name === \"string\" &&\n\t\t\ttypeof slot.access === \"string\" &&\n\t\t\tslot.access.trim().length > 0 &&\n\t\t\ttypeof slot.refresh === \"string\" &&\n\t\t\tslot.refresh.trim().length > 0 &&\n\t\t\ttypeof slot.expires === \"number\" &&\n\t\t\tNumber.isFinite(slot.expires),\n\t);\n}\n\nfunction installationMessage(error: unknown): string {\n\tconst detail = error instanceof Error ? error.message : String(error);\n\treturn `cursor-agent not installed: ${detail.replace(/^Cursor CLI is not installed\\.\\s/, \"\")}`;\n}\n\n/*\n The typed turn-path error for a missing cursor-agent binary: carries the\n * `cursor-agent not installed` marker plus the install guidance verbatim, with\n * the underlying resolution failure preserved as `cause`.\n /\nexport function cursorAgentNotInstalledError(cause: unknown): Error {\n\tconst error = new Error(installationMessage(cause));\n\terror.name = \"CursorAgentNotInstalledError\";\n\terror.cause = cause;\n\treturn error;\n}\n\n/* Resolve credentials immediately before execution so a concurrent refresh cannot leave a stale token in memory. /\nexport async function resolveCursorCliOauthLane(deps: CursorCliOauthConfigDeps): Promise<CursorCliOauthLaneResolution> {\n\tconst assessment = await configuredFor(deps);\n\tconst account = assessment.accounts[0];\n\tif (!account) throw new Error(NO_ACCOUNTS_MESSAGE);\n\treturn { lane: FILE_STORE_LANE, account, accounts: assessment.accounts };\n}\n\nasync function loadCursorOAuthFlow(): Promise<OAuthAuth> {\n\tconst flow = cursorProvider().auth.oauth;\n\tif (!flow) throw new Error(\"Cursor OAuth flow is unavailable\");\n\treturn flow;\n}\n\nfunction providerInteraction(callbacks: OAuthLoginCallbacks): ProviderAuthInteraction {\n\treturn {\n\t\tsignal: callbacks.signal ?? new AbortController().signal,\n\t\tprompt: async (prompt) => {\n\t\t\tswitch (prompt.type) {\n\t\t\t\tcase \"select\":\n\t\t\t\t\treturn (await callbacks.onSelect(prompt)) ?? \"\";\n\t\t\t\tcase \"manual_code\":\n\t\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\t\tdefault:\n\t\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t\t}\n\t\t},\n\t\tnotify: (event) => {\n\t\t\tswitch (event.type) {\n\t\t\t\tcase \"auth_url\":\n\t\t\t\t\tcallbacks.onAuth({ url: event.url, instructions: event.instructions });\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"device_code\":\n\t\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"progress\":\n\t\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"info\":\n\t\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t},\n\t};\n}\n\nasync function accountName(\n\texisting: CursorCliAccountSlot[],\n\tonPrompt: OAuthLoginCallbacks[\"onPrompt\"] \| undefined,\n): Promise<string> {\n\tif (existing.length === 0) return \"default\";\n\tconst fallback = `account-${existing.length + 1}`;\n\tif (!onPrompt) return fallback;\n\tconst answer = (\n\t\tawait onPrompt({\n\t\t\tmessage: `Name for this account (existing: ${existing.map((slot) => slot.name).join(\", \")})`,\n\t\t\tplaceholder: fallback,\n\t\t})\n\t).trim();\n\treturn answer \|\| fallback;\n}\n\nfunction slotFromCredential(\n\tcredential: Pick<OAuthCredentials, \"access\" \| \"refresh\" \| \"expires\">,\n\tname: string,\n\tsource: CursorCliAccountSlot[\"source\"],\n): CursorCliAccountSlot {\n\treturn {\n\t\tname,\n\t\taccess: credential.access,\n\t\trefresh: credential.refresh,\n\t\texpires: credential.expires,\n\t\tsource,\n\t};\n}\n\n/* The one-screen login explanation: what unattended Cursor CLI execution gives up, and the plan-mode alternative. /\nexport const CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION = `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} Plan mode (planning only, no tool execution) is available via the executionMode setting.`;\n\nconst ACKNOWLEDGEMENT_ACCEPTANCE = new Set([\"yes\", \"y\"]);\n\n/\n Present the no-approval explanation exactly once and return the ISO\n * acknowledgement timestamp on explicit confirmation, undefined otherwise.\n * Shared by the login flow and the /cursor-account acknowledge subcommand so\n * both surfaces present the identical explanation and persist identically.\n /\nexport async function confirmCursorCliNoApprovalAcknowledgement(\n\tonPrompt: ((prompt: { message: string; placeholder?: string }) => Promise<string>) \| undefined,\n\tnow: () => Date,\n): Promise<string \| undefined> {\n\tif (!onPrompt) return undefined;\n\tconst answer = (\n\t\tawait onPrompt({\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION}\\nType \"yes\" to acknowledge and allow unattended Cursor CLI tool execution; anything else leaves it off.`,\n\t\t})\n\t)\n\t\t.trim()\n\t\t.toLowerCase();\n\treturn ACKNOWLEDGEMENT_ACCEPTANCE.has(answer) ? now().toISOString() : undefined;\n}\n\nexport function createCursorCliOauthConfig(deps: CursorCliOauthConfigDeps): CursorCliOauthConfig {\n\treturn {\n\t\tname: CURSOR_CLI_OAUTH_NAME,\n\t\tisSubscription: true,\n\n\t\tasync check(input) {\n\t\t\t// Tolerant by contract: ModelsImpl.getAvailable runs every provider's\n\t\t\t// check under Promise.all (packages/ai/src/models.ts:544-548) and turns a\n\t\t\t// throw into a rejecting ModelsError, so one throwing check would reject\n\t\t\t// all model listing. Not usable (disabled / not installed / no accounts)\n\t\t\t// reports undefined here - as claude-sdk-oauth's check does - while\n\t\t\t// turn-time resolution keeps throwing via configuredFor.\n\t\t\t//\n\t\t\t// One nuance: the auth-resolution path (checkAuth, resolveStoredOAuth)\n\t\t\t// always passes the stored credential, while bare model listing does not.\n\t\t\t// A credential-backed lane whose executable is missing stays selectable\n\t\t\t// with the install guidance as its source, so a TURN reaches\n\t\t\t// streamCursorCliOauth, which throws the typed not-installed error;\n\t\t\t// without a credential the lane hides exactly as before.\n\t\t\tconst outcome = await assessConfiguration(deps);\n\t\t\tif (outcome.status === \"disabled\" \|\| outcome.status === \"no-accounts\") return undefined;\n\t\t\tif (outcome.status === \"not-installed\") {\n\t\t\t\treturn input.credential === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: { type: \"oauth\", source: installationMessage(outcome.error) };\n\t\t\t}\n\t\t\treturn { type: \"oauth\", source: outcome.assessment.message };\n\t\t},\n\n\t\tasync login(callbacks) {\n\t\t\tconst stored = await deps.readCurrent();\n\t\t\tconst current = isCursorCliOauthCredential(stored) ? stored : emptyCredential();\n\t\t\tconst existing = listAccounts(current);\n\t\t\tconst flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();\n\t\t\tconst loggedIn = await flow.login(providerInteraction(callbacks));\n\t\t\tconst name = await accountName(existing, callbacks.onPrompt);\n\t\t\t// After the PKCE flow succeeds and before the slot is stored: the\n\t\t\t// one-screen no-approval explanation, confirmed once. Declining still\n\t\t\t// stores the slot; only the acknowledgement stays unset, so force turns\n\t\t\t// refuse until the user acknowledges later.\n\t\t\tconst acknowledgedAt = await confirmCursorCliNoApprovalAcknowledgement(\n\t\t\t\tcallbacks.onPrompt,\n\t\t\t\tdeps.now ?? (() => new Date()),\n\t\t\t);\n\t\t\tif (acknowledgedAt !== undefined) deps.persistAcknowledgement?.(acknowledgedAt);\n\t\t\tconst credential = addAccount(current, slotFromCredential(loggedIn, name, \"login\"));\n\t\t\tdeps.persistEnabled?.(true);\n\t\t\treturn credential;\n\t\t},\n\n\t\tasync refreshToken(credentials, signal) {\n\t\t\tif (!isCursorCliOauthCredential(credentials)) return credentials;\n\t\t\tconst flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();\n\t\t\tconst accounts: CursorCliAccountSlot[] = [];\n\t\t\tfor (const slot of listAccounts(credentials)) {\n\t\t\t\tif (Date.now() < slot.expires) {\n\t\t\t\t\taccounts.push(slot);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst refreshed = await flow.refresh(\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\taccess: slot.access,\n\t\t\t\t\t\trefresh: slot.refresh,\n\t\t\t\t\t\texpires: slot.expires,\n\t\t\t\t\t},\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\taccounts.push({\n\t\t\t\t\t...slot,\n\t\t\t\t\taccess: refreshed.access,\n\t\t\t\t\trefresh: refreshed.refresh,\n\t\t\t\t\texpires: refreshed.expires,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { ...credentials, ...SENTINEL_OAUTH_FIELDS, accounts };\n\t\t},\n\n\t\tgetApiKey() {\n\t\t\treturn SENTINEL_OAUTH_FIELDS.access;\n\t\t},\n\t};\n}\n\nfunction execFileOutput(file: string, args: string[]): Promise<string \| undefined> {\n\treturn new Promise((resolve) => {\n\t\tnodeExecFile(file, args, { encoding: \"utf8\" }, (error, stdout) => {\n\t\t\tif (error) {\n\t\t\t\tresolve(undefined);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst value = stdout.trim();\n\t\t\tresolve(value.length > 0 ? value : undefined);\n\t\t});\n\t});\n}\n\nasync function defaultKeychainCredential(): Promise<ImportedCursorCredential \| undefined> {\n\tif (process.platform !== \"darwin\") return undefined;\n\tconst [access, refresh] = await Promise.all([\n\t\texecFileOutput(\"security\", [\"find-generic-password\", \"-a\", \"cursor-user\", \"-s\", \"cursor-access-token\", \"-w\"]),\n\t\texecFileOutput(\"security\", [\"find-generic-password\", \"-a\", \"cursor-user\", \"-s\", \"cursor-refresh-token\", \"-w\"]),\n\t]);\n\treturn access && refresh ? { access, refresh } : undefined;\n}\n\nfunction localCursorAuthPath(platform: NodeJS.Platform): string \| undefined {\n\tswitch (platform) {\n\t\tcase \"darwin\":\n\t\t\treturn join(homedir(), \".cursor\", \"auth.json\");\n\t\tcase \"linux\":\n\t\t\treturn join(process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"cursor\", \"auth.json\");\n\t\tcase \"win32\": {\n\t\t\tconst appData = process.env.APPDATA;\n\t\t\treturn appData ? join(appData, \"Cursor\", \"auth.json\") : undefined;\n\t\t}\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nasync function defaultFileCredential(platform: NodeJS.Platform): Promise<ImportedCursorCredential \| undefined> {\n\tconst path = localCursorAuthPath(platform);\n\tif (!path) return undefined;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(await nodeReadFile(path, \"utf8\"));\n\t\tif (typeof parsed !== \"object\" \|\| parsed === null \|\| Array.isArray(parsed)) return undefined;\n\t\tconst record = parsed as Record<string, unknown>;\n\t\tconst access = record.accessToken;\n\t\tconst refresh = record.refreshToken;\n\t\tif (typeof access !== \"string\" \|\| access.length === 0 \|\| typeof refresh !== \"string\" \|\| refresh.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { access, refresh };\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/* Explicitly copy the user's local Cursor credential into this provider's managed account slots. /\nexport async function importLocalCursorCredential(\n\tcurrent: CursorCliOauthCredential,\n\tdeps: LocalCursorImportDeps = {},\n): Promise<CursorCliOauthCredential> {\n\tconst platform = deps.platform ?? process.platform;\n\tconst readKeychain = deps.readCursorKeychain ?? defaultKeychainCredential;\n\tconst readFile = deps.readCursorFile ?? (() => defaultFileCredential(platform));\n\tconst imported = platform === \"darwin\" ? ((await readKeychain()) ?? (await readFile())) : await readFile();\n\tif (!imported) throw new Error(\"No local Cursor OAuth credential found\");\n\tconst existing = listAccounts(current);\n\tconst name = await accountName(existing, deps.onPrompt);\n\treturn addAccount(\n\t\tcurrent,\n\t\tslotFromCredential(\n\t\t\t{\n\t\t\t\taccess: imported.access,\n\t\t\t\trefresh: imported.refresh,\n\t\t\t\texpires: imported.expires ?? Date.now() + DEFAULT_IMPORTED_EXPIRY_MS,\n\t\t\t},\n\t\t\tname,\n\t\t\t\"import\",\n\t\t),\n\t);\n}\n\nfunction isUsableFlatOAuthCredential(value: Credential \| undefined): value is OAuthCredential {\n\treturn (\n\t\tvalue?.type === \"oauth\" &&\n\t\ttypeof value.access === \"string\" &&\n\t\tvalue.access.length > 0 &&\n\t\ttypeof value.refresh === \"string\" &&\n\t\tvalue.refresh.length > 0 &&\n\t\ttypeof value.expires === \"number\" &&\n\t\tNumber.isFinite(value.expires)\n\t);\n}\n\nfunction nativeAccountName(existing: readonly CursorCliAccountSlot[]): string {\n\tconst names = new Set(existing.map((account) => account.name));\n\tif (!names.has(\"native\")) return \"native\";\n\tfor (let index = 2; index <= 10_000; index++) {\n\t\tconst candidate = `native-${index}`;\n\t\tif (!names.has(candidate)) return candidate;\n\t}\n\tthrow new Error(\"Could not allocate a Cursor CLI OAuth native account name\");\n}\n\n/* Explicitly copy Senpi's native `cursor` OAuth credential into a managed CLI account slot. */\nexport async function importNativeCursorCredential(\n\tcurrent: CursorCliOauthCredential,\n\treadNativeCredential: () => Credential \| undefined \| Promise<Credential \| undefined>,\n): Promise<CursorCliOauthCredential> {\n\tconst native = await readNativeCredential();\n\tif (!isUsableFlatOAuthCredential(native)) {\n\t\tthrow new Error(\"No stored native Cursor OAuth credential found\");\n\t}\n\treturn addAccount(current, slotFromCredential(native, nativeAccountName(listAccounts(current)), \"import\"));\n}\n\nexport function defaultCursorCliOauthConfig(\n\tcwd: string,\n\treadCurrent: () => Promise<Credential \| undefined>,\n): CursorCliOauthConfig {\n\treturn createCursorCliOauthConfig({\n\t\treadCurrent,\n\t\treadSettings: () => loadCursorCliOauthProviderSettingsFromDisk(cwd),\n\t\tresolveExecutable: (settings) => {\n\t\t\tconst executableDeps: CursorAgentExecutableDeps = {\n\t\t\t\t...defaultCursorAgentExecutableDeps(),\n\t\t\t\tsettings,\n\t\t\t};\n\t\t\treturn resolveCursorAgentExecutable(executableDeps);\n\t\t},\n\t\tnow: () => new Date(),\n\t\tpersistAcknowledgement: (acknowledgedAt: string) =>\n\t\t\tpersistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\tpersistEnabled: (enabled: boolean) => persistCursorCliOauthEnabled(cwd, enabled),\n\t});\n}\n"]}
1	+ {"version":3,"file":"oauth-login.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/oauth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EACN,UAAU,EAGV,eAAe,EACf,YAAY,EACZ,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wCAAwC,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAE1D,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AACvE,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAKlD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC,EAAE,kBAA0B;IACvG,IAAI,QAAQ,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,QAAQ,CAAC,OAAO,IAAI,kBAAkB,GAAG,CAAC,CAAC;AACnD,CAAC;AA6DD;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA8B;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,IAAI,CAAC;QACJ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,+EAA+E;IAC/E,kFAAkF;IAClF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5D,OAAO;QACN,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,QAAQ,CAAC,MAAM,YAAY,EAAE;KACzF,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,aAAa,CAAC,IAA8B;IAC1D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,UAAU;YACd,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnC,KAAK,eAAe;YACnB,MAAM,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,KAAK,aAAa;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtC;YACC,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;AACF,CAAC;AAED,SAAS,0BAA0B,CAClC,KAAgD;IAEhD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA0C,CAAC;IAC7D,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,KAAgD;IACvE,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAChC,CAAC,IAAI,EAAE,EAAE,CACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,+BAA+B,MAAM,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAA8B;IAC7E,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA8B;IAC1D,OAAO;QACN,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;QACxD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,QAAQ;oBACZ,OAAO,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,KAAK,aAAa;oBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACtE;oBACC,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,UAAU;oBACd,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;oBACvE,MAAM;gBACP,KAAK,aAAa;oBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAC9B,MAAM;gBACP,KAAK,UAAU;oBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,MAAM;gBACP,KAAK,MAAM;oBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,MAAM;YACR,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,QAAgC,EAChC,QAAqD;IAErD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,QAAQ,GAAG,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,CACd,MAAM,QAAQ,CAAC;QACd,OAAO,EAAE,oCAAoC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,WAAW,EAAE,QAAQ;KACrB,CAAC,CACF,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,MAAM,IAAI,QAAQ,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAC1B,UAAoE,EACpE,IAAY,EACZ,MAAsC;IAEtC,OAAO;QACN,IAAI;QACJ,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM;KACN,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,MAAM,CAAC,MAAM,kDAAkD,GAAG,GAAG,wCAAwC,2FAA2F,CAAC;AAEzM,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC9D,QAA8F,EAC9F,GAAe;IAEf,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,CACd,MAAM,QAAQ,CAAC;QACd,OAAO,EAAE,GAAG,kDAAkD,0GAA0G;KACxK,CAAC,CACF;SACC,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IAChB,OAAO,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAA8B;IACxE,OAAO;QACN,IAAI,EAAE,qBAAqB;QAC3B,cAAc,EAAE,IAAI;QAEpB,KAAK,CAAC,KAAK,CAAC,KAAK;YAChB,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,yDAAyD;YACzD,EAAE;YACF,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,6DAA6D;YAC7D,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YACxF,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;oBACpC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS;YACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7D,kEAAkE;YAClE,sEAAsE;YACtE,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,cAAc,GAAG,MAAM,yCAAyC,CACrE,SAAS,CAAC,QAAQ,EAClB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAC9B,CAAC;YACF,IAAI,cAAc,KAAK,SAAS;gBAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,cAAc,CAAC,CAAC;YAChF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM;YACrC,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC;gBAAE,OAAO,WAAW,CAAC;YACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpB,SAAS;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC;oBACC,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACrB,EACD,MAAM,CACN,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC;oBACb,GAAG,IAAI;oBACP,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,CAAC;QAC/D,CAAC;QAED,SAAS;YACR,OAAO,qBAAqB,CAAC,MAAM,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAc;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChE,IAAI,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACR,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,cAAc,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAC7G,cAAc,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;KAC9G,CAAC,CAAC;IACH,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAyB;IACrD,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,QAAQ;YACZ,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAChD,KAAK,OAAO;YACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/F,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACpC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QACD;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9G,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAiC,EACjC,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC;IAC3G,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,UAAU,CAChB,OAAO,EACP,kBAAkB,CACjB;QACC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B;KACpE,EACD,IAAI,EACJ,QAAQ,CACR,CACD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAA6B;IACjE,OAAO,CACN,KAAK,EAAE,IAAI,KAAK,OAAO;QACvB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAC9B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAyC;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,UAAU,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAiC,EACjC,oBAAoF;IAEpF,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,GAAW,EACX,WAAkD;IAElD,OAAO,0BAA0B,CAAC;QACjC,WAAW;QACX,YAAY,EAAE,GAAG,EAAE,CAAC,0CAA0C,CAAC,GAAG,CAAC;QACnE,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC/B,MAAM,cAAc,GAA8B;gBACjD,GAAG,gCAAgC,EAAE;gBACrC,QAAQ;aACR,CAAC;YACF,OAAO,4BAA4B,CAAC,cAAc,CAAC,CAAC;QACrD,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,sBAAsB,EAAE,CAAC,cAAsB,EAAE,EAAE,CAClD,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;QAC/D,cAAc,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;KAChF,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { execFile as nodeExecFile } from \"node:child_process\";\nimport { readFile as nodeReadFile } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type {\n\tAuthCheck,\n\tAuthContext,\n\tCredential,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthCredentials,\n\tOAuthLoginCallbacks,\n\tProviderAuthInteraction,\n} from \"@earendil-works/pi-ai\";\nimport { cursorProvider } from \"@earendil-works/pi-ai/providers/cursor\";\nimport {\n\taddAccount,\n\ttype CursorCliAccountSlot,\n\ttype CursorCliOauthCredential,\n\temptyCredential,\n\tlistAccounts,\n\tSENTINEL_OAUTH_FIELDS,\n} from \"./accounts.ts\";\nimport {\n\ttype CursorAgentExecutableDeps,\n\tdefaultCursorAgentExecutableDeps,\n\tresolveCursorAgentExecutable,\n} from \"./executable.ts\";\nimport { CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION } from \"./guardrails.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\n\nexport const CURSOR_CLI_OAUTH_PROVIDER_ID = \"cursor-cli-oauth\";\nexport const CURSOR_CLI_OAUTH_NAME = \"Cursor CLI (OAuth)\";\n\nconst NO_ACCOUNTS_MESSAGE = \"no accounts: run /login cursor-cli-oauth\";\nconst DISABLED_MESSAGE = \"disabled by settings\";\nconst FILE_STORE_LANE = \"file-store\" as const;\nconst DEFAULT_IMPORTED_EXPIRY_MS = 60 * 60 * 1000;\n\ntype CursorCliOauthSettings = Pick<CursorCliOauthProviderSettings, \"enabled\" \| \"executablePath\"> &\n\tPartial<Pick<CursorCliOauthProviderSettings, \"explicitlyDisabled\">>;\n\n/*\n The opt-in rule, in one place so availability, turn-time resolution, and the\n * host-derived bootstrap gate cannot disagree.\n \n - `enabled: false` written verbatim in settings or the environment is a kill\n * switch: the lane is off regardless of what is stored.\n * - Otherwise the flag gates only the host-CLI-derived opt-in. Stored senpi account slots\n * exist only because the user ran `/login cursor-cli-oauth` or\n * `/cursor-account import`, and that explicit action IS the opt-in.\n /\nexport function isCursorCliOauthLaneEnabled(settings: CursorCliOauthSettings, storedAccountCount: number): boolean {\n\tif (settings.explicitlyDisabled === true) return false;\n\treturn settings.enabled \|\| storedAccountCount > 0;\n}\n\ntype ImportedCursorCredential = {\n\taccess: string;\n\trefresh: string;\n\texpires?: number;\n};\n\nexport type CursorCliOauthConfigDeps = {\n\treadCurrent: () => Promise<Credential \| undefined>;\n\treadSettings: () => CursorCliOauthSettings;\n\tresolveExecutable: (settings: CursorCliOauthSettings) => string;\n\tloadOAuth?: () => Promise<OAuthAuth>;\n\treadCursorFile?: () => Promise<ImportedCursorCredential \| undefined>;\n\treadCursorKeychain?: () => Promise<ImportedCursorCredential \| undefined>;\n\t/* Clock for acknowledgement timestamps; injectable so tests stay deterministic. /\n\tnow?: () => Date;\n\t/* Persists the no-approval acknowledgement; the disk default is wired in defaultCursorCliOauthConfig. /\n\tpersistAcknowledgement?: (acknowledgedAt: string) => void;\n\t/* Persists explicit provider activation after a successful login. /\n\tpersistEnabled?: (enabled: boolean) => void;\n};\n\nexport type CursorCliOauthLaneResolution = {\n\tlane: typeof FILE_STORE_LANE;\n\taccount: CursorCliAccountSlot;\n\taccounts: CursorCliAccountSlot[];\n};\n\nexport type CursorCliOauthConfig = {\n\tname: string;\n\tisSubscription: true;\n\tcheck(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal?: AbortSignal;\n\t}): Promise<AuthCheck \| undefined>;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n};\n\nexport type LocalCursorImportDeps = {\n\tplatform?: NodeJS.Platform;\n\treadCursorFile?: () => Promise<ImportedCursorCredential \| undefined>;\n\treadCursorKeychain?: () => Promise<ImportedCursorCredential \| undefined>;\n\tonPrompt?: OAuthLoginCallbacks[\"onPrompt\"];\n};\n\ntype ConfigurationAssessment = {\n\taccounts: CursorCliAccountSlot[];\n\tmessage: string;\n};\n\n/* The single condition evaluation behind both the tolerant `check` and the throwing turn-time resolution. /\ntype ConfigurationOutcome =\n\t\| { status: \"disabled\" }\n\t\| { status: \"not-installed\"; error: unknown }\n\t\| { status: \"no-accounts\" }\n\t\| { status: \"configured\"; assessment: ConfigurationAssessment };\n\n/\n One predicate so availability and resolution cannot disagree: evaluates the\n * same conditions for every caller and reports why the lane is unusable\n * instead of deciding per call-site whether that is fatal.\n /\nasync function assessConfiguration(deps: CursorCliOauthConfigDeps): Promise<ConfigurationOutcome> {\n\tconst settings = deps.readSettings();\n\tif (settings.explicitlyDisabled === true) return { status: \"disabled\" };\n\ttry {\n\t\tdeps.resolveExecutable(settings);\n\t} catch (error) {\n\t\treturn { status: \"not-installed\", error };\n\t}\n\n\t// Read the stored slots before applying the flag: an explicit senpi-side login\n\t// is itself the opt-in, so only the flagless host-derived shape reports disabled.\n\tconst accounts = usableAccounts(await deps.readCurrent());\n\tif (!isCursorCliOauthLaneEnabled(settings, accounts.length)) return { status: \"disabled\" };\n\tif (accounts.length === 0) return { status: \"no-accounts\" };\n\treturn {\n\t\tstatus: \"configured\",\n\t\tassessment: { accounts, message: `configured (file-store, ${accounts.length} accounts)` },\n\t};\n}\n\n/* The throwing view used by turn-time resolution; a turn attempted on an unusable lane must still error clearly. /\nasync function configuredFor(deps: CursorCliOauthConfigDeps): Promise<ConfigurationAssessment> {\n\tconst outcome = await assessConfiguration(deps);\n\tswitch (outcome.status) {\n\t\tcase \"disabled\":\n\t\t\tthrow new Error(DISABLED_MESSAGE);\n\t\tcase \"not-installed\":\n\t\t\tthrow cursorAgentNotInstalledError(outcome.error);\n\t\tcase \"no-accounts\":\n\t\t\tthrow new Error(NO_ACCOUNTS_MESSAGE);\n\t\tdefault:\n\t\t\treturn outcome.assessment;\n\t}\n}\n\nfunction isCursorCliOauthCredential(\n\tvalue: Credential \| OAuthCredentials \| undefined,\n): value is CursorCliOauthCredential {\n\tif (typeof value !== \"object\" \|\| value === null) return false;\n\tconst candidate = value as Partial<CursorCliOauthCredential>;\n\treturn candidate.type === \"oauth\" && Array.isArray(candidate.accounts);\n}\n\nfunction usableAccounts(value: Credential \| OAuthCredentials \| undefined): CursorCliAccountSlot[] {\n\tif (!isCursorCliOauthCredential(value)) return [];\n\treturn listAccounts(value).filter(\n\t\t(slot) =>\n\t\t\ttypeof slot.name === \"string\" &&\n\t\t\ttypeof slot.access === \"string\" &&\n\t\t\tslot.access.trim().length > 0 &&\n\t\t\ttypeof slot.refresh === \"string\" &&\n\t\t\tslot.refresh.trim().length > 0 &&\n\t\t\ttypeof slot.expires === \"number\" &&\n\t\t\tNumber.isFinite(slot.expires),\n\t);\n}\n\nfunction installationMessage(error: unknown): string {\n\tconst detail = error instanceof Error ? error.message : String(error);\n\treturn `cursor-agent not installed: ${detail.replace(/^Cursor CLI is not installed\\.\\s/, \"\")}`;\n}\n\n/*\n The typed turn-path error for a missing cursor-agent binary: carries the\n * `cursor-agent not installed` marker plus the install guidance verbatim, with\n * the underlying resolution failure preserved as `cause`.\n /\nexport function cursorAgentNotInstalledError(cause: unknown): Error {\n\tconst error = new Error(installationMessage(cause));\n\terror.name = \"CursorAgentNotInstalledError\";\n\terror.cause = cause;\n\treturn error;\n}\n\n/* Resolve credentials immediately before execution so a concurrent refresh cannot leave a stale token in memory. /\nexport async function resolveCursorCliOauthLane(deps: CursorCliOauthConfigDeps): Promise<CursorCliOauthLaneResolution> {\n\tconst assessment = await configuredFor(deps);\n\tconst account = assessment.accounts[0];\n\tif (!account) throw new Error(NO_ACCOUNTS_MESSAGE);\n\treturn { lane: FILE_STORE_LANE, account, accounts: assessment.accounts };\n}\n\nasync function loadCursorOAuthFlow(): Promise<OAuthAuth> {\n\tconst flow = cursorProvider().auth.oauth;\n\tif (!flow) throw new Error(\"Cursor OAuth flow is unavailable\");\n\treturn flow;\n}\n\nfunction providerInteraction(callbacks: OAuthLoginCallbacks): ProviderAuthInteraction {\n\treturn {\n\t\tsignal: callbacks.signal ?? new AbortController().signal,\n\t\tprompt: async (prompt) => {\n\t\t\tswitch (prompt.type) {\n\t\t\t\tcase \"select\":\n\t\t\t\t\treturn (await callbacks.onSelect(prompt)) ?? \"\";\n\t\t\t\tcase \"manual_code\":\n\t\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\t\tdefault:\n\t\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t\t}\n\t\t},\n\t\tnotify: (event) => {\n\t\t\tswitch (event.type) {\n\t\t\t\tcase \"auth_url\":\n\t\t\t\t\tcallbacks.onAuth({ url: event.url, instructions: event.instructions });\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"device_code\":\n\t\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"progress\":\n\t\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"info\":\n\t\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t},\n\t};\n}\n\nasync function accountName(\n\texisting: CursorCliAccountSlot[],\n\tonPrompt: OAuthLoginCallbacks[\"onPrompt\"] \| undefined,\n): Promise<string> {\n\tif (existing.length === 0) return \"default\";\n\tconst fallback = `account-${existing.length + 1}`;\n\tif (!onPrompt) return fallback;\n\tconst answer = (\n\t\tawait onPrompt({\n\t\t\tmessage: `Name for this account (existing: ${existing.map((slot) => slot.name).join(\", \")})`,\n\t\t\tplaceholder: fallback,\n\t\t})\n\t).trim();\n\treturn answer \|\| fallback;\n}\n\nfunction slotFromCredential(\n\tcredential: Pick<OAuthCredentials, \"access\" \| \"refresh\" \| \"expires\">,\n\tname: string,\n\tsource: CursorCliAccountSlot[\"source\"],\n): CursorCliAccountSlot {\n\treturn {\n\t\tname,\n\t\taccess: credential.access,\n\t\trefresh: credential.refresh,\n\t\texpires: credential.expires,\n\t\tsource,\n\t};\n}\n\n/* The one-screen login explanation: what unattended Cursor CLI execution gives up, and the plan-mode alternative. /\nexport const CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION = `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} Plan mode (planning only, no tool execution) is available via the executionMode setting.`;\n\nconst ACKNOWLEDGEMENT_ACCEPTANCE = new Set([\"yes\", \"y\"]);\n\n/\n Present the no-approval explanation exactly once and return the ISO\n * acknowledgement timestamp on explicit confirmation, undefined otherwise.\n * Shared by the login flow and the /cursor-account acknowledge subcommand so\n * both surfaces present the identical explanation and persist identically.\n /\nexport async function confirmCursorCliNoApprovalAcknowledgement(\n\tonPrompt: ((prompt: { message: string; placeholder?: string }) => Promise<string>) \| undefined,\n\tnow: () => Date,\n): Promise<string \| undefined> {\n\tif (!onPrompt) return undefined;\n\tconst answer = (\n\t\tawait onPrompt({\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_LOGIN_ACKNOWLEDGEMENT_EXPLANATION}\\nType \"yes\" to acknowledge and allow unattended Cursor CLI tool execution; anything else leaves it off.`,\n\t\t})\n\t)\n\t\t.trim()\n\t\t.toLowerCase();\n\treturn ACKNOWLEDGEMENT_ACCEPTANCE.has(answer) ? now().toISOString() : undefined;\n}\n\nexport function createCursorCliOauthConfig(deps: CursorCliOauthConfigDeps): CursorCliOauthConfig {\n\treturn {\n\t\tname: CURSOR_CLI_OAUTH_NAME,\n\t\tisSubscription: true,\n\n\t\tasync check(input) {\n\t\t\t// Tolerant by contract: ModelsImpl.getAvailable runs every provider's\n\t\t\t// check under Promise.all (packages/ai/src/models.ts:544-548) and turns a\n\t\t\t// throw into a rejecting ModelsError, so one throwing check would reject\n\t\t\t// all model listing. Not usable (disabled / not installed / no accounts)\n\t\t\t// reports undefined here - as claude-sdk-oauth's check does - while\n\t\t\t// turn-time resolution keeps throwing via configuredFor.\n\t\t\t//\n\t\t\t// One nuance: the auth-resolution path (checkAuth, resolveStoredOAuth)\n\t\t\t// always passes the stored credential, while bare model listing does not.\n\t\t\t// A credential-backed lane whose executable is missing stays selectable\n\t\t\t// with the install guidance as its source, so a TURN reaches\n\t\t\t// streamCursorCliOauth, which throws the typed not-installed error;\n\t\t\t// without a credential the lane hides exactly as before.\n\t\t\tconst outcome = await assessConfiguration(deps);\n\t\t\tif (outcome.status === \"disabled\" \|\| outcome.status === \"no-accounts\") return undefined;\n\t\t\tif (outcome.status === \"not-installed\") {\n\t\t\t\treturn input.credential === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: { type: \"oauth\", source: installationMessage(outcome.error) };\n\t\t\t}\n\t\t\treturn { type: \"oauth\", source: outcome.assessment.message };\n\t\t},\n\n\t\tasync login(callbacks) {\n\t\t\tconst stored = await deps.readCurrent();\n\t\t\tconst current = isCursorCliOauthCredential(stored) ? stored : emptyCredential();\n\t\t\tconst existing = listAccounts(current);\n\t\t\tconst flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();\n\t\t\tconst loggedIn = await flow.login(providerInteraction(callbacks));\n\t\t\tconst name = await accountName(existing, callbacks.onPrompt);\n\t\t\t// After the PKCE flow succeeds and before the slot is stored: the\n\t\t\t// one-screen no-approval explanation, confirmed once. Declining still\n\t\t\t// stores the slot; only the acknowledgement stays unset, so force turns\n\t\t\t// refuse until the user acknowledges later.\n\t\t\tconst acknowledgedAt = await confirmCursorCliNoApprovalAcknowledgement(\n\t\t\t\tcallbacks.onPrompt,\n\t\t\t\tdeps.now ?? (() => new Date()),\n\t\t\t);\n\t\t\tif (acknowledgedAt !== undefined) deps.persistAcknowledgement?.(acknowledgedAt);\n\t\t\tconst credential = addAccount(current, slotFromCredential(loggedIn, name, \"login\"));\n\t\t\tdeps.persistEnabled?.(true);\n\t\t\treturn credential;\n\t\t},\n\n\t\tasync refreshToken(credentials, signal) {\n\t\t\tif (!isCursorCliOauthCredential(credentials)) return credentials;\n\t\t\tconst flow = await (deps.loadOAuth ?? loadCursorOAuthFlow)();\n\t\t\tconst accounts: CursorCliAccountSlot[] = [];\n\t\t\tfor (const slot of listAccounts(credentials)) {\n\t\t\t\tif (Date.now() < slot.expires) {\n\t\t\t\t\taccounts.push(slot);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst refreshed = await flow.refresh(\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"oauth\",\n\t\t\t\t\t\taccess: slot.access,\n\t\t\t\t\t\trefresh: slot.refresh,\n\t\t\t\t\t\texpires: slot.expires,\n\t\t\t\t\t},\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\taccounts.push({\n\t\t\t\t\t...slot,\n\t\t\t\t\taccess: refreshed.access,\n\t\t\t\t\trefresh: refreshed.refresh,\n\t\t\t\t\texpires: refreshed.expires,\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { ...credentials, ...SENTINEL_OAUTH_FIELDS, accounts };\n\t\t},\n\n\t\tgetApiKey() {\n\t\t\treturn SENTINEL_OAUTH_FIELDS.access;\n\t\t},\n\t};\n}\n\nfunction execFileOutput(file: string, args: string[]): Promise<string \| undefined> {\n\treturn new Promise((resolve) => {\n\t\tnodeExecFile(file, args, { encoding: \"utf8\" }, (error, stdout) => {\n\t\t\tif (error) {\n\t\t\t\tresolve(undefined);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst value = stdout.trim();\n\t\t\tresolve(value.length > 0 ? value : undefined);\n\t\t});\n\t});\n}\n\nasync function defaultKeychainCredential(): Promise<ImportedCursorCredential \| undefined> {\n\tif (process.platform !== \"darwin\") return undefined;\n\tconst [access, refresh] = await Promise.all([\n\t\texecFileOutput(\"security\", [\"find-generic-password\", \"-a\", \"cursor-user\", \"-s\", \"cursor-access-token\", \"-w\"]),\n\t\texecFileOutput(\"security\", [\"find-generic-password\", \"-a\", \"cursor-user\", \"-s\", \"cursor-refresh-token\", \"-w\"]),\n\t]);\n\treturn access && refresh ? { access, refresh } : undefined;\n}\n\nfunction localCursorAuthPath(platform: NodeJS.Platform): string \| undefined {\n\tswitch (platform) {\n\t\tcase \"darwin\":\n\t\t\treturn join(homedir(), \".cursor\", \"auth.json\");\n\t\tcase \"linux\":\n\t\t\treturn join(process.env.XDG_CONFIG_HOME ?? join(homedir(), \".config\"), \"cursor\", \"auth.json\");\n\t\tcase \"win32\": {\n\t\t\tconst appData = process.env.APPDATA;\n\t\t\treturn appData ? join(appData, \"Cursor\", \"auth.json\") : undefined;\n\t\t}\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nasync function defaultFileCredential(platform: NodeJS.Platform): Promise<ImportedCursorCredential \| undefined> {\n\tconst path = localCursorAuthPath(platform);\n\tif (!path) return undefined;\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(await nodeReadFile(path, \"utf8\"));\n\t\tif (typeof parsed !== \"object\" \|\| parsed === null \|\| Array.isArray(parsed)) return undefined;\n\t\tconst record = parsed as Record<string, unknown>;\n\t\tconst access = record.accessToken;\n\t\tconst refresh = record.refreshToken;\n\t\tif (typeof access !== \"string\" \|\| access.length === 0 \|\| typeof refresh !== \"string\" \|\| refresh.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { access, refresh };\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/* Explicitly copy the user's local Cursor credential into this provider's managed account slots. /\nexport async function importLocalCursorCredential(\n\tcurrent: CursorCliOauthCredential,\n\tdeps: LocalCursorImportDeps = {},\n): Promise<CursorCliOauthCredential> {\n\tconst platform = deps.platform ?? process.platform;\n\tconst readKeychain = deps.readCursorKeychain ?? defaultKeychainCredential;\n\tconst readFile = deps.readCursorFile ?? (() => defaultFileCredential(platform));\n\tconst imported = platform === \"darwin\" ? ((await readKeychain()) ?? (await readFile())) : await readFile();\n\tif (!imported) throw new Error(\"No local Cursor OAuth credential found\");\n\tconst existing = listAccounts(current);\n\tconst name = await accountName(existing, deps.onPrompt);\n\treturn addAccount(\n\t\tcurrent,\n\t\tslotFromCredential(\n\t\t\t{\n\t\t\t\taccess: imported.access,\n\t\t\t\trefresh: imported.refresh,\n\t\t\t\texpires: imported.expires ?? Date.now() + DEFAULT_IMPORTED_EXPIRY_MS,\n\t\t\t},\n\t\t\tname,\n\t\t\t\"import\",\n\t\t),\n\t);\n}\n\nfunction isUsableFlatOAuthCredential(value: Credential \| undefined): value is OAuthCredential {\n\treturn (\n\t\tvalue?.type === \"oauth\" &&\n\t\ttypeof value.access === \"string\" &&\n\t\tvalue.access.length > 0 &&\n\t\ttypeof value.refresh === \"string\" &&\n\t\tvalue.refresh.length > 0 &&\n\t\ttypeof value.expires === \"number\" &&\n\t\tNumber.isFinite(value.expires)\n\t);\n}\n\nfunction nativeAccountName(existing: readonly CursorCliAccountSlot[]): string {\n\tconst names = new Set(existing.map((account) => account.name));\n\tif (!names.has(\"native\")) return \"native\";\n\tfor (let index = 2; index <= 10_000; index++) {\n\t\tconst candidate = `native-${index}`;\n\t\tif (!names.has(candidate)) return candidate;\n\t}\n\tthrow new Error(\"Could not allocate a Cursor CLI OAuth native account name\");\n}\n\n/* Explicitly copy Senpi's native `cursor` OAuth credential into a managed CLI account slot. */\nexport async function importNativeCursorCredential(\n\tcurrent: CursorCliOauthCredential,\n\treadNativeCredential: () => Credential \| undefined \| Promise<Credential \| undefined>,\n): Promise<CursorCliOauthCredential> {\n\tconst native = await readNativeCredential();\n\tif (!isUsableFlatOAuthCredential(native)) {\n\t\tthrow new Error(\"No stored native Cursor OAuth credential found\");\n\t}\n\treturn addAccount(current, slotFromCredential(native, nativeAccountName(listAccounts(current)), \"import\"));\n}\n\nexport function defaultCursorCliOauthConfig(\n\tcwd: string,\n\treadCurrent: () => Promise<Credential \| undefined>,\n): CursorCliOauthConfig {\n\treturn createCursorCliOauthConfig({\n\t\treadCurrent,\n\t\treadSettings: () => loadCursorCliOauthProviderSettingsFromDisk(cwd),\n\t\tresolveExecutable: (settings) => {\n\t\t\tconst executableDeps: CursorAgentExecutableDeps = {\n\t\t\t\t...defaultCursorAgentExecutableDeps(),\n\t\t\t\tsettings,\n\t\t\t};\n\t\t\treturn resolveCursorAgentExecutable(executableDeps);\n\t\t},\n\t\tnow: () => new Date(),\n\t\tpersistAcknowledgement: (acknowledgedAt: string) =>\n\t\t\tpersistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\tpersistEnabled: (enabled: boolean) => persistCursorCliOauthEnabled(cwd, enabled),\n\t});\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/settings.d.ts CHANGED Viewed

@@ -1,7 +1,18 @@
 export type CursorCliOauthExecutionMode = "agent" | "plan";
 export type CursorCliOauthResumeMode = "auto" | "off";
 export interface CursorCliOauthProviderSettings {
+    /**
+     * Explicit senpi-side opt-in for the AMBIENT lane (host-CLI-derived native
+     * credential bootstrap). Defaults to false: a logged-in `cursor-agent` on the
+     * host is not consent to spend that subscription from senpi.
+     */
     readonly enabled: boolean;
+    /**
+     * True only when a settings layer or the environment set `enabled` to false
+     * verbatim. That is a kill switch and outranks stored accounts, while a merely
+     * absent flag leaves an explicit senpi-side login usable.
+     */
+    readonly explicitlyDisabled: boolean;
     readonly executablePath: string | undefined;
     readonly forceExecution: boolean;
     readonly noApprovalAcknowledgedAt: string | undefined;

package/dist/core/extensions/builtin/cursor-cli-oauth/settings.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/settings.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,2BAA2B,GAAG,OAAO,GAAG,MAAM,CAAC;AAC3D,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,KAAK,CAAC;AAEtD,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,KAAK,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;~~AAmJhE~~,mFAAmF;AACnF,wBAAgB,mCAAmC,CAClD,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,WAAW,GACtB,8BAA8B,CAEhC;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACvD,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAClC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAUnD;AAED,wFAAwF;AACxF,wBAAgB,0CAA0C,CAAC,GAAG,EAAE,MAAM,GAAG,8BAA8B,CAStG;AA4BD,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAKnG"}
1	+ {"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/settings.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,2BAA2B,GAAG,OAAO,GAAG,MAAM,CAAC;AAC3D,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,KAAK,CAAC;AAEtD,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,KAAK,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAwJhE,mFAAmF;AACnF,wBAAgB,mCAAmC,CAClD,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,WAAW,GACtB,8BAA8B,CAEhC;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACvD,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAClC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAUnD;AAED,wFAAwF;AACxF,wBAAgB,0CAA0C,CAAC,GAAG,EAAE,MAAM,GAAG,8BAA8B,CAStG;AA4BD,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAKnG"}

package/dist/core/extensions/builtin/cursor-cli-oauth/settings.js CHANGED Viewed

@@ -2,6 +2,7 @@ import { getAgentDir } from "../../../../config.js";
 import { FileSettingsStorage, parseSettingsJson, SettingsManager } from "../../../settings-manager.js";
 const DEFAULT_SETTINGS = {
     enabled: false,
+    explicitlyDisabled: false,
     executablePath: undefined,
     forceExecution: true,
     noApprovalAcknowledgedAt: undefined,
@@ -129,7 +130,11 @@ function parseEnvironmentSettings(environment) {
     };
 }
 function resolveSettings(...layers) {
-    return Object.assign({}, DEFAULT_SETTINGS, ...layers);
+    const resolved = Object.assign({}, DEFAULT_SETTINGS, ...layers);
+    // The last layer that names `enabled` wins, exactly as the value merge does;
+    // only a verbatim false there is the kill switch.
+    const named = layers.filter((layer) => layer.enabled !== undefined);
+    return { ...resolved, explicitlyDisabled: named.length > 0 && named[named.length - 1]?.enabled === false };
 }
 /** Parse one provider settings block with environment values taking precedence. */
 export function parseCursorCliOauthProviderSettings(value, environment) {

package/dist/core/extensions/builtin/cursor-cli-oauth/settings.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAiB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AA2BtH,MAAM,gBAAgB,GAAmC;IACxD,OAAO,EAAE,KAAK;IACd,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,IAAI;IACpB,wBAAwB,EAAE,SAAS;IACnC,aAAa,EAAE,OAAO;IACtB,UAAU,EAAE,MAAM;IAClB,aAAa,EAAE,SAAS;IACxB,yBAAyB,EAAE,IAAI;IAC/B,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,EAAE;CAChB,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC;QACT,KAAK,MAAM;YACV,OAAO,IAAI,CAAC;QACb,KAAK,GAAG,CAAC;QACT,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAS,4BAA4B,CAAC,KAAyB;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAyB;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,wBAAwB,GAAG,cAAc,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,yBAAyB,GAAG,YAAY,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChF,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAwB;IACzD,MAAM,cAAc,GACnB,mBAAmB,CAAC,WAAW,CAAC,iCAAiC,CAAC;QAClE,mBAAmB,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,kBAAkB,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACpG,MAAM,oBAAoB,GAAG,oCAAoC,CAChE,WAAW,CAAC,8CAA8C,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,mBAAmB,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,4BAA4B,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IACpG,OAAO;QACN,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAG,MAAiC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mCAAmC,CAClD,KAAc,EACd,WAAwB;IAExB,OAAO,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACvD,aAAkC,EAClC,SAAoC;IAEpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,OAAO,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,0CAA0C,CAAC,GAAW;IACrE,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAwC,CAAC;IACzF,MAAM,OAAO,GAAG,eAAe,CAAC,kBAAkB,EAAwC,CAAC;IAC3F,OAAO,eAAe,CACrB,qBAAqB,CAAC,MAAM,CAAC,sBAAsB,CAAC,EACpD,qBAAqB,CAAC,OAAO,CAAC,sBAAsB,CAAC,EACrD,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CACrC,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAC1C,GAAW,EACX,MAAc,EACd,KAAwC;IAExC,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACJ,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,uCAAuC,MAAM,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC7I,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GACb,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ;YAC/C,IAAI,CAAC,sBAAsB,KAAK,IAAI;YACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC;YAC1C,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,sBAAkD,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAAgB;IACzE,kCAAkC,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,GAAW,EAAE,cAAsB;IAC5F,kCAAkC,CAAC,GAAG,EAAE,iBAAiB,EAAE;QAC1D,OAAO,EAAE,IAAI;QACb,wBAAwB,EAAE,cAAc;KACxC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { getAgentDir } from \"../../../../config.ts\";\nimport { FileSettingsStorage, parseSettingsJson, type Settings, SettingsManager } from \"../../../settings-manager.ts\";\n\nexport type CursorCliOauthExecutionMode = \"agent\" \| \"plan\";\nexport type CursorCliOauthResumeMode = \"auto\" \| \"off\";\n\nexport interface CursorCliOauthProviderSettings {\n\treadonly enabled: boolean;\n\treadonly executablePath: string \| undefined;\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string \| undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly resumeMode: CursorCliOauthResumeMode;\n\treadonly pinnedAccount: string \| undefined;\n\treadonly contextRecapOnModelSwitch: boolean;\n\treadonly modelCatalogTtlHours: number;\n\treadonly sandboxMode: string \| undefined;\n\t/** Exact full commands the spawned CLI must refuse; globs are not supported. /\n\treadonly denyCommands?: string[];\n}\n\ntype SettingsWithCursorCliOauthProvider = Settings & {\n\tcursorCliOauthProvider?: unknown;\n};\n\ntype Environment = Readonly<Record<string, string \| undefined>>;\ntype ParsedSettings = Partial<CursorCliOauthProviderSettings>;\n\nconst DEFAULT_SETTINGS: CursorCliOauthProviderSettings = {\n\tenabled: false,\n\texecutablePath: undefined,\n\tforceExecution: true,\n\tnoApprovalAcknowledgedAt: undefined,\n\texecutionMode: \"agent\",\n\tresumeMode: \"auto\",\n\tpinnedAccount: undefined,\n\tcontextRecapOnModelSwitch: true,\n\tmodelCatalogTtlHours: 24,\n\tsandboxMode: undefined,\n\tdenyCommands: [],\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseBoolean(value: unknown): boolean \| undefined {\n\treturn typeof value === \"boolean\" ? value : undefined;\n}\n\nfunction parseEnvironmentBoolean(value: string \| undefined): boolean \| undefined {\n\tif (value === undefined) return undefined;\n\tswitch (value.toLowerCase()) {\n\t\tcase \"1\":\n\t\tcase \"true\":\n\t\t\treturn true;\n\t\tcase \"0\":\n\t\tcase \"false\":\n\t\t\treturn false;\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nfunction parseNonEmptyString(value: unknown): string \| undefined {\n\treturn typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/* Exact full commands only: string entries are trimmed, non-strings and empties are dropped. /\nfunction parseDenyCommands(value: unknown): string[] \| undefined {\n\tif (!Array.isArray(value)) return undefined;\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((command) => command.length > 0);\n}\n\n/* Comma-separated exact full commands; a missing or empty value leaves settings untouched. /\nfunction parseEnvironmentDenyCommands(value: string \| undefined): string[] \| undefined {\n\tif (value === undefined \|\| value.length === 0) return undefined;\n\treturn value\n\t\t.split(\",\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((command) => command.length > 0);\n}\n\nfunction parseIsoString(value: unknown): string \| undefined {\n\tif (typeof value !== \"string\" \|\| !/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$/.test(value)) {\n\t\treturn undefined;\n\t}\n\treturn Number.isNaN(Date.parse(value)) ? undefined : value;\n}\n\nfunction parseExecutionMode(value: unknown): CursorCliOauthExecutionMode \| undefined {\n\treturn value === \"agent\" \|\| value === \"plan\" ? value : undefined;\n}\n\nfunction parseResumeMode(value: unknown): CursorCliOauthResumeMode \| undefined {\n\treturn value === \"auto\" \|\| value === \"off\" ? value : undefined;\n}\n\nfunction parsePositiveFiniteNumber(value: unknown): number \| undefined {\n\treturn typeof value === \"number\" && Number.isFinite(value) && value > 0 ? value : undefined;\n}\n\nfunction parseEnvironmentPositiveFiniteNumber(value: string \| undefined): number \| undefined {\n\tif (value === undefined \|\| value.length === 0) return undefined;\n\tconst parsed = Number(value);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;\n}\n\nfunction parseProviderSettings(value: unknown): ParsedSettings {\n\tif (!isRecord(value)) return {};\n\tconst enabled = parseBoolean(value.enabled);\n\tconst executablePath = parseNonEmptyString(value.executablePath);\n\tconst forceExecution = parseBoolean(value.forceExecution);\n\tconst noApprovalAcknowledgedAt = parseIsoString(value.noApprovalAcknowledgedAt);\n\tconst executionMode = parseExecutionMode(value.executionMode);\n\tconst resumeMode = parseResumeMode(value.resumeMode);\n\tconst pinnedAccount = parseNonEmptyString(value.pinnedAccount);\n\tconst contextRecapOnModelSwitch = parseBoolean(value.contextRecapOnModelSwitch);\n\tconst modelCatalogTtlHours = parsePositiveFiniteNumber(value.modelCatalogTtlHours);\n\tconst sandboxMode = parseNonEmptyString(value.sandboxMode);\n\tconst denyCommands = parseDenyCommands(value.denyCommands);\n\treturn {\n\t\t...(enabled !== undefined ? { enabled } : {}),\n\t\t...(executablePath !== undefined ? { executablePath } : {}),\n\t\t...(forceExecution !== undefined ? { forceExecution } : {}),\n\t\t...(noApprovalAcknowledgedAt !== undefined ? { noApprovalAcknowledgedAt } : {}),\n\t\t...(executionMode !== undefined ? { executionMode } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t\t...(contextRecapOnModelSwitch !== undefined ? { contextRecapOnModelSwitch } : {}),\n\t\t...(modelCatalogTtlHours !== undefined ? { modelCatalogTtlHours } : {}),\n\t\t...(sandboxMode !== undefined ? { sandboxMode } : {}),\n\t\t...(denyCommands !== undefined ? { denyCommands } : {}),\n\t};\n}\n\nfunction parseEnvironmentSettings(environment: Environment): ParsedSettings {\n\tconst executablePath =\n\t\tparseNonEmptyString(environment.SENPI_CURSOR_CLI_OAUTH_EXECUTABLE) ??\n\t\tparseNonEmptyString(environment.CURSOR_AGENT_EXECUTABLE);\n\tconst enabled = parseEnvironmentBoolean(environment.SENPI_CURSOR_CLI_OAUTH_ENABLED);\n\tconst forceExecution = parseEnvironmentBoolean(environment.SENPI_CURSOR_CLI_OAUTH_FORCE);\n\tconst executionMode = parseExecutionMode(environment.SENPI_CURSOR_CLI_OAUTH_EXECUTION_MODE);\n\tconst resumeMode = parseResumeMode(environment.SENPI_CURSOR_CLI_OAUTH_RESUME);\n\tconst pinnedAccount = parseNonEmptyString(environment.SENPI_CURSOR_CLI_OAUTH_PINNED_ACCOUNT);\n\tconst contextRecapOnModelSwitch = parseEnvironmentBoolean(environment.SENPI_CURSOR_CLI_OAUTH_RECAP);\n\tconst modelCatalogTtlHours = parseEnvironmentPositiveFiniteNumber(\n\t\tenvironment.SENPI_CURSOR_CLI_OAUTH_MODEL_CATALOG_TTL_HOURS,\n\t);\n\tconst sandboxMode = parseNonEmptyString(environment.SENPI_CURSOR_CLI_OAUTH_SANDBOX_MODE);\n\tconst denyCommands = parseEnvironmentDenyCommands(environment.SENPI_CURSOR_CLI_OAUTH_DENY_COMMANDS);\n\treturn {\n\t\t...(executablePath !== undefined ? { executablePath } : {}),\n\t\t...(enabled !== undefined ? { enabled } : {}),\n\t\t...(forceExecution !== undefined ? { forceExecution } : {}),\n\t\t...(executionMode !== undefined ? { executionMode } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t\t...(contextRecapOnModelSwitch !== undefined ? { contextRecapOnModelSwitch } : {}),\n\t\t...(modelCatalogTtlHours !== undefined ? { modelCatalogTtlHours } : {}),\n\t\t...(sandboxMode !== undefined ? { sandboxMode } : {}),\n\t\t...(denyCommands !== undefined ? { denyCommands } : {}),\n\t};\n}\n\nfunction resolveSettings(...layers: readonly ParsedSettings[]): CursorCliOauthProviderSettings {\n\treturn Object.assign({}, DEFAULT_SETTINGS, ...layers);\n}\n\n/* Parse one provider settings block with environment values taking precedence. /\nexport function parseCursorCliOauthProviderSettings(\n\tvalue: unknown,\n\tenvironment: Environment,\n): CursorCliOauthProviderSettings {\n\treturn resolveSettings(parseProviderSettings(value), parseEnvironmentSettings(environment));\n}\n\n/\n Build the probe-owned sandbox allowlist validator without hardcoding modes in settings parsing.\n * Each distinct rejected mode is reported once through the supplied warning hook.\n /\nexport function createCursorCliOauthSandboxModeValidator(\n\tacceptedModes: ReadonlySet<string>,\n\tonWarning: (message: string) => void,\n): (value: string \| undefined) => string \| undefined {\n\tconst warnedModes = new Set<string>();\n\treturn (value) => {\n\t\tif (value === undefined \|\| acceptedModes.has(value)) return value;\n\t\tif (!warnedModes.has(value)) {\n\t\t\twarnedModes.add(value);\n\t\t\tonWarning(`Ignoring unrecognized Cursor CLI OAuth sandbox mode: ${value}`);\n\t\t}\n\t\treturn undefined;\n\t};\n}\n\n/* Load global and project settings afresh, with env values taking final precedence. /\nexport function loadCursorCliOauthProviderSettingsFromDisk(cwd: string): CursorCliOauthProviderSettings {\n\tconst settingsManager = SettingsManager.create(cwd, getAgentDir());\n\tconst global = settingsManager.getGlobalSettings() as SettingsWithCursorCliOauthProvider;\n\tconst project = settingsManager.getProjectSettings() as SettingsWithCursorCliOauthProvider;\n\treturn resolveSettings(\n\t\tparseProviderSettings(global.cursorCliOauthProvider),\n\t\tparseProviderSettings(project.cursorCliOauthProvider),\n\t\tparseEnvironmentSettings(process.env),\n\t);\n}\n\nfunction persistCursorCliOauthProviderPatch(\n\tcwd: string,\n\taction: string,\n\tpatch: Readonly<Record<string, unknown>>,\n): void {\n\tconst storage = new FileSettingsStorage(cwd, getAgentDir());\n\tstorage.selectSource(\"global\");\n\tstorage.withLock(\"global\", (current) => {\n\t\tlet root: Record<string, unknown>;\n\t\ttry {\n\t\t\troot = current === undefined ? {} : parseSettingsJson(current);\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Cannot persist the cursor-cli-oauth ${action}: the settings file is unparseable (${error instanceof Error ? error.message : String(error)})`,\n\t\t\t);\n\t\t}\n\t\tconst provider =\n\t\t\ttypeof root.cursorCliOauthProvider === \"object\" &&\n\t\t\troot.cursorCliOauthProvider !== null &&\n\t\t\t!Array.isArray(root.cursorCliOauthProvider)\n\t\t\t\t? { ...(root.cursorCliOauthProvider as Record<string, unknown>) }\n\t\t\t\t: {};\n\t\treturn JSON.stringify({ ...root, cursorCliOauthProvider: { ...provider, ...patch } }, null, 2);\n\t});\n}\n\n/* Persist explicit provider activation while preserving every sibling setting. /\nexport function persistCursorCliOauthEnabled(cwd: string, enabled: boolean): void {\n\tpersistCursorCliOauthProviderPatch(cwd, \"enabled state\", { enabled });\n}\n\n/\n Read-modify-write `noApprovalAcknowledgedAt` into the provider block of the\n * global settings file, preserving every other key. An unparseable file is\n * reported instead of silently clobbered, so an acknowledgement can never\n * claim success while leaving the settings unwritten.\n */\nexport function persistCursorCliNoApprovalAcknowledgement(cwd: string, acknowledgedAt: string): void {\n\tpersistCursorCliOauthProviderPatch(cwd, \"acknowledgement\", {\n\t\tenabled: true,\n\t\tnoApprovalAcknowledgedAt: acknowledgedAt,\n\t});\n}\n"]}
1	+ {"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAiB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAsCtH,MAAM,gBAAgB,GAAmC;IACxD,OAAO,EAAE,KAAK;IACd,kBAAkB,EAAE,KAAK;IACzB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,IAAI;IACpB,wBAAwB,EAAE,SAAS;IACnC,aAAa,EAAE,OAAO;IACtB,UAAU,EAAE,MAAM;IAClB,aAAa,EAAE,SAAS;IACxB,yBAAyB,EAAE,IAAI;IAC/B,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE,EAAE;CAChB,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC;QACT,KAAK,MAAM;YACV,OAAO,IAAI,CAAC;QACb,KAAK,GAAG,CAAC;QACT,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAS,4BAA4B,CAAC,KAAyB;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAyB;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,wBAAwB,GAAG,cAAc,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/D,MAAM,yBAAyB,GAAG,YAAY,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChF,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAwB;IACzD,MAAM,cAAc,GACnB,mBAAmB,CAAC,WAAW,CAAC,iCAAiC,CAAC;QAClE,mBAAmB,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,uBAAuB,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,uBAAuB,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,kBAAkB,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;IACpG,MAAM,oBAAoB,GAAG,oCAAoC,CAChE,WAAW,CAAC,8CAA8C,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,mBAAmB,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,4BAA4B,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IACpG,OAAO;QACN,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAG,MAAiC;IAC5D,MAAM,QAAQ,GAAmC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,CAAC;IAChG,6EAA6E;IAC7E,kDAAkD;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;AAC5G,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mCAAmC,CAClD,KAAc,EACd,WAAwB;IAExB,OAAO,eAAe,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACvD,aAAkC,EAClC,SAAoC;IAEpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,OAAO,CAAC,KAAK,EAAE,EAAE;QAChB,IAAI,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,SAAS,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,0CAA0C,CAAC,GAAW;IACrE,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAwC,CAAC;IACzF,MAAM,OAAO,GAAG,eAAe,CAAC,kBAAkB,EAAwC,CAAC;IAC3F,OAAO,eAAe,CACrB,qBAAqB,CAAC,MAAM,CAAC,sBAAsB,CAAC,EACpD,qBAAqB,CAAC,OAAO,CAAC,sBAAsB,CAAC,EACrD,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CACrC,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAC1C,GAAW,EACX,MAAc,EACd,KAAwC;IAExC,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;QACtC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACJ,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,uCAAuC,MAAM,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC7I,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GACb,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ;YAC/C,IAAI,CAAC,sBAAsB,KAAK,IAAI;YACpC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC;YAC1C,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,sBAAkD,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAAgB;IACzE,kCAAkC,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,GAAW,EAAE,cAAsB;IAC5F,kCAAkC,CAAC,GAAG,EAAE,iBAAiB,EAAE;QAC1D,OAAO,EAAE,IAAI;QACb,wBAAwB,EAAE,cAAc;KACxC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { getAgentDir } from \"../../../../config.ts\";\nimport { FileSettingsStorage, parseSettingsJson, type Settings, SettingsManager } from \"../../../settings-manager.ts\";\n\nexport type CursorCliOauthExecutionMode = \"agent\" \| \"plan\";\nexport type CursorCliOauthResumeMode = \"auto\" \| \"off\";\n\nexport interface CursorCliOauthProviderSettings {\n\t/*\n\t Explicit senpi-side opt-in for the AMBIENT lane (host-CLI-derived native\n\t * credential bootstrap). Defaults to false: a logged-in `cursor-agent` on the\n\t * host is not consent to spend that subscription from senpi.\n\t /\n\treadonly enabled: boolean;\n\t/\n\t True only when a settings layer or the environment set `enabled` to false\n\t * verbatim. That is a kill switch and outranks stored accounts, while a merely\n\t * absent flag leaves an explicit senpi-side login usable.\n\t /\n\treadonly explicitlyDisabled: boolean;\n\treadonly executablePath: string \| undefined;\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string \| undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly resumeMode: CursorCliOauthResumeMode;\n\treadonly pinnedAccount: string \| undefined;\n\treadonly contextRecapOnModelSwitch: boolean;\n\treadonly modelCatalogTtlHours: number;\n\treadonly sandboxMode: string \| undefined;\n\t/* Exact full commands the spawned CLI must refuse; globs are not supported. /\n\treadonly denyCommands?: string[];\n}\n\ntype SettingsWithCursorCliOauthProvider = Settings & {\n\tcursorCliOauthProvider?: unknown;\n};\n\ntype Environment = Readonly<Record<string, string \| undefined>>;\ntype ParsedSettings = Partial<CursorCliOauthProviderSettings>;\n\nconst DEFAULT_SETTINGS: CursorCliOauthProviderSettings = {\n\tenabled: false,\n\texplicitlyDisabled: false,\n\texecutablePath: undefined,\n\tforceExecution: true,\n\tnoApprovalAcknowledgedAt: undefined,\n\texecutionMode: \"agent\",\n\tresumeMode: \"auto\",\n\tpinnedAccount: undefined,\n\tcontextRecapOnModelSwitch: true,\n\tmodelCatalogTtlHours: 24,\n\tsandboxMode: undefined,\n\tdenyCommands: [],\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseBoolean(value: unknown): boolean \| undefined {\n\treturn typeof value === \"boolean\" ? value : undefined;\n}\n\nfunction parseEnvironmentBoolean(value: string \| undefined): boolean \| undefined {\n\tif (value === undefined) return undefined;\n\tswitch (value.toLowerCase()) {\n\t\tcase \"1\":\n\t\tcase \"true\":\n\t\t\treturn true;\n\t\tcase \"0\":\n\t\tcase \"false\":\n\t\t\treturn false;\n\t\tdefault:\n\t\t\treturn undefined;\n\t}\n}\n\nfunction parseNonEmptyString(value: unknown): string \| undefined {\n\treturn typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/* Exact full commands only: string entries are trimmed, non-strings and empties are dropped. /\nfunction parseDenyCommands(value: unknown): string[] \| undefined {\n\tif (!Array.isArray(value)) return undefined;\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((command) => command.length > 0);\n}\n\n/* Comma-separated exact full commands; a missing or empty value leaves settings untouched. /\nfunction parseEnvironmentDenyCommands(value: string \| undefined): string[] \| undefined {\n\tif (value === undefined \|\| value.length === 0) return undefined;\n\treturn value\n\t\t.split(\",\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((command) => command.length > 0);\n}\n\nfunction parseIsoString(value: unknown): string \| undefined {\n\tif (typeof value !== \"string\" \|\| !/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3})?Z$/.test(value)) {\n\t\treturn undefined;\n\t}\n\treturn Number.isNaN(Date.parse(value)) ? undefined : value;\n}\n\nfunction parseExecutionMode(value: unknown): CursorCliOauthExecutionMode \| undefined {\n\treturn value === \"agent\" \|\| value === \"plan\" ? value : undefined;\n}\n\nfunction parseResumeMode(value: unknown): CursorCliOauthResumeMode \| undefined {\n\treturn value === \"auto\" \|\| value === \"off\" ? value : undefined;\n}\n\nfunction parsePositiveFiniteNumber(value: unknown): number \| undefined {\n\treturn typeof value === \"number\" && Number.isFinite(value) && value > 0 ? value : undefined;\n}\n\nfunction parseEnvironmentPositiveFiniteNumber(value: string \| undefined): number \| undefined {\n\tif (value === undefined \|\| value.length === 0) return undefined;\n\tconst parsed = Number(value);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;\n}\n\nfunction parseProviderSettings(value: unknown): ParsedSettings {\n\tif (!isRecord(value)) return {};\n\tconst enabled = parseBoolean(value.enabled);\n\tconst executablePath = parseNonEmptyString(value.executablePath);\n\tconst forceExecution = parseBoolean(value.forceExecution);\n\tconst noApprovalAcknowledgedAt = parseIsoString(value.noApprovalAcknowledgedAt);\n\tconst executionMode = parseExecutionMode(value.executionMode);\n\tconst resumeMode = parseResumeMode(value.resumeMode);\n\tconst pinnedAccount = parseNonEmptyString(value.pinnedAccount);\n\tconst contextRecapOnModelSwitch = parseBoolean(value.contextRecapOnModelSwitch);\n\tconst modelCatalogTtlHours = parsePositiveFiniteNumber(value.modelCatalogTtlHours);\n\tconst sandboxMode = parseNonEmptyString(value.sandboxMode);\n\tconst denyCommands = parseDenyCommands(value.denyCommands);\n\treturn {\n\t\t...(enabled !== undefined ? { enabled } : {}),\n\t\t...(executablePath !== undefined ? { executablePath } : {}),\n\t\t...(forceExecution !== undefined ? { forceExecution } : {}),\n\t\t...(noApprovalAcknowledgedAt !== undefined ? { noApprovalAcknowledgedAt } : {}),\n\t\t...(executionMode !== undefined ? { executionMode } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t\t...(contextRecapOnModelSwitch !== undefined ? { contextRecapOnModelSwitch } : {}),\n\t\t...(modelCatalogTtlHours !== undefined ? { modelCatalogTtlHours } : {}),\n\t\t...(sandboxMode !== undefined ? { sandboxMode } : {}),\n\t\t...(denyCommands !== undefined ? { denyCommands } : {}),\n\t};\n}\n\nfunction parseEnvironmentSettings(environment: Environment): ParsedSettings {\n\tconst executablePath =\n\t\tparseNonEmptyString(environment.SENPI_CURSOR_CLI_OAUTH_EXECUTABLE) ??\n\t\tparseNonEmptyString(environment.CURSOR_AGENT_EXECUTABLE);\n\tconst enabled = parseEnvironmentBoolean(environment.SENPI_CURSOR_CLI_OAUTH_ENABLED);\n\tconst forceExecution = parseEnvironmentBoolean(environment.SENPI_CURSOR_CLI_OAUTH_FORCE);\n\tconst executionMode = parseExecutionMode(environment.SENPI_CURSOR_CLI_OAUTH_EXECUTION_MODE);\n\tconst resumeMode = parseResumeMode(environment.SENPI_CURSOR_CLI_OAUTH_RESUME);\n\tconst pinnedAccount = parseNonEmptyString(environment.SENPI_CURSOR_CLI_OAUTH_PINNED_ACCOUNT);\n\tconst contextRecapOnModelSwitch = parseEnvironmentBoolean(environment.SENPI_CURSOR_CLI_OAUTH_RECAP);\n\tconst modelCatalogTtlHours = parseEnvironmentPositiveFiniteNumber(\n\t\tenvironment.SENPI_CURSOR_CLI_OAUTH_MODEL_CATALOG_TTL_HOURS,\n\t);\n\tconst sandboxMode = parseNonEmptyString(environment.SENPI_CURSOR_CLI_OAUTH_SANDBOX_MODE);\n\tconst denyCommands = parseEnvironmentDenyCommands(environment.SENPI_CURSOR_CLI_OAUTH_DENY_COMMANDS);\n\treturn {\n\t\t...(executablePath !== undefined ? { executablePath } : {}),\n\t\t...(enabled !== undefined ? { enabled } : {}),\n\t\t...(forceExecution !== undefined ? { forceExecution } : {}),\n\t\t...(executionMode !== undefined ? { executionMode } : {}),\n\t\t...(resumeMode !== undefined ? { resumeMode } : {}),\n\t\t...(pinnedAccount !== undefined ? { pinnedAccount } : {}),\n\t\t...(contextRecapOnModelSwitch !== undefined ? { contextRecapOnModelSwitch } : {}),\n\t\t...(modelCatalogTtlHours !== undefined ? { modelCatalogTtlHours } : {}),\n\t\t...(sandboxMode !== undefined ? { sandboxMode } : {}),\n\t\t...(denyCommands !== undefined ? { denyCommands } : {}),\n\t};\n}\n\nfunction resolveSettings(...layers: readonly ParsedSettings[]): CursorCliOauthProviderSettings {\n\tconst resolved: CursorCliOauthProviderSettings = Object.assign({}, DEFAULT_SETTINGS, ...layers);\n\t// The last layer that names `enabled` wins, exactly as the value merge does;\n\t// only a verbatim false there is the kill switch.\n\tconst named = layers.filter((layer) => layer.enabled !== undefined);\n\treturn { ...resolved, explicitlyDisabled: named.length > 0 && named[named.length - 1]?.enabled === false };\n}\n\n/* Parse one provider settings block with environment values taking precedence. /\nexport function parseCursorCliOauthProviderSettings(\n\tvalue: unknown,\n\tenvironment: Environment,\n): CursorCliOauthProviderSettings {\n\treturn resolveSettings(parseProviderSettings(value), parseEnvironmentSettings(environment));\n}\n\n/\n Build the probe-owned sandbox allowlist validator without hardcoding modes in settings parsing.\n * Each distinct rejected mode is reported once through the supplied warning hook.\n /\nexport function createCursorCliOauthSandboxModeValidator(\n\tacceptedModes: ReadonlySet<string>,\n\tonWarning: (message: string) => void,\n): (value: string \| undefined) => string \| undefined {\n\tconst warnedModes = new Set<string>();\n\treturn (value) => {\n\t\tif (value === undefined \|\| acceptedModes.has(value)) return value;\n\t\tif (!warnedModes.has(value)) {\n\t\t\twarnedModes.add(value);\n\t\t\tonWarning(`Ignoring unrecognized Cursor CLI OAuth sandbox mode: ${value}`);\n\t\t}\n\t\treturn undefined;\n\t};\n}\n\n/* Load global and project settings afresh, with env values taking final precedence. /\nexport function loadCursorCliOauthProviderSettingsFromDisk(cwd: string): CursorCliOauthProviderSettings {\n\tconst settingsManager = SettingsManager.create(cwd, getAgentDir());\n\tconst global = settingsManager.getGlobalSettings() as SettingsWithCursorCliOauthProvider;\n\tconst project = settingsManager.getProjectSettings() as SettingsWithCursorCliOauthProvider;\n\treturn resolveSettings(\n\t\tparseProviderSettings(global.cursorCliOauthProvider),\n\t\tparseProviderSettings(project.cursorCliOauthProvider),\n\t\tparseEnvironmentSettings(process.env),\n\t);\n}\n\nfunction persistCursorCliOauthProviderPatch(\n\tcwd: string,\n\taction: string,\n\tpatch: Readonly<Record<string, unknown>>,\n): void {\n\tconst storage = new FileSettingsStorage(cwd, getAgentDir());\n\tstorage.selectSource(\"global\");\n\tstorage.withLock(\"global\", (current) => {\n\t\tlet root: Record<string, unknown>;\n\t\ttry {\n\t\t\troot = current === undefined ? {} : parseSettingsJson(current);\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Cannot persist the cursor-cli-oauth ${action}: the settings file is unparseable (${error instanceof Error ? error.message : String(error)})`,\n\t\t\t);\n\t\t}\n\t\tconst provider =\n\t\t\ttypeof root.cursorCliOauthProvider === \"object\" &&\n\t\t\troot.cursorCliOauthProvider !== null &&\n\t\t\t!Array.isArray(root.cursorCliOauthProvider)\n\t\t\t\t? { ...(root.cursorCliOauthProvider as Record<string, unknown>) }\n\t\t\t\t: {};\n\t\treturn JSON.stringify({ ...root, cursorCliOauthProvider: { ...provider, ...patch } }, null, 2);\n\t});\n}\n\n/* Persist explicit provider activation while preserving every sibling setting. /\nexport function persistCursorCliOauthEnabled(cwd: string, enabled: boolean): void {\n\tpersistCursorCliOauthProviderPatch(cwd, \"enabled state\", { enabled });\n}\n\n/\n Read-modify-write `noApprovalAcknowledgedAt` into the provider block of the\n * global settings file, preserving every other key. An unparseable file is\n * reported instead of silently clobbered, so an acknowledgement can never\n * claim success while leaving the settings unwritten.\n */\nexport function persistCursorCliNoApprovalAcknowledgement(cwd: string, acknowledgedAt: string): void {\n\tpersistCursorCliOauthProviderPatch(cwd, \"acknowledgement\", {\n\t\tenabled: true,\n\t\tnoApprovalAcknowledgedAt: acknowledgedAt,\n\t});\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/spawn-model.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import { type Model, type ThinkingSelection } from "@earendil-works/pi-ai";
+export declare function resolveCursorCliSpawnModel(model: Model<"cursor-agent">, selection: ThinkingSelection | undefined): string;
+//# sourceMappingURL=spawn-model.d.ts.map

package/dist/core/extensions/builtin/cursor-cli-oauth/spawn-model.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"spawn-model.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/spawn-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAA8B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEvG,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,EAC5B,SAAS,EAAE,iBAAiB,GAAG,SAAS,GACtC,MAAM,CAER"}

package/dist/core/extensions/builtin/cursor-cli-oauth/spawn-model.js ADDED Viewed

@@ -0,0 +1,5 @@
+import { renderCursorCliModelString } from "@earendil-works/pi-ai";
+export function resolveCursorCliSpawnModel(model, selection) {
+    return renderCursorCliModelString(model, selection);
+}
+//# sourceMappingURL=spawn-model.js.map

package/dist/core/extensions/builtin/cursor-cli-oauth/spawn-model.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"spawn-model.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/spawn-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,0BAA0B,EAA0B,MAAM,uBAAuB,CAAC;AAEvG,MAAM,UAAU,0BAA0B,CACzC,KAA4B,EAC5B,SAAwC;IAExC,OAAO,0BAA0B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC","sourcesContent":["import { type Model, renderCursorCliModelString, type ThinkingSelection } from \"@earendil-works/pi-ai\";\n\nexport function resolveCursorCliSpawnModel(\n\tmodel: Model<\"cursor-agent\">,\n\tselection: ThinkingSelection | undefined,\n): string {\n\treturn renderCursorCliModelString(model, selection);\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/stream.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/stream.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,GAAG,EAER,KAAK,2BAA2B,EAChC,KAAK,OAAO,EACZ,KAAK,eAAe,EAIpB,KAAK,KAAK,EACV,KAAK,mBAAmB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EACN,KAAK,yBAAyB,EAG9B,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEN,KAAK,oBAAoB,~~EAGzB~~,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGN,KAAK,sBAAsB,EAG3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,8BAA8B,EAA8C,MAAM,eAAe,CAAC;~~AAIhH~~,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAYhE,sFAAsF;AACtF,MAAM,MAAM,mBAAmB,GAAG;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,CAAC;CACpD,CAAC;AAyUF;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,IAAI,GAAE,mBAAwB,GAC5B,2BAA2B,~~CA+Q7B~~"}
1	+ {"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/stream.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,GAAG,EAER,KAAK,2BAA2B,EAChC,KAAK,OAAO,EACZ,KAAK,eAAe,EAIpB,KAAK,KAAK,EACV,KAAK,mBAAmB,EACxB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EACN,KAAK,yBAAyB,EAG9B,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEN,KAAK,oBAAoB,EAIzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGN,KAAK,sBAAsB,EAG3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,8BAA8B,EAA8C,MAAM,eAAe,CAAC;AAKhH,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAYhE,sFAAsF;AACtF,MAAM,MAAM,mBAAmB,GAAG;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,CAAC;CACpD,CAAC;AAyUF;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,IAAI,GAAE,mBAAwB,GAC5B,2BAA2B,CAoR7B"}

package/dist/core/extensions/builtin/cursor-cli-oauth/stream.js CHANGED Viewed

@@ -8,9 +8,10 @@ import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable, } from
 import { runCursorCliFailover } from "./failover.js";
 import { applyCursorCliDenyConfig, CursorCliExecutionRefusalError, createCursorCliGuardrailSession, resolveCursorCliExecutionPolicy, } from "./guardrails.js";
 import { runInCursorAccountHome } from "./home-store.js";
-import { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig, cursorAgentNotInstalledError, } from "./oauth-login.js";
+import { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig, cursorAgentNotInstalledError, isCursorCliOauthLaneEnabled, } from "./oauth-login.js";
 import { cursorCliSessionRouter, } from "./session-router.js";
 import { loadCursorCliOauthProviderSettingsFromDisk } from "./settings.js";
+import { resolveCursorCliSpawnModel } from "./spawn-model.js";
 import { CursorCliAbortError, spawnCursorCli } from "./transport.js";
 export { CURSOR_CLI_OAUTH_PROVIDER_ID } from "./oauth-login.js";
 const DISABLED_MESSAGE = "disabled by settings";
@@ -361,7 +362,10 @@ export function streamCursorCliOauth(model, context, options, deps = {}) {
             // Fresh per turn: settings, credentials, and executable resolution are
             // never cached across turns, so back-to-back turns observe changes.
             const settings = deps.settings ?? loadCursorCliOauthProviderSettingsFromDisk(cwdDirectory);
-            if (!settings.enabled)
+            // An explicit `enabled: false` is the kill switch; the flagless ambient
+            // case is refused below, once the stored slots are known, so the turn path
+            // and `assessConfiguration` share one opt-in rule.
+            if (settings.explicitlyDisabled)
                 throw new Error(DISABLED_MESSAGE);
             const executableDeps = {
                 ...defaultCursorAgentExecutableDeps(),
@@ -393,13 +397,16 @@ export function streamCursorCliOauth(model, context, options, deps = {}) {
                 appendNotice(mapper, warning.message);
             const stored = await store.read(CURSOR_CLI_OAUTH_PROVIDER_ID);
             const storedAccounts = stored?.type === "oauth" ? listAccounts(stored) : [];
+            if (!isCursorCliOauthLaneEnabled(settings, storedAccounts.length))
+                throw new Error(DISABLED_MESSAGE);
             if (storedAccounts.length === 0)
                 throw new Error(NO_ACCOUNTS_MESSAGE);
             const prompt = lastUserPrompt(context);
             const senpiSessionId = options?.affinitySessionId ?? options?.sessionId ?? DEFAULT_CURSOR_AFFINITY_KEY;
+            const spawnModel = resolveCursorCliSpawnModel(model, options?.thinkingSelection);
             const turnInput = {
                 prompt,
-                model: model.id,
+                model: spawnModel,
                 recentExchanges: recapExchanges(context),
             };
             const spawnAndStream = (attempt, slot) => {
@@ -424,7 +431,7 @@ export function streamCursorCliOauth(model, context, options, deps = {}) {
                             applyCursorCliDenyConfig(home, policy.denyCommands);
                             const handle = spawnCursorCli({
                                 prompt: attempt.prompt,
-                                model: model.id,
+                                model: spawnModel,
                                 resumeChatId: attempt.resumeChatId,
                                 force: policy.force,
                                 executionMode: policy.executionMode,