@cursor/july 0.1.1

package/src/internal/cli-cursor.ts

@@ -0,0 +1,275 @@
+/**
+ * `agent-serve login | logout | whoami` — the Cursor account CLI.
+ *
+ * `login` runs the same PKCE browser flow as `cursor-agent`, then uses the
+ * short-lived session exactly once to mint a named, dashboard-revocable
+ * user API key. Only the key is stored (see `../cursor/credentials.ts`);
+ * everything on the host — inference, cloud runtime, account MCP
+ * connections — flows from it.
+ */
+
+import { spawn } from "node:child_process";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import {
+  CursorBackendClient,
+  CursorBackendError,
+  type CursorIdentity,
+  createUserApiKeyWithSessionToken,
+  revokeMintedUserApiKey,
+} from "./cursor/backend-client.js";
+import {
+  clearStoredCredentials,
+  credentialsFilePath,
+  cursorBackendUrl,
+  type LoginPollResult,
+  pollForLoginTokens,
+  readStoredCredentials,
+  resolveApiKey,
+  SIGN_IN_HINT,
+  startBrowserLogin,
+  writeStoredCredentials,
+} from "./cursor/credentials.js";
+import { CLI_COMMAND_NAME } from "./distribution.js";
+
+export interface CursorCliOptions {
+  /** `login --api-key <key>`: store this key instead of browser login. */
+  apiKey?: string;
+  /** `login --key-name <name>`: label for the minted key. */
+  keyName?: string;
+  json?: boolean;
+}
+
+export async function cmdLogin(options: CursorCliOptions): Promise<number> {
+  const backendUrl = cursorBackendUrl();
+
+  let apiKey: string;
+  // Set only on the browser-mint path; carries what the revoke-on-failure
+  // cleanup needs (the session token that minted the key + its label).
+  let minted: { keyName: string; sessionToken: string } | undefined;
+  if (options.apiKey !== undefined && options.apiKey.trim() !== "") {
+    // Headless path: the operator brings a key (dashboard → Integrations).
+    apiKey = options.apiKey.trim();
+  } else {
+    const { loginUrl, uuid, verifier } = startBrowserLogin();
+    process.stderr.write(
+      `Opening your browser to sign in to Cursor…\n\n  ${loginUrl}\n\n(waiting for the browser sign-in to complete)\n`
+    );
+    openBrowser(loginUrl);
+    const login = await pollForLoginTokens({
+      uuid,
+      verifier,
+      backendUrl,
+      logger: (line) => process.stderr.write(`warning: ${line}\n`),
+    });
+    if (login.status !== "signed_in") {
+      process.stderr.write(`${describeLoginPollFailure(login)}\n`);
+      return 1;
+    }
+    const requestedKeyName = options.keyName?.trim();
+    const keyName =
+      requestedKeyName === undefined || requestedKeyName === ""
+        ? `${CLI_COMMAND_NAME} (${hostname()})`
+        : requestedKeyName;
+    try {
+      apiKey = await createUserApiKeyWithSessionToken({
+        backendUrl,
+        sessionToken: login.accessToken,
+        keyName,
+      });
+    } catch (error) {
+      if (error instanceof CursorBackendError && error.status === 401) {
+        // Team policy: non-admin members may be blocked from minting keys.
+        process.stderr.write(
+          `${error.message}\nYour team may restrict API key creation. Ask a team admin, or run \`${CLI_COMMAND_NAME} login --api-key <key>\` with a key from the Cursor dashboard.\n`
+        );
+        return 1;
+      }
+      throw error;
+    }
+    minted = { keyName, sessionToken: login.accessToken };
+    process.stderr.write(`Minted the "${keyName}" API key.\n`);
+  }
+
+  // Revoke the just-minted key when a later step fails, so a botched login
+  // never leaves an orphaned live credential (no-op on the headless path).
+  const rollbackMintedKey = async (): Promise<void> => {
+    if (minted !== undefined) {
+      await revokeMintedUserApiKey({
+        backendUrl,
+        keyName: minted.keyName,
+        apiKey,
+        sessionToken: minted.sessionToken,
+      }).catch(() => {});
+    }
+  };
+
+  // Prove the credential end-to-end (exchange + GetMe) before storing it.
+  const client = new CursorBackendClient({ backendUrl, apiKey });
+  let identity: CursorIdentity;
+  try {
+    identity = await client.getMe();
+  } catch (error) {
+    await rollbackMintedKey();
+    process.stderr.write(
+      `The API key did not authenticate against ${backendUrl}: ${describeError(error)}\n`
+    );
+    return 1;
+  }
+
+  try {
+    await writeStoredCredentials({ backendUrl, apiKey });
+  } catch (error) {
+    await rollbackMintedKey();
+    process.stderr.write(
+      `Could not store credentials at ${credentialsFilePath()}: ${describeError(error)}\n`
+    );
+    return 1;
+  }
+  process.stdout.write(
+    `Signed in as ${formatIdentity(identity)} (${backendUrl})\nCredentials stored at ${credentialsFilePath()}\n`
+  );
+  if (process.env.CURSOR_API_KEY !== undefined) {
+    process.stderr.write(
+      "note: CURSOR_API_KEY is set in this shell and takes precedence over the stored login.\n"
+    );
+  }
+  return 0;
+}
+
+export async function cmdLogout(): Promise<number> {
+  const stored = await readStoredCredentials();
+  const removed = await clearStoredCredentials();
+  if (!removed || stored === undefined) {
+    process.stdout.write("No stored Cursor credentials.\n");
+    return 0;
+  }
+  process.stdout.write(
+    `Signed out (removed ${credentialsFilePath()}). The API key still exists — revoke it in the Cursor dashboard if it should stop working.\n`
+  );
+  return 0;
+}
+
+export async function cmdWhoami(options: CursorCliOptions): Promise<number> {
+  const resolved = await resolveApiKey();
+  if (resolved === undefined) {
+    process.stderr.write(`Not signed in to Cursor. ${SIGN_IN_HINT}\n`);
+    return 1;
+  }
+  const client = new CursorBackendClient({
+    backendUrl: resolved.backendUrl,
+    apiKey: resolved.apiKey,
+  });
+  let identity: CursorIdentity;
+  try {
+    identity = await client.getMe();
+  } catch (error) {
+    process.stderr.write(
+      `The ${describeSource(resolved.source)} did not authenticate against ${resolved.backendUrl}: ${describeError(error)}\n`
+    );
+    return 1;
+  }
+  if (options.json === true) {
+    process.stdout.write(
+      `${JSON.stringify(
+        {
+          email: identity.email ?? null,
+          authId: identity.authId ?? null,
+          teamName: identity.teamName ?? null,
+          backendUrl: resolved.backendUrl,
+          credentialSource: resolved.source,
+        },
+        null,
+        2
+      )}\n`
+    );
+    return 0;
+  }
+  process.stdout.write(
+    `${formatIdentity(identity)}\n  backend:    ${resolved.backendUrl}\n  credential: ${describeSource(resolved.source)}\n`
+  );
+  return 0;
+}
+
+function formatIdentity(identity: CursorIdentity): string {
+  const name = [identity.firstName, identity.lastName]
+    .filter((part) => part !== undefined && part !== "")
+    .join(" ");
+  const email = identity.email ?? identity.authId ?? "(unknown user)";
+  const team =
+    identity.teamName === undefined ? "" : ` — team ${identity.teamName}`;
+  return name === "" ? `${email}${team}` : `${name} <${email}>${team}`;
+}
+
+function describeSource(source: "option" | "env" | "login"): string {
+  switch (source) {
+    case "option":
+      return "explicit --api-key / serve({ apiKey })";
+    case "env":
+      return "CURSOR_API_KEY environment variable";
+    case "login":
+      return `stored login (${credentialsFilePath()})`;
+  }
+}
+
+/**
+ * Never report a backend failure as a timeout: a wrong-verb poll used to print
+ * "Login timed out or was cancelled" ~200ms in, which reads as "you were too
+ * slow" and hides the actual 404.
+ */
+function describeLoginPollFailure(
+  result: Exclude<LoginPollResult, { status: "signed_in" }>
+): string {
+  switch (result.status) {
+    case "cancelled":
+      return "Login cancelled.";
+    case "timed_out":
+      return `Login timed out — the browser sign-in was never completed. Run \`${CLI_COMMAND_NAME} login\` to try again.`;
+    case "failed":
+      return [
+        `Login failed: ${result.message}`,
+        "This is not a timeout — the sign-in never got a chance to complete.",
+        `Sign in without the browser flow with \`${CLI_COMMAND_NAME} login --api-key <key>\` (Cursor dashboard → Integrations).`,
+      ].join("\n");
+  }
+}
+
+/** Best-effort browser open; the URL is always printed as the fallback. */
+function openBrowser(url: string): void {
+  const command =
+    process.platform === "darwin"
+      ? { cmd: "open", args: [url] }
+      : process.platform === "win32"
+        ? {
+            cmd: join(
+              process.env.SYSTEMROOT ?? "C:\\Windows",
+              "System32",
+              "WindowsPowerShell",
+              "v1.0",
+              "powershell.exe"
+            ),
+            args: [
+              "-NoProfile",
+              "-NonInteractive",
+              "-WindowStyle",
+              "Hidden",
+              "-Command",
+              `Start-Process '${url.replace(/'/g, "''")}'`,
+            ],
+          }
+        : { cmd: "xdg-open", args: [url] };
+  try {
+    const child = spawn(command.cmd, command.args, {
+      stdio: "ignore",
+      detached: true,
+    });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    // The printed URL is the fallback.
+  }
+}
+
+function describeError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}