@cursor/july 0.1.20 → 0.1.21

package/src/internal/cursor/credentials.test.ts

@@ -0,0 +1,351 @@
+import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  clearStoredCredentials,
+  credentialsFilePath,
+  cursorBackendUrl,
+  cursorExternalApiUrl,
+  pollForLoginTokens,
+  readStoredCredentials,
+  resolveApiKey,
+  startBrowserLogin,
+  writeStoredCredentials,
+} from "./credentials.js";
+
+let configDir: string;
+const savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(async () => {
+  configDir = await mkdtemp(join(tmpdir(), "agent-serve-creds-"));
+  for (const key of [
+    "AGENT_SERVE_CONFIG_DIR",
+    "CURSOR_API_KEY",
+    "CURSOR_API_BASE_URL",
+    "AGENT_SERVE_CURSOR_BACKEND_URL",
+    "CURSOR_WEBSITE_URL",
+  ]) {
+    savedEnv[key] = process.env[key];
+    delete process.env[key];
+  }
+  process.env.AGENT_SERVE_CONFIG_DIR = configDir;
+});
+
+afterEach(async () => {
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  await rm(configDir, { recursive: true, force: true });
+});
+
+describe("base URLs", () => {
+  it("defaults the external API host separately from the backend", () => {
+    expect(cursorBackendUrl()).toBe("https://api2.cursor.sh");
+    expect(cursorExternalApiUrl()).toBe("https://api.cursor.com");
+  });
+
+  it("CURSOR_API_BASE_URL overrides both for local dev", () => {
+    process.env.CURSOR_API_BASE_URL = "http://localhost:8888/";
+    expect(cursorBackendUrl()).toBe("http://localhost:8888");
+    expect(cursorExternalApiUrl()).toBe("http://localhost:8888");
+  });
+
+  it("AGENT_SERVE_CURSOR_BACKEND_URL re-pins only the backend family (hosted pods)", () => {
+    process.env.CURSOR_API_BASE_URL = "https://api.cursor.com";
+    process.env.AGENT_SERVE_CURSOR_BACKEND_URL = "https://api2.cursor.sh/";
+    expect(cursorBackendUrl()).toBe("https://api2.cursor.sh");
+    expect(cursorExternalApiUrl()).toBe("https://api.cursor.com");
+  });
+});
+
+describe("stored credentials", () => {
+  it("round-trips through the credentials file with 0600 permissions", async () => {
+    await writeStoredCredentials({
+      backendUrl: "https://api2.cursor.sh",
+      apiKey: "crsr_test",
+    });
+    expect(await readStoredCredentials()).toEqual({
+      backendUrl: "https://api2.cursor.sh",
+      apiKey: "crsr_test",
+    });
+    const mode = (await stat(credentialsFilePath())).mode & 0o777;
+    expect(mode).toBe(0o600);
+    expect(await readFile(credentialsFilePath(), "utf8")).toContain(
+      "crsr_test"
+    );
+
+    expect(await clearStoredCredentials()).toBe(true);
+    expect(await readStoredCredentials()).toBeUndefined();
+    expect(await clearStoredCredentials()).toBe(false);
+  });
+
+  it("treats a corrupt credentials file as signed out", async () => {
+    await writeStoredCredentials({
+      backendUrl: "https://api2.cursor.sh",
+      apiKey: "crsr_test",
+    });
+    const { writeFile } = await import("node:fs/promises");
+    await writeFile(credentialsFilePath(), "not json");
+    expect(await readStoredCredentials()).toBeUndefined();
+  });
+});
+
+describe("resolveApiKey", () => {
+  it("prefers the explicit option, then env, then the stored login", async () => {
+    await writeStoredCredentials({
+      backendUrl: cursorBackendUrl(),
+      apiKey: "crsr_stored",
+    });
+    process.env.CURSOR_API_KEY = "crsr_env";
+
+    expect(await resolveApiKey({ apiKey: "crsr_option" })).toMatchObject({
+      apiKey: "crsr_option",
+      source: "option",
+    });
+    expect(await resolveApiKey()).toMatchObject({
+      apiKey: "crsr_env",
+      source: "env",
+    });
+    delete process.env.CURSOR_API_KEY;
+    expect(await resolveApiKey()).toMatchObject({
+      apiKey: "crsr_stored",
+      source: "login",
+    });
+  });
+
+  it("ignores a stored key minted against a different backend", async () => {
+    await writeStoredCredentials({
+      backendUrl: "https://localhost:8000",
+      apiKey: "crsr_dev_backend",
+    });
+    expect(await resolveApiKey()).toBeUndefined();
+    expect(
+      await resolveApiKey({ backendUrl: "https://localhost:8000" })
+    ).toMatchObject({ apiKey: "crsr_dev_backend", source: "login" });
+  });
+
+  it("resolves to undefined with no credentials anywhere", async () => {
+    expect(await resolveApiKey()).toBeUndefined();
+  });
+});
+
+describe("browser login", () => {
+  it("builds a PKCE deep link on the configured website", () => {
+    process.env.CURSOR_WEBSITE_URL = "https://localhost:4443";
+    const start = startBrowserLogin();
+    const url = new URL(start.loginUrl);
+    expect(url.origin).toBe("https://localhost:4443");
+    expect(url.pathname).toBe("/loginDeepControl");
+    expect(url.searchParams.get("uuid")).toBe(start.uuid);
+    expect(url.searchParams.get("mode")).toBe("login");
+    expect(url.searchParams.get("redirectTarget")).toBe("cli");
+    // The challenge is derived from (and never equals) the verifier.
+    expect(url.searchParams.get("challenge")).not.toBe(start.verifier);
+    expect(url.searchParams.get("challenge")).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  });
+
+  // The verifier is redeemable for a durable API key, so it must never reach a
+  // URL: POST keeps it in the body, out of access logs.
+  it("polls POST /auth/poll with the verifier in the body, never the URL", async () => {
+    const seen: Array<{ url: string; init?: RequestInit }> = [];
+    let calls = 0;
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      seen.push({ url: String(input), init });
+      calls++;
+      if (calls < 3) {
+        return new Response("Not found", { status: 404 });
+      }
+      return Response.json({ accessToken: "session-token", refreshToken: "r" });
+    }) as typeof fetch;
+
+    const result = await pollForLoginTokens({
+      uuid: "uuid-1",
+      verifier: "verifier-1",
+      backendUrl: "https://backend.example",
+      fetchImpl,
+    });
+    expect(result).toEqual({
+      status: "signed_in",
+      accessToken: "session-token",
+    });
+    expect(calls).toBe(3);
+    for (const { url, init } of seen) {
+      expect(init?.method).toBe("POST");
+      // The whole point: no verifier anywhere in the request URL.
+      expect(url).toBe("https://backend.example/auth/poll");
+      expect(JSON.parse(String(init?.body))).toEqual({
+        uuid: "uuid-1",
+        verifier: "verifier-1",
+      });
+    }
+  });
+
+  // Production has not deployed POST /auth/poll yet (the route landed in
+  // #167554). Until it does, the login has to work over GET.
+  it("falls back to GET, once and stickily, when the backend has no POST route", async () => {
+    const seen: Array<{ url: string; method?: string }> = [];
+    const warnings: string[] = [];
+    let calls = 0;
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      seen.push({ url: String(input), method: init?.method });
+      calls++;
+      if (calls === 1) {
+        return Response.json(
+          {
+            message: "Route POST:/auth/poll not found",
+            error: "Not Found",
+            statusCode: 404,
+          },
+          { status: 404 }
+        );
+      }
+      if (calls === 2) {
+        return new Response("Not found", { status: 404 });
+      }
+      return Response.json({ accessToken: "session-token" });
+    }) as typeof fetch;
+
+    const result = await pollForLoginTokens({
+      uuid: "uuid-1",
+      verifier: "verifier-1",
+      backendUrl: "https://backend.example",
+      fetchImpl,
+      logger: (line) => warnings.push(line),
+    });
+    expect(result).toEqual({
+      status: "signed_in",
+      accessToken: "session-token",
+    });
+    expect(seen.map((s) => s.method)).toEqual(["POST", "GET", "GET"]);
+    // The fallback carries the PKCE material in the query string — the exposure
+    // POST exists to avoid — so it must say so out loud, exactly once.
+    expect(warnings).toHaveLength(1);
+    expect(warnings[0]).toContain("no POST /auth/poll");
+    expect(new URL(seen[1]?.url ?? "").searchParams.get("verifier")).toBe(
+      "verifier-1"
+    );
+  });
+
+  it("fails clearly when the backend serves neither verb", async () => {
+    let calls = 0;
+    const fetchImpl = (async (
+      _input: RequestInfo | URL,
+      init?: RequestInit
+    ) => {
+      calls++;
+      return Response.json(
+        {
+          message: `Route ${init?.method ?? "GET"}:/auth/poll not found`,
+          error: "Not Found",
+          statusCode: 404,
+        },
+        { status: 404 }
+      );
+    }) as typeof fetch;
+
+    const result = await pollForLoginTokens({
+      uuid: "uuid-1",
+      verifier: "verifier-1",
+      backendUrl: "https://backend.example",
+      fetchImpl,
+    });
+    expect(result).toMatchObject({
+      status: "failed",
+      message: expect.stringContaining("neither POST nor GET"),
+    });
+    // POST, then the GET retry. No backoff loop on a route that cannot exist.
+    expect(calls).toBe(2);
+  });
+
+  // Fastify's 404 body echoes the full request URL, so on the GET fallback it
+  // contains the verifier. Error text is printed to terminals and pasted into
+  // bug reports; it must never carry a redeemable secret.
+  it("redacts the verifier from error messages", async () => {
+    const verifier = "sUpErSeCrEtVeRiFiEr";
+    const fetchImpl = (async () =>
+      new Response(
+        `upstream error for /auth/poll?uuid=u&verifier=${verifier}`,
+        { status: 500 }
+      )) as typeof fetch;
+
+    const result = await pollForLoginTokens({
+      uuid: "u",
+      verifier,
+      backendUrl: "https://backend.example",
+      fetchImpl,
+    });
+    expect(result.status).toBe("failed");
+    const message = result.status === "failed" ? result.message : "";
+    expect(message).not.toContain(verifier);
+    expect(message).toContain("[verifier redacted]");
+    expect(message).toContain("500");
+  });
+
+  // Regression marker: an earlier poll treated any unrecognized 404 body as
+  // fatal, so a body-shape change looked exactly like "you signed in too
+  // slowly". On the GET path, an unknown 404 body means "keep waiting".
+  it("treats an unrecognized 404 body on the GET fallback as still-pending", async () => {
+    let calls = 0;
+    const fetchImpl = (async (
+      _input: RequestInfo | URL,
+      init?: RequestInit
+    ) => {
+      calls++;
+      if (init?.method === "POST") {
+        // Force the GET fallback.
+        return Response.json(
+          { message: "Route POST:/auth/poll not found", statusCode: 404 },
+          { status: 404 }
+        );
+      }
+      if (calls < 4) {
+        return Response.json({ error: "not_found" }, { status: 404 });
+      }
+      return Response.json({ accessToken: "session-token" });
+    }) as typeof fetch;
+
+    const result = await pollForLoginTokens({
+      uuid: "u",
+      verifier: "v",
+      backendUrl: "https://backend.example",
+      fetchImpl,
+    });
+    expect(result).toEqual({
+      status: "signed_in",
+      accessToken: "session-token",
+    });
+  });
+
+  it("gives up after repeated hard errors, naming the status", async () => {
+    const fetchImpl = (async () =>
+      new Response("nope", { status: 500 })) as typeof fetch;
+    const result = await pollForLoginTokens({
+      uuid: "u",
+      verifier: "v",
+      backendUrl: "https://backend.example",
+      fetchImpl,
+    });
+    expect(result).toMatchObject({
+      status: "failed",
+      message: expect.stringContaining("500"),
+    });
+  });
+
+  it("times out when the browser sign-in never lands", async () => {
+    const fetchImpl = (async () =>
+      new Response("Not found", { status: 404 })) as typeof fetch;
+    const result = await pollForLoginTokens({
+      uuid: "u",
+      verifier: "v",
+      backendUrl: "https://backend.example",
+      fetchImpl,
+      maxAttempts: 1,
+    });
+    expect(result).toEqual({ status: "timed_out" });
+  });
+});

package/src/internal/cursor/github-credentials.test.ts

@@ -0,0 +1,136 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { parseCursorGithubRepoScope } from "../../channels/github/cursor-account.js";
+import { CursorGithubCredentialProvider } from "./github-credentials.js";
+
+describe("CursorGithubCredentialProvider", () => {
+  let savedGhToken: string | undefined;
+
+  beforeEach(() => {
+    savedGhToken = process.env.GH_TOKEN;
+    process.env.GH_TOKEN = "previous-token";
+  });
+
+  afterEach(() => {
+    if (savedGhToken === undefined) {
+      delete process.env.GH_TOKEN;
+    } else {
+      process.env.GH_TOKEN = savedGhToken;
+    }
+  });
+
+  it("caches, refreshes, and exports the scoped token for gh", async () => {
+    let now = Date.parse("2026-07-16T00:00:00.000Z");
+    let mint = 0;
+    const getGithubToken = vi.fn(async () => {
+      mint++;
+      return {
+        token: `ghs_scoped_${mint}`,
+        expiresAt: new Date(now + 45 * 60_000).toISOString(),
+      };
+    });
+    const provider = new CursorGithubCredentialProvider({
+      client: { getGithubToken },
+      scope: parseCursorGithubRepoScope(["Acme/Widgets", "acme/widgets"]),
+      now: () => now,
+    });
+
+    await provider.start();
+    expect(process.env.GH_TOKEN).toBe("ghs_scoped_1");
+    await expect(provider.getToken()).resolves.toBe("ghs_scoped_1");
+    expect(getGithubToken).toHaveBeenCalledOnce();
+    expect(getGithubToken).toHaveBeenCalledWith(["acme/widgets"], {
+      permissions: "pr-write",
+    });
+
+    now += 41 * 60_000;
+    await expect(provider.getToken()).resolves.toBe("ghs_scoped_2");
+    expect(process.env.GH_TOKEN).toBe("ghs_scoped_2");
+    expect(getGithubToken).toHaveBeenCalledTimes(2);
+
+    provider.stop();
+    expect(process.env.GH_TOKEN).toBe("previous-token");
+    await expect(provider.getToken()).rejects.toThrow(/have been stopped/);
+  });
+
+  it("single-flights concurrent token requests", async () => {
+    const expiresAt = new Date(Date.now() + 45 * 60_000).toISOString();
+    const getGithubToken = vi.fn(async () => ({
+      token: "ghs_one",
+      expiresAt,
+    }));
+    const provider = new CursorGithubCredentialProvider({
+      client: { getGithubToken },
+      scope: parseCursorGithubRepoScope(["acme/widgets"]),
+    });
+
+    await expect(
+      Promise.all([provider.getToken(), provider.getToken()])
+    ).resolves.toEqual(["ghs_one", "ghs_one"]);
+    expect(getGithubToken).toHaveBeenCalledOnce();
+  });
+
+  it("activates a token fetched before the provider starts", async () => {
+    const getGithubToken = vi.fn(async () => ({
+      token: "ghs_prefetched",
+      expiresAt: new Date(Date.now() + 45 * 60_000).toISOString(),
+    }));
+    const provider = new CursorGithubCredentialProvider({
+      client: { getGithubToken },
+      scope: parseCursorGithubRepoScope(["acme/widgets"]),
+    });
+
+    await provider.getToken();
+    expect(process.env.GH_TOKEN).toBe("previous-token");
+    await provider.start();
+    expect(process.env.GH_TOKEN).toBe("ghs_prefetched");
+    provider.stop();
+  });
+
+  it("keeps the previous token when an early refresh is transiently unavailable", async () => {
+    let now = Date.parse("2026-07-16T00:00:00.000Z");
+    const getGithubToken = vi
+      .fn()
+      .mockResolvedValueOnce({
+        token: "ghs_still_valid",
+        expiresAt: new Date(now + 45 * 60_000).toISOString(),
+      })
+      .mockRejectedValueOnce(new Error("backend unavailable"));
+    const provider = new CursorGithubCredentialProvider({
+      client: { getGithubToken },
+      scope: parseCursorGithubRepoScope(["acme/widgets"]),
+      now: () => now,
+    });
+
+    await expect(provider.getToken()).resolves.toBe("ghs_still_valid");
+    now += 41 * 60_000;
+    await expect(provider.getToken()).resolves.toBe("ghs_still_valid");
+  });
+
+  it("evicts an expired lease and negative-caches hard failures", async () => {
+    let now = Date.parse("2026-07-16T00:00:00.000Z");
+    const getGithubToken = vi
+      .fn()
+      .mockResolvedValueOnce({
+        token: "ghs_expired",
+        expiresAt: new Date(now + 45 * 60_000).toISOString(),
+      })
+      .mockRejectedValue(new Error("GitHub connection missing"));
+    const provider = new CursorGithubCredentialProvider({
+      client: { getGithubToken },
+      scope: parseCursorGithubRepoScope(["acme/widgets"]),
+      now: () => now,
+    });
+
+    await expect(provider.getToken()).resolves.toBe("ghs_expired");
+    now += 46 * 60_000;
+    await expect(provider.getToken()).rejects.toThrow(
+      /GitHub connection missing/
+    );
+    expect(getGithubToken).toHaveBeenCalledTimes(2);
+    // Negative cache: do not hot-loop the backend before the backoff elapses.
+    await expect(provider.getToken()).rejects.toThrow(
+      /GitHub connection missing/
+    );
+    expect(getGithubToken).toHaveBeenCalledTimes(2);
+  });
+});