@cursor/july 0.1.26 → 0.1.27

package/src/internal/cursor/credentials.test.ts

@@ -1,351 +0,0 @@
-import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import {
-  clearStoredCredentials,
-  credentialsFilePath,
-  cursorBackendUrl,
-  cursorExternalApiUrl,
-  pollForLoginTokens,
-  readStoredCredentials,
-  resolveApiKey,
-  startBrowserLogin,
-  writeStoredCredentials,
-} from "./credentials.js";
-
-let configDir: string;
-const savedEnv: Record<string, string | undefined> = {};
-
-beforeEach(async () => {
-  configDir = await mkdtemp(join(tmpdir(), "agent-serve-creds-"));
-  for (const key of [
-    "AGENT_SERVE_CONFIG_DIR",
-    "CURSOR_API_KEY",
-    "CURSOR_API_BASE_URL",
-    "AGENT_SERVE_CURSOR_BACKEND_URL",
-    "CURSOR_WEBSITE_URL",
-  ]) {
-    savedEnv[key] = process.env[key];
-    delete process.env[key];
-  }
-  process.env.AGENT_SERVE_CONFIG_DIR = configDir;
-});
-
-afterEach(async () => {
-  for (const [key, value] of Object.entries(savedEnv)) {
-    if (value === undefined) {
-      delete process.env[key];
-    } else {
-      process.env[key] = value;
-    }
-  }
-  await rm(configDir, { recursive: true, force: true });
-});
-
-describe("base URLs", () => {
-  it("defaults the external API host separately from the backend", () => {
-    expect(cursorBackendUrl()).toBe("https://api2.cursor.sh");
-    expect(cursorExternalApiUrl()).toBe("https://api.cursor.com");
-  });
-
-  it("CURSOR_API_BASE_URL overrides both for local dev", () => {
-    process.env.CURSOR_API_BASE_URL = "http://localhost:8888/";
-    expect(cursorBackendUrl()).toBe("http://localhost:8888");
-    expect(cursorExternalApiUrl()).toBe("http://localhost:8888");
-  });
-
-  it("AGENT_SERVE_CURSOR_BACKEND_URL re-pins only the backend family (hosted pods)", () => {
-    process.env.CURSOR_API_BASE_URL = "https://api.cursor.com";
-    process.env.AGENT_SERVE_CURSOR_BACKEND_URL = "https://api2.cursor.sh/";
-    expect(cursorBackendUrl()).toBe("https://api2.cursor.sh");
-    expect(cursorExternalApiUrl()).toBe("https://api.cursor.com");
-  });
-});
-
-describe("stored credentials", () => {
-  it("round-trips through the credentials file with 0600 permissions", async () => {
-    await writeStoredCredentials({
-      backendUrl: "https://api2.cursor.sh",
-      apiKey: "crsr_test",
-    });
-    expect(await readStoredCredentials()).toEqual({
-      backendUrl: "https://api2.cursor.sh",
-      apiKey: "crsr_test",
-    });
-    const mode = (await stat(credentialsFilePath())).mode & 0o777;
-    expect(mode).toBe(0o600);
-    expect(await readFile(credentialsFilePath(), "utf8")).toContain(
-      "crsr_test"
-    );
-
-    expect(await clearStoredCredentials()).toBe(true);
-    expect(await readStoredCredentials()).toBeUndefined();
-    expect(await clearStoredCredentials()).toBe(false);
-  });
-
-  it("treats a corrupt credentials file as signed out", async () => {
-    await writeStoredCredentials({
-      backendUrl: "https://api2.cursor.sh",
-      apiKey: "crsr_test",
-    });
-    const { writeFile } = await import("node:fs/promises");
-    await writeFile(credentialsFilePath(), "not json");
-    expect(await readStoredCredentials()).toBeUndefined();
-  });
-});
-
-describe("resolveApiKey", () => {
-  it("prefers the explicit option, then env, then the stored login", async () => {
-    await writeStoredCredentials({
-      backendUrl: cursorBackendUrl(),
-      apiKey: "crsr_stored",
-    });
-    process.env.CURSOR_API_KEY = "crsr_env";
-
-    expect(await resolveApiKey({ apiKey: "crsr_option" })).toMatchObject({
-      apiKey: "crsr_option",
-      source: "option",
-    });
-    expect(await resolveApiKey()).toMatchObject({
-      apiKey: "crsr_env",
-      source: "env",
-    });
-    delete process.env.CURSOR_API_KEY;
-    expect(await resolveApiKey()).toMatchObject({
-      apiKey: "crsr_stored",
-      source: "login",
-    });
-  });
-
-  it("ignores a stored key minted against a different backend", async () => {
-    await writeStoredCredentials({
-      backendUrl: "https://localhost:8000",
-      apiKey: "crsr_dev_backend",
-    });
-    expect(await resolveApiKey()).toBeUndefined();
-    expect(
-      await resolveApiKey({ backendUrl: "https://localhost:8000" })
-    ).toMatchObject({ apiKey: "crsr_dev_backend", source: "login" });
-  });
-
-  it("resolves to undefined with no credentials anywhere", async () => {
-    expect(await resolveApiKey()).toBeUndefined();
-  });
-});
-
-describe("browser login", () => {
-  it("builds a PKCE deep link on the configured website", () => {
-    process.env.CURSOR_WEBSITE_URL = "https://localhost:4443";
-    const start = startBrowserLogin();
-    const url = new URL(start.loginUrl);
-    expect(url.origin).toBe("https://localhost:4443");
-    expect(url.pathname).toBe("/loginDeepControl");
-    expect(url.searchParams.get("uuid")).toBe(start.uuid);
-    expect(url.searchParams.get("mode")).toBe("login");
-    expect(url.searchParams.get("redirectTarget")).toBe("cli");
-    // The challenge is derived from (and never equals) the verifier.
-    expect(url.searchParams.get("challenge")).not.toBe(start.verifier);
-    expect(url.searchParams.get("challenge")).toMatch(/^[A-Za-z0-9_-]{43}$/);
-  });
-
-  // The verifier is redeemable for a durable API key, so it must never reach a
-  // URL: POST keeps it in the body, out of access logs.
-  it("polls POST /auth/poll with the verifier in the body, never the URL", async () => {
-    const seen: Array<{ url: string; init?: RequestInit }> = [];
-    let calls = 0;
-    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      seen.push({ url: String(input), init });
-      calls++;
-      if (calls < 3) {
-        return new Response("Not found", { status: 404 });
-      }
-      return Response.json({ accessToken: "session-token", refreshToken: "r" });
-    }) as typeof fetch;
-
-    const result = await pollForLoginTokens({
-      uuid: "uuid-1",
-      verifier: "verifier-1",
-      backendUrl: "https://backend.example",
-      fetchImpl,
-    });
-    expect(result).toEqual({
-      status: "signed_in",
-      accessToken: "session-token",
-    });
-    expect(calls).toBe(3);
-    for (const { url, init } of seen) {
-      expect(init?.method).toBe("POST");
-      // The whole point: no verifier anywhere in the request URL.
-      expect(url).toBe("https://backend.example/auth/poll");
-      expect(JSON.parse(String(init?.body))).toEqual({
-        uuid: "uuid-1",
-        verifier: "verifier-1",
-      });
-    }
-  });
-
-  // Production has not deployed POST /auth/poll yet (the route landed in
-  // #167554). Until it does, the login has to work over GET.
-  it("falls back to GET, once and stickily, when the backend has no POST route", async () => {
-    const seen: Array<{ url: string; method?: string }> = [];
-    const warnings: string[] = [];
-    let calls = 0;
-    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      seen.push({ url: String(input), method: init?.method });
-      calls++;
-      if (calls === 1) {
-        return Response.json(
-          {
-            message: "Route POST:/auth/poll not found",
-            error: "Not Found",
-            statusCode: 404,
-          },
-          { status: 404 }
-        );
-      }
-      if (calls === 2) {
-        return new Response("Not found", { status: 404 });
-      }
-      return Response.json({ accessToken: "session-token" });
-    }) as typeof fetch;
-
-    const result = await pollForLoginTokens({
-      uuid: "uuid-1",
-      verifier: "verifier-1",
-      backendUrl: "https://backend.example",
-      fetchImpl,
-      logger: (line) => warnings.push(line),
-    });
-    expect(result).toEqual({
-      status: "signed_in",
-      accessToken: "session-token",
-    });
-    expect(seen.map((s) => s.method)).toEqual(["POST", "GET", "GET"]);
-    // The fallback carries the PKCE material in the query string — the exposure
-    // POST exists to avoid — so it must say so out loud, exactly once.
-    expect(warnings).toHaveLength(1);
-    expect(warnings[0]).toContain("no POST /auth/poll");
-    expect(new URL(seen[1]?.url ?? "").searchParams.get("verifier")).toBe(
-      "verifier-1"
-    );
-  });
-
-  it("fails clearly when the backend serves neither verb", async () => {
-    let calls = 0;
-    const fetchImpl = (async (
-      _input: RequestInfo | URL,
-      init?: RequestInit
-    ) => {
-      calls++;
-      return Response.json(
-        {
-          message: `Route ${init?.method ?? "GET"}:/auth/poll not found`,
-          error: "Not Found",
-          statusCode: 404,
-        },
-        { status: 404 }
-      );
-    }) as typeof fetch;
-
-    const result = await pollForLoginTokens({
-      uuid: "uuid-1",
-      verifier: "verifier-1",
-      backendUrl: "https://backend.example",
-      fetchImpl,
-    });
-    expect(result).toMatchObject({
-      status: "failed",
-      message: expect.stringContaining("neither POST nor GET"),
-    });
-    // POST, then the GET retry. No backoff loop on a route that cannot exist.
-    expect(calls).toBe(2);
-  });
-
-  // Fastify's 404 body echoes the full request URL, so on the GET fallback it
-  // contains the verifier. Error text is printed to terminals and pasted into
-  // bug reports; it must never carry a redeemable secret.
-  it("redacts the verifier from error messages", async () => {
-    const verifier = "sUpErSeCrEtVeRiFiEr";
-    const fetchImpl = (async () =>
-      new Response(
-        `upstream error for /auth/poll?uuid=u&verifier=${verifier}`,
-        { status: 500 }
-      )) as typeof fetch;
-
-    const result = await pollForLoginTokens({
-      uuid: "u",
-      verifier,
-      backendUrl: "https://backend.example",
-      fetchImpl,
-    });
-    expect(result.status).toBe("failed");
-    const message = result.status === "failed" ? result.message : "";
-    expect(message).not.toContain(verifier);
-    expect(message).toContain("[verifier redacted]");
-    expect(message).toContain("500");
-  });
-
-  // Regression marker: an earlier poll treated any unrecognized 404 body as
-  // fatal, so a body-shape change looked exactly like "you signed in too
-  // slowly". On the GET path, an unknown 404 body means "keep waiting".
-  it("treats an unrecognized 404 body on the GET fallback as still-pending", async () => {
-    let calls = 0;
-    const fetchImpl = (async (
-      _input: RequestInfo | URL,
-      init?: RequestInit
-    ) => {
-      calls++;
-      if (init?.method === "POST") {
-        // Force the GET fallback.
-        return Response.json(
-          { message: "Route POST:/auth/poll not found", statusCode: 404 },
-          { status: 404 }
-        );
-      }
-      if (calls < 4) {
-        return Response.json({ error: "not_found" }, { status: 404 });
-      }
-      return Response.json({ accessToken: "session-token" });
-    }) as typeof fetch;
-
-    const result = await pollForLoginTokens({
-      uuid: "u",
-      verifier: "v",
-      backendUrl: "https://backend.example",
-      fetchImpl,
-    });
-    expect(result).toEqual({
-      status: "signed_in",
-      accessToken: "session-token",
-    });
-  });
-
-  it("gives up after repeated hard errors, naming the status", async () => {
-    const fetchImpl = (async () =>
-      new Response("nope", { status: 500 })) as typeof fetch;
-    const result = await pollForLoginTokens({
-      uuid: "u",
-      verifier: "v",
-      backendUrl: "https://backend.example",
-      fetchImpl,
-    });
-    expect(result).toMatchObject({
-      status: "failed",
-      message: expect.stringContaining("500"),
-    });
-  });
-
-  it("times out when the browser sign-in never lands", async () => {
-    const fetchImpl = (async () =>
-      new Response("Not found", { status: 404 })) as typeof fetch;
-    const result = await pollForLoginTokens({
-      uuid: "u",
-      verifier: "v",
-      backendUrl: "https://backend.example",
-      fetchImpl,
-      maxAttempts: 1,
-    });
-    expect(result).toEqual({ status: "timed_out" });
-  });
-});

package/src/internal/cursor/github-credentials.test.ts

@@ -1,136 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseCursorGithubRepoScope } from "../../channels/github/cursor-account.js";
-import { CursorGithubCredentialProvider } from "./github-credentials.js";
-
-describe("CursorGithubCredentialProvider", () => {
-  let savedGhToken: string | undefined;
-
-  beforeEach(() => {
-    savedGhToken = process.env.GH_TOKEN;
-    process.env.GH_TOKEN = "previous-token";
-  });
-
-  afterEach(() => {
-    if (savedGhToken === undefined) {
-      delete process.env.GH_TOKEN;
-    } else {
-      process.env.GH_TOKEN = savedGhToken;
-    }
-  });
-
-  it("caches, refreshes, and exports the scoped token for gh", async () => {
-    let now = Date.parse("2026-07-16T00:00:00.000Z");
-    let mint = 0;
-    const getGithubToken = vi.fn(async () => {
-      mint++;
-      return {
-        token: `ghs_scoped_${mint}`,
-        expiresAt: new Date(now + 45 * 60_000).toISOString(),
-      };
-    });
-    const provider = new CursorGithubCredentialProvider({
-      client: { getGithubToken },
-      scope: parseCursorGithubRepoScope(["Acme/Widgets", "acme/widgets"]),
-      now: () => now,
-    });
-
-    await provider.start();
-    expect(process.env.GH_TOKEN).toBe("ghs_scoped_1");
-    await expect(provider.getToken()).resolves.toBe("ghs_scoped_1");
-    expect(getGithubToken).toHaveBeenCalledOnce();
-    expect(getGithubToken).toHaveBeenCalledWith(["acme/widgets"], {
-      permissions: "pr-write",
-    });
-
-    now += 41 * 60_000;
-    await expect(provider.getToken()).resolves.toBe("ghs_scoped_2");
-    expect(process.env.GH_TOKEN).toBe("ghs_scoped_2");
-    expect(getGithubToken).toHaveBeenCalledTimes(2);
-
-    provider.stop();
-    expect(process.env.GH_TOKEN).toBe("previous-token");
-    await expect(provider.getToken()).rejects.toThrow(/have been stopped/);
-  });
-
-  it("single-flights concurrent token requests", async () => {
-    const expiresAt = new Date(Date.now() + 45 * 60_000).toISOString();
-    const getGithubToken = vi.fn(async () => ({
-      token: "ghs_one",
-      expiresAt,
-    }));
-    const provider = new CursorGithubCredentialProvider({
-      client: { getGithubToken },
-      scope: parseCursorGithubRepoScope(["acme/widgets"]),
-    });
-
-    await expect(
-      Promise.all([provider.getToken(), provider.getToken()])
-    ).resolves.toEqual(["ghs_one", "ghs_one"]);
-    expect(getGithubToken).toHaveBeenCalledOnce();
-  });
-
-  it("activates a token fetched before the provider starts", async () => {
-    const getGithubToken = vi.fn(async () => ({
-      token: "ghs_prefetched",
-      expiresAt: new Date(Date.now() + 45 * 60_000).toISOString(),
-    }));
-    const provider = new CursorGithubCredentialProvider({
-      client: { getGithubToken },
-      scope: parseCursorGithubRepoScope(["acme/widgets"]),
-    });
-
-    await provider.getToken();
-    expect(process.env.GH_TOKEN).toBe("previous-token");
-    await provider.start();
-    expect(process.env.GH_TOKEN).toBe("ghs_prefetched");
-    provider.stop();
-  });
-
-  it("keeps the previous token when an early refresh is transiently unavailable", async () => {
-    let now = Date.parse("2026-07-16T00:00:00.000Z");
-    const getGithubToken = vi
-      .fn()
-      .mockResolvedValueOnce({
-        token: "ghs_still_valid",
-        expiresAt: new Date(now + 45 * 60_000).toISOString(),
-      })
-      .mockRejectedValueOnce(new Error("backend unavailable"));
-    const provider = new CursorGithubCredentialProvider({
-      client: { getGithubToken },
-      scope: parseCursorGithubRepoScope(["acme/widgets"]),
-      now: () => now,
-    });
-
-    await expect(provider.getToken()).resolves.toBe("ghs_still_valid");
-    now += 41 * 60_000;
-    await expect(provider.getToken()).resolves.toBe("ghs_still_valid");
-  });
-
-  it("evicts an expired lease and negative-caches hard failures", async () => {
-    let now = Date.parse("2026-07-16T00:00:00.000Z");
-    const getGithubToken = vi
-      .fn()
-      .mockResolvedValueOnce({
-        token: "ghs_expired",
-        expiresAt: new Date(now + 45 * 60_000).toISOString(),
-      })
-      .mockRejectedValue(new Error("GitHub connection missing"));
-    const provider = new CursorGithubCredentialProvider({
-      client: { getGithubToken },
-      scope: parseCursorGithubRepoScope(["acme/widgets"]),
-      now: () => now,
-    });
-
-    await expect(provider.getToken()).resolves.toBe("ghs_expired");
-    now += 46 * 60_000;
-    await expect(provider.getToken()).rejects.toThrow(
-      /GitHub connection missing/
-    );
-    expect(getGithubToken).toHaveBeenCalledTimes(2);
-    // Negative cache: do not hot-loop the backend before the backoff elapses.
-    await expect(provider.getToken()).rejects.toThrow(
-      /GitHub connection missing/
-    );
-    expect(getGithubToken).toHaveBeenCalledTimes(2);
-  });
-});