@cursorpool-dev/cli 0.5.6

package/node_modules/@cursor-pool/service/src/takeover.ts

@@ -0,0 +1,111 @@
+import { randomUUID } from 'node:crypto';
+import type { SafeGatewayForwardState } from './requestGateway';
+import type { SafeRouteState } from './platformSession';
+import type { RequestGateDecision } from './requestGate';
+
+export type AgentTakeoverInput = {
+  requestId?: unknown;
+  source?: unknown;
+  model?: unknown;
+  stream?: unknown;
+  messagesShape?: unknown;
+};
+
+export type AgentTakeoverRejectReason =
+  | 'logged-out'
+  | 'mode-inactive'
+  | 'mode-released'
+  | 'device-inactive'
+  | 'invalid-session'
+  | 'route-missing'
+  | 'route-expired';
+
+export type AgentTakeoverResponse =
+  | {
+      state: 'answered';
+      requestId: string;
+      source: 'cursor-always-local' | 'cursor-agent-exec' | 'unknown';
+      model: string;
+      content: string;
+    }
+  | {
+      state: 'rejected';
+      requestId: string;
+      reason: AgentTakeoverRejectReason;
+    };
+
+const SAFE_TOKEN_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const SAFE_MODEL_PATTERN = /^[A-Za-z0-9._:-]{1,96}$/;
+const SECRET_PATTERN =
+  /(api[_-]?key|authorization|bearer|cookie|cursor[_-]?auth|provider[_-]?secret|secret|token|prompt|messages|sk-[A-Za-z0-9])/i;
+
+function safeToken(value: unknown, fallback: string) {
+  return typeof value === 'string' &&
+    SAFE_TOKEN_PATTERN.test(value) &&
+    !SECRET_PATTERN.test(value)
+    ? value
+    : fallback;
+}
+
+function safeSource(value: unknown): Extract<AgentTakeoverResponse, { state: 'answered' }>['source'] {
+  return value === 'cursor-always-local' || value === 'cursor-agent-exec'
+    ? value
+    : 'unknown';
+}
+
+function safeModel(value: unknown) {
+  return typeof value === 'string' &&
+    SAFE_MODEL_PATTERN.test(value) &&
+    !SECRET_PATTERN.test(value)
+    ? value
+    : 'unknown';
+}
+
+export function buildAgentTakeoverResponse(
+  input: AgentTakeoverInput,
+  gate: RequestGateDecision,
+  route: SafeRouteState,
+  forward?: SafeGatewayForwardState,
+): AgentTakeoverResponse {
+  const requestId = safeToken(input.requestId, randomUUID());
+
+  if (gate.state === 'blocked') {
+    return {
+      state: 'rejected',
+      requestId,
+      reason: gate.reason,
+    };
+  }
+
+  if (route.state === 'missing') {
+    return { state: 'rejected', requestId, reason: 'route-missing' };
+  }
+
+  if (route.state === 'expired') {
+    return { state: 'rejected', requestId, reason: 'route-expired' };
+  }
+
+  const content = forward?.state === 'forwarded' ? forward.content : undefined;
+
+  return {
+    state: 'answered',
+    requestId,
+    source: safeSource(input.source),
+    model: safeModel(input.model),
+    content: content ?? 'Cursor Pool provider 暂时没有返回可显示内容',
+  };
+}
+
+export function createAgentTakeoverStore() {
+  let latestTakeover: AgentTakeoverResponse | null = null;
+
+  return {
+    record(takeover: AgentTakeoverResponse): AgentTakeoverResponse {
+      latestTakeover = takeover;
+      return takeover;
+    },
+    latest(): AgentTakeoverResponse | null {
+      return latestTakeover;
+    },
+  };
+}

package/node_modules/@cursor-pool/service/test/canary.test.ts

@@ -0,0 +1,140 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createCanaryStore, sanitizeAgentCanary } from '../src/canary';
+
+const allowedGate = {
+  state: 'allowed' as const,
+  productId: 'prod_basic',
+  modeStartedAt: '2026-05-31T00:05:00.000Z',
+};
+const blockedGate = {
+  state: 'blocked' as const,
+  reason: 'logged-out' as const,
+};
+
+test('sanitizeAgentCanary drops sensitive and unknown fields while adding service fields', () => {
+  const canary = sanitizeAgentCanary(
+    {
+      requestId: 'req-1',
+      requestType: 'agent',
+      source: 'cursor-agent-exec',
+      model: 'claude-secret',
+      prompt: 'do not store',
+      messages: [{ role: 'user', content: 'do not store' }],
+      apiKey: 'secret',
+      authorization: 'Bearer secret',
+      cookie: 'secret',
+      body: { hidden: true },
+      unknown: 'discard-me',
+      gate: { state: 'allowed', productId: 'prod_from_input', modeStartedAt: 'discard-me' },
+    },
+    {
+      runtimeId: 'runtime-1',
+      gate: allowedGate,
+      now: () => '2026-05-30T00:00:00.000Z',
+      requestId: () => 'generated-1',
+    },
+  );
+
+  assert.deepEqual(canary, {
+    requestId: 'req-1',
+    requestType: 'agent',
+    source: 'cursor-agent-exec',
+    model: 'claude-secret',
+    receivedAt: '2026-05-30T00:00:00.000Z',
+    runtimeId: 'runtime-1',
+    gate: allowedGate,
+  });
+  assert.equal(Object.hasOwn(canary, 'prompt'), false);
+  assert.equal(Object.hasOwn(canary, 'messages'), false);
+  assert.equal(Object.hasOwn(canary, 'apiKey'), false);
+  assert.equal(Object.hasOwn(canary, 'authorization'), false);
+  assert.equal(Object.hasOwn(canary, 'cookie'), false);
+  assert.equal(Object.hasOwn(canary, 'body'), false);
+  assert.equal(Object.hasOwn(canary, 'unknown'), false);
+  assert.notDeepEqual(canary.gate, { state: 'allowed', productId: 'prod_from_input', modeStartedAt: 'discard-me' });
+});
+
+test('sanitizeAgentCanary defaults fields and generates requestId for invalid input', () => {
+  const canary = sanitizeAgentCanary(
+    {
+      requestId: 'x'.repeat(129),
+      requestType: 123,
+      source: '',
+      model: null,
+    },
+    {
+      runtimeId: 'runtime-2',
+      gate: blockedGate,
+      now: () => '2026-05-30T00:00:01.000Z',
+      requestId: () => 'generated-2',
+    },
+  );
+
+  assert.deepEqual(canary, {
+    requestId: 'generated-2',
+    requestType: 'agent',
+    source: 'cursor-agent-exec',
+    model: 'unknown',
+    receivedAt: '2026-05-30T00:00:01.000Z',
+    runtimeId: 'runtime-2',
+    gate: blockedGate,
+  });
+});
+
+test('sanitizeAgentCanary uses default clock and requestId providers when omitted', () => {
+  const canary = sanitizeAgentCanary({}, { runtimeId: 'runtime-3', gate: blockedGate });
+
+  assert.equal(typeof canary.requestId, 'string');
+  assert.notEqual(canary.requestId, '');
+  assert.equal(Number.isNaN(Date.parse(canary.receivedAt)), false);
+  assert.equal(canary.runtimeId, 'runtime-3');
+  assert.equal(canary.requestType, 'agent');
+  assert.equal(canary.source, 'cursor-agent-exec');
+  assert.equal(canary.model, 'unknown');
+  assert.equal(canary.gate, blockedGate);
+});
+
+test('canary store keeps only the latest event in memory', () => {
+  const store = createCanaryStore();
+  assert.equal(store.latest(), null);
+
+  store.record({
+    requestId: 'req-1',
+    requestType: 'agent',
+    source: 'cursor-agent-exec',
+    model: 'unknown',
+    receivedAt: '2026-05-30T00:00:00.000Z',
+    runtimeId: 'runtime-1',
+    gate: blockedGate,
+  });
+  store.record({
+    requestId: 'req-2',
+    requestType: 'agent',
+    source: 'cursor-agent-exec',
+    model: 'unknown',
+    receivedAt: '2026-05-30T00:00:01.000Z',
+    runtimeId: 'runtime-1',
+    gate: allowedGate,
+  });
+
+  assert.equal(store.latest()?.requestId, 'req-2');
+});
+
+test('canary store record returns the saved canary', () => {
+  const store = createCanaryStore();
+  const canary = {
+    requestId: 'req-3',
+    requestType: 'agent' as const,
+    source: 'cursor-agent-exec' as const,
+    model: 'unknown',
+    receivedAt: '2026-05-30T00:00:02.000Z',
+    runtimeId: 'runtime-1',
+    gate: allowedGate,
+  };
+
+  const saved = store.record(canary);
+
+  assert.equal(saved, canary);
+  assert.equal(store.latest(), canary);
+});