@magpie-community/opencode-cursor-auth 0.2.16 → 0.2.18

package/README.md

@@ -13,11 +13,13 @@ An account is a Cursor access token. There are three ways to get one:
   plugin polls `api2.cursor.sh/auth/poll` until the browser has signed in.
   The account is named by its email (`DashboardService/GetMe`).
 - **cursor-agent's sign-in**: takes the account `cursor-agent login`
-  signed in to. Its token is read on every request from where the CLI
-  keeps it: the macOS keychain (`cursor-access-token`), else its
-  `auth.json` (`~/.cursor/`, `$XDG_CONFIG_HOME/cursor/` or
-  `%APPDATA%\Cursor\`). The plugin never writes it; when it has less than
-  5 minutes left, `cursor-agent status` is run, which renews it.
+  signed in to. Its token is read from where the CLI keeps it: the macOS
+  keychain (`cursor-access-token`), else its `auth.json` (`~/.cursor/`,
+  `$XDG_CONFIG_HOME/cursor/` or `%APPDATA%\Cursor\`). A keychain read is
+  kept for 10 seconds, and one the keychain refused (the user said no to
+  its dialog) is not asked again for 10 minutes; signing in reads it
+  afresh. The plugin never writes it; when it has less than 5 minutes
+  left, `cursor-agent status` is run, which renews it.
 - **Cursor API key**: a key from cursor.com/dashboard → Integrations. It is
   exchanged for a token at `/auth/exchange_user_api_key`, as the CLI does
   with `CURSOR_API_KEY`, and exchanged again when the token runs out.
@@ -94,7 +96,10 @@ Tool results can continue a retained Run in the same plugin process. The owner
 uses the same session/cache key and first user message as `conversation_id`, so
 Task subagents sharing their parent's session can run independently. Retention
 waits at most 120 seconds for a result batch and 15 minutes for a Run's total
-lifetime. The pool holds at most 8 owners per account and 32 per process, with
+lifetime. A continuation arriving in the last minute of that lifetime rebuilds
+from supplied history before submitting results to the old Run. The absolute
+deadline still applies to an active segment; it is never extended by activity.
+The pool holds at most 8 owners per account and 32 per process, with
 bounded history, blobs, arguments, and pending writes. When pending writes
 reach their bound (a long history asks for its blobs at once, and a slow link
 drains them slowly), the Run waits for the link to drain, and fails only if it

package/index.mjs

@@ -63,7 +63,7 @@ const exists = (p) => stat(p).then((s) => !s.isDirectory(), () => false)
 function run(file, args, { timeout = 10_000, env } = {}) {
   return new Promise((resolve) => {
     execFile(file, args, { timeout, env: env ?? process.env, maxBuffer: 8 << 20 }, (err, stdout) =>
-      resolve({ ok: !err, out: String(stdout ?? "") }))
+      resolve({ ok: !err, out: String(stdout ?? ""), code: typeof err?.code === "number" ? err.code : err ? -1 : 0 }))
   })
 }
 
@@ -117,12 +117,48 @@ function authFile() {
   return join(process.env.XDG_CONFIG_HOME || join(home, ".config"), "cursor", "auth.json")
 }
 
+// TOKEN_TTL is how long a token read from the Keychain is taken as it: a
+// sign-in reads it afresh, one made in cursor-agent is seen within it.
+// KEYCHAIN_DENIED is how long a read the user may have been asked about,
+// and answered no to, is not asked again: with the item's trust list
+// holding no `security`, every ask can show the dialog again. Both as the
+// built-in's cursorKeychainToken (magpie #746, #2408).
+const TOKEN_TTL = 10_000
+const KEYCHAIN_DENIED = 10 * 60_000
+const keychain = { tok: "", at: 0, ask: 0, busy: null, now: () => Date.now(), read: (args) => run("security", args) }
+
+// keychainToken is cursor-agent's token in the Keychain, "" for none; fresh
+// reads it whatever was read last. Reads go one at a time, so callers at
+// once share one `security` run (and one dialog).
+function keychainToken(fresh = false) {
+  const go = async () => {
+    const now = keychain.now()
+    const ttl = !keychain.tok && now - keychain.ask < KEYCHAIN_DENIED ? KEYCHAIN_DENIED : TOKEN_TTL
+    if (!fresh && now - keychain.at < ttl) return keychain.tok
+    const r = await keychain.read(["find-generic-password", "-s", "cursor-access-token", "-a", "cursor-user", "-w"])
+    keychain.tok = ""
+    keychain.at = keychain.now()
+    if (r.ok) {
+      keychain.tok = r.out.trim()
+      keychain.ask = 0
+    } else if (r.code !== 44) {
+      // 44 is "no such item"; anything else may have been a dialog the
+      // user said no to, or a keychain that refused
+      keychain.ask = keychain.at
+    } else keychain.ask = 0
+    return keychain.tok
+  }
+  const p = (keychain.busy ?? Promise.resolve()).then(go, go)
+  keychain.busy = p.catch(() => {})
+  return p
+}
+
 // cliToken is the access token cursor-agent signed in with; read, never
-// written.
-async function cliToken() {
+// written. fresh reads the Keychain whatever was read last.
+async function cliToken(fresh = false) {
   if (GOOS === "darwin") {
-    const r = await run("security", ["find-generic-password", "-s", "cursor-access-token", "-a", "cursor-user", "-w"])
-    if (r.ok && r.out.trim()) return r.out.trim()
+    const t = await keychainToken(fresh)
+    if (t) return t
   }
   try {
     return JSON.parse(await readFile(authFile(), "utf8"))?.accessToken ?? ""
@@ -163,7 +199,7 @@ async function cliTokenNow() {
   if (exe) {
     cliRefresh ??= run(exe, ["status"], { timeout: 30_000 }).finally(() => (cliRefresh = null))
     await cliRefresh
-    tok = await cliToken()
+    tok = await cliToken(true)
   }
   // the built-in's words (provider.CursorToken)
   if (!tok) throw new AuthError("Cursor isn't signed in; sign in from magpie's Providers page or run `cursor-agent login`")
@@ -332,7 +368,7 @@ async function cliSignIn() {
     instructions: "Uses the account `cursor-agent login` signed in to.",
     method: "auto",
     async callback() {
-      const tok = await cliToken()
+      const tok = await cliToken(true)
       const exp = expiry(tok)
       if (!tok) return { type: "failed", error: "cursor-agent isn't signed in: run `cursor-agent login`" }
       if (exp && exp <= Date.now()) return { type: "failed", error: "cursor-agent's sign-in has run out: run `cursor-agent login` again" }
@@ -1209,7 +1245,9 @@ function conversation(chat, tools) {
         pending.splice(i, 1)
         const text = textOf(m.content)
         size += text.length
-        results.push(result(id, text, false))
+        // a failed tool's result says so, as the built-in's cursorResult
+        // told Cursor isError
+        results.push(result(id, text, m.is_error === true || m.isError === true))
       }
       continue
     }
@@ -2828,4 +2866,4 @@ export async function CursorAuthPlugin() {
 }
 
 // for tests
-export const _internal = { nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }
+export const _internal = { keychain, keychainToken, nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }

package/native-session.mjs

@@ -381,6 +381,14 @@ export class NativeSessionPool {
           return { owner, batch, replay: true, segment: batch.next }
         }
         if (owner.state !== "awaiting-results" || owner.segment !== batch || !batch.clean) return fallback("owner busy")
+        // A retained Run's absolute timer spans all tool roundtrips. Rebuild
+        // near its deadline before writing this batch: otherwise a new Chat
+        // segment can lose its transport after already exposing output.
+        const reserve = Math.min(60_000, owner.limits.lifetime / 10)
+        if (owner.expiresAt - Date.now() <= reserve) {
+          owner.fail({ status: 410, message: "native Run retired before lifetime deadline" }, "expired")
+          return fallback("owner near lifetime deadline")
+        }
         return { owner, batch, results, encoded, digest, chat }
       } catch (e) {
         if (!(e instanceof NativeSessionError)) throw e
@@ -463,7 +471,14 @@ class NativeSession {
     this.terminal = false
     this.segment = new Segment(this, prepared.chat)
     this.retain(bytes(prepared.chat))
-    this.lifetimeTimer = later(() => this.fail({ status: 410, message: "native Run lifetime expired" }, "expired"), this.limits.lifetime)
+    this.expireIn(this.limits.lifetime)
+  }
+  // expireIn sets the Run's absolute deadline ms from now: from its start,
+  // the whole lifetime; a test brings it in after the first answer
+  expireIn(ms) {
+    clearTimeout(this.lifetimeTimer)
+    this.expiresAt = Date.now() + ms
+    this.lifetimeTimer = later(() => this.fail({ status: 410, message: "native Run lifetime expired" }, "expired"), ms)
   }
   retain(n) {
     if (this.retainedBytes + n > this.limits.outputBytes) invalid("native output/history retention limit reached", 503)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-cursor-auth",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "description": "Cursor subscriptions (Pro, Pro+, Ultra, Teams) in OpenCode and magpie, through the API cursor-agent talks to",
   "type": "module",
   "main": "./index.mjs",