@magpie-community/opencode-cursor-auth 0.2.17 → 0.2.19

package/README.md

@@ -13,11 +13,13 @@ An account is a Cursor access token. There are three ways to get one:
   plugin polls `api2.cursor.sh/auth/poll` until the browser has signed in.
   The account is named by its email (`DashboardService/GetMe`).
 - **cursor-agent's sign-in**: takes the account `cursor-agent login`
-  signed in to. Its token is read on every request from where the CLI
-  keeps it: the macOS keychain (`cursor-access-token`), else its
-  `auth.json` (`~/.cursor/`, `$XDG_CONFIG_HOME/cursor/` or
-  `%APPDATA%\Cursor\`). The plugin never writes it; when it has less than
-  5 minutes left, `cursor-agent status` is run, which renews it.
+  signed in to. Its token is read from where the CLI keeps it: the macOS
+  keychain (`cursor-access-token`), else its `auth.json` (`~/.cursor/`,
+  `$XDG_CONFIG_HOME/cursor/` or `%APPDATA%\Cursor\`). A keychain read is
+  kept for 10 seconds, and one the keychain refused (the user said no to
+  its dialog) is not asked again for 10 minutes; signing in reads it
+  afresh. The plugin never writes it; when it has less than 5 minutes
+  left, `cursor-agent status` is run, which renews it.
 - **Cursor API key**: a key from cursor.com/dashboard → Integrations. It is
   exchanged for a token at `/auth/exchange_user_api_key`, as the CLI does
   with `CURSOR_API_KEY`, and exchanged again when the token runs out.

package/index.mjs

@@ -63,7 +63,7 @@ const exists = (p) => stat(p).then((s) => !s.isDirectory(), () => false)
 function run(file, args, { timeout = 10_000, env } = {}) {
   return new Promise((resolve) => {
     execFile(file, args, { timeout, env: env ?? process.env, maxBuffer: 8 << 20 }, (err, stdout) =>
-      resolve({ ok: !err, out: String(stdout ?? "") }))
+      resolve({ ok: !err, out: String(stdout ?? ""), code: typeof err?.code === "number" ? err.code : err ? -1 : 0 }))
   })
 }
 
@@ -117,12 +117,48 @@ function authFile() {
   return join(process.env.XDG_CONFIG_HOME || join(home, ".config"), "cursor", "auth.json")
 }
 
+// TOKEN_TTL is how long a token read from the Keychain is taken as it: a
+// sign-in reads it afresh, one made in cursor-agent is seen within it.
+// KEYCHAIN_DENIED is how long a read the user may have been asked about,
+// and answered no to, is not asked again: with the item's trust list
+// holding no `security`, every ask can show the dialog again. Both as the
+// built-in's cursorKeychainToken (magpie #746, #2408).
+const TOKEN_TTL = 10_000
+const KEYCHAIN_DENIED = 10 * 60_000
+const keychain = { tok: "", at: 0, ask: 0, busy: null, now: () => Date.now(), read: (args) => run("security", args) }
+
+// keychainToken is cursor-agent's token in the Keychain, "" for none; fresh
+// reads it whatever was read last. Reads go one at a time, so callers at
+// once share one `security` run (and one dialog).
+function keychainToken(fresh = false) {
+  const go = async () => {
+    const now = keychain.now()
+    const ttl = !keychain.tok && now - keychain.ask < KEYCHAIN_DENIED ? KEYCHAIN_DENIED : TOKEN_TTL
+    if (!fresh && now - keychain.at < ttl) return keychain.tok
+    const r = await keychain.read(["find-generic-password", "-s", "cursor-access-token", "-a", "cursor-user", "-w"])
+    keychain.tok = ""
+    keychain.at = keychain.now()
+    if (r.ok) {
+      keychain.tok = r.out.trim()
+      keychain.ask = 0
+    } else if (r.code !== 44) {
+      // 44 is "no such item"; anything else may have been a dialog the
+      // user said no to, or a keychain that refused
+      keychain.ask = keychain.at
+    } else keychain.ask = 0
+    return keychain.tok
+  }
+  const p = (keychain.busy ?? Promise.resolve()).then(go, go)
+  keychain.busy = p.catch(() => {})
+  return p
+}
+
 // cliToken is the access token cursor-agent signed in with; read, never
-// written.
-async function cliToken() {
+// written. fresh reads the Keychain whatever was read last.
+async function cliToken(fresh = false) {
   if (GOOS === "darwin") {
-    const r = await run("security", ["find-generic-password", "-s", "cursor-access-token", "-a", "cursor-user", "-w"])
-    if (r.ok && r.out.trim()) return r.out.trim()
+    const t = await keychainToken(fresh)
+    if (t) return t
   }
   try {
     return JSON.parse(await readFile(authFile(), "utf8"))?.accessToken ?? ""
@@ -163,7 +199,7 @@ async function cliTokenNow() {
   if (exe) {
     cliRefresh ??= run(exe, ["status"], { timeout: 30_000 }).finally(() => (cliRefresh = null))
     await cliRefresh
-    tok = await cliToken()
+    tok = await cliToken(true)
   }
   // the built-in's words (provider.CursorToken)
   if (!tok) throw new AuthError("Cursor isn't signed in; sign in from magpie's Providers page or run `cursor-agent login`")
@@ -332,7 +368,7 @@ async function cliSignIn() {
     instructions: "Uses the account `cursor-agent login` signed in to.",
     method: "auto",
     async callback() {
-      const tok = await cliToken()
+      const tok = await cliToken(true)
       const exp = expiry(tok)
       if (!tok) return { type: "failed", error: "cursor-agent isn't signed in: run `cursor-agent login`" }
       if (exp && exp <= Date.now()) return { type: "failed", error: "cursor-agent's sign-in has run out: run `cursor-agent login` again" }
@@ -1209,7 +1245,9 @@ function conversation(chat, tools) {
         pending.splice(i, 1)
         const text = textOf(m.content)
         size += text.length
-        results.push(result(id, text, false))
+        // a failed tool's result says so, as the built-in's cursorResult
+        // told Cursor isError
+        results.push(result(id, text, m.is_error === true || m.isError === true))
       }
       continue
     }
@@ -2618,12 +2656,12 @@ async function answerOf(auth, chat, signal, session = "") {
       let response = native ? await runNative({ ...args, native }) : await runOnce(args)
       const rebuild = async () => {
         const fallback = await runOnce(args)
-        fallback.diagnostic = "stateless; bootstrap=imported-history; reason=missing-batch-count"
+        fallback.diagnostic = "stateless; bootstrap=imported-history; reason=" + (response.error?.continuityReason || "missing-batch-count")
         return fallback
       }
-      // A missing native batch count may be retried once, only before Chat
-      // output is exposed or any native result was submitted. Never repeat an
-      // uncertain tool result write or duplicate a progressive stream's output.
+      // A missing or conflicting native batch count may be retried once,
+      // only before Chat output is exposed or any native result was submitted.
+      // Never repeat an uncertain tool write or progressive stream output.
       if (response.error?.retentionIneligible && !signal?.aborted) response = await rebuild()
       else if (native) response.rebuild = rebuild
       response.diagnostic ??= "stateless; bootstrap=imported-history; reason=" + (prepared.fallback || "retention capacity or reservation unavailable")
@@ -2681,8 +2719,10 @@ async function answerOf(auth, chat, signal, session = "") {
       for await (const e of events) {
         if (e.error) {
           if (!e.error.retentionIneligible || !r.rebuild || signal?.aborted) return errorResponse(e.error)
+          const reason = e.error.continuityReason
           r = await r.rebuild()
           if (r.error) return errorResponse(r.error)
+          if (reason) r.diagnostic = "stateless; bootstrap=imported-history; reason=" + reason
           events = r.events
           responseHeaders["X-Magpie-Cursor-Continuity"] = r.diagnostic
           retry = true
@@ -2828,4 +2868,4 @@ export async function CursorAuthPlugin() {
 }
 
 // for tests
-export const _internal = { nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }
+export const _internal = { keychain, keychainToken, nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }

package/native-session.mjs

@@ -675,7 +675,13 @@ class NativeSession {
   }
   listed(count) {
     if (!Number.isSafeInteger(count) || count < 1) invalid("invalid native tool count", 502)
-    if (this.segment.expected != null && this.segment.expected !== count) invalid("inconsistent native tool count", 502)
+    if (this.segment.expected != null && this.segment.expected !== count) {
+      // Conflicting counts leave the native step boundary ambiguous. Retire
+      // this owner; Chat may rebuild from history only if no native result
+      // was submitted to this Run.
+      this.fail({ status: 502, message: "inconsistent native tool count", retentionIneligible: !this.resultSubmitted, continuityReason: "inconsistent-batch-count" })
+      return
+    }
     this.segment.expected = count
     if (this.state === "awaiting-results") return // an identical retransmission
     this.waitForBatch()
@@ -876,7 +882,10 @@ class NativeSession {
                 } else if (u.num === 14) {
                   if (!this.segment.content && !this.segment.calls.length) invalid("an empty reply (Cursor ended the turn without text or a tool call)", 502)
                   this.terminalSeen(uf)
-                } else if (u.num === 27) this.listed(num(uf, 1))
+                } else if (u.num === 27) {
+                  this.listed(num(uf, 1))
+                  if (this.error) return
+                }
               }
               break
             case 2: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-cursor-auth",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "Cursor subscriptions (Pro, Pro+, Ultra, Teams) in OpenCode and magpie, through the API cursor-agent talks to",
   "type": "module",
   "main": "./index.mjs",