@magpie-community/opencode-cursor-auth 0.2.22 → 0.2.24

package/README.md

@@ -197,6 +197,17 @@ minutes), the way pi-cursor-sdk lists Cursor's catalog:
   has. A model the usable list has nothing of is the picker's alone
   (GLM-5.3) and is kept whole; so is every model when Cursor can't give
   the usable list.
+- A family the usable list has and the picker doesn't (an account whose
+  picker lacks Claude Opus 5.5 while `cursor-agent models` lists
+  `claude-opus-5-5-low` to `-max`) is listed once under its family id
+  (`claude-opus-5-5`), its efforts as variants, and goes as the usable id
+  those parameters pick, never as the family id Cursor doesn't know. A
+  picker model whose chosen variant isn't one the account can use goes as
+  its family's nearest usable id the same way.
+- An `@<size>` id the list no longer has (`claude-opus-5-5@1m` when only
+  300k is listed, or the model is listed unsized) runs at the model's
+  nearest size, in Max Mode when the size asked for is over the model's
+  window, never as the literal `@<size>` id.
 - An id from before 0.2.0 still runs. A variant's own id
   (`claude-opus-5-5-high`) is that variant; a family 0.1.x listed
   (`claude-opus-5-5`, `claude-opus-5-5-fast`, `claude-haiku-5-5-thinking`,

package/index.mjs

@@ -117,6 +117,68 @@ function authFile() {
   return join(process.env.XDG_CONFIG_HOME || join(home, ".config"), "cursor", "auth.json")
 }
 
+// cliConfigFile is cursor-agent's cli-config.json, where it keeps the team
+// it signed in to (authInfo.activeTeamId); its directory found as the CLI
+// finds it, on every OS.
+function cliConfigFile() {
+  const dir = process.env.CURSOR_CONFIG_DIR?.trim()
+    || (process.env.XDG_CONFIG_HOME?.trim() ? join(process.env.XDG_CONFIG_HOME, "cursor") : join(homedir(), ".cursor"))
+  return join(dir, "cli-config.json")
+}
+
+// tokenSub is a JWT's subject (the auth id, "auth0|user_…"); "" when it
+// doesn't say.
+function tokenSub(tok) {
+  const parts = String(tok ?? "").split(".")
+  if (parts.length !== 3) return ""
+  try {
+    const sub = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"))?.sub
+    return typeof sub === "string" ? sub : ""
+  } catch {
+    return ""
+  }
+}
+
+const teamOf = (v) => (Number.isSafeInteger(v) && v > 0 ? v : undefined)
+
+// activeTeamId is the team a request is billed to, as cursor-agent sends it
+// (x-cursor-team-id): cli-config.json's authInfo.activeTeamId. Without it
+// Cursor takes the token's default team, which in an organization may be one
+// with on-demand spend turned off ("Team budget limit reached"). The config's
+// team is only taken for the account cursor-agent signed in to: a token
+// whose subject isn't its authInfo.authId, or a config with none, gets none.
+// Read again after 10 s; cursor-agent rewrites the file in place, so a read
+// that fails to parse keeps the last one, and only a missing file clears it.
+const TEAM_TTL = 10_000
+const teamRead = { at: 0, info: null }
+async function activeTeamId(tok) {
+  if (Date.now() - teamRead.at >= TEAM_TTL) {
+    try {
+      teamRead.info = JSON.parse(await readFile(cliConfigFile(), "utf8"))?.authInfo ?? null
+    } catch (e) {
+      if (e?.code === "ENOENT") teamRead.info = null
+    }
+    teamRead.at = Date.now()
+  }
+  const info = teamRead.info
+  if (!info) return undefined
+  if (!info.authId || info.authId !== tokenSub(tok)) return undefined
+  return teamOf(info.activeTeamId)
+}
+
+// teamHeader names that team in a request's headers, and teamBody in
+// GetFilteredUsageEvents' body; neither says anything when there is none.
+// GetHardLimit and GetCurrentPeriodUsage go out with "{}", as cursor-agent
+// sends them: the team rides in the header only.
+async function teamHeader(tok) {
+  const id = await activeTeamId(tok)
+  return id ? { "x-cursor-team-id": String(id) } : {}
+}
+async function teamBody(tok) {
+  const id = await activeTeamId(tok)
+  return id ? { teamId: id } : {}
+}
+
 // TOKEN_TTL is how long a token read from the Keychain is taken as it: a
 // sign-in reads it afresh, one made in cursor-agent is seen within it.
 // KEYCHAIN_DENIED is how long a read the user may have been asked about,
@@ -218,6 +280,7 @@ async function headersFor(tok) {
     "x-cursor-client-version": await clientVersion(),
     "x-cursor-client-type": "cli",
     "x-ghost-mode": "true",
+    ...await teamHeader(tok),
   }
 }
 
@@ -456,7 +519,7 @@ async function hardLimit(tok) {
   try {
     const res = await fetch(API + "/aiserver.v1.DashboardService/GetHardLimit", {
       method: "POST",
-      headers: { Authorization: `Bearer ${tok}`, "Content-Type": "application/json", "Connect-Protocol-Version": "1" },
+      headers: { Authorization: `Bearer ${tok}`, "Content-Type": "application/json", "Connect-Protocol-Version": "1", ...await teamHeader(tok) },
       body: "{}",
       signal: AbortSignal.timeout(15_000),
     })
@@ -481,7 +544,7 @@ async function usage(tok, ids) {
   const [res, hard] = await Promise.all([
     fetch(API + "/aiserver.v1.DashboardService/GetCurrentPeriodUsage", {
       method: "POST",
-      headers: { Authorization: `Bearer ${tok}`, "Content-Type": "application/json", "Connect-Protocol-Version": "1" },
+      headers: { Authorization: `Bearer ${tok}`, "Content-Type": "application/json", "Connect-Protocol-Version": "1", ...await teamHeader(tok) },
       body: "{}",
       signal: AbortSignal.timeout(15_000),
     }),
@@ -672,12 +735,72 @@ function served(m, ids) {
   return got.some((v) => v.legacySlug) ? got : vs
 }
 
+// familyOf is the family one of Cursor's own ids is of, fast or not:
+// claude-opus-5-5-low-fast is of claude-opus-5-5, at low, fast.
+function familyOf(id) {
+  let [family, effort] = splitID(id)
+  const fast = family.endsWith("-fast") && family.length > "-fast".length
+  if (fast) family = family.slice(0, -"-fast".length)
+  return { family, effort, fast }
+}
+
+// familiesOf is the usable list (GetUsableModels, what cursor-agent models
+// shows: claude-opus-5-5-low, claude-opus-5-5-low-fast, …) by family: each
+// id with its effort, whether it is fast, whether Cursor runs it in Max
+// Mode, and its name.
+function familiesOf(listed) {
+  const fams = new Map()
+  for (const u of listed ?? []) {
+    const id = String(u?.modelId ?? "")
+    if (!id) continue
+    const { family, effort, fast } = familyOf(id)
+    if (!fams.has(family)) fams.set(family, [])
+    fams.get(family).push({ id, effort, fast, maxMode: u.maxMode === true, name: clean(u.displayName || id) })
+  }
+  return fams
+}
+
+// fromUsable is the id of a family of the usable list's that a request
+// runs as: fast as asked (when the family has both), at the effort asked or
+// the nearest it has; with none asked, the one without an effort in its
+// id, else medium, as Cursor's default is (claude-opus-5-5-medium), else
+// the first.
+function fromUsable(fam, effort, fast) {
+  let vs = fam.filter((u) => u.fast === !!fast)
+  if (!vs.length) vs = fam
+  if (effort === "off") effort = "none"
+  const at = effort ? fitEffort(effort, vs.map((u) => u.effort).filter(Boolean)) : ""
+  return (at && vs.find((u) => u.effort === at)) || vs.find((u) => u.effort === "") || vs.find((u) => u.effort === "medium") || vs[0]
+}
+
+// usableTitle is a usable id's name without what the id says apart: the
+// effort, fast, and the 1M Cursor names every Max-capable Claude with
+// ("Claude Opus 5.5 1M Low" is Claude Opus 5.5).
+function usableTitle(name) {
+  const drop = new Set(["low", "medium", "high", "xhigh", "extra", "max", "minimal", "none", "fast", "1m", "(1m)"])
+  const ws = name.split(" ")
+  while (ws.length > 1 && drop.has(ws.at(-1).toLowerCase())) ws.pop()
+  return ws.join(" ")
+}
+
 // modelsOf is the picker's models as offered: one entry for each context
 // size a model has, or one with Cursor's limit when it has none. A model
 // served in part is offered at the sizes and efforts it is served at.
-function modelsOf(picker, ids) {
+// listed is the usable list: a family of its ids the picker has nothing of
+// (a Team's picker can leave out what cursor-agent models lists, magpie
+// #3150 ysm119 on Discord) is offered too, once, with its efforts, and each
+// entry keeps its family's usable ids, so a request goes as one of those
+// and never as a name Cursor would answer "AI Model Not Found".
+function modelsOf(picker, ids, listed = []) {
   const out = []
   const used = new Set()
+  const fams = familiesOf(listed)
+  // every id the picker names at all, shown or left out
+  const named = new Set()
+  for (const m of picker) {
+    if (!m?.name) continue
+    for (const x of [m.name, ...(m.legacySlugs ?? []), ...(m.idAliases ?? []), ...(m.variants ?? []).map((v) => v.legacySlug)]) if (x) named.add(x)
+  }
   for (const m of picker) {
     if (!m?.name || m.isHidden || m.isChatOnly || m.onlySupportsCmdK || m.supportsAgent === false || PICKER_SKIP.has(m.name)) continue
     const defs = paramDefs(m)
@@ -687,7 +810,8 @@ function modelsOf(picker, ids) {
     const def = defaultVariant({ variants })
     const { pid, levels: all } = effortsOf(defs)
     const levels = Object.fromEntries(Object.entries(all).filter(([, value]) => has(pid, value)))
-    const base = { run: m.name, title: clean(m.clientDisplayName || m.name), pid, levels, fast: !!defs.fast?.length, variants, def, partial, model: m }
+    const fam = fams.get(familyOf(def?.legacySlug || m.name).family) ?? []
+    const base = { run: m.name, title: clean(m.clientDisplayName || m.name), pid, levels, fast: !!defs.fast?.length, variants, def, partial, model: m, fam, ids }
     const contexts = (defs.context ?? []).filter((c) => has("context", c))
     if (contexts.length) {
       for (const c of contexts) {
@@ -702,6 +826,15 @@ function modelsOf(picker, ids) {
       out.push({ ...base, id: m.name === "default" ? "auto" : m.name, name: base.title, context: limit > 0 ? limit : DEFAULT_CONTEXT, size: "", offersFast: fastAt(variants, "") })
     }
   }
+  for (const [family, fam] of fams) {
+    if (fam.some((u) => named.has(u.id)) || named.has(family) || used.has(family)) continue
+    used.add(family)
+    const levels = Object.fromEntries(fam.filter((u) => LEVEL_RANK.includes(u.effort)).map((u) => [u.effort, u.effort]))
+    const def = fromUsable(fam, "", false)
+    // Cursor's context for it isn't known: its default's, as for a model
+    // the picker gives no limit for
+    out.push({ id: family, run: family, name: usableTitle(def.name), title: usableTitle(def.name), pid: "", levels, fast: false, variants: [], def: undefined, partial: false, model: { name: family }, fam, ids, usableOnly: true, context: DEFAULT_CONTEXT, size: "", offersFast: fam.some((u) => u.fast) })
+  }
   return out
 }
 
@@ -734,6 +867,11 @@ function nearest(vs, want) {
 // variant the account has. seed is the variant an id of Cursor's own named
 // (request), in the default's place.
 function pick(entry, effort, fast, seed) {
+  // a family the usable list has and the picker doesn't: its own id
+  if (entry.usableOnly) {
+    const u = fromUsable(entry.fam, effort, fast)
+    return { id: u.id, params: [], maxMode: u.maxMode }
+  }
   const def = entry.def
   const want = { ...valuesOf(seed ?? def) }
   if (entry.size) want.context = entry.size
@@ -761,6 +899,14 @@ function pick(entry, effort, fast, seed) {
   // cursor-agent models lists it: claude-opus-5-5-high), not the picker's
   // model name; the default's when no variant matched
   const id = v?.legacySlug || def?.legacySlug || entry.run
+  // an id the usable list doesn't have, when it has the family's (a
+  // picker model without variants goes by its name, claude-opus-5-5,
+  // which Cursor doesn't serve): the family's usable id at the effort
+  if (entry.ids && !entry.ids.has(id) && entry.fam?.length) {
+    const level = entry.pid && entry.pid !== "thinking" ? String(want[entry.pid] ?? "").replace("extra-high", "xhigh") : ""
+    const u = fromUsable(entry.fam, effort || level, fast)
+    return { id: u.id, params: [], maxMode: maxMode || u.maxMode }
+  }
   return { id, params, maxMode }
 }
 
@@ -815,17 +961,15 @@ async function usable(tok) {
   const h = createHash("sha256").update(tok).digest("hex")
   const had = lists.get(h)
   if (had && Date.now() - had.at < MODELS_KEEP) return had.raw
-  const [j, ids] = await Promise.all([
+  const [j, listed] = await Promise.all([
     unary(API, "aiserver.v1.AiService/AvailableModels", tok, { useModelParameters: true, doNotUseMarkdown: true }, 30_000),
     unary(API, "agent.v1.AgentService/GetUsableModels", tok, {}, 8_000).then(
-      (u) => {
-        const ids = new Set((u?.models ?? []).flatMap((m) => [m.modelId, m.displayModelId]).filter(Boolean))
-        return ids.size ? ids : null
-      },
-      () => null,
+      (u) => (Array.isArray(u?.models) ? u.models : []),
+      () => [],
     ),
   ])
-  const raw = modelsOf(Array.isArray(j?.models) ? j.models : [], ids)
+  const ids = new Set(listed.flatMap((m) => [m?.modelId, m?.displayModelId]).filter(Boolean))
+  const raw = modelsOf(Array.isArray(j?.models) ? j.models : [], ids.size ? ids : null, listed)
   if (!raw.length) throw new Error("Cursor listed no models")
   lists.set(h, { at: Date.now(), raw })
   return raw
@@ -858,8 +1002,33 @@ function named(raw, id) {
   }
   for (const e of models) {
     const m = e.model
+    if (e.usableOnly) continue
     if ([m.name, ...(m.legacySlugs ?? []), ...(m.idAliases ?? [])].includes(id)) return { entry: at(e, e.def), seed: undefined, effort: "", fast: false }
   }
+  // one of the usable list's own ids, or a family of them, that the picker
+  // has nothing of: that family at the id's effort, fast when it is
+  const of = familyOf(id)
+  for (const e of models) {
+    if (!e.usableOnly) continue
+    const u = e.fam.find((x) => x.id === id)
+    if (u) return { entry: e, seed: undefined, effort: u.effort, fast: u.fast }
+    if (e.id === of.family) return { entry: e, seed: undefined, effort: of.effort, fast: of.fast }
+  }
+  // an id at a context size the list no longer has (claude-opus-5-5@1m,
+  // picked from an earlier list, or from another account's): the model at
+  // the nearest size it has; a model listed without sizes, in Max Mode for
+  // a size over its window
+  const sized = /^(.+)@([^@]+)$/.exec(id)
+  if (sized) {
+    const want = tokensOf(sized[2])
+    const same = raw.filter((e) => e.run === sized[1] && e.size)
+    if (same.length) {
+      const near = same.reduce((a, b) => (Math.abs(tokensOf(b.size) - want) < Math.abs(tokensOf(a.size) - want) ? b : a))
+      return { entry: near, seed: undefined, effort: "", fast: false }
+    }
+    const old = named(raw, sized[1])
+    if (old) return { ...old, max: !old.entry.size && want > old.entry.context }
+  }
   return null
 }
 
@@ -870,8 +1039,17 @@ function named(raw, id) {
 function request(raw, model, effort, fast) {
   const entry = raw.find((m) => m.id === model)
   if (entry) return pick(entry, effort, fast)
+  const bare = raw.find((m) => m.id === model.replace(/@[^@]*$/, ""))
+  if (bare && model !== bare.id && !bare.size) {
+    // a model now listed without sizes, asked at one
+    const r = pick(bare, effort, fast)
+    return tokensOf(model.split("@").at(-1)) > bare.context ? { ...r, maxMode: true } : r
+  }
   const old = named(raw, model)
-  if (old) return pick(old.entry, effort || old.effort, fast || old.fast, old.seed)
+  if (old) {
+    const r = pick(old.entry, effort || old.effort, fast || old.fast, old.seed)
+    return old.max ? { ...r, maxMode: true } : r
+  }
   return { id: model === "auto" ? "default" : model, params: [], maxMode: false }
 }
 
@@ -1515,7 +1693,7 @@ async function usageEvents(tok, conv, since, want, { poll = false, first = STEP_
       const res = await fetch(API + "/aiserver.v1.DashboardService/GetFilteredUsageEvents", {
         method: "POST",
         headers: await headersFor(tok),
-        body: JSON.stringify({ teamId: 0, startDate: String(since - 60_000), endDate: String(Date.now() + 60_000), page: 1, pageSize: 50 }),
+        body: JSON.stringify({ ...await teamBody(tok), startDate: String(since - 60_000), endDate: String(Date.now() + 60_000), page: 1, pageSize: 50 }),
         signal: abortFetch && signal ? AbortSignal.any([signal, AbortSignal.timeout(STEP_WAIT.ask)]) : AbortSignal.timeout(STEP_WAIT.ask),
       })
       if (res.status >= 400 && res.status < 500 && res.status !== 429) {
@@ -2149,6 +2327,7 @@ async function runNative({ tok, base, id, tools, conv, convID, signal, maxMode,
       "x-cursor-client-type": "cli", // else Cursor adds a prompt of its own
       "x-ghost-mode": "true", // privacy mode: nothing kept for training
       "x-request-id": randomUUID(),
+      ...await teamHeader(tok),
       // none of Cursor's own tools, only the caller's
       "x-cursor-agent-allowed-tools": "mcp_tool_call,get_mcp_tools_tool_call",
     },
@@ -2237,6 +2416,7 @@ async function runOnce({ tok, base, id, tools, conv, convID, signal, maxMode, pa
       "x-cursor-client-type": "cli", // else Cursor adds a prompt of its own
       "x-ghost-mode": "true", // privacy mode: nothing kept for training
       "x-request-id": randomUUID(),
+      ...await teamHeader(tok),
       // none of Cursor's own tools, only the caller's
       "x-cursor-agent-allowed-tools": "mcp_tool_call,get_mcp_tools_tool_call",
     },
@@ -2887,4 +3067,4 @@ export async function CursorAuthPlugin() {
 }
 
 // for tests
-export const _internal = { keychain, keychainToken, nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }
+export const _internal = { keychain, keychainToken, nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, resetTeam: () => { teamRead.at = 0; teamRead.info = null }, expireTeam: () => (teamRead.at = 0),H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-cursor-auth",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "Cursor subscriptions (Pro, Pro+, Ultra, Teams) in OpenCode and magpie, through the API cursor-agent talks to",
   "type": "module",
   "main": "./index.mjs",