@magpie-community/opencode-cursor-auth 0.2.28 → 0.2.30

package/README.md

@@ -51,8 +51,10 @@ plugin's `fetch` answers them on Cursor's agent API:
   (refused, no network) or a stream the server refused leaves the next Run
   to try HTTP/2 again. A region error over HTTP/1.1 sends the Run back to
   HTTP/2 at the region's agent host. BidiAppends go up numbered in order,
-  up to 16 at a time as cursor-agent sends them (one at a time for a
-  native session's Run, whose tool results must be certain). A BidiAppend
+  up to 16 at a time as cursor-agent sends them. A native session's Run
+  sends only its KV replies (the history's blobs) that way; a tool result
+  or anything else waits for the appends before it, goes alone, and is
+  written once Cursor answered it, so it is never uncertain. A BidiAppend
   with no answer in 60 s (more for a large one) ends the Run, as
   cursor-agent does.
 - A new Run imports the whole conversation as AI SDK messages kept as blobs
@@ -252,6 +254,17 @@ own spends the team's pool: On-demand shows the pool's spend and limit,
 with the member's own spend beside it, and the account is used up when
 the pool is.
 
+An Enterprise account's period has no Cursor Models, Other Models or Total
+in `GetCurrentPeriodUsage`: Cursor reports its overall allowance through
+the website's `usage-summary` instead. Magpie shows that as Enterprise,
+for example `49.45 / 800 USD · 6.2% used`, or
+`750.55 / 800 USD · 93.8% left` with Magpie's Used / Left choice, reset at
+the billing cycle's end. When the summary says team on-demand is enabled
+and unlimited or still has room, the Enterprise window is informational:
+reaching its included allowance doesn't count the account as used up.
+On-demand also shows the team's spend when known, with its limit when it
+has one. A reached on-demand limit counts the account as used up.
+
 Sign in to the Cursor account linked in Grok Bot. A linked SuperGrok
 subscription grants Bot access without a paid Cursor plan; see
 [Grok Bot plans and billing](https://cursor.com/help/grok-bot/plans).

package/index.mjs

@@ -532,14 +532,79 @@ async function hardLimit(tok) {
 // dollars, thousands grouped: a team's pool runs to six figures ($451,200.00)
 const dollars = (n) => "$" + n.toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 })
 
-// usage is the account's windows this billing period; an enterprise plan
-// reports spend instead, and gets none. ids are the models it can be
-// asked for, each counted by the pool Cursor bills it to. An account that
-// may spend on-demand once its included usage is gone (fottencity on
+// enterpriseUsage is the allowance GetCurrentPeriodUsage leaves out on an
+// Enterprise account. That call answers with only the billing cycle there;
+// the website's usage-summary has individualUsage.overall, in cents, and
+// the account's membership. The CLI JWT is also the website's dashboard
+// session, as botUsage builds it. undefined when the summary says nothing
+// this can show, so a failed read stays an empty card, as before.
+async function enterpriseUsage(tok) {
+  try {
+    const subject = JSON.parse(Buffer.from(tok.split(".")[1], "base64url").toString()).sub
+    if (typeof subject !== "string") return undefined
+    const user = subject.split("|").filter(Boolean).at(-1)
+    if (!user || !/^[a-zA-Z0-9._-]+$/.test(user)) return undefined
+    const res = await fetch(WEBSITE + "/api/usage-summary", {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        Origin: WEBSITE,
+        Cookie: "WorkosCursorSessionToken=" + encodeURIComponent(user + "::" + tok),
+      },
+      redirect: "error",
+      signal: AbortSignal.timeout(15_000),
+    })
+    if (!res.ok) return undefined
+    const data = await res.json()
+    if (String(data?.membershipType).toLowerCase() !== "enterprise") return undefined
+    const overall = data?.individualUsage?.overall
+    if (overall?.enabled !== true) return undefined
+    const { used, limit } = overall
+    if (typeof used !== "number" || !Number.isFinite(used) || used < 0) return undefined
+    if (typeof limit !== "number" || !Number.isFinite(limit) || limit <= 0) return undefined
+    const end = Date.parse(data.billingCycleEnd ?? "")
+    const resets = Number.isFinite(end) ? { resetsAt: new Date(end).toISOString() } : {}
+    const od = data.teamUsage?.onDemand
+    const spent = typeof od?.used === "number" && Number.isFinite(od.used) && od.used >= 0
+    const unlimited = od?.enabled === true && od.limit === null
+    const fixed = od?.enabled === true && typeof od.limit === "number" && Number.isFinite(od.limit) && od.limit > 0 && spent
+    // Only an explicitly unlimited budget or a measured budget with room
+    // lets a spent included allowance stay available to magpie's routing.
+    const aside = unlimited || (fixed && od.used < od.limit)
+    const windows = [{
+      name: "Enterprise",
+      used: Math.max(0, Math.min(100, (100 * used) / limit)),
+      display: `${dollars(used / 100)} / ${dollars(limit / 100)}`,
+      amount: used / 100,
+      limit: limit / 100,
+      unit: "USD",
+      ...resets,
+      ...(aside ? { aside: true } : {}),
+    }]
+    if (fixed) windows.push({
+      name: "On-demand",
+      used: Math.min(100, (100 * od.used) / od.limit),
+      display: `${dollars(od.used / 100)} / ${dollars(od.limit / 100)}`,
+      amount: od.used / 100,
+      limit: od.limit / 100,
+      unit: "USD",
+      ...resets,
+    })
+    else if (unlimited && spent) windows.push({ name: "On-demand", used: 0, display: dollars(od.used / 100), ...resets, aside: true })
+    return windows
+  } catch {
+    return undefined
+  }
+}
+
+// usage is the account's windows this billing period. ids are the models it
+// can be asked for, each counted by the pool Cursor bills it to. An account
+// that may spend on-demand once its included usage is gone (fottencity on
 // Discord: a team that pays for more) is still served when the pools are
 // spent, so they are shown aside, and its On-demand spend is what can run
 // out: at its limit (a team member with none of their own: the team's
-// pool), or never when it has none.
+// pool), or never when it has none. An Enterprise account's period has no
+// planUsage; its allowance comes from usage-summary instead.
 async function usage(tok, ids) {
   const [res, hard] = await Promise.all([
     fetch(API + "/aiserver.v1.DashboardService/GetCurrentPeriodUsage", {
@@ -553,7 +618,11 @@ async function usage(tok, ids) {
   if (!res.ok) return { error: statusText(res.status), windows: [] }
   const data = await res.json()
   const u = data?.planUsage
-  if (!u) return { windows: [] }
+  if (!u) {
+    // Prefer measured Enterprise usage before any reset-date-only fallback.
+    const windows = await enterpriseUsage(tok)
+    return windows ? { windows } : { windows: [] }
+  }
   const ms = /^[+-]?\d+$/.test(data.billingCycleEnd ?? "") ? Number(data.billingCycleEnd) : 0
   const resets = ms > 0 ? { resetsAt: new Date(ms).toISOString() } : {}
   const bucket = new Set((data.autoBucketModels ?? []).map(poolBase))
@@ -2038,10 +2107,11 @@ async function agentURL(tok, fresh) {
 // H2.retryAfter, or until a region error sends one back (answerOf); a
 // connection that failed (refused, no network) or a stream the server
 // refused leaves the next Run to try HTTP/2 again. atOnce is how many
-// BidiAppends openH1 may have on their way at once.
+// BidiAppends openH1 may have on their way at once, overlaps which messages
+// may be among them (openH1).
 let h1Until = 0
 const cancelledOpen = () => ({ error: { status: 410, message: "the request was cancelled" }, h2Failed: false })
-async function open(base, headers, signal, atOnce = H1.atOnce) {
+async function open(base, headers, signal, atOnce = H1.atOnce, overlaps) {
   if (signal?.aborted) return cancelledOpen()
   if (Date.now() >= h1Until) {
     const o = await openH2(base, headers, signal)
@@ -2055,7 +2125,7 @@ async function open(base, headers, signal, atOnce = H1.atOnce) {
     if (o.blocked) h1Until = Date.now() + H2.retryAfter
   }
   if (signal?.aborted) return cancelledOpen()
-  return openH1(headers, signal, atOnce)
+  return openH1(headers, signal, atOnce, overlaps)
 }
 
 const H2 = {
@@ -2128,10 +2198,19 @@ const H1 = {
   // keeps them: one at a time, a new Run's history (a blob a message,
   // hundreds for a long conversation, all asked for at once) took a round
   // trip to Cursor each before the model could start. A native session's
-  // Run keeps them one at a time (runNative).
+  // Run sends only its KV replies that way (kvReply); each of its other
+  // messages waits for every append before it, and goes alone (runNative).
   atOnce: 16,
 }
 
+// kvReply is whether a client message (an AgentClientMessage, unframed) is
+// a KV reply, kv_client_message: a blob Cursor asked for, which nothing
+// else waits on. Cursor asks for a new Run's whole history at once.
+function kvReply(msg) {
+  const b = Buffer.isBuffer(msg) ? msg : Buffer.from(msg ?? EMPTY)
+  return b.length > 0 && b[0] === 0x1a // field 3, length-delimited
+}
+
 // connectCode is Connect's code for an HTTP status that came with no
 // Connect error of its own
 function connectCode(status) {
@@ -2144,8 +2223,11 @@ function connectCode(status) {
 // the stream it reads, Connect's frames as the HTTP/2 Run's. Its response
 // is a 200 at once; an error Cursor says later, or a call that fails,
 // ends the stream with Connect's end frame, which runOnce reads as the
-// Run's own.
-function openH1(headers, signal, atOnce = H1.atOnce) {
+// Run's own. overlaps says of a message whether it may go up while appends
+// before it are on their way (up to atOnce of them); one that may not waits
+// for all of them, goes alone, and its write's callback is its own append
+// answered.
+function openH1(headers, signal, atOnce = H1.atOnce, overlaps = () => true) {
   if (signal?.aborted) return Promise.resolve(cancelledOpen())
   const ac = new AbortController()
   const id = headers["x-request-id"]
@@ -2159,11 +2241,20 @@ function openH1(headers, signal, atOnce = H1.atOnce) {
     write(chunk, _enc, cb) {
       // runOnce writes one whole frame each time
       const msg = Buffer.from(chunk).subarray(5)
-      const n = seq++
-      const p = append(msg, n)
-      going.add(p)
-      const gone = () => going.delete(p)
-      p.then(gone, gone)
+      const go = () => {
+        const p = append(msg, seq++)
+        going.add(p)
+        const gone = () => going.delete(p)
+        p.then(gone, gone)
+        return p
+      }
+      if (!overlaps(msg)) {
+        // alone: after every append before it is answered, and answered
+        // itself before the next write
+        Promise.allSettled([...going]).then(go).then(() => cb(), (e) => cb(e))
+        return
+      }
+      go()
       // Up to atOnce appends go at once; past that the write stays
       // buffered until one finishes, so callbacks and drain reflect the
       // pending upload rather than an unbounded promise chain. At one,
@@ -2432,9 +2523,15 @@ async function runNative({ tok, base, id, tools, conv, convID, signal, maxMode,
       "x-cursor-agent-allowed-tools": "mcp_tool_call,get_mcp_tools_tool_call",
     },
     native.ac.signal,
-    // one at a time: a native session counts a write as done only when
-    // Cursor answered its own append, so a tool result is never uncertain
-    1,
+    // Over HTTP/1.1 the history's blobs go up H1.atOnce at a time, as
+    // cursor-agent sends them; one at a time, a Run with a long history
+    // waited a round trip to api2 a blob before its first token (ysm119 on
+    // Discord: 135 blobs, 37 s against 3 s over HTTP/2). Everything else
+    // goes alone, after the appends before it were answered, and counts as
+    // written only once Cursor answered it, so a tool result is never
+    // uncertain.
+    H1.atOnce,
+    kvReply,
   )
   if (o.error) {
     native.fail(o.error)
@@ -3167,4 +3264,4 @@ export async function CursorAuthPlugin() {
 }
 
 // for tests
-export const _internal = { listFor, lists, keychain, keychainToken, nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, resetTeam: () => { teamRead.at = 0; teamRead.info = null }, expireTeam: () => (teamRead.at = 0),H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }
+export const _internal = { kvReply, listFor, lists, keychain, keychainToken, nativeTransport, onDemandOf,resetH1: () => (h1Until = 0), onH1: () => Date.now() < h1Until, resetTeam: () => { teamRead.at = 0; teamRead.info = null }, expireTeam: () => (teamRead.at = 0),H2, H1, h2Blocked, open, openH1, openH2, STEP_WAIT, stepUsage, usageKey, ledger, owed, flights, misses, unreadable, catalog, usable, request, modelsOf, tokensOf, maxRequired, conversationID, usageOf, sessionOf, SESSION, errorResponse, kept, poolBase, conversation, buildRun, decode, exec, fields, pb, pbValue, pbAny, frame, frames, failure, toolsOf, expiry }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magpie-community/opencode-cursor-auth",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "Cursor subscriptions (Pro, Pro+, Ultra, Teams) in OpenCode and magpie, through the API cursor-agent talks to",
   "type": "module",
   "main": "./index.mjs",