@playwo/opencode-cursor-oauth 0.0.0-dev.17eadae36ea6

package/README.md

@@ -0,0 +1,103 @@
+# @playwo/opencode-cursor-oauth
+
+OpenCode plugin that connects to Cursor's API, giving you access to Cursor
+models inside OpenCode with full tool-calling support.
+
+## Install in OpenCode
+
+Add this to `~/.config/opencode/opencode.json`:
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": [
+    "@playwo/opencode-cursor-oauth"
+  ],
+  "provider": {
+    "cursor": {
+      "name": "Cursor"
+    }
+  }
+}
+```
+
+The `cursor` provider stub is required because OpenCode drops providers that do
+not already exist in its bundled provider catalog.
+
+OpenCode installs npm plugins automatically at startup, so users do not need to
+clone this repository.
+
+## Authenticate
+
+```sh
+opencode auth login --provider cursor
+```
+
+This opens Cursor OAuth in the browser. Tokens are stored in
+`~/.local/share/opencode/auth.json` and refreshed automatically.
+
+## Use
+
+Start OpenCode and select any Cursor model. The plugin starts a local
+OpenAI-compatible proxy on demand and routes requests through Cursor's gRPC API.
+
+## How it works
+
+1. OAuth — browser-based login to Cursor via PKCE.
+2. Model discovery — queries Cursor's gRPC API for all available models; if discovery fails, the plugin disables the Cursor provider for that load and shows a visible error toast instead of crashing OpenCode.
+3. Local proxy — translates `POST /v1/chat/completions` into Cursor's
+   protobuf/Connect protocol.
+4. Native tool routing — rejects Cursor's built-in filesystem/shell tools and
+   exposes OpenCode's tool surface via Cursor MCP instead.
+
+Cursor agent streaming uses Cursor's `RunSSE` + `BidiAppend` transport, so the
+plugin runs entirely inside OpenCode without a Node sidecar.
+
+## Architecture
+
+```
+OpenCode  -->  /v1/chat/completions  -->  Bun.serve (proxy)
+                                              |
+                              RunSSE stream + BidiAppend writes
+                                              |
+                                Cursor Connect/SSE transport
+                                              |
+                                     api2.cursor.sh gRPC
+```
+
+### Tool call flow
+
+```
+1. Cursor model receives OpenAI tools via RequestContext (as MCP tool defs)
+2. Model tries native tools (readArgs, shellArgs, etc.)
+3. Proxy rejects each with typed error (ReadRejected, ShellRejected, etc.)
+4. Model falls back to MCP tool -> mcpArgs exec message
+5. Proxy emits OpenAI tool_calls SSE chunk, pauses the Cursor stream
+6. OpenCode executes tool, sends result in follow-up request
+7. Proxy resumes the Cursor stream with mcpResult and continues streaming
+```
+
+## Develop locally
+
+```sh
+bun install
+bun run build
+bun test/smoke.ts
+```
+
+## Publish
+
+GitHub Actions publishes this package with `.github/workflows/publish-npm.yml`.
+
+- branch pushes publish a `dev` build as `0.0.0-dev.<sha>`
+- versioned releases publish `latest` using the `package.json` version and upload the packed `.tgz` to the GitHub release
+
+Repository secrets required:
+
+- `NPM_TOKEN` for npm publish access
+
+## Requirements
+
+- [OpenCode](https://opencode.ai)
+- [Bun](https://bun.sh)
+- Active [Cursor](https://cursor.com) subscription

package/dist/auth.d.ts

@@ -0,0 +1,22 @@
+export interface CursorAuthParams {
+    verifier: string;
+    challenge: string;
+    uuid: string;
+    loginUrl: string;
+}
+export interface CursorCredentials {
+    access: string;
+    refresh: string;
+    expires: number;
+}
+export declare function generateCursorAuthParams(): Promise<CursorAuthParams>;
+export declare function pollCursorAuth(uuid: string, verifier: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+}>;
+export declare function refreshCursorToken(refreshToken: string): Promise<CursorCredentials>;
+/**
+ * Extract JWT expiry with 5-minute safety margin.
+ * Falls back to 1 hour from now if token can't be parsed.
+ */
+export declare function getTokenExpiry(token: string): number;

package/dist/auth.js

@@ -0,0 +1,92 @@
+import { generatePKCE } from "./pkce";
+const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
+const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
+const CURSOR_REFRESH_URL = process.env.CURSOR_REFRESH_URL ??
+    "https://api2.cursor.sh/auth/exchange_user_api_key";
+const POLL_MAX_ATTEMPTS = 150;
+const POLL_BASE_DELAY = 1000;
+const POLL_MAX_DELAY = 10_000;
+const POLL_BACKOFF_MULTIPLIER = 1.2;
+export async function generateCursorAuthParams() {
+    const { verifier, challenge } = await generatePKCE();
+    const uuid = crypto.randomUUID();
+    const params = new URLSearchParams({
+        challenge,
+        uuid,
+        mode: "login",
+        redirectTarget: "cli",
+    });
+    const loginUrl = `${CURSOR_LOGIN_URL}?${params.toString()}`;
+    return { verifier, challenge, uuid, loginUrl };
+}
+export async function pollCursorAuth(uuid, verifier) {
+    let delay = POLL_BASE_DELAY;
+    let consecutiveErrors = 0;
+    for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
+        await Bun.sleep(delay);
+        try {
+            const response = await fetch(`${CURSOR_POLL_URL}?uuid=${uuid}&verifier=${verifier}`);
+            if (response.status === 404) {
+                consecutiveErrors = 0;
+                delay = Math.min(delay * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY);
+                continue;
+            }
+            if (response.ok) {
+                const data = (await response.json());
+                return {
+                    accessToken: data.accessToken,
+                    refreshToken: data.refreshToken,
+                };
+            }
+            throw new Error(`Poll failed: ${response.status}`);
+        }
+        catch {
+            consecutiveErrors++;
+            if (consecutiveErrors >= 3) {
+                throw new Error("Too many consecutive errors during Cursor auth polling");
+            }
+        }
+    }
+    throw new Error("Cursor authentication polling timeout");
+}
+export async function refreshCursorToken(refreshToken) {
+    const response = await fetch(CURSOR_REFRESH_URL, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${refreshToken}`,
+            "Content-Type": "application/json",
+        },
+        body: "{}",
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Cursor token refresh failed: ${error}`);
+    }
+    const data = (await response.json());
+    return {
+        access: data.accessToken,
+        refresh: data.refreshToken || refreshToken,
+        expires: getTokenExpiry(data.accessToken),
+    };
+}
+/**
+ * Extract JWT expiry with 5-minute safety margin.
+ * Falls back to 1 hour from now if token can't be parsed.
+ */
+export function getTokenExpiry(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3 || !parts[1]) {
+            return Date.now() + 3600 * 1000;
+        }
+        const decoded = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+        if (decoded &&
+            typeof decoded === "object" &&
+            typeof decoded.exp === "number") {
+            return decoded.exp * 1000 - 5 * 60 * 1000;
+        }
+    }
+    catch {
+    }
+    return Date.now() + 3600 * 1000;
+}

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OpenCode Cursor Auth Plugin
+ *
+ * Enables using Cursor models (Claude, GPT, etc.) inside OpenCode via:
+ * 1. Browser-based OAuth login to Cursor
+ * 2. Local proxy translating OpenAI format → Cursor gRPC protocol
+ */
+import type { Plugin } from "@opencode-ai/plugin";
+/**
+ * OpenCode plugin that provides Cursor authentication and model access.
+ * Register in opencode.json: { "plugin": ["opencode-cursor-oauth"] }
+ */
+export declare const CursorAuthPlugin: Plugin;
+export default CursorAuthPlugin;

package/dist/index.js

@@ -0,0 +1,279 @@
+import { generateCursorAuthParams, getTokenExpiry, pollCursorAuth, refreshCursorToken, } from "./auth";
+import { getCursorModels } from "./models";
+import { startProxy, stopProxy } from "./proxy";
+const CURSOR_PROVIDER_ID = "cursor";
+let lastModelDiscoveryError = null;
+/**
+ * OpenCode plugin that provides Cursor authentication and model access.
+ * Register in opencode.json: { "plugin": ["opencode-cursor-oauth"] }
+ */
+export const CursorAuthPlugin = async (input) => {
+    return {
+        auth: {
+            provider: CURSOR_PROVIDER_ID,
+            async loader(getAuth, provider) {
+                const auth = await getAuth();
+                if (!auth || auth.type !== "oauth")
+                    return {};
+                // Ensure we have a valid access token, refreshing if expired
+                let accessToken = auth.access;
+                if (!accessToken || auth.expires < Date.now()) {
+                    const refreshed = await refreshCursorToken(auth.refresh);
+                    await input.client.auth.set({
+                        path: { id: CURSOR_PROVIDER_ID },
+                        body: {
+                            type: "oauth",
+                            refresh: refreshed.refresh,
+                            access: refreshed.access,
+                            expires: refreshed.expires,
+                        },
+                    });
+                    accessToken = refreshed.access;
+                }
+                let models;
+                try {
+                    models = await getCursorModels(accessToken);
+                    lastModelDiscoveryError = null;
+                }
+                catch (error) {
+                    const message = error instanceof Error
+                        ? error.message
+                        : "Cursor model discovery failed.";
+                    stopProxy();
+                    if (provider) {
+                        provider.models = {};
+                    }
+                    if (message !== lastModelDiscoveryError) {
+                        lastModelDiscoveryError = message;
+                        await showDiscoveryFailureToast(input, message);
+                    }
+                    return buildDisabledProviderConfig(message);
+                }
+                const port = await startProxy(async () => {
+                    const currentAuth = await getAuth();
+                    if (currentAuth.type !== "oauth") {
+                        throw new Error("Cursor auth not configured");
+                    }
+                    if (!currentAuth.access || currentAuth.expires < Date.now()) {
+                        const refreshed = await refreshCursorToken(currentAuth.refresh);
+                        await input.client.auth.set({
+                            path: { id: CURSOR_PROVIDER_ID },
+                            body: {
+                                type: "oauth",
+                                refresh: refreshed.refresh,
+                                access: refreshed.access,
+                                expires: refreshed.expires,
+                            },
+                        });
+                        return refreshed.access;
+                    }
+                    return currentAuth.access;
+                }, models);
+                if (provider) {
+                    provider.models = buildCursorProviderModels(models, port);
+                }
+                return {
+                    baseURL: `http://localhost:${port}/v1`,
+                    apiKey: "cursor-proxy",
+                    async fetch(requestInput, init) {
+                        if (init?.headers) {
+                            if (init.headers instanceof Headers) {
+                                init.headers.delete("authorization");
+                            }
+                            else if (Array.isArray(init.headers)) {
+                                init.headers = init.headers.filter(([key]) => key.toLowerCase() !== "authorization");
+                            }
+                            else {
+                                delete init.headers["authorization"];
+                                delete init.headers["Authorization"];
+                            }
+                        }
+                        return fetch(requestInput, init);
+                    },
+                };
+            },
+            methods: [
+                {
+                    type: "oauth",
+                    label: "Login with Cursor",
+                    async authorize() {
+                        const { verifier, uuid, loginUrl } = await generateCursorAuthParams();
+                        return {
+                            url: loginUrl,
+                            instructions: "Complete login in your browser. This window will close automatically.",
+                            method: "auto",
+                            async callback() {
+                                const { accessToken, refreshToken } = await pollCursorAuth(uuid, verifier);
+                                return {
+                                    type: "success",
+                                    refresh: refreshToken,
+                                    access: accessToken,
+                                    expires: getTokenExpiry(accessToken),
+                                };
+                            },
+                        };
+                    },
+                },
+            ],
+        },
+    };
+};
+function buildCursorProviderModels(models, port) {
+    return Object.fromEntries(models.map((model) => [
+        model.id,
+        {
+            id: model.id,
+            providerID: CURSOR_PROVIDER_ID,
+            api: {
+                id: model.id,
+                url: `http://localhost:${port}/v1`,
+                npm: "@ai-sdk/openai-compatible",
+            },
+            name: model.name,
+            capabilities: {
+                temperature: true,
+                reasoning: model.reasoning,
+                attachment: false,
+                toolcall: true,
+                input: {
+                    text: true,
+                    audio: false,
+                    image: false,
+                    video: false,
+                    pdf: false,
+                },
+                output: {
+                    text: true,
+                    audio: false,
+                    image: false,
+                    video: false,
+                    pdf: false,
+                },
+                interleaved: false,
+            },
+            cost: estimateModelCost(model.id),
+            limit: {
+                context: model.contextWindow,
+                output: model.maxTokens,
+            },
+            status: "active",
+            options: {},
+            headers: {},
+            release_date: "",
+            variants: {},
+        },
+    ]));
+}
+async function showDiscoveryFailureToast(input, message) {
+    try {
+        await input.client.tui.showToast({
+            body: {
+                title: "Cursor plugin disabled",
+                message,
+                variant: "error",
+                duration: 8_000,
+            },
+        });
+    }
+    catch { }
+}
+function buildDisabledProviderConfig(message) {
+    return {
+        baseURL: "http://127.0.0.1/cursor-disabled/v1",
+        apiKey: "cursor-disabled",
+        async fetch() {
+            return new Response(JSON.stringify({
+                error: {
+                    message,
+                    type: "server_error",
+                    code: "cursor_model_discovery_failed",
+                },
+            }), {
+                status: 503,
+                headers: { "Content-Type": "application/json" },
+            });
+        },
+    };
+}
+// $/M token rates from cursor.com/docs/models-and-pricing
+const MODEL_COST_TABLE = {
+    // Anthropic
+    "claude-4-sonnet": { input: 3, output: 15, cache: { read: 0.3, write: 3.75 } },
+    "claude-4-sonnet-1m": { input: 6, output: 22.5, cache: { read: 0.6, write: 7.5 } },
+    "claude-4.5-haiku": { input: 1, output: 5, cache: { read: 0.1, write: 1.25 } },
+    "claude-4.5-opus": { input: 5, output: 25, cache: { read: 0.5, write: 6.25 } },
+    "claude-4.5-sonnet": { input: 3, output: 15, cache: { read: 0.3, write: 3.75 } },
+    "claude-4.6-opus": { input: 5, output: 25, cache: { read: 0.5, write: 6.25 } },
+    "claude-4.6-opus-fast": { input: 30, output: 150, cache: { read: 3, write: 37.5 } },
+    "claude-4.6-sonnet": { input: 3, output: 15, cache: { read: 0.3, write: 3.75 } },
+    // Cursor
+    "composer-1": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "composer-1.5": { input: 3.5, output: 17.5, cache: { read: 0.35, write: 0 } },
+    "composer-2": { input: 0.5, output: 2.5, cache: { read: 0.2, write: 0 } },
+    "composer-2-fast": { input: 1.5, output: 7.5, cache: { read: 0.2, write: 0 } },
+    // Google
+    "gemini-2.5-flash": { input: 0.3, output: 2.5, cache: { read: 0.03, write: 0 } },
+    "gemini-3-flash": { input: 0.5, output: 3, cache: { read: 0.05, write: 0 } },
+    "gemini-3-pro": { input: 2, output: 12, cache: { read: 0.2, write: 0 } },
+    "gemini-3-pro-image": { input: 2, output: 12, cache: { read: 0.2, write: 0 } },
+    "gemini-3.1-pro": { input: 2, output: 12, cache: { read: 0.2, write: 0 } },
+    // OpenAI
+    "gpt-5": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5-fast": { input: 2.5, output: 20, cache: { read: 0.25, write: 0 } },
+    "gpt-5-mini": { input: 0.25, output: 2, cache: { read: 0.025, write: 0 } },
+    "gpt-5-codex": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5.1-codex": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5.1-codex-max": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5.1-codex-mini": { input: 0.25, output: 2, cache: { read: 0.025, write: 0 } },
+    "gpt-5.2": { input: 1.75, output: 14, cache: { read: 0.175, write: 0 } },
+    "gpt-5.2-codex": { input: 1.75, output: 14, cache: { read: 0.175, write: 0 } },
+    "gpt-5.3-codex": { input: 1.75, output: 14, cache: { read: 0.175, write: 0 } },
+    "gpt-5.4": { input: 2.5, output: 15, cache: { read: 0.25, write: 0 } },
+    "gpt-5.4-mini": { input: 0.75, output: 4.5, cache: { read: 0.075, write: 0 } },
+    "gpt-5.4-nano": { input: 0.2, output: 1.25, cache: { read: 0.02, write: 0 } },
+    // xAI
+    "grok-4.20": { input: 2, output: 6, cache: { read: 0.2, write: 0 } },
+    // Moonshot
+    "kimi-k2.5": { input: 0.6, output: 3, cache: { read: 0.1, write: 0 } },
+};
+// Most-specific first
+const MODEL_COST_PATTERNS = [
+    { match: (id) => /claude.*opus.*fast/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-opus-fast"] },
+    { match: (id) => /claude.*opus/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-opus"] },
+    { match: (id) => /claude.*haiku/i.test(id), cost: MODEL_COST_TABLE["claude-4.5-haiku"] },
+    { match: (id) => /claude.*sonnet/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-sonnet"] },
+    { match: (id) => /claude/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-sonnet"] },
+    { match: (id) => /composer-?2/i.test(id), cost: MODEL_COST_TABLE["composer-2"] },
+    { match: (id) => /composer-?1\.5/i.test(id), cost: MODEL_COST_TABLE["composer-1.5"] },
+    { match: (id) => /composer/i.test(id), cost: MODEL_COST_TABLE["composer-1"] },
+    { match: (id) => /gpt-5\.4.*nano/i.test(id), cost: MODEL_COST_TABLE["gpt-5.4-nano"] },
+    { match: (id) => /gpt-5\.4.*mini/i.test(id), cost: MODEL_COST_TABLE["gpt-5.4-mini"] },
+    { match: (id) => /gpt-5\.4/i.test(id), cost: MODEL_COST_TABLE["gpt-5.4"] },
+    { match: (id) => /gpt-5\.3/i.test(id), cost: MODEL_COST_TABLE["gpt-5.3-codex"] },
+    { match: (id) => /gpt-5\.2/i.test(id), cost: MODEL_COST_TABLE["gpt-5.2"] },
+    { match: (id) => /gpt-5\.1.*mini/i.test(id), cost: MODEL_COST_TABLE["gpt-5.1-codex-mini"] },
+    { match: (id) => /gpt-5\.1/i.test(id), cost: MODEL_COST_TABLE["gpt-5.1-codex"] },
+    { match: (id) => /gpt-5.*mini/i.test(id), cost: MODEL_COST_TABLE["gpt-5-mini"] },
+    { match: (id) => /gpt-5.*fast/i.test(id), cost: MODEL_COST_TABLE["gpt-5-fast"] },
+    { match: (id) => /gpt-5/i.test(id), cost: MODEL_COST_TABLE["gpt-5"] },
+    { match: (id) => /gemini.*3\.1/i.test(id), cost: MODEL_COST_TABLE["gemini-3.1-pro"] },
+    { match: (id) => /gemini.*3.*flash/i.test(id), cost: MODEL_COST_TABLE["gemini-3-flash"] },
+    { match: (id) => /gemini.*3/i.test(id), cost: MODEL_COST_TABLE["gemini-3-pro"] },
+    { match: (id) => /gemini.*flash/i.test(id), cost: MODEL_COST_TABLE["gemini-2.5-flash"] },
+    { match: (id) => /gemini/i.test(id), cost: MODEL_COST_TABLE["gemini-3.1-pro"] },
+    { match: (id) => /grok/i.test(id), cost: MODEL_COST_TABLE["grok-4.20"] },
+    { match: (id) => /kimi/i.test(id), cost: MODEL_COST_TABLE["kimi-k2.5"] },
+];
+const DEFAULT_COST = { input: 3, output: 15, cache: { read: 0.3, write: 0 } };
+function estimateModelCost(modelId) {
+    const normalized = modelId.toLowerCase();
+    const exact = MODEL_COST_TABLE[normalized];
+    if (exact)
+        return exact;
+    const stripped = normalized.replace(/-(high|medium|low|preview|thinking|spark-preview)$/g, "");
+    const strippedMatch = MODEL_COST_TABLE[stripped];
+    if (strippedMatch)
+        return strippedMatch;
+    return MODEL_COST_PATTERNS.find((p) => p.match(normalized))?.cost ?? DEFAULT_COST;
+}
+export default CursorAuthPlugin;

package/dist/models.d.ts

@@ -0,0 +1,13 @@
+export interface CursorModel {
+    id: string;
+    name: string;
+    reasoning: boolean;
+    contextWindow: number;
+    maxTokens: number;
+}
+export declare class CursorModelDiscoveryError extends Error {
+    constructor(message: string);
+}
+export declare function getCursorModels(apiKey: string): Promise<CursorModel[]>;
+/** @internal Test-only. */
+export declare function clearModelCache(): void;