@rahularya01/pi-cursor 1.1.0 → 1.2.0

package/src/auth/cli-credentials.ts

@@ -1,193 +0,0 @@
-import { existsSync, readdirSync } from "node:fs";
-import { execFileSync } from "node:child_process";
-import { homedir, platform } from "node:os";
-import { join } from "node:path";
-import { systemCredentialsAllowed } from "./consent.js";
-import { getCursorAccessTokenFromEnv, getTokenExpiry, refreshCursorToken } from "./oauth.js";
-
-export type CredentialSource =
-  | "env"
-  | "cli_keychain"
-  | "cli_keychain_refresh"
-  | "ide_vscdb"
-  | "ide_vscdb_refresh"
-  | "pi_oauth"
-  | "pi_oauth_refresh";
-
-export interface CursorTokenResult {
-  accessToken: string;
-  source: CredentialSource;
-}
-
-/**
- * Reads token from macOS Keychain (security CLI).
- */
-export async function getCursorKeychainToken(): Promise<CursorTokenResult | undefined> {
-  if (platform() !== "darwin") return undefined;
-
-  let accessToken: string | undefined;
-  let refreshToken: string | undefined;
-
-  try {
-    const rawAccess = execFileSync(
-      "security",
-      ["find-generic-password", "-s", "cursor-access-token", "-a", "cursor-user", "-w"],
-      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 2000 },
-    ).trim();
-    if (rawAccess) accessToken = rawAccess;
-  } catch {
-    // Keychain item not found or error
-  }
-
-  try {
-    const rawRefresh = execFileSync(
-      "security",
-      ["find-generic-password", "-s", "cursor-refresh-token", "-a", "cursor-user", "-w"],
-      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 2000 },
-    ).trim();
-    if (rawRefresh) refreshToken = rawRefresh;
-  } catch {
-    // Keychain item not found or error
-  }
-
-  if (accessToken && Date.now() < getTokenExpiry(accessToken)) {
-    return { accessToken, source: "cli_keychain" };
-  }
-
-  if (refreshToken) {
-    try {
-      const refreshed = await refreshCursorToken(refreshToken);
-      return { accessToken: refreshed.access, source: "cli_keychain_refresh" };
-    } catch {
-      // Refresh failed
-    }
-  }
-
-  return undefined;
-}
-
-async function getDatabaseSync() {
-  try {
-    const mod = await import("node:sqlite");
-    return mod.DatabaseSync;
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Reads token from Cursor IDE state.vscdb.
- */
-export async function getCursorVscdbToken(): Promise<CursorTokenResult | undefined> {
-  const DatabaseSyncClass = await getDatabaseSync();
-  if (!DatabaseSyncClass) return undefined;
-
-  const dbPaths: string[] = [];
-  const home = homedir();
-
-  if (platform() === "darwin") {
-    dbPaths.push(join(home, "Library/Application Support/Cursor/User/globalStorage/state.vscdb"));
-  } else if (platform() === "win32") {
-    if (process.env.APPDATA) {
-      dbPaths.push(join(process.env.APPDATA, "Cursor/User/globalStorage/state.vscdb"));
-    }
-  } else {
-    // Linux / WSL
-    dbPaths.push(join(home, ".config/Cursor/User/globalStorage/state.vscdb"));
-    // If running inside WSL, auto-detect Windows host Cursor credentials
-    if (process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP || existsSync("/mnt/c/Users")) {
-      try {
-        const usersDir = "/mnt/c/Users";
-        if (existsSync(usersDir)) {
-          for (const user of readdirSync(usersDir)) {
-            if (user === "Public" || user === "Default" || user.startsWith(".")) continue;
-            dbPaths.push(
-              join(usersDir, user, "AppData/Roaming/Cursor/User/globalStorage/state.vscdb"),
-            );
-          }
-        }
-      } catch {
-        // Ignore read permission errors on Windows user profiles
-      }
-    }
-  }
-
-  for (const dbPath of dbPaths) {
-    try {
-      const db = new DatabaseSyncClass(dbPath, { readOnly: true });
-
-      const accessRow = db
-        .prepare("SELECT value FROM ItemTable WHERE key = 'cursorAuth/accessToken'")
-        .get() as { value?: string } | undefined;
-      const refreshRow = db
-        .prepare("SELECT value FROM ItemTable WHERE key = 'cursorAuth/refreshToken'")
-        .get() as { value?: string } | undefined;
-
-      db.close();
-
-      const accessToken = typeof accessRow?.value === "string" ? accessRow.value.trim() : undefined;
-      const refreshToken =
-        typeof refreshRow?.value === "string" ? refreshRow.value.trim() : undefined;
-
-      if (accessToken && Date.now() < getTokenExpiry(accessToken)) {
-        return { accessToken, source: "ide_vscdb" };
-      }
-
-      if (refreshToken) {
-        try {
-          const refreshed = await refreshCursorToken(refreshToken);
-          return { accessToken: refreshed.access, source: "ide_vscdb_refresh" };
-        } catch {
-          // Refresh failed
-        }
-      }
-    } catch {
-      // Database missing or unreadable
-    }
-  }
-
-  return undefined;
-}
-
-/**
- * Full credential resolution cascade:
- * 1. CURSOR_ACCESS_TOKEN env var
- * 2. macOS Keychain (Cursor CLI) — gated by system-credential consent
- * 3. Cursor IDE state.vscdb — gated by system-credential consent
- *
- * Opt out of Keychain/vscdb scraping with PI_CURSOR_SYSTEM_CREDENTIALS=0.
- */
-export async function resolveSystemCursorAccessToken(options?: {
-  forceRefresh?: boolean;
-}): Promise<CursorTokenResult | undefined> {
-  const envToken = getCursorAccessTokenFromEnv();
-  if (envToken) {
-    // Env tokens cannot be refreshed here; still prefer them when present.
-    if (!options?.forceRefresh || Date.now() < getTokenExpiry(envToken)) {
-      return { accessToken: envToken, source: "env" };
-    }
-  }
-
-  if (!systemCredentialsAllowed()) {
-    return undefined;
-  }
-
-  // forceRefresh: skip unexpired access-token short-circuit by re-reading sources
-  // (keychain/vscdb helpers already refresh when access is expired).
-  const keychainToken = await getCursorKeychainToken();
-  if (keychainToken) {
-    if (!options?.forceRefresh || keychainToken.source.endsWith("_refresh")) {
-      return keychainToken;
-    }
-    // Access still valid but forceRefresh requested — try refresh path via re-read.
-    // Keychain helper returns unexpired access first; force path falls through to vscdb/oauth.
-  }
-
-  const vscdbToken = await getCursorVscdbToken();
-  if (vscdbToken) return vscdbToken;
-
-  // If forceRefresh and we only had unexpired keychain access, return it as last resort.
-  if (keychainToken) return keychainToken;
-
-  return undefined;
-}

package/src/auth/consent.ts

@@ -1,27 +0,0 @@
-/**
- * Consent / opt-out for reusing Cursor CLI / IDE system credentials.
- *
- * Default: allow system credential reuse (Keychain + state.vscdb + WSL host).
- * Opt out with PI_CURSOR_SYSTEM_CREDENTIALS=0|false|off|deny.
- * Force-enable with PI_CURSOR_SYSTEM_CREDENTIALS=1|true|on|allow.
- */
-export type SystemCredentialPolicy = "allow" | "deny";
-
-export function resolveSystemCredentialPolicy(
-  envValue: string | undefined = process.env.PI_CURSOR_SYSTEM_CREDENTIALS,
-): SystemCredentialPolicy {
-  const raw = envValue?.trim().toLowerCase();
-  if (!raw) return "allow";
-  if (raw === "0" || raw === "false" || raw === "off" || raw === "deny" || raw === "no") {
-    return "deny";
-  }
-  if (raw === "1" || raw === "true" || raw === "on" || raw === "allow" || raw === "yes") {
-    return "allow";
-  }
-  // Unknown values fail closed so misconfiguration never silently scrapes credentials.
-  return "deny";
-}
-
-export function systemCredentialsAllowed(envValue?: string): boolean {
-  return resolveSystemCredentialPolicy(envValue) === "allow";
-}

package/src/auth/index.ts

@@ -1,22 +0,0 @@
-export {
-  generateCursorAuthParams,
-  pollCursorAuth,
-  refreshCursorToken,
-  getTokenExpiry,
-  getCursorAccessTokenFromEnv,
-  createCursorAuthClient,
-  type CursorAuthParams,
-  type CursorCredentials,
-} from "./oauth.js";
-export {
-  resolveSystemCursorAccessToken,
-  getCursorKeychainToken,
-  getCursorVscdbToken,
-  type CredentialSource,
-  type CursorTokenResult,
-} from "./cli-credentials.js";
-export {
-  systemCredentialsAllowed,
-  resolveSystemCredentialPolicy,
-  type SystemCredentialPolicy,
-} from "./consent.js";

package/src/auth/oauth.ts

@@ -1,214 +0,0 @@
-/**
- * Cursor OAuth authentication via PKCE.
- *
- * Flow:
- * 1. Generate PKCE verifier + challenge
- * 2. Open browser to cursor.com/loginDeepControl
- * 3. Poll api2.cursor.sh/auth/poll until tokens arrive
- * 4. Refresh via api2.cursor.sh/auth/exchange_user_api_key
- *
- * Based on https://github.com/ephraimduncan/opencode-cursor by Ephraim Duncan.
- */
-
-const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
-const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
-const CURSOR_REFRESH_URL = "https://api2.cursor.sh/auth/exchange_user_api_key";
-const POLL_MAX_ATTEMPTS = 150;
-const POLL_BASE_DELAY = 1000;
-const POLL_MAX_DELAY = 10_000;
-const POLL_BACKOFF_MULTIPLIER = 1.2;
-
-// ── PKCE ──
-
-async function generatePKCE(): Promise<{ verifier: string; challenge: string }> {
-  const verifierBytes = new Uint8Array(96);
-  crypto.getRandomValues(verifierBytes);
-  const verifier = Buffer.from(verifierBytes).toString("base64url");
-
-  const data = new TextEncoder().encode(verifier);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-  const challenge = Buffer.from(hashBuffer).toString("base64url");
-
-  return { verifier, challenge };
-}
-
-// ── Login params ──
-
-export interface CursorAuthParams {
-  verifier: string;
-  challenge: string;
-  uuid: string;
-  loginUrl: string;
-}
-
-export interface CursorAuthClientDependencies {
-  fetch?: typeof fetch;
-  generatePkce?: () => Promise<{ verifier: string; challenge: string; uuid?: string }>;
-  randomUUID?: () => string;
-  sleep?: (ms: number) => Promise<void>;
-}
-
-export interface CursorAuthLoginCallbacks {
-  onAuth(payload: { url: string }): void | Promise<void>;
-}
-
-export function createCursorAuthClient(deps: CursorAuthClientDependencies = {}) {
-  const fetchImpl = deps.fetch ?? fetch;
-  const sleepImpl =
-    deps.sleep ??
-    ((ms: number) =>
-      new Promise<void>((resolve) => {
-        setTimeout(resolve, ms);
-      }));
-  const generatePkceImpl: () => Promise<{ verifier: string; challenge: string; uuid?: string }> =
-    deps.generatePkce ?? generatePKCE;
-  const randomUUIDImpl = deps.randomUUID ?? (() => crypto.randomUUID());
-
-  async function generateParams(): Promise<CursorAuthParams> {
-    const { verifier, challenge, uuid: injectedUuid } = await generatePkceImpl();
-    const uuid = injectedUuid ?? randomUUIDImpl();
-
-    const params = new URLSearchParams({
-      challenge,
-      uuid,
-      mode: "login",
-      redirectTarget: "cli",
-    });
-
-    const loginUrl = `${CURSOR_LOGIN_URL}?${params.toString()}`;
-    return { verifier, challenge, uuid, loginUrl };
-  }
-
-  async function poll(
-    uuid: string,
-    verifier: string,
-  ): Promise<{ accessToken: string; refreshToken: string }> {
-    let delay = POLL_BASE_DELAY;
-    let consecutiveErrors = 0;
-
-    for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
-      await sleepImpl(delay);
-
-      try {
-        const response = await fetchImpl(`${CURSOR_POLL_URL}?uuid=${uuid}&verifier=${verifier}`);
-
-        if (response.status === 404) {
-          consecutiveErrors = 0;
-          delay = Math.min(delay * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY);
-          continue;
-        }
-
-        if (response.ok) {
-          const data = (await response.json()) as {
-            accessToken: string;
-            refreshToken: string;
-          };
-          return {
-            accessToken: data.accessToken,
-            refreshToken: data.refreshToken,
-          };
-        }
-
-        throw new Error(`Poll failed: ${response.status}`);
-      } catch {
-        consecutiveErrors++;
-        if (consecutiveErrors >= 3) {
-          throw new Error("Too many consecutive errors during Cursor auth polling");
-        }
-      }
-    }
-
-    throw new Error("Cursor authentication polling timeout");
-  }
-
-  async function refreshToken(refreshToken: string): Promise<CursorCredentials> {
-    const response = await fetchImpl(CURSOR_REFRESH_URL, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${refreshToken}`,
-        "Content-Type": "application/json",
-      },
-      body: "{}",
-    });
-
-    if (!response.ok) {
-      const error = await response.text();
-      throw new Error(`Cursor token refresh failed: ${error}`);
-    }
-
-    const data = (await response.json()) as {
-      accessToken: string;
-      refreshToken: string;
-    };
-
-    return {
-      access: data.accessToken,
-      refresh: data.refreshToken || refreshToken,
-      expires: getTokenExpiry(data.accessToken),
-    };
-  }
-
-  async function login(callbacks: CursorAuthLoginCallbacks): Promise<CursorCredentials> {
-    const { verifier, uuid, loginUrl } = await generateParams();
-    await callbacks.onAuth({ url: loginUrl });
-    const { accessToken, refreshToken } = await poll(uuid, verifier);
-    return {
-      access: accessToken,
-      refresh: refreshToken,
-      expires: getTokenExpiry(accessToken),
-    };
-  }
-
-  return {
-    generateParams,
-    login,
-    poll,
-    refreshToken,
-  };
-}
-
-export async function generateCursorAuthParams(): Promise<CursorAuthParams> {
-  return createCursorAuthClient().generateParams();
-}
-
-// ── Poll for auth completion ──
-
-export async function pollCursorAuth(
-  uuid: string,
-  verifier: string,
-): Promise<{ accessToken: string; refreshToken: string }> {
-  return createCursorAuthClient().poll(uuid, verifier);
-}
-
-// ── Token refresh ──
-
-export interface CursorCredentials {
-  access: string;
-  refresh: string;
-  expires: number;
-}
-
-export async function refreshCursorToken(refreshToken: string): Promise<CursorCredentials> {
-  return createCursorAuthClient().refreshToken(refreshToken);
-}
-
-// ── JWT expiry extraction ──
-
-export function getCursorAccessTokenFromEnv(): string | undefined {
-  const token = process.env.CURSOR_ACCESS_TOKEN?.trim();
-  return token || undefined;
-}
-
-export function getTokenExpiry(token: string): number {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3 || !parts[1]) {
-      return Date.now() + 3600 * 1000;
-    }
-    const decoded = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
-    if (decoded && typeof decoded === "object" && typeof decoded.exp === "number") {
-      return decoded.exp * 1000 - 5 * 60 * 1000;
-    }
-  } catch {}
-  return Date.now() + 3600 * 1000;
-}

package/src/client/bridge.ts

@@ -1,206 +0,0 @@
-import { spawn, type ChildProcess } from "node:child_process";
-import { resolve as pathResolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const CURSOR_API_URL = "https://api2.cursor.sh";
-const CONNECT_END_STREAM_FLAG = 0b00000010;
-const BRIDGE_PATH = pathResolve(dirname(fileURLToPath(import.meta.url)), "h2-bridge.mjs");
-
-export interface SpawnBridgeOptions {
-  accessToken: string;
-  rpcPath: string;
-  url?: string;
-  unary?: boolean;
-}
-
-export interface BridgeHandle {
-  proc: Pick<ChildProcess, "kill">;
-  readonly alive: boolean;
-  write(data: Uint8Array): void;
-  end(): void;
-  onData(cb: (chunk: Buffer) => void): void;
-  onClose(cb: (code: number) => void): void;
-}
-
-export type BridgeFactory = (options: SpawnBridgeOptions) => BridgeHandle;
-export type BridgeDebugLog = (event: string, data?: Record<string, unknown>) => void;
-
-function noopDebugLog(): void {}
-
-type BridgeChildProcess = Pick<ChildProcess, "kill"> & {
-  on(event: string | symbol, listener: (...args: any[]) => void): unknown;
-  stdin?: NodeJS.WritableStream | null;
-  stdout?: NodeJS.ReadableStream | null;
-};
-
-export function lpEncode(data: Uint8Array): Buffer {
-  const buf = Buffer.alloc(4 + data.length);
-  buf.writeUInt32BE(data.length, 0);
-  buf.set(data, 4);
-  return buf;
-}
-
-export function frameConnectMessage(data: Uint8Array, flags = 0): Buffer {
-  const frame = Buffer.alloc(5 + data.length);
-  frame[0] = flags;
-  frame.writeUInt32BE(data.length, 1);
-  frame.set(data, 5);
-  return frame;
-}
-
-export function spawnBridge(
-  options: SpawnBridgeOptions,
-  debugLog: BridgeDebugLog = noopDebugLog,
-): BridgeHandle {
-  debugLog("bridge.spawn", {
-    rpcPath: options.rpcPath,
-    url: options.url ?? CURSOR_API_URL,
-    unary: options.unary ?? false,
-    cursorClientVersion: process.env.PI_CURSOR_CLIENT_VERSION || "cli-2026.05.01-eea359f",
-  });
-  const proc = spawn(process.execPath, [BRIDGE_PATH], {
-    stdio: ["pipe", "pipe", "ignore"],
-  });
-
-  return createBridgeHandleForChild(proc, options, debugLog);
-}
-
-function createBridgeHandleForChild(
-  proc: BridgeChildProcess,
-  options: SpawnBridgeOptions,
-  debugLog: BridgeDebugLog = noopDebugLog,
-): BridgeHandle {
-  const stdin = proc.stdin;
-  const stdout = proc.stdout;
-
-  const cbs = {
-    data: null as ((chunk: Buffer) => void) | null,
-    close: null as ((code: number) => void) | null,
-  };
-
-  let exited = false;
-  let exitCode = 1;
-  let stdinClosed = !stdin;
-  const markStdinClosed = (err?: unknown): void => {
-    stdinClosed = true;
-    if (err) {
-      debugLog("bridge.stdin_error", {
-        code:
-          typeof err === "object" && err !== null && "code" in err
-            ? String((err as { code?: unknown }).code)
-            : undefined,
-        message: err instanceof Error ? err.message : String(err),
-      });
-    }
-  };
-  stdin?.on?.("error", markStdinClosed);
-  stdin?.on?.("close", () => markStdinClosed());
-  stdin?.on?.("finish", () => markStdinClosed());
-
-  const safeWrite = (data: Uint8Array): void => {
-    if (!stdin || stdinClosed) return;
-    try {
-      stdin.write(lpEncode(data));
-    } catch (err) {
-      markStdinClosed(err);
-    }
-  };
-
-  const safeEnd = (): void => {
-    if (!stdin || stdinClosed) return;
-    try {
-      stdin.end();
-      stdinClosed = true;
-    } catch (err) {
-      markStdinClosed(err);
-    }
-  };
-
-  const config = JSON.stringify({
-    accessToken: options.accessToken,
-    url: options.url ?? CURSOR_API_URL,
-    path: options.rpcPath,
-    unary: options.unary ?? false,
-  });
-  safeWrite(new TextEncoder().encode(config));
-
-  let pending = Buffer.alloc(0);
-  stdout?.on("data", (chunk: Buffer) => {
-    pending = Buffer.concat([pending, chunk]);
-    while (pending.length >= 4) {
-      const len = pending.readUInt32BE(0);
-      if (pending.length < 4 + len) break;
-      const payload = pending.subarray(4, 4 + len);
-      pending = pending.subarray(4 + len);
-      cbs.data?.(Buffer.from(payload));
-    }
-  });
-
-  proc.on("exit", (code) => {
-    exited = true;
-    exitCode = code ?? 1;
-    debugLog("bridge.exit", { rpcPath: options.rpcPath, exitCode });
-    cbs.close?.(exitCode);
-  });
-
-  return {
-    proc,
-    get alive() {
-      return !exited;
-    },
-    write(data: Uint8Array) {
-      safeWrite(data);
-    },
-    end() {
-      safeWrite(new Uint8Array(0));
-      safeEnd();
-    },
-    onData(cb: (chunk: Buffer) => void) {
-      cbs.data = cb;
-    },
-    onClose(cb: (code: number) => void) {
-      if (exited) {
-        queueMicrotask(() => cb(exitCode));
-      } else {
-        cbs.close = cb;
-      }
-    },
-  };
-}
-
-export const __testInternals = {
-  createBridgeHandleForChild,
-};
-
-export function createConnectFrameParser(
-  onMessage: (bytes: Uint8Array) => void,
-  onEndStream: (bytes: Uint8Array) => void,
-): (incoming: Buffer) => void {
-  let pending = Buffer.alloc(0);
-  return (incoming: Buffer) => {
-    pending = Buffer.concat([pending, incoming]);
-    while (pending.length >= 5) {
-      const flags = pending[0]!;
-      const msgLen = pending.readUInt32BE(1);
-      if (pending.length < 5 + msgLen) break;
-      const messageBytes = pending.subarray(5, 5 + msgLen);
-      pending = pending.subarray(5 + msgLen);
-      if (flags & CONNECT_END_STREAM_FLAG) onEndStream(messageBytes);
-      else onMessage(messageBytes);
-    }
-  };
-}
-
-export function parseConnectEndStream(data: Uint8Array): Error | null {
-  try {
-    const payload = JSON.parse(new TextDecoder().decode(data));
-    const error = payload?.error;
-    if (error)
-      return new Error(
-        `Connect error ${error.code ?? "unknown"}: ${error.message ?? "Unknown error"}`,
-      );
-    return null;
-  } catch {
-    return new Error("Failed to parse Connect end stream");
-  }
-}