@vidit19sharma/opencode-cursor-auth 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vidit Sharma
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# opencode-cursor-auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Use your **Cursor subscription** inside [opencode](https://opencode.ai) — no proxy server, no port, no separate API bill.
+
+The plugin bridges opencode's OpenAI-style chat requests to the official [`@cursor/sdk`](https://www.npmjs.com/package/@cursor/sdk) **in-process**, so every model your Cursor plan includes (GPT, Claude, Gemini, Kimi, GLM, Composer, …) shows up as a `cursor/*` model in opencode.
+
+## Features
+
+- **Official SDK, not a reverse-engineered API** — auth, checksums, and client versioning handled by `@cursor/sdk`
+- **In-process bridge** — no local HTTP proxy, no port to collide on, no extra daemon
+- **Full tool loop** — opencode's native tools (read, edit, bash, MCP, …) work end-to-end via a held-run bridge: one Cursor run spans the whole tool exchange
+- **Thinking blocks** — Cursor reasoning streams into opencode as proper thinking blocks (`reasoning_content`)
+- **Session resume** — conversations map to native Cursor agents (`Agent.resume`), in-memory and persisted to disk for 7 days, so multi-turn chats don't replay history
+- **System prompts** — delivered via `AGENTS.md` in a per-session workspace (the `--system-prompt` flag is server-gated by Cursor)
+- **Dynamic model list** — fetched live from `Cursor.models.list()`, cached 24h
+- **Zero cost display** — models are marked cost-free since you're on subscription billing
+
+## Requirements
+
+- Node >= 22.13 (opencode runs plugins on Bun, which also works)
+- [`cursor-agent` CLI](https://cursor.com/docs/cli) installed (`curl https://cursor.com/install -fsS | bash`) — the SDK's local executor uses it
+- A Cursor subscription
+
+## Install
+
+Add the plugin to `~/.config/opencode/opencode.json`:
+
+```json
+{
+  "plugin": ["@vidit19sharma/opencode-cursor-auth@latest"]
+}
+```
+
+The plugin auto-registers a `cursor` provider — no manual provider config needed.
+
+## Authenticate
+
+```sh
+opencode auth login
+```
+
+Pick **Cursor**, then either:
+
+- **Log in with Cursor (browser)** — opens cursor.com, mints a 90-day SDK key, stored at `~/.cursor/sdk/auth.json`
+- **Paste a Cursor API key** — from [cursor.com/dashboard](https://cursor.com/dashboard)
+
+Alternatively set `CURSOR_API_KEY` in your environment.
+
+## Use
+
+```sh
+opencode run -m cursor/gpt-5.5 "hello"
+opencode run -m cursor/claude-opus-5-5 "hello"
+opencode run -m cursor/auto "hello"
+```
+
+Or pick any `cursor/*` model from the opencode model selector.
+
+## How it works
+
+```
+opencode ──(OpenAI chat JSON)──> plugin fetch() ──> @cursor/sdk Agent ──> cursor-agent ──> Cursor backend
+         <─(SSE stream)────────  bridge  <──(typed deltas: text / thinking / tool calls)
+```
+
+- opencode calls the provider's `fetch` — the plugin intercepts it in-process; `http://cursor.local/v1` is a dummy URL that never resolves.
+- Each opencode tool is registered as a Cursor **custom tool** whose `execute()` parks a promise, emits an OpenAI `tool_calls` chunk, and resumes the *same* Cursor run when opencode sends the tool result back.
+- Conversation prefixes are hashed → mapped to Cursor agent IDs, so follow-up turns use `Agent.resume` instead of replaying history. The map persists at `~/.cache/opencode-cursor-auth/sessions.json`.
+- System messages are written to `AGENTS.md` in a per-session temp workspace and loaded via Cursor's project rules (`settingSources: ["project"]`).
+
+## Development
+
+```sh
+bun install
+bun run build        # tsc → dist/
+bun run test         # end-to-end bridge tests (requires Cursor login)
+bun run spike        # raw @cursor/sdk validation
+```
+
+The test suite exercises: plain streaming, a full tool loop on one held run, in-memory session resume, AGENTS.md system-prompt delivery, and disk-persisted resume.
+
+## Known limitations
+
+- `systemPrompt` as a true harness replacement is feature-gated server-side by Cursor; system text is applied as a project rule (merged under Cursor's harness prompt).
+- The SDK spawns a `cursor-agent` worker per turn (~1–2 s startup on resume).
+- Usage/rate limits are whatever your Cursor plan enforces — the plugin adds none.
+
+## License
+
+[MIT](./LICENSE) © Vidit Sharma

package/dist/bridge.d.ts

@@ -0,0 +1,33 @@
+type ContentPart = {
+    type: string;
+    text?: string;
+};
+type OaMessage = {
+    role: "system" | "user" | "assistant" | "tool";
+    content: string | ContentPart[] | null;
+    tool_calls?: {
+        id: string;
+        function: {
+            name: string;
+            arguments: string;
+        };
+    }[];
+    tool_call_id?: string;
+};
+type OaTool = {
+    type: "function";
+    function: {
+        name: string;
+        description?: string;
+        parameters?: Record<string, unknown>;
+    };
+};
+type OaBody = {
+    model: string;
+    messages: OaMessage[];
+    tools?: OaTool[];
+    stream?: boolean;
+};
+export declare function _resetForTest(): void;
+export declare function handleChatCompletion(body: OaBody, apiKey?: string): Promise<Response>;
+export {};

package/dist/bridge.js

@@ -0,0 +1,458 @@
+/**
+ * OpenAI chat-completions JSON <-> @cursor/sdk bridge, fully in-process.
+ *
+ * Tool loop ("held run" pattern, from pwnapplehat/Cursor-OpenAI):
+ * each opencode tool is registered as a Cursor customTool whose execute()
+ * PARKS on a promise. When the model requests tools we flush them to the
+ * client as OpenAI tool_calls and keep the Cursor run alive. The client's
+ * next HTTP request (role:"tool" messages) resolves the parked promises and
+ * the SAME run continues — one metered Cursor run per opencode tool loop.
+ */
+import { Agent } from "@cursor/sdk";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+// @cursor/sdk's internal logger writes "HH:MM:SS.mmm INFO ..." lines via
+// console.log unconditionally (no config/env to silence it, verified against
+// the esm bundle). Filter exactly those lines, pass everything else through.
+const SDK_LOG_LINE = /^\d{2}:\d{2}:\d{2}\.\d{3} (TRACE|DEBUG|INFO|WARN|ERROR)\s/;
+const originalConsoleLog = console.log.bind(console);
+console.log = (...args) => {
+    if (typeof args[0] === "string" && SDK_LOG_LINE.test(args[0]))
+        return;
+    originalConsoleLog(...args);
+};
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (!content)
+        return "";
+    return content.map((p) => p.text ?? "").join("");
+}
+function chunk(id, model, delta, finish, usage) {
+    return {
+        id,
+        object: "chat.completion.chunk",
+        created: Math.floor(Date.now() / 1000),
+        model,
+        choices: [{ index: 0, delta, finish_reason: finish }],
+        ...(usage ? { usage } : {}),
+    };
+}
+function sseResponse(model) {
+    const id = `chatcmpl-${randomUUID()}`;
+    const enc = new TextEncoder();
+    let controller;
+    let closed = false;
+    const stream = new ReadableStream({
+        start(c) {
+            controller = c;
+            send({ role: "assistant", content: "" });
+        },
+        cancel() {
+            closed = true;
+        },
+    });
+    function send(delta, finish = null, usage) {
+        if (closed)
+            return;
+        controller.enqueue(enc.encode(`data: ${JSON.stringify(chunk(id, model, delta, finish, usage))}\n\n`));
+    }
+    function end() {
+        if (closed)
+            return;
+        controller.enqueue(enc.encode("data: [DONE]\n\n"));
+        controller.close();
+        closed = true;
+    }
+    const sink = {
+        text: (t) => send({ content: t }),
+        reasoning: (t) => send({ reasoning_content: t }),
+        toolCalls: (calls) => send({
+            tool_calls: calls.map((c, index) => ({
+                index,
+                id: c.id,
+                type: "function",
+                function: { name: c.name, arguments: c.argumentsJson },
+            })),
+        }),
+        finish: (reason, usage) => {
+            send({}, reason, usage);
+            end();
+        },
+        fail: (err) => {
+            send({ content: `\n\n[cursor error] ${err instanceof Error ? err.message : String(err)}` });
+            send({}, "stop");
+            end();
+        },
+    };
+    return {
+        response: new Response(stream, {
+            status: 200,
+            headers: { "content-type": "text/event-stream", "cache-control": "no-cache" },
+        }),
+        sink,
+    };
+}
+function jsonCollector(model) {
+    const id = `chatcmpl-${randomUUID()}`;
+    let content = "";
+    let calls = [];
+    let resolve;
+    const promise = new Promise((r) => (resolve = r));
+    const sink = {
+        text: (t) => (content += t),
+        reasoning: () => { },
+        toolCalls: (c) => (calls = calls.concat(c)),
+        finish: (reason, usage) => resolve(Response.json({
+            id,
+            object: "chat.completion",
+            created: Math.floor(Date.now() / 1000),
+            model,
+            choices: [
+                {
+                    index: 0,
+                    message: {
+                        role: "assistant",
+                        content: content || null,
+                        ...(calls.length
+                            ? {
+                                tool_calls: calls.map((c2) => ({
+                                    id: c2.id,
+                                    type: "function",
+                                    function: { name: c2.name, arguments: c2.argumentsJson },
+                                })),
+                            }
+                            : {}),
+                    },
+                    finish_reason: reason,
+                },
+            ],
+            usage: usage ?? { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 },
+        })),
+        fail: (err) => resolve(Response.json({ error: { message: err instanceof Error ? err.message : String(err), type: "cursor_error" } }, { status: 500 })),
+    };
+    return { promise, sink };
+}
+const BATCH_SETTLE_MS = 300;
+const TOOL_RESULT_TIMEOUT_MS = 10 * 60 * 1000;
+const SESSION_TTL_MS = 30 * 60 * 1000;
+const DISK_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// ponytail: single-user plugin, small fixed caps; make configurable if ever shared
+const MAX_SESSIONS = 8;
+const SESSION_STORE_DIR = join(homedir(), ".cache", "opencode-cursor-auth");
+const SESSION_STORE_PATH = join(SESSION_STORE_DIR, "sessions.json");
+const sessions = new Map();
+const heldByAgent = new Map();
+const agentByToolCallId = new Map();
+let diskSessions = new Map();
+let sessionsLoaded = false;
+function hashMessages(messages) {
+    const norm = messages.map((m) => [m.role, textOf(m.content), m.tool_call_id ?? "", JSON.stringify(m.tool_calls ?? null)]);
+    return createHash("sha256").update(JSON.stringify(norm)).digest("hex");
+}
+function collectDiskEntries() {
+    const now = Date.now();
+    const entries = {};
+    for (const [k, v] of diskSessions)
+        if (now - v.lastUsedAt <= DISK_SESSION_TTL_MS)
+            entries[k] = v;
+    return entries;
+}
+async function loadSessions() {
+    if (sessionsLoaded)
+        return;
+    sessionsLoaded = true;
+    try {
+        const raw = JSON.parse(await readFile(SESSION_STORE_PATH, "utf8"));
+        if (raw.version !== 1 || !raw.entries)
+            return;
+        const now = Date.now();
+        for (const [k, v] of Object.entries(raw.entries)) {
+            // disk entries stay out of the 30-min memory map so the memory sweep
+            // can't evict a still-valid 7-day entry; lookup falls back to diskSessions
+            if (now - v.lastUsedAt <= DISK_SESSION_TTL_MS)
+                diskSessions.set(k, v);
+        }
+    }
+    catch { }
+}
+function saveSessions() {
+    mkdirSync(SESSION_STORE_DIR, { recursive: true });
+    writeFileSync(SESSION_STORE_PATH, JSON.stringify({ version: 1, entries: collectDiskEntries() }));
+}
+function sweepSessions(save = true) {
+    const now = Date.now();
+    for (const [k, v] of sessions)
+        if (now - v.lastUsedAt > SESSION_TTL_MS)
+            sessions.delete(k);
+    while (sessions.size > MAX_SESSIONS) {
+        let oldestKey = "";
+        let oldest = Infinity;
+        for (const [k, v] of sessions)
+            if (v.lastUsedAt < oldest) {
+                oldest = v.lastUsedAt;
+                oldestKey = k;
+            }
+        sessions.delete(oldestKey);
+    }
+    if (save)
+        saveSessions();
+}
+/**
+ * Re-key the session under the conversation state the NEXT request will
+ * present (current messages + the assistant message we just produced), since
+ * session-unaware clients like opencode resend full history every turn.
+ */
+function rememberSession(held, toolCalls) {
+    const assistant = {
+        role: "assistant",
+        content: held.textAcc || null,
+        ...(toolCalls.length
+            ? { tool_calls: toolCalls.map((c) => ({ id: c.id, function: { name: c.name, arguments: c.argumentsJson } })) }
+            : {}),
+    };
+    const key = hashMessages(held.messages.concat(assistant));
+    const entry = {
+        agentId: held.agent.agentId,
+        cwd: held.cwd,
+        lastUsedAt: Date.now(),
+    };
+    sessions.set(key, entry);
+    diskSessions.set(key, entry);
+    sweepSessions();
+}
+async function syncAgentsMd(cwd, messages) {
+    mkdirSync(cwd, { recursive: true });
+    const path = join(cwd, "AGENTS.md");
+    const systemText = messages
+        .filter((m) => m.role === "system")
+        .map((m) => textOf(m.content))
+        .filter(Boolean)
+        .join("\n\n");
+    if (systemText)
+        await writeFile(path, systemText);
+    else if (existsSync(path))
+        rmSync(path);
+}
+function mapUsage(u) {
+    if (!u)
+        return undefined;
+    const prompt = u.inputTokens ?? 0;
+    const completion = u.outputTokens ?? 0;
+    return { prompt_tokens: prompt, completion_tokens: completion, total_tokens: prompt + completion };
+}
+// deltas arriving between tool flush and the continuation request get buffered
+function emit(held, kind, t) {
+    if (held.sink)
+        (kind === "text" ? held.sink.text : held.sink.reasoning)(t);
+    else
+        held.buffer.push({ kind, t });
+}
+function attachSink(held, sink) {
+    held.sink = sink;
+    for (const b of held.buffer)
+        (b.kind === "text" ? sink.text : sink.reasoning)(b.t);
+    held.buffer = [];
+}
+function teardownHeld(agentId, held) {
+    held.done = true;
+    if (held.flushTimer)
+        clearTimeout(held.flushTimer);
+    if (held.idleTimer)
+        clearTimeout(held.idleTimer);
+    for (const id of held.parked.keys())
+        agentByToolCallId.delete(id);
+    heldByAgent.delete(agentId);
+}
+/** Model requested tools: emit tool_calls, end this HTTP segment, park the run. */
+function flushToolCalls(agentId, held) {
+    held.flushTimer = null;
+    if (held.done || !held.pendingCalls.length)
+        return;
+    const calls = held.pendingCalls;
+    held.pendingCalls = [];
+    for (const c of calls)
+        agentByToolCallId.set(c.id, agentId);
+    const sink = held.sink;
+    held.sink = null;
+    sink?.toolCalls(calls);
+    sink?.finish("tool_calls");
+    rememberSession(held, calls);
+    held.idleTimer = setTimeout(() => {
+        teardownHeld(agentId, held);
+        held.run.cancel().catch(() => { });
+        try {
+            held.agent.close();
+        }
+        catch { }
+    }, TOOL_RESULT_TIMEOUT_MS);
+    held.idleTimer.unref?.();
+}
+async function wireRunCompletion(agentId, held) {
+    if (held.wired)
+        return;
+    held.wired = true;
+    try {
+        const result = await held.run.wait();
+        if (held.done)
+            return;
+        const usage = mapUsage(result.usage) ?? held.usage;
+        teardownHeld(agentId, held);
+        rememberSession(held, []);
+        held.sink?.finish("stop", usage);
+        try {
+            held.agent.close();
+        }
+        catch { }
+    }
+    catch (err) {
+        if (held.done)
+            return;
+        teardownHeld(agentId, held);
+        held.sink?.fail(err);
+        try {
+            held.agent.close();
+        }
+        catch { }
+    }
+}
+export function _resetForTest() {
+    sessions.clear();
+    diskSessions.clear();
+    heldByAgent.clear();
+    agentByToolCallId.clear();
+    sessionsLoaded = false;
+}
+export async function handleChatCompletion(body, apiKey) {
+    await loadSessions();
+    const streaming = body.stream !== false;
+    const sse = streaming ? sseResponse(body.model) : undefined;
+    const collected = streaming ? undefined : jsonCollector(body.model);
+    const sink = (sse?.sink ?? collected?.sink);
+    const reply = () => sse?.response ?? collected.promise;
+    // continuation: trailing tool results for a parked run
+    const lastMsg = body.messages[body.messages.length - 1];
+    if (lastMsg?.role === "tool" && lastMsg.tool_call_id && agentByToolCallId.has(lastMsg.tool_call_id)) {
+        const agentId = agentByToolCallId.get(lastMsg.tool_call_id);
+        const held = heldByAgent.get(agentId);
+        if (held && !held.done) {
+            if (held.idleTimer)
+                clearTimeout(held.idleTimer);
+            held.messages = body.messages;
+            held.textAcc = "";
+            attachSink(held, sink);
+            for (const m of body.messages) {
+                if (m.role !== "tool" || !m.tool_call_id)
+                    continue;
+                const resolve = held.parked.get(m.tool_call_id);
+                if (resolve) {
+                    held.parked.delete(m.tool_call_id);
+                    agentByToolCallId.delete(m.tool_call_id);
+                    resolve(textOf(m.content));
+                }
+            }
+            return reply();
+        }
+        sink.fail(new Error("cursor run for this tool call expired — please retry"));
+        return reply();
+    }
+    // new turn: reuse the agent whose last-seen conversation matches our prefix
+    const prefix = body.messages.slice(0, -1);
+    const key = hashMessages(prefix);
+    const entry = sessions.get(key) ?? diskSessions.get(key);
+    let agent;
+    let cwd;
+    let newSuffix = body.messages;
+    if (entry) {
+        sessions.delete(key);
+        cwd = entry.cwd;
+        agent = await Agent.resume(entry.agentId, {
+            model: { id: body.model },
+            tools: ["mcp"],
+            ...(apiKey ? { apiKey } : {}),
+            local: { cwd, settingSources: ["project"], enableAgentRetries: true },
+        }).catch(() => {
+            sessions.delete(key);
+            diskSessions.delete(key);
+            saveSessions();
+            return undefined;
+        });
+        if (agent)
+            newSuffix = body.messages.slice(-1);
+    }
+    if (!agent) {
+        cwd = await mkdtemp(join(tmpdir(), "opencode-cursor-"));
+        agent = await Agent.create({
+            model: { id: body.model },
+            tools: ["mcp"],
+            ...(apiKey ? { apiKey } : {}),
+            local: { cwd, settingSources: ["project"], enableAgentRetries: true },
+        });
+    }
+    const held = {
+        agent,
+        cwd: cwd,
+        run: undefined,
+        messages: body.messages,
+        textAcc: "",
+        sink: null,
+        buffer: [],
+        pendingCalls: [],
+        parked: new Map(),
+        flushTimer: null,
+        idleTimer: null,
+        wired: false,
+        done: false,
+    };
+    attachSink(held, sink);
+    const agentIdRef = { id: "" };
+    const customTools = {};
+    for (const t of body.tools ?? []) {
+        customTools[t.function.name] = {
+            description: t.function.description ?? "",
+            inputSchema: t.function.parameters ?? { type: "object", properties: {} },
+            execute: (args, ctx) => {
+                const id = (ctx.toolCallId ?? `call_${randomUUID()}`).replace(/\s+/g, "_");
+                held.pendingCalls.push({ id, name: t.function.name, argumentsJson: JSON.stringify(args ?? {}) });
+                if (held.flushTimer)
+                    clearTimeout(held.flushTimer);
+                held.flushTimer = setTimeout(() => flushToolCalls(agentIdRef.id, held), BATCH_SETTLE_MS);
+                return new Promise((resolve) => held.parked.set(id, resolve));
+            },
+        };
+    }
+    await syncAgentsMd(cwd, body.messages);
+    const prompt = newSuffix
+        .filter((m) => m.role !== "system")
+        .map((m) => (m.role === "user" ? textOf(m.content) : `${m.role.toUpperCase()}: ${textOf(m.content)}`))
+        .filter(Boolean)
+        .join("\n\n") || "(empty message)";
+    try {
+        held.run = await held.agent.send(prompt, {
+            onDelta: ({ update }) => {
+                if (update.type === "text-delta" && update.text) {
+                    held.textAcc += update.text;
+                    emit(held, "text", update.text);
+                }
+                else if (update.type === "thinking-delta" && update.text) {
+                    emit(held, "reasoning", update.text);
+                }
+                else if (update.type === "turn-ended") {
+                    held.usage = mapUsage(update.usage);
+                }
+            },
+            local: { customTools: customTools },
+        });
+    }
+    catch (err) {
+        sink.fail(err);
+        return reply();
+    }
+    agentIdRef.id = held.run.agentId;
+    heldByAgent.set(held.run.agentId, held);
+    void wireRunCompletion(held.run.agentId, held);
+    return reply();
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "@opencode-ai/plugin";
+export declare const CursorAuthPlugin: Plugin;
+export default CursorAuthPlugin;

package/dist/index.js

@@ -0,0 +1,128 @@
+import { Cursor } from "@cursor/sdk";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { handleChatCompletion } from "./bridge.js";
+const BASE_URL = "http://cursor.local/v1";
+const CACHE_DIR = join(homedir(), ".cache", "opencode-cursor-auth");
+const MODELS_CACHE_PATH = join(CACHE_DIR, "models.json");
+const MODELS_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+function loadCachedModels() {
+    try {
+        const raw = JSON.parse(readFileSync(MODELS_CACHE_PATH, "utf8"));
+        if (raw?.version === 1 && raw.models && Object.keys(raw.models).length > 0)
+            return raw;
+    }
+    catch {
+        // no cache yet, or unreadable — fall back
+    }
+    return undefined;
+}
+// Live model list from Cursor, cached 24h to keep opencode startup fast.
+// Offline/logged-out: stale cache if present, else just "auto" (Cursor's universal alias).
+async function currentModels() {
+    const cached = loadCachedModels();
+    if (cached && Date.now() - cached.fetchedAt <= MODELS_CACHE_TTL_MS)
+        return cached.models;
+    try {
+        const list = await Cursor.models.list();
+        const models = {};
+        for (const m of list)
+            models[m.id === "default" ? "auto" : m.id] = m.displayName ?? m.id;
+        mkdirSync(CACHE_DIR, { recursive: true });
+        writeFileSync(MODELS_CACHE_PATH, JSON.stringify({ version: 1, fetchedAt: Date.now(), models }));
+        return models;
+    }
+    catch {
+        return cached?.models ?? { auto: "Auto" };
+    }
+}
+async function bodyText(input, init) {
+    const b = init?.body;
+    if (typeof b === "string")
+        return b;
+    if (b instanceof Uint8Array)
+        return new TextDecoder().decode(b);
+    if (input instanceof Request)
+        return input.text();
+    return "";
+}
+let pastedApiKey;
+async function cursorFetch(input, init) {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    if (url.includes("/chat/completions")) {
+        const body = JSON.parse(await bodyText(input, init));
+        return handleChatCompletion(body, pastedApiKey);
+    }
+    if (url.includes("/models")) {
+        return Response.json({
+            object: "list",
+            data: Object.keys(await currentModels()).map((id) => ({ id, object: "model" })),
+        });
+    }
+    return Response.json({ error: { message: `unsupported endpoint: ${url}` } }, { status: 404 });
+}
+export const CursorAuthPlugin = async () => {
+    return {
+        config: async (config) => {
+            const providers = (config.provider ??= {});
+            const cursor = (providers["cursor"] ??= { models: {} });
+            cursor.npm ??= "@ai-sdk/openai-compatible";
+            cursor.name ??= "Cursor";
+            cursor.options = { ...cursor.options, baseURL: BASE_URL };
+            cursor.models ??= {};
+            for (const [id, displayName] of Object.entries(await currentModels())) {
+                cursor.models[id] ??= { name: displayName };
+                const model = cursor.models[id];
+                model.cost = { input: 0, output: 0, cache_read: 0, cache_write: 0 };
+            }
+        },
+        auth: {
+            provider: "cursor",
+            loader: async (getAuth) => {
+                const auth = await getAuth().catch(() => undefined);
+                if (auth && auth.type === "api" && auth.key !== "cursor-sdk-store")
+                    pastedApiKey = auth.key;
+                return {
+                    apiKey: "cursor-managed",
+                    baseURL: BASE_URL,
+                    fetch: cursorFetch,
+                };
+            },
+            methods: [
+                {
+                    type: "oauth",
+                    label: "Log in with Cursor (browser)",
+                    authorize: async () => {
+                        let resolveUrl;
+                        const urlReady = new Promise((r) => (resolveUrl = r));
+                        const login = Cursor.auth
+                            .login({
+                            apiKeyName: "opencode-cursor-auth",
+                            openBrowser: false,
+                            onLoginUrl: (url) => resolveUrl(url),
+                        })
+                            .catch((err) => err);
+                        const url = await Promise.race([urlReady, login.then(() => "")]);
+                        return {
+                            url: typeof url === "string" && url ? url : "https://cursor.com/dashboard",
+                            instructions: "Complete the login in your browser. The key is stored in ~/.cursor/sdk/auth.json.",
+                            method: "auto",
+                            callback: async () => {
+                                const result = await login;
+                                if (result instanceof Error)
+                                    return { type: "failed" };
+                                return { type: "success", key: "cursor-sdk-store" };
+                            },
+                        };
+                    },
+                },
+                {
+                    type: "api",
+                    label: "Paste a Cursor API key (cursor.com/dashboard)",
+                },
+            ],
+        },
+    };
+};
+export default CursorAuthPlugin;

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@vidit19sharma/opencode-cursor-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "OpenCode plugin that uses your Cursor subscription via the official @cursor/sdk \u2014 no proxy server, no separate login.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "author": "Vidit Sharma <vidit19sharma@gmail.com> (https://github.com/vidit19sharma)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vidit19sharma/opencode-cursor-auth.git"
+  },
+  "bugs": {
+    "url": "https://github.com/vidit19sharma/opencode-cursor-auth/issues"
+  },
+  "homepage": "https://github.com/vidit19sharma/opencode-cursor-auth#readme",
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "cursor",
+    "cursor-sdk",
+    "ai",
+    "llm",
+    "auth"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "bun spike/e2e-bridge.ts",
+    "spike": "bun spike/validate-sdk.ts",
+    "prepublishOnly": "tsc"
+  },
+  "dependencies": {
+    "@cursor/sdk": "^1.0.36"
+  },
+  "peerDependencies": {
+    "@opencode-ai/plugin": "*"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "latest",
+    "@types/node": "^26.6.5",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "license": "MIT"
+}