@vidit19sharma/opencode-cursor-auth 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 0.3.3 — 2026-10-16
+
+### Added
+
+- `npx @vidit19sharma/opencode-cursor-auth update` — removes opencode's cached copy of the plugin so the next opencode start installs the current release. opencode resolves `@latest` once at first install and never re-checks, so users were silently stuck on the version they first installed (`--dry-run` supported).
+- Mocked plugin unit tests (`bun run test:plugin`) covering key handling, expiry, headless login URL passthrough and auth-entry seeding.
+
+### Fixed
+
+- Pressing Esc before the first byte (during agent setup) returned HTTP 502 "aborted"; it now propagates as a proper abort.
+- `@cursor/sdk` INFO/WARN log lines leaked into the opencode TUI: the lines are ANSI-coloured when stdout is a TTY, so the filter never matched there. Colours are stripped before matching and the filter is re-asserted per request.
+- An empty or whitespace API key stored via the paste method silently fell back to the SDK key store; it now returns 401 `invalid_api_key`.
+- A failure after content has already streamed emits a single SSE `error` frame and closes without `[DONE]` (covered by a test).
+
 ## 0.3.2 — 2026-10-16
 
 ### Added

package/README.md

@@ -85,6 +85,18 @@ opencode run -m cursor/auto "hello"
 
 Or pick any `cursor/*` model from the opencode model selector.
 
+## Upgrading
+
+```sh
+npx @vidit19sharma/opencode-cursor-auth update
+```
+
+Then restart opencode. opencode pins `@latest` to the version it first installed and never re-checks npm, so this deletes that cached copy and opencode installs the current release on next start. Tell-tale sign you need it: Ctrl+T shows no variants, or features from the changelog are missing. Manual equivalent:
+
+```sh
+rm -rf ~/.cache/opencode/packages/@vidit19sharma/opencode-cursor-auth@latest
+```
+
 ## Models
 
 ```sh

package/dist/bridge.d.ts

@@ -1,3 +1,4 @@
+export declare function ensureQuietConsole(): void;
 type ContentPart = {
     type: string;
     text?: string;
@@ -34,6 +35,7 @@ export declare function withRetry<T>(fn: () => Promise<T>, signal?: AbortSignal,
 export declare function _setMaxActive(n: number): void;
 export declare function errorResponse(err: unknown, status?: number): Response;
 export declare function _resetForTest(): void;
+export declare function _failAfterFirstDelta(message: string | null): void;
 export declare function _stats(): {
     held: number;
     sessions: number;

package/dist/bridge.js

@@ -15,16 +15,28 @@ import { mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { markBlocked, resolveVariant } from "./models.js";
-// @cursor/sdk's internal logger writes "HH:MM:SS.mmm INFO ..." lines via
-// console.log unconditionally (no config/env to silence it, verified against
-// the esm bundle). Filter exactly those lines, pass everything else through.
-const SDK_LOG_LINE = /^\d{2}:\d{2}:\d{2}\.\d{3} (TRACE|DEBUG|INFO|WARN|ERROR)\s/;
-const originalConsoleLog = console.log.bind(console);
-console.log = (...args) => {
-    if (typeof args[0] === "string" && SDK_LOG_LINE.test(args[0]))
-        return;
-    originalConsoleLog(...args);
-};
+// @cursor/sdk has no log-level switch: it prints "HH:MM:SS.mmm INFO ..." through
+// whatever console.* is installed at call time, ANSI-coloured when stdout is a
+// TTY (the opencode TUI). Match after stripping colours; re-wrap per request so
+// a host that replaces console.* after plugin load cannot bypass the filter.
+const SDK_LOG_LINE = /^\d{2}:\d{2}:\d{2}\.\d{3} (TRACE|DEBUG|INFO|WARN)\s/;
+const ANSI = /\x1b\[[0-9;]*m/g;
+const QUIET = Symbol.for("opencode-cursor-auth.quiet");
+export function ensureQuietConsole() {
+    for (const m of ["log", "info", "warn", "debug"]) {
+        const current = console[m];
+        if (current[QUIET])
+            continue;
+        const wrapped = (...args) => {
+            if (typeof args[0] === "string" && SDK_LOG_LINE.test(args[0].replace(ANSI, "")))
+                return;
+            current(...args);
+        };
+        wrapped[QUIET] = true;
+        console[m] = wrapped;
+    }
+}
+ensureQuietConsole();
 function textOf(content) {
     if (typeof content === "string")
         return content;
@@ -63,6 +75,7 @@ function errorBody(err, status = statusFor(err)) {
     };
 }
 const abortError = () => new DOMException("aborted", "AbortError");
+const isAbort = (err) => err?.name === "AbortError";
 export function isTransient(err) {
     const e = (typeof err === "object" && err !== null ? err : {});
     if (e.name === "AbortError")
@@ -84,7 +97,9 @@ export async function withRetry(fn, signal, baseDelayMs = 1000, retryable = isTr
             return await fn();
         }
         catch (err) {
-            if (attempt >= 2 || signal?.aborted || !retryable(err))
+            if (signal?.aborted || isAbort(err))
+                throw abortError();
+            if (attempt >= 2 || !retryable(err))
                 throw err;
             const delay = Math.min(baseDelayMs * 2 ** attempt * (0.75 + Math.random() * 0.5), 30_000);
             await new Promise((r) => {
@@ -438,6 +453,9 @@ function attachSignal(held, signal) {
     held.detachSignal = null;
     if (!signal)
         return;
+    // listeners never fire on an already-aborted signal (abort during Agent.create/resume)
+    if (signal.aborted)
+        return abortHeld(held);
     const onAbort = () => abortHeld(held);
     signal.addEventListener("abort", onAbort, { once: true });
     held.detachSignal = () => signal.removeEventListener("abort", onAbort);
@@ -465,7 +483,10 @@ function teardownHeld(held) {
     heldByAgent.delete(held.agent.agentId);
 }
 function failHeld(held, err) {
+    if (isAbort(err))
+        return abortHeld(held);
     teardownHeld(held);
+    held.run?.cancel().catch(() => { });
     if (statusFor(err) === 403)
         markBlocked(held.model);
     if (held.response && !held.opened) {
@@ -544,6 +565,10 @@ export function _resetForTest() {
     agentByToolCallId.clear();
     sessionsLoaded = false;
 }
+let failAfterFirstDelta = null;
+export function _failAfterFirstDelta(message) {
+    failAfterFirstDelta = message;
+}
 export function _stats() {
     return {
         held: heldByAgent.size,
@@ -557,6 +582,7 @@ export function _stats() {
 export async function handleChatCompletion(body, apiKey, signal, scope) {
     if (signal?.aborted)
         throw new DOMException("aborted", "AbortError");
+    ensureQuietConsole();
     await loadSessions();
     const streaming = body.stream !== false;
     const reply = deferred();
@@ -579,6 +605,8 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
         held.response = sse?.response ?? null;
         held.opened = false;
         attachSignal(held, signal);
+        if (held.done)
+            return reply.promise;
         attachSink(held, sink);
         for (const m of body.messages) {
             if (m.role !== "tool" || !m.tool_call_id)
@@ -630,7 +658,7 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
         catch (err) {
             releaseSlot();
             releaseCwd(cwd);
-            if (signal?.aborted)
+            if (signal?.aborted || isAbort(err))
                 throw abortError();
             return errorResponse(err);
         }
@@ -660,6 +688,8 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
     const self = held;
     heldByAgent.set(agent.agentId, held);
     attachSignal(held, signal);
+    if (held.done)
+        return reply.promise;
     attachSink(held, sink);
     const customTools = {};
     for (const t of body.tools ?? []) {
@@ -676,7 +706,12 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
             },
         };
     }
-    await syncAgentsMd(cwd, body.messages);
+    await syncAgentsMd(cwd, body.messages).catch((err) => {
+        if (!self.done)
+            throw err;
+    });
+    if (self.done)
+        return reply.promise;
     const prompt = newSuffix
         .filter((m) => m.role !== "system")
         .map((m) => (m.role === "user" ? textOf(m.content) : `${m.role.toUpperCase()}: ${textOf(m.content)}`))
@@ -692,6 +727,11 @@ export async function handleChatCompletion(body, apiKey, signal, scope) {
                     openReply(self);
                     self.textAcc += update.text;
                     emit(self, "text", update.text);
+                    if (failAfterFirstDelta !== null) {
+                        const message = failAfterFirstDelta;
+                        failAfterFirstDelta = null;
+                        failHeld(self, new Error(message));
+                    }
                 }
                 else if (update.type === "thinking-delta" && update.text) {
                     openReply(self);

package/dist/cli.js

@@ -1,16 +1,21 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import process from "node:process";
 const PKG = "@vidit19sharma/opencode-cursor-auth";
 const ENTRY = `${PKG}@latest`;
 const HELP = `Usage: npx ${PKG} [setup] [--dry-run] [--config <path>]
+       npx ${PKG} update [--dry-run]
 
-Adds "${ENTRY}" to the "plugin" array of your opencode config.
+setup (default): adds "${ENTRY}" to the "plugin" array of your opencode config.
 Idempotent: does nothing if any ${PKG} entry is already present.
 
-  --dry-run        print what would change, write nothing
+update: deletes opencode's cached copy of ${PKG} (opencode never re-resolves
+"@latest" once installed), so the next opencode start installs the latest version.
+Cache: $XDG_CACHE_HOME/opencode or ~/.cache/opencode.
+
+  --dry-run        print what would change, write/delete nothing
   --config <path>  edit this file instead of the auto-detected one
   --help           show this help
 
@@ -36,9 +41,45 @@ function tryParse(s) {
         return undefined;
     }
 }
+// opencode caches npm plugins in <cache>/packages/<name>@<spec>/ (older: <cache>/npm/) and never re-resolves @latest.
+function update(dryRun) {
+    const cache = join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "opencode");
+    const [scope, name] = PKG.split("/");
+    const dirs = ["packages", "npm"].flatMap((p) => {
+        const parent = join(cache, p, scope);
+        if (!existsSync(parent))
+            return [];
+        return readdirSync(parent)
+            .filter((d) => d.startsWith(`${name}@`))
+            .map((d) => join(parent, d));
+    });
+    if (!dirs.length) {
+        console.log(`nothing to update: opencode has no cached copy of ${PKG} (it will install the latest version on next start)`);
+        return 0;
+    }
+    for (const d of dirs) {
+        const pkg = tryParse(readFileSafe(join(d, "node_modules", PKG, "package.json")));
+        const version = typeof pkg?.version === "string" ? pkg.version : "unknown version";
+        if (!dryRun)
+            rmSync(d, { recursive: true, force: true });
+        console.log(`${dryRun ? "would remove" : "removed"} cached ${version} at ${d}`);
+    }
+    if (!dryRun)
+        console.log(`restart opencode — it will install the latest ${PKG} from npm on start`);
+    return 0;
+}
+function readFileSafe(f) {
+    try {
+        return readFileSync(f, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
 function main(argv) {
     let dryRun = false;
     let explicit;
+    let cmd = "setup";
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         if (a === "--help" || a === "-h")
@@ -47,11 +88,15 @@ function main(argv) {
             dryRun = true;
         else if (a === "--config")
             explicit = argv[++i];
-        else if (a !== "setup")
+        else if (a === "setup" || a === "update")
+            cmd = a;
+        else
             return console.error(`Unknown argument: ${a}\n\n${HELP}`), 1;
     }
     if (argv.includes("--config") && !explicit)
         return console.error("--config needs a path"), 1;
+    if (cmd === "update")
+        return update(dryRun);
     const env = process.env;
     const dir = env.OPENCODE_CONFIG_DIR || join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "opencode");
     const file = resolve(explicit ||

package/dist/plugin.d.ts

@@ -2,4 +2,5 @@ import type { Plugin } from "@opencode-ai/plugin";
 import { type SdkAuthStatus } from "@cursor/sdk";
 export { parseContext } from "./models.js";
 export declare function keyProblem(status: SdkAuthStatus, nowMs: number): string | undefined;
+export declare function _resetKeyCache(): void;
 export declare const CursorAuthPlugin: Plugin;

package/dist/plugin.js

@@ -48,10 +48,17 @@ async function bodyText(input, init) {
         return input.text();
     return "";
 }
+export function _resetKeyCache() {
+    keyStatus = undefined;
+    warnedExpiry = false;
+}
 let pastedApiKey;
+const EMPTY_KEY = "Cursor API key is empty — run `opencode auth login` and pick Cursor, or paste a key from cursor.com/dashboard";
 async function cursorFetch(input, init) {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     if (url.includes("/chat/completions")) {
+        if (pastedApiKey === "")
+            return errorResponse({ message: EMPTY_KEY, code: "invalid_api_key" }, 401);
         const problem = await checkKey();
         if (problem)
             return errorResponse(problem, 401);
@@ -106,8 +113,7 @@ export const CursorAuthPlugin = async (input) => {
             provider: "cursor",
             loader: async (getAuth) => {
                 const auth = await getAuth().catch(() => undefined);
-                if (auth && auth.type === "api" && auth.key !== "cursor-sdk-store")
-                    pastedApiKey = auth.key;
+                pastedApiKey = auth?.type === "api" && auth.key !== "cursor-sdk-store" ? (auth.key ?? "").trim() : undefined;
                 return {
                     apiKey: "cursor-managed",
                     baseURL: BASE_URL,

package/installation.md

@@ -101,7 +101,13 @@ Optional: to see which models the account is actually allowed to use, clone the
 
 ## Upgrading
 
-With `@latest` in the `plugin` array, restarting opencode picks up new versions. If it stays on an old version, clear the cached package and restart opencode:
+opencode resolves `@latest` once, at first install, and keeps that cached version forever; restarting does not upgrade it. To upgrade, run:
+
+```bash
+npx @vidit19sharma/opencode-cursor-auth update
+```
+
+Then tell the user to restart opencode; it installs the current release from npm on start. `update --dry-run` shows what would be removed. Manual equivalent (also delete any other `@vidit19sharma/opencode-cursor-auth@*` dir there, and under `~/.cache/opencode/npm/` on older opencode):
 
 ```bash
 rm -rf ~/.cache/opencode/packages/@vidit19sharma/opencode-cursor-auth@latest
@@ -118,6 +124,7 @@ The plugin is installed. Every model the user's Cursor plan includes is availabl
 - **403 `permission_error` "Model Blocked"**: a team admin disabled that model for the account. It is hidden from `opencode models` from then on; delete `~/.cache/opencode-cursor-auth/models.json` to re-check.
 - **400 `Cannot use this model`**: the model id is not in Cursor's catalog for this account.
 - **Request hangs with no error**: `opencode auth login` was never run for Cursor; run it (0.3.2+ seeds the entry automatically so you get a 401 message instead).
+- **Features missing / variants not showing on Ctrl+T**: opencode is running a stale cached version. Run `npx @vidit19sharma/opencode-cursor-auth update`, then restart opencode.
 - **Model list empty or only `cursor/auto`**: the catalog fetch failed (offline or not logged in). Fix auth, delete `~/.cache/opencode-cursor-auth/models.json`, restart opencode.
 
 ### Paths

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vidit19sharma/opencode-cursor-auth",
-  "version": "0.3.2",
-  "description": "OpenCode plugin that uses your Cursor subscription via the official @cursor/sdk \u2014 no proxy server, no separate login.",
+  "version": "0.3.3",
+  "description": "OpenCode plugin that uses your Cursor subscription via the official @cursor/sdk — no proxy server, no separate login.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -39,7 +39,8 @@
     "spike": "bun spike/validate-sdk.ts",
     "smoke": "bash scripts/fresh-home-smoke.sh",
     "prepublishOnly": "npm run build",
-    "test:cli": "npm run build && bash spike/cli-setup.test.sh"
+    "test:cli": "npm run build && bash spike/cli-setup.test.sh",
+    "test:plugin": "bun test spike/plugin.test.ts"
   },
   "dependencies": {
     "@cursor/sdk": "^1.0.36"