cursor-oauth-opencode 0.1.1

package/dist/index.js

@@ -0,0 +1,229 @@
+import { generateCursorAuthParams, getTokenExpiry, pollCursorAuth, refreshCursorToken, } from "./auth";
+import { getCursorModels } from "./models";
+import { startProxy } from "./proxy";
+const CURSOR_PROVIDER_ID = "cursor";
+/**
+ * OpenCode plugin that provides Cursor authentication and model access.
+ * Register in opencode.json: { "plugin": ["cursor-oauth-opencode"] }
+ */
+export const CursorAuthPlugin = async (input) => {
+    return {
+        auth: {
+            provider: CURSOR_PROVIDER_ID,
+            async loader(getAuth, provider) {
+                const auth = await getAuth();
+                if (!auth || auth.type !== "oauth")
+                    return {};
+                // Ensure we have a valid access token, refreshing if expired
+                let accessToken = auth.access;
+                if (!accessToken || auth.expires < Date.now()) {
+                    const refreshed = await refreshCursorToken(auth.refresh);
+                    await input.client.auth.set({
+                        path: { id: CURSOR_PROVIDER_ID },
+                        body: {
+                            type: "oauth",
+                            refresh: refreshed.refresh,
+                            access: refreshed.access,
+                            expires: refreshed.expires,
+                        },
+                    });
+                    accessToken = refreshed.access;
+                }
+                const models = await getCursorModels(accessToken);
+                const port = await startProxy(async () => {
+                    const currentAuth = await getAuth();
+                    if (currentAuth.type !== "oauth") {
+                        throw new Error("Cursor auth not configured");
+                    }
+                    if (!currentAuth.access || currentAuth.expires < Date.now()) {
+                        const refreshed = await refreshCursorToken(currentAuth.refresh);
+                        await input.client.auth.set({
+                            path: { id: CURSOR_PROVIDER_ID },
+                            body: {
+                                type: "oauth",
+                                refresh: refreshed.refresh,
+                                access: refreshed.access,
+                                expires: refreshed.expires,
+                            },
+                        });
+                        return refreshed.access;
+                    }
+                    return currentAuth.access;
+                }, models);
+                if (provider) {
+                    provider.models = buildCursorProviderModels(models, port);
+                }
+                return {
+                    baseURL: `http://localhost:${port}/v1`,
+                    apiKey: "cursor-proxy",
+                    async fetch(requestInput, init) {
+                        if (init?.headers) {
+                            if (init.headers instanceof Headers) {
+                                init.headers.delete("authorization");
+                            }
+                            else if (Array.isArray(init.headers)) {
+                                init.headers = init.headers.filter(([key]) => key.toLowerCase() !== "authorization");
+                            }
+                            else {
+                                delete init.headers["authorization"];
+                                delete init.headers["Authorization"];
+                            }
+                        }
+                        return fetch(requestInput, init);
+                    },
+                };
+            },
+            methods: [
+                {
+                    type: "oauth",
+                    label: "Login with Cursor",
+                    async authorize() {
+                        const { verifier, uuid, loginUrl } = await generateCursorAuthParams();
+                        return {
+                            url: loginUrl,
+                            instructions: "Complete login in your browser. This window will close automatically.",
+                            method: "auto",
+                            async callback() {
+                                const { accessToken, refreshToken } = await pollCursorAuth(uuid, verifier);
+                                return {
+                                    type: "success",
+                                    refresh: refreshToken,
+                                    access: accessToken,
+                                    expires: getTokenExpiry(accessToken),
+                                };
+                            },
+                        };
+                    },
+                },
+            ],
+        },
+    };
+};
+function buildCursorProviderModels(models, port) {
+    return Object.fromEntries(models.map((model) => [
+        model.id,
+        {
+            id: model.id,
+            providerID: CURSOR_PROVIDER_ID,
+            api: {
+                id: model.id,
+                url: `http://localhost:${port}/v1`,
+                npm: "@ai-sdk/openai-compatible",
+            },
+            name: model.name,
+            capabilities: {
+                temperature: true,
+                reasoning: model.reasoning,
+                attachment: false,
+                toolcall: true,
+                input: {
+                    text: true,
+                    audio: false,
+                    image: false,
+                    video: false,
+                    pdf: false,
+                },
+                output: {
+                    text: true,
+                    audio: false,
+                    image: false,
+                    video: false,
+                    pdf: false,
+                },
+                interleaved: false,
+            },
+            cost: estimateModelCost(model.id),
+            limit: {
+                context: model.contextWindow,
+                output: model.maxTokens,
+            },
+            status: "active",
+            options: {},
+            headers: {},
+            release_date: "",
+            variants: {},
+        },
+    ]));
+}
+// $/M token rates from cursor.com/docs/models-and-pricing
+const MODEL_COST_TABLE = {
+    // Anthropic
+    "claude-4-sonnet": { input: 3, output: 15, cache: { read: 0.3, write: 3.75 } },
+    "claude-4-sonnet-1m": { input: 6, output: 22.5, cache: { read: 0.6, write: 7.5 } },
+    "claude-4.5-haiku": { input: 1, output: 5, cache: { read: 0.1, write: 1.25 } },
+    "claude-4.5-opus": { input: 5, output: 25, cache: { read: 0.5, write: 6.25 } },
+    "claude-4.5-sonnet": { input: 3, output: 15, cache: { read: 0.3, write: 3.75 } },
+    "claude-4.6-opus": { input: 5, output: 25, cache: { read: 0.5, write: 6.25 } },
+    "claude-4.6-opus-fast": { input: 30, output: 150, cache: { read: 3, write: 37.5 } },
+    "claude-4.6-sonnet": { input: 3, output: 15, cache: { read: 0.3, write: 3.75 } },
+    // Cursor
+    "composer-1": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "composer-1.5": { input: 3.5, output: 17.5, cache: { read: 0.35, write: 0 } },
+    "composer-2": { input: 0.5, output: 2.5, cache: { read: 0.2, write: 0 } },
+    "composer-2-fast": { input: 1.5, output: 7.5, cache: { read: 0.2, write: 0 } },
+    // Google
+    "gemini-2.5-flash": { input: 0.3, output: 2.5, cache: { read: 0.03, write: 0 } },
+    "gemini-3-flash": { input: 0.5, output: 3, cache: { read: 0.05, write: 0 } },
+    "gemini-3-pro": { input: 2, output: 12, cache: { read: 0.2, write: 0 } },
+    "gemini-3-pro-image": { input: 2, output: 12, cache: { read: 0.2, write: 0 } },
+    "gemini-3.1-pro": { input: 2, output: 12, cache: { read: 0.2, write: 0 } },
+    // OpenAI
+    "gpt-5": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5-fast": { input: 2.5, output: 20, cache: { read: 0.25, write: 0 } },
+    "gpt-5-mini": { input: 0.25, output: 2, cache: { read: 0.025, write: 0 } },
+    "gpt-5-codex": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5.1-codex": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5.1-codex-max": { input: 1.25, output: 10, cache: { read: 0.125, write: 0 } },
+    "gpt-5.1-codex-mini": { input: 0.25, output: 2, cache: { read: 0.025, write: 0 } },
+    "gpt-5.2": { input: 1.75, output: 14, cache: { read: 0.175, write: 0 } },
+    "gpt-5.2-codex": { input: 1.75, output: 14, cache: { read: 0.175, write: 0 } },
+    "gpt-5.3-codex": { input: 1.75, output: 14, cache: { read: 0.175, write: 0 } },
+    "gpt-5.4": { input: 2.5, output: 15, cache: { read: 0.25, write: 0 } },
+    "gpt-5.4-mini": { input: 0.75, output: 4.5, cache: { read: 0.075, write: 0 } },
+    "gpt-5.4-nano": { input: 0.2, output: 1.25, cache: { read: 0.02, write: 0 } },
+    // xAI
+    "grok-4.20": { input: 2, output: 6, cache: { read: 0.2, write: 0 } },
+    // Moonshot
+    "kimi-k2.5": { input: 0.6, output: 3, cache: { read: 0.1, write: 0 } },
+};
+// Most-specific first
+const MODEL_COST_PATTERNS = [
+    { match: (id) => /claude.*opus.*fast/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-opus-fast"] },
+    { match: (id) => /claude.*opus/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-opus"] },
+    { match: (id) => /claude.*haiku/i.test(id), cost: MODEL_COST_TABLE["claude-4.5-haiku"] },
+    { match: (id) => /claude.*sonnet/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-sonnet"] },
+    { match: (id) => /claude/i.test(id), cost: MODEL_COST_TABLE["claude-4.6-sonnet"] },
+    { match: (id) => /composer-?2/i.test(id), cost: MODEL_COST_TABLE["composer-2"] },
+    { match: (id) => /composer-?1\.5/i.test(id), cost: MODEL_COST_TABLE["composer-1.5"] },
+    { match: (id) => /composer/i.test(id), cost: MODEL_COST_TABLE["composer-1"] },
+    { match: (id) => /gpt-5\.4.*nano/i.test(id), cost: MODEL_COST_TABLE["gpt-5.4-nano"] },
+    { match: (id) => /gpt-5\.4.*mini/i.test(id), cost: MODEL_COST_TABLE["gpt-5.4-mini"] },
+    { match: (id) => /gpt-5\.4/i.test(id), cost: MODEL_COST_TABLE["gpt-5.4"] },
+    { match: (id) => /gpt-5\.3/i.test(id), cost: MODEL_COST_TABLE["gpt-5.3-codex"] },
+    { match: (id) => /gpt-5\.2/i.test(id), cost: MODEL_COST_TABLE["gpt-5.2"] },
+    { match: (id) => /gpt-5\.1.*mini/i.test(id), cost: MODEL_COST_TABLE["gpt-5.1-codex-mini"] },
+    { match: (id) => /gpt-5\.1/i.test(id), cost: MODEL_COST_TABLE["gpt-5.1-codex"] },
+    { match: (id) => /gpt-5.*mini/i.test(id), cost: MODEL_COST_TABLE["gpt-5-mini"] },
+    { match: (id) => /gpt-5.*fast/i.test(id), cost: MODEL_COST_TABLE["gpt-5-fast"] },
+    { match: (id) => /gpt-5/i.test(id), cost: MODEL_COST_TABLE["gpt-5"] },
+    { match: (id) => /gemini.*3\.1/i.test(id), cost: MODEL_COST_TABLE["gemini-3.1-pro"] },
+    { match: (id) => /gemini.*3.*flash/i.test(id), cost: MODEL_COST_TABLE["gemini-3-flash"] },
+    { match: (id) => /gemini.*3/i.test(id), cost: MODEL_COST_TABLE["gemini-3-pro"] },
+    { match: (id) => /gemini.*flash/i.test(id), cost: MODEL_COST_TABLE["gemini-2.5-flash"] },
+    { match: (id) => /gemini/i.test(id), cost: MODEL_COST_TABLE["gemini-3.1-pro"] },
+    { match: (id) => /grok/i.test(id), cost: MODEL_COST_TABLE["grok-4.20"] },
+    { match: (id) => /kimi/i.test(id), cost: MODEL_COST_TABLE["kimi-k2.5"] },
+];
+const DEFAULT_COST = { input: 3, output: 15, cache: { read: 0.3, write: 0 } };
+function estimateModelCost(modelId) {
+    const normalized = modelId.toLowerCase();
+    const exact = MODEL_COST_TABLE[normalized];
+    if (exact)
+        return exact;
+    const stripped = normalized.replace(/-(high|medium|low|preview|thinking|spark-preview)$/g, "");
+    const strippedMatch = MODEL_COST_TABLE[stripped];
+    if (strippedMatch)
+        return strippedMatch;
+    return MODEL_COST_PATTERNS.find((p) => p.match(normalized))?.cost ?? DEFAULT_COST;
+}
+export default CursorAuthPlugin;

package/dist/models.d.ts

@@ -0,0 +1,10 @@
+export interface CursorModel {
+    id: string;
+    name: string;
+    reasoning: boolean;
+    contextWindow: number;
+    maxTokens: number;
+}
+export declare function getCursorModels(apiKey: string): Promise<CursorModel[]>;
+/** @internal Test-only. */
+export declare function clearModelCache(): void;

package/dist/models.js

@@ -0,0 +1,158 @@
+/**
+ * Cursor model discovery via GetUsableModels.
+ * Uses the H2 bridge for transport. Falls back to a hardcoded list
+ * when discovery fails.
+ */
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { z } from "zod";
+import { callCursorUnaryRpc } from "./proxy";
+import { GetUsableModelsRequestSchema, GetUsableModelsResponseSchema, } from "./proto/agent_pb";
+const GET_USABLE_MODELS_PATH = "/agent.v1.AgentService/GetUsableModels";
+const DEFAULT_CONTEXT_WINDOW = 200_000;
+const DEFAULT_MAX_TOKENS = 64_000;
+const CursorModelDetailsSchema = z.object({
+    modelId: z.string(),
+    displayName: z.string().optional().catch(undefined),
+    displayNameShort: z.string().optional().catch(undefined),
+    displayModelId: z.string().optional().catch(undefined),
+    aliases: z
+        .array(z.unknown())
+        .optional()
+        .catch([])
+        .transform((aliases) => (aliases ?? []).filter((alias) => typeof alias === "string")),
+    thinkingDetails: z.unknown().optional(),
+});
+const FALLBACK_MODELS = [
+    // Composer models
+    { id: "composer-1", name: "Composer 1", reasoning: true, contextWindow: 200_000, maxTokens: 64_000 },
+    { id: "composer-1.5", name: "Composer 1.5", reasoning: true, contextWindow: 200_000, maxTokens: 64_000 },
+    // Claude models
+    { id: "claude-4.6-opus-high", name: "Claude 4.6 Opus", reasoning: true, contextWindow: 200_000, maxTokens: 128_000 },
+    { id: "claude-4.6-sonnet-medium", name: "Claude 4.6 Sonnet", reasoning: true, contextWindow: 200_000, maxTokens: 64_000 },
+    { id: "claude-4.5-sonnet", name: "Claude 4.5 Sonnet", reasoning: true, contextWindow: 200_000, maxTokens: 64_000 },
+    // GPT models
+    { id: "gpt-5.4-medium", name: "GPT-5.4", reasoning: true, contextWindow: 272_000, maxTokens: 128_000 },
+    { id: "gpt-5.2", name: "GPT-5.2", reasoning: true, contextWindow: 400_000, maxTokens: 128_000 },
+    { id: "gpt-5.2-codex", name: "GPT-5.2 Codex", reasoning: true, contextWindow: 400_000, maxTokens: 128_000 },
+    { id: "gpt-5.3-codex", name: "GPT-5.3 Codex", reasoning: true, contextWindow: 400_000, maxTokens: 128_000 },
+    { id: "gpt-5.3-codex-spark-preview", name: "GPT-5.3 Codex Spark", reasoning: true, contextWindow: 128_000, maxTokens: 128_000 },
+    // Other models
+    { id: "gemini-3.1-pro", name: "Gemini 3.1 Pro", reasoning: true, contextWindow: 1_000_000, maxTokens: 64_000 },
+    { id: "grok-code-fast-1", name: "Grok Code Fast 1", reasoning: false, contextWindow: 128_000, maxTokens: 64_000 },
+];
+async function fetchCursorUsableModels(apiKey) {
+    try {
+        const requestPayload = create(GetUsableModelsRequestSchema, {});
+        const requestBody = toBinary(GetUsableModelsRequestSchema, requestPayload);
+        const response = await callCursorUnaryRpc({
+            accessToken: apiKey,
+            rpcPath: GET_USABLE_MODELS_PATH,
+            requestBody,
+        });
+        if (response.timedOut || response.exitCode !== 0 || response.body.length === 0) {
+            return null;
+        }
+        const decoded = decodeGetUsableModelsResponse(response.body);
+        if (!decoded)
+            return null;
+        const models = normalizeCursorModels(decoded.models);
+        return models.length > 0 ? models : null;
+    }
+    catch {
+        return null;
+    }
+}
+let cachedModels = null;
+export async function getCursorModels(apiKey) {
+    if (cachedModels)
+        return cachedModels;
+    const discovered = await fetchCursorUsableModels(apiKey);
+    cachedModels = discovered && discovered.length > 0 ? discovered : FALLBACK_MODELS;
+    return cachedModels;
+}
+/** @internal Test-only. */
+export function clearModelCache() {
+    cachedModels = null;
+}
+function decodeGetUsableModelsResponse(payload) {
+    try {
+        return fromBinary(GetUsableModelsResponseSchema, payload);
+    }
+    catch {
+        const framedBody = decodeConnectUnaryBody(payload);
+        if (!framedBody)
+            return null;
+        try {
+            return fromBinary(GetUsableModelsResponseSchema, framedBody);
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function decodeConnectUnaryBody(payload) {
+    if (payload.length < 5)
+        return null;
+    let offset = 0;
+    while (offset + 5 <= payload.length) {
+        const flags = payload[offset];
+        const view = new DataView(payload.buffer, payload.byteOffset + offset, payload.byteLength - offset);
+        const messageLength = view.getUint32(1, false);
+        const frameEnd = offset + 5 + messageLength;
+        if (frameEnd > payload.length)
+            return null;
+        // Compression flag
+        if ((flags & 0b0000_0001) !== 0)
+            return null;
+        // End-of-stream flag — skip trailer frames
+        if ((flags & 0b0000_0010) === 0) {
+            return payload.subarray(offset + 5, frameEnd);
+        }
+        offset = frameEnd;
+    }
+    return null;
+}
+function normalizeCursorModels(models) {
+    if (models.length === 0)
+        return [];
+    const byId = new Map();
+    for (const model of models) {
+        const normalized = normalizeSingleModel(model);
+        if (normalized)
+            byId.set(normalized.id, normalized);
+    }
+    return [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
+}
+function normalizeSingleModel(model) {
+    const parsed = CursorModelDetailsSchema.safeParse(model);
+    if (!parsed.success)
+        return null;
+    const details = parsed.data;
+    const id = details.modelId.trim();
+    if (!id)
+        return null;
+    return {
+        id,
+        name: pickDisplayName(details, id),
+        reasoning: Boolean(details.thinkingDetails),
+        contextWindow: DEFAULT_CONTEXT_WINDOW,
+        maxTokens: DEFAULT_MAX_TOKENS,
+    };
+}
+function pickDisplayName(model, fallbackId) {
+    const candidates = [
+        model.displayName,
+        model.displayNameShort,
+        model.displayModelId,
+        ...model.aliases,
+        fallbackId,
+    ];
+    for (const candidate of candidates) {
+        if (typeof candidate !== "string")
+            continue;
+        const trimmed = candidate.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    return fallbackId;
+}

package/dist/pkce.d.ts

@@ -0,0 +1,4 @@
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;

package/dist/pkce.js

@@ -0,0 +1,9 @@
+export async function generatePKCE() {
+    const verifierBytes = new Uint8Array(96);
+    crypto.getRandomValues(verifierBytes);
+    const verifier = Buffer.from(verifierBytes).toString("base64url");
+    const data = new TextEncoder().encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const challenge = Buffer.from(hashBuffer).toString("base64url");
+    return { verifier, challenge };
+}