cursor-opencode-provider 0.2.8 → 0.3.0

package/dist/model-config.js

@@ -0,0 +1,188 @@
+import { CURSOR_VARIANT_PARAMETERS_KEY, CURSOR_WIRE_MODEL_ID_KEY, parseCursorContextLimit, } from "./models.js";
+/**
+ * Cursor `ModelInfo` → OpenCode model-config mapping.
+ *
+ * Host-neutral on purpose: both the classic/1.18 plugins and the OpenCode 2.0
+ * plugin derive their catalogs from here, so model naming, thinking suffixes,
+ * and long-context tiering stay identical across every surface. Do not import
+ * a host plugin API into this module.
+ */
+/**
+ * Strip characters and markup that break rendering in the OpenCode TUI/GUI from
+ * a model or variant display name:
+ *   • HTML tags (e.g. `<span style="…">Medium</span>`) — the IDE colours variant
+ *     suffixes with a CSS var that doesn't exist in OpenCode, so the raw markup
+ *     would show as literal text. We drop the tags and keep the inner text
+ *     ("Medium").
+ *   • HTML/markup chars (`< > & " ' \``), parentheses.
+ *   • Tabs/newlines collapse to single spaces.
+ * Dots and unicode letters are preserved so names stay readable.
+ * Fixes https://github.com/oakimov/cursor-opencode-provider/issues/2.
+ */
+function safeLabel(value) {
+    return (value
+        .replace(/<[^>]+>/g, "")
+        .replace(/[()<>&"'`]/g, "")
+        .replace(/\s+/g, " ")
+        .trim() || "default");
+}
+function baseName(mi) {
+    return safeLabel(mi.displayName ?? mi.id);
+}
+function modelInfoVariants(mi, variants) {
+    if (variants.length === 0)
+        return undefined;
+    const entries = {};
+    const usedKeys = new Set();
+    const baseName = safeLabel(mi.displayName ?? mi.id);
+    // Each variant's key is `safeLabel(displayName)` (the IDE's own label, e.g.
+    // "Opus 4.8 1M High Fast Thinking") so the picker matches what the user
+    // sees in Cursor. Two variants can sanitize to the same name when the IDE
+    // wraps a differentiator in `<span>…</span>` (e.g. Composer's "Fast"
+    // suffix collapses to the bare model name after stripping). To guarantee
+    // every variant stays pickable:
+    //   1. If the sanitized displayName matches the model name itself, suffix
+    //      it with distinguishing params (or "default") so it never collides
+    //      with the model entry in the variant panel.
+    //   2. If two variants still collide, tag the later one with its params.
+    // Suffixes must stay free of `()` / markup chars — same constraint as
+    // safeLabel (issue #2); use spaced tokens, not parenthetical tags.
+    const tagDims = (p) => {
+        const labels = [];
+        for (const d of p) {
+            if (d.id === "fast" && d.value === "true")
+                labels.push("Fast");
+            else if (d.id === "thinking" && d.value === "true")
+                labels.push("Thinking");
+            else if (d.id === "context")
+                labels.push(d.value);
+        }
+        if (labels.length > 0)
+            return ` ${labels.join(" ")}`;
+        // No params at all — still disambiguate from the model name itself.
+        if (p.length === 0)
+            return "";
+        return " default";
+    };
+    for (const v of variants) {
+        const sanitized = safeLabel(v.displayName || v.key || "default");
+        let key = sanitized;
+        // Never let a variant key equal the model name — that would make the
+        // variant entry indistinguishable from the model entry in pickers that
+        // collapse them.
+        if (key === baseName && !usedKeys.has(key)) {
+            key = `${baseName}${tagDims(v.parameterValues)}` || `${baseName} default`;
+        }
+        else if (usedKeys.has(key)) {
+            key = `${sanitized}${tagDims(v.parameterValues)}`;
+        }
+        let n = 2;
+        while (usedKeys.has(key))
+            key = `${sanitized}${tagDims(v.parameterValues)} ${n++}`;
+        usedKeys.add(key);
+        entries[key] = {
+            [CURSOR_VARIANT_PARAMETERS_KEY]: v.parameterValues.map((p) => ({ ...p })),
+        };
+    }
+    return entries;
+}
+function isLongContextVariant(v) {
+    return v.parameterValues.some((p) => p.id === "context" && parseCursorContextLimit(p.value) === 1_000_000);
+}
+function variantsForTier(mi, tier) {
+    return mi.variants.filter((v) => isLongContextVariant(v) === (tier === "long"));
+}
+/**
+ * Display names shared by both a thinking and a non-thinking model. A thinking
+ * model with such a name needs a "Thinking" tag to disambiguate it from its
+ * non-thinking twin (Cursor's Claude/Fable/Sonnet families). Models whose names
+ * are already unique — including Cursor's GPT family, where the reasoning tier
+ * ("None"/"Low"/"High"…) is baked into the name — are excluded, so they aren't
+ * tagged redundantly.
+ */
+export function thinkingSuffixBaseNames(models) {
+    const flags = new Map();
+    for (const m of models) {
+        const base = baseName(m);
+        const entry = flags.get(base) ?? { hasThinking: false, hasNonThinking: false };
+        if (m.supportsThinking)
+            entry.hasThinking = true;
+        else
+            entry.hasNonThinking = true;
+        flags.set(base, entry);
+    }
+    const ambiguous = new Set();
+    for (const [base, f] of flags)
+        if (f.hasThinking && f.hasNonThinking)
+            ambiguous.add(base);
+    return ambiguous;
+}
+export function modelInfoToConfig(mi, options = {}) {
+    const contextTier = options.contextTier ?? "base";
+    const variants = variantsForTier(mi, contextTier);
+    let name = baseName(mi);
+    if (options.thinkingSuffix)
+        name += " Thinking";
+    if (contextTier === "long")
+        name += " 1M";
+    // OpenCode's context limit is static per model entry, while Cursor's context
+    // tier is a variant parameter. Long-context choices are therefore emitted as
+    // separate OpenCode entries by modelsToConfig.
+    const context = contextTier === "long"
+        ? (mi.maxContextForMaxMode ?? 1_000_000)
+        : (mi.maxContext ?? 200_000);
+    // OpenCode's overflow/compaction/UI use limit.context; generation and
+    // thinking budgets use limit.output. models.dev 1M peers advertise
+    // 64k–128k output — a tiny cap makes long-context sessions feel broken
+    // even when the 1M input window is correct.
+    const output = contextTier === "long" ? 128_000 : 32_000;
+    const config = {
+        name,
+        reasoning: mi.supportsThinking ?? false,
+        tool_call: mi.supportsAgent ?? true,
+        temperature: false,
+        limit: {
+            context,
+            output,
+        },
+    };
+    const variantConfig = modelInfoVariants(mi, variants);
+    if (variantConfig)
+        config.variants = variantConfig;
+    if (contextTier === "long") {
+        const defaultVariant = variants.find((v) => v.isDefaultMax) ?? variants[0];
+        if (defaultVariant) {
+            config.options = {
+                [CURSOR_WIRE_MODEL_ID_KEY]: mi.id,
+                [CURSOR_VARIANT_PARAMETERS_KEY]: defaultVariant.parameterValues.map((p) => ({ ...p })),
+            };
+        }
+    }
+    return config;
+}
+export function modelsToConfig(models) {
+    const ambiguous = thinkingSuffixBaseNames(models);
+    const out = {};
+    const usedIds = new Set(models.map((m) => m.id));
+    for (const m of models) {
+        const thinkingSuffix = !!m.supportsThinking && ambiguous.has(baseName(m));
+        const baseVariants = variantsForTier(m, "base");
+        const longVariants = variantsForTier(m, "long");
+        if (baseVariants.length > 0 || longVariants.length === 0) {
+            out[m.id] = modelInfoToConfig(m, { thinkingSuffix, contextTier: "base" });
+        }
+        if (longVariants.length === 0)
+            continue;
+        if (baseVariants.length === 0) {
+            out[m.id] = modelInfoToConfig(m, { thinkingSuffix, contextTier: "long" });
+            continue;
+        }
+        let longId = `${m.id}-1m`;
+        let suffix = 2;
+        while (usedIds.has(longId))
+            longId = `${m.id}-1m-${suffix++}`;
+        usedIds.add(longId);
+        out[longId] = modelInfoToConfig(m, { thinkingSuffix, contextTier: "long" });
+    }
+    return out;
+}

package/dist/opencode2/catalog.d.ts

@@ -0,0 +1,33 @@
+import { type ModelInfo } from "../models.js";
+import type { CatalogDraft } from "./types.js";
+/**
+ * Catalog registration for the OpenCode 2.0 plugin — the replacement for the
+ * classic plugin's `config` hook.
+ *
+ * Model naming, thinking suffixes, and long-context tiering are NOT reimplemented
+ * here: we run the shared `modelsToConfig` and translate its output into the 2.0
+ * `Model.Info` shape, so every surface exposes an identical model list.
+ */
+/** Integration id owning Cursor credentials. Matches the provider id. */
+export declare const CURSOR_INTEGRATION_ID = "cursor";
+/**
+ * `aisdk:` selects OpenCode 2.0's AI SDK path, which is what surfaces the
+ * `aisdk.hook("sdk")` / `("language")` extension points we supply the provider
+ * through. The suffix is this package's npm name so the host's built-in
+ * `DynamicProviderPlugin` can still resolve it if our own hook is ever
+ * bypassed — that fallback runs `npm.add(pkg)` against the *published*
+ * registry into `<host-cache>/packages/<pkg>/node_modules/<pkg>`, ignoring
+ * any local `file://` plugin path this process was loaded from.
+ *
+ * `CURSOR_OPENCODE2_DEV_ENTRY` overrides the suffix with an `aisdk:file://…`
+ * spec instead, pointed at a local built entry file (e.g. `dist/index.js`,
+ * which exports `createCursor`). The host's fallback recognizes `file://`
+ * specs and imports them directly, skipping `npm.add` — the only way to
+ * exercise a local build through that fallback path short of publishing.
+ * Unset in production; only meant for local `opencode2 run` testing.
+ */
+export declare const CURSOR_AISDK_PACKAGE: string;
+/** Register (or update) the Cursor provider entry. `update` is an upsert. */
+export declare function applyCursorProvider(draft: CatalogDraft): void;
+/** Register every discovered Cursor model. Safe to re-run; `update` upserts. */
+export declare function applyCursorModels(draft: CatalogDraft, models: ModelInfo[]): void;

package/dist/opencode2/catalog.js

@@ -0,0 +1,85 @@
+import { pathToFileURL } from "node:url";
+import { CURSOR_PROVIDER_ID } from "../shared.js";
+import { CURSOR_WIRE_MODEL_ID_KEY } from "../models.js";
+import { modelsToConfig } from "../model-config.js";
+/**
+ * Catalog registration for the OpenCode 2.0 plugin — the replacement for the
+ * classic plugin's `config` hook.
+ *
+ * Model naming, thinking suffixes, and long-context tiering are NOT reimplemented
+ * here: we run the shared `modelsToConfig` and translate its output into the 2.0
+ * `Model.Info` shape, so every surface exposes an identical model list.
+ */
+/** Integration id owning Cursor credentials. Matches the provider id. */
+export const CURSOR_INTEGRATION_ID = CURSOR_PROVIDER_ID;
+/**
+ * `aisdk:` selects OpenCode 2.0's AI SDK path, which is what surfaces the
+ * `aisdk.hook("sdk")` / `("language")` extension points we supply the provider
+ * through. The suffix is this package's npm name so the host's built-in
+ * `DynamicProviderPlugin` can still resolve it if our own hook is ever
+ * bypassed — that fallback runs `npm.add(pkg)` against the *published*
+ * registry into `<host-cache>/packages/<pkg>/node_modules/<pkg>`, ignoring
+ * any local `file://` plugin path this process was loaded from.
+ *
+ * `CURSOR_OPENCODE2_DEV_ENTRY` overrides the suffix with an `aisdk:file://…`
+ * spec instead, pointed at a local built entry file (e.g. `dist/index.js`,
+ * which exports `createCursor`). The host's fallback recognizes `file://`
+ * specs and imports them directly, skipping `npm.add` — the only way to
+ * exercise a local build through that fallback path short of publishing.
+ * Unset in production; only meant for local `opencode2 run` testing.
+ */
+export const CURSOR_AISDK_PACKAGE = process.env.CURSOR_OPENCODE2_DEV_ENTRY
+    ? `aisdk:${pathToFileURL(process.env.CURSOR_OPENCODE2_DEV_ENTRY).href}`
+    : "aisdk:cursor-opencode-provider";
+/** Register (or update) the Cursor provider entry. `update` is an upsert. */
+export function applyCursorProvider(draft) {
+    draft.provider.update(CURSOR_PROVIDER_ID, (provider) => {
+        provider.id = CURSOR_PROVIDER_ID;
+        provider.name = "Cursor";
+        provider.package = CURSOR_AISDK_PACKAGE;
+        // Links the provider to the integration that stores its credentials, so
+        // `connection.active(...)` resolves the token the user set up via /connect.
+        provider.integrationID = CURSOR_INTEGRATION_ID;
+    });
+}
+/** Translate one `modelsToConfig` entry into the 2.0 `Model.Info` shape. */
+function applyModelEntry(draft, id, entry) {
+    const options = entry.options;
+    // Long-context entries get a synthetic OpenCode id (`<id>-1m`) while still
+    // addressing the same Cursor model on the wire. V1 smuggled that through
+    // provider options; 2.0 has a first-class `modelID` for exactly this.
+    const wireId = typeof options?.[CURSOR_WIRE_MODEL_ID_KEY] === "string"
+        ? options[CURSOR_WIRE_MODEL_ID_KEY]
+        : id;
+    const variants = Object.entries((entry.variants ?? {})).map(([variantId, settings]) => ({ id: variantId, settings: { ...settings } }));
+    draft.model.update(CURSOR_PROVIDER_ID, id, (model) => {
+        model.id = id;
+        model.modelID = wireId;
+        model.providerID = CURSOR_PROVIDER_ID;
+        model.name = entry.name;
+        model.capabilities = {
+            tools: entry.tool_call !== false,
+            // The provider does not convert file/image prompt parts, so text-only is
+            // the honest declaration. Revisit alongside Cursor's `supports_images`.
+            input: ["text"],
+            output: ["text"],
+        };
+        model.limit = { context: entry.limit.context, output: entry.limit.output };
+        model.variants = variants;
+        model.status = "active";
+        model.enabled = true;
+        model.time = { released: 0 };
+        model.cost = [];
+        // Carries the default variant parameters (and the wire id) through to
+        // doStream as provider options, matching the classic plugin.
+        if (options)
+            model.settings = { ...options };
+    });
+}
+/** Register every discovered Cursor model. Safe to re-run; `update` upserts. */
+export function applyCursorModels(draft, models) {
+    const config = modelsToConfig(models);
+    for (const [id, entry] of Object.entries(config)) {
+        applyModelEntry(draft, id, entry);
+    }
+}

package/dist/opencode2/integration.d.ts

@@ -0,0 +1,23 @@
+import type { CredentialValue, IntegrationDomain, IntegrationDraft } from "./types.js";
+/**
+ * Integration registration for the OpenCode 2.0 plugin — the replacement for the
+ * classic plugin's `auth` hook (`methods` + `loader`).
+ *
+ * Unlike the 1.18 v2 API (where OAuth registration is Effect-valued), 2.0 takes
+ * plain Promises, so the PKCE flow from `src/auth.ts` ports across unchanged.
+ */
+export declare const CURSOR_OAUTH_METHOD_ID = "oauth";
+/** Env vars that can supply a Cursor API key without running /connect. */
+export declare const CURSOR_ENV_NAMES: string[];
+/** Register the Cursor integration and its three connection methods. */
+export declare function applyCursorIntegration(draft: IntegrationDraft): void;
+/**
+ * Turn a stored credential into a Cursor access token.
+ *
+ * OAuth credentials already hold a JWT (the host refreshes them via `refresh`
+ * above). A `key` credential is the raw `crsr_…` API key, which Cursor requires us
+ * to exchange for a short-lived JWT — mirroring the classic plugin's behavior.
+ */
+export declare function accessTokenFromCredential(credential: CredentialValue | undefined): Promise<string | undefined>;
+/** Resolve the active Cursor connection into an access token, if any. */
+export declare function resolveCursorAccessToken(integration: IntegrationDomain): Promise<string | undefined>;

package/dist/opencode2/integration.js

@@ -0,0 +1,124 @@
+import { CURSOR_WEBSITE_HOST } from "../shared.js";
+import { cursorApiBaseURL } from "../plugin-core.js";
+import { buildLoginUrl, decodeJwtExpiryMs, exchangeApiKey, generatePkceChallenge, generatePkceParams, isExpiringSoon, pollForTokens, refreshAccessToken, } from "../auth.js";
+import { CURSOR_INTEGRATION_ID } from "./catalog.js";
+/**
+ * Integration registration for the OpenCode 2.0 plugin — the replacement for the
+ * classic plugin's `auth` hook (`methods` + `loader`).
+ *
+ * Unlike the 1.18 v2 API (where OAuth registration is Effect-valued), 2.0 takes
+ * plain Promises, so the PKCE flow from `src/auth.ts` ports across unchanged.
+ */
+export const CURSOR_OAUTH_METHOD_ID = "oauth";
+/** Env vars that can supply a Cursor API key without running /connect. */
+export const CURSOR_ENV_NAMES = ["CURSOR_API_KEY"];
+function websiteURL() {
+    return process.env.CURSOR_WEBSITE_URL ?? `https://${CURSOR_WEBSITE_HOST}`;
+}
+/** Browser (PKCE) login: open URL, then poll until Cursor hands back tokens. */
+async function authorizeOAuth() {
+    const params = generatePkceParams();
+    const challenge = await generatePkceChallenge(params.verifier);
+    const apiBaseURL = cursorApiBaseURL();
+    const url = buildLoginUrl(challenge, params.uuid, websiteURL());
+    return {
+        url,
+        instructions: "Open this URL in a browser to sign in to Cursor",
+        mode: "auto",
+        callback: pollForTokens(params.uuid, params.verifier, apiBaseURL).then((result) => ({
+            type: "oauth",
+            methodID: CURSOR_OAUTH_METHOD_ID,
+            access: result.accessToken,
+            refresh: result.refreshToken,
+            expires: decodeJwtExpiryMs(result.accessToken) ?? Date.now(),
+        })),
+    };
+}
+/**
+ * Renew an expiring Cursor JWT. The host calls this lazily when the stored
+ * credential is close to expiry, so it must not assume it runs on every request.
+ */
+async function refreshOAuth(credential) {
+    const tokens = await refreshAccessToken(credential.refresh, cursorApiBaseURL());
+    return {
+        type: "oauth",
+        methodID: credential.methodID || CURSOR_OAUTH_METHOD_ID,
+        access: tokens.accessToken,
+        refresh: tokens.refreshToken,
+        expires: decodeJwtExpiryMs(tokens.accessToken) ?? Date.now(),
+        ...(credential.metadata === undefined ? {} : { metadata: credential.metadata }),
+    };
+}
+/** Register the Cursor integration and its three connection methods. */
+export function applyCursorIntegration(draft) {
+    draft.update(CURSOR_INTEGRATION_ID, (integration) => {
+        integration.id = CURSOR_INTEGRATION_ID;
+        integration.name = "Cursor";
+    });
+    draft.method.update({
+        integrationID: CURSOR_INTEGRATION_ID,
+        method: {
+            id: CURSOR_OAUTH_METHOD_ID,
+            type: "oauth",
+            label: "Cursor account (browser login)",
+        },
+        authorize: authorizeOAuth,
+        refresh: refreshOAuth,
+    });
+    draft.method.update({
+        integrationID: CURSOR_INTEGRATION_ID,
+        method: { type: "key", label: "API key (cursor.com/settings)" },
+    });
+    draft.method.update({
+        integrationID: CURSOR_INTEGRATION_ID,
+        method: { type: "env", names: CURSOR_ENV_NAMES },
+    });
+}
+/**
+ * Turn a stored credential into a Cursor access token.
+ *
+ * OAuth credentials already hold a JWT (the host refreshes them via `refresh`
+ * above). A `key` credential is the raw `crsr_…` API key, which Cursor requires us
+ * to exchange for a short-lived JWT — mirroring the classic plugin's behavior.
+ */
+export async function accessTokenFromCredential(credential) {
+    if (!credential)
+        return undefined;
+    if (credential.type === "oauth") {
+        if (credential.access && !isExpiringSoon(credential.access))
+            return credential.access;
+        if (!credential.refresh)
+            return credential.access || undefined;
+        try {
+            return (await refreshOAuth(credential)).access;
+        }
+        catch {
+            // Fall back to the existing token; the call may still succeed.
+            return credential.access || undefined;
+        }
+    }
+    if (credential.type === "key") {
+        // Already a JWT (e.g. exchanged by an earlier run) — use it directly.
+        if (!credential.key.startsWith("crsr_"))
+            return credential.key;
+        try {
+            return (await exchangeApiKey(credential.key, cursorApiBaseURL())).accessToken;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/** Resolve the active Cursor connection into an access token, if any. */
+export async function resolveCursorAccessToken(integration) {
+    try {
+        const connection = await integration.connection.active(CURSOR_INTEGRATION_ID);
+        if (!connection)
+            return undefined;
+        return await accessTokenFromCredential(await integration.connection.resolve(connection));
+    }
+    catch {
+        return undefined;
+    }
+}