cursor-opencode-provider 0.2.9 → 0.3.1

package/dist/opencode2/integration.js

@@ -0,0 +1,124 @@
+import { CURSOR_WEBSITE_HOST } from "../shared.js";
+import { cursorApiBaseURL } from "../plugin-core.js";
+import { buildLoginUrl, decodeJwtExpiryMs, exchangeApiKey, generatePkceChallenge, generatePkceParams, isExpiringSoon, pollForTokens, refreshAccessToken, } from "../auth.js";
+import { CURSOR_INTEGRATION_ID } from "./catalog.js";
+/**
+ * Integration registration for the OpenCode 2.0 plugin — the replacement for the
+ * classic plugin's `auth` hook (`methods` + `loader`).
+ *
+ * Unlike the 1.18 v2 API (where OAuth registration is Effect-valued), 2.0 takes
+ * plain Promises, so the PKCE flow from `src/auth.ts` ports across unchanged.
+ */
+export const CURSOR_OAUTH_METHOD_ID = "oauth";
+/** Env vars that can supply a Cursor API key without running /connect. */
+export const CURSOR_ENV_NAMES = ["CURSOR_API_KEY"];
+function websiteURL() {
+    return process.env.CURSOR_WEBSITE_URL ?? `https://${CURSOR_WEBSITE_HOST}`;
+}
+/** Browser (PKCE) login: open URL, then poll until Cursor hands back tokens. */
+async function authorizeOAuth() {
+    const params = generatePkceParams();
+    const challenge = await generatePkceChallenge(params.verifier);
+    const apiBaseURL = cursorApiBaseURL();
+    const url = buildLoginUrl(challenge, params.uuid, websiteURL());
+    return {
+        url,
+        instructions: "Open this URL in a browser to sign in to Cursor",
+        mode: "auto",
+        callback: pollForTokens(params.uuid, params.verifier, apiBaseURL).then((result) => ({
+            type: "oauth",
+            methodID: CURSOR_OAUTH_METHOD_ID,
+            access: result.accessToken,
+            refresh: result.refreshToken,
+            expires: decodeJwtExpiryMs(result.accessToken) ?? Date.now(),
+        })),
+    };
+}
+/**
+ * Renew an expiring Cursor JWT. The host calls this lazily when the stored
+ * credential is close to expiry, so it must not assume it runs on every request.
+ */
+async function refreshOAuth(credential) {
+    const tokens = await refreshAccessToken(credential.refresh, cursorApiBaseURL());
+    return {
+        type: "oauth",
+        methodID: credential.methodID || CURSOR_OAUTH_METHOD_ID,
+        access: tokens.accessToken,
+        refresh: tokens.refreshToken,
+        expires: decodeJwtExpiryMs(tokens.accessToken) ?? Date.now(),
+        ...(credential.metadata === undefined ? {} : { metadata: credential.metadata }),
+    };
+}
+/** Register the Cursor integration and its three connection methods. */
+export function applyCursorIntegration(draft) {
+    draft.update(CURSOR_INTEGRATION_ID, (integration) => {
+        integration.id = CURSOR_INTEGRATION_ID;
+        integration.name = "Cursor";
+    });
+    draft.method.update({
+        integrationID: CURSOR_INTEGRATION_ID,
+        method: {
+            id: CURSOR_OAUTH_METHOD_ID,
+            type: "oauth",
+            label: "Cursor account (browser login)",
+        },
+        authorize: authorizeOAuth,
+        refresh: refreshOAuth,
+    });
+    draft.method.update({
+        integrationID: CURSOR_INTEGRATION_ID,
+        method: { type: "key", label: "API key (cursor.com/settings)" },
+    });
+    draft.method.update({
+        integrationID: CURSOR_INTEGRATION_ID,
+        method: { type: "env", names: CURSOR_ENV_NAMES },
+    });
+}
+/**
+ * Turn a stored credential into a Cursor access token.
+ *
+ * OAuth credentials already hold a JWT (the host refreshes them via `refresh`
+ * above). A `key` credential is the raw `crsr_…` API key, which Cursor requires us
+ * to exchange for a short-lived JWT — mirroring the classic plugin's behavior.
+ */
+export async function accessTokenFromCredential(credential) {
+    if (!credential)
+        return undefined;
+    if (credential.type === "oauth") {
+        if (credential.access && !isExpiringSoon(credential.access))
+            return credential.access;
+        if (!credential.refresh)
+            return credential.access || undefined;
+        try {
+            return (await refreshOAuth(credential)).access;
+        }
+        catch {
+            // Fall back to the existing token; the call may still succeed.
+            return credential.access || undefined;
+        }
+    }
+    if (credential.type === "key") {
+        // Already a JWT (e.g. exchanged by an earlier run) — use it directly.
+        if (!credential.key.startsWith("crsr_"))
+            return credential.key;
+        try {
+            return (await exchangeApiKey(credential.key, cursorApiBaseURL())).accessToken;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/** Resolve the active Cursor connection into an access token, if any. */
+export async function resolveCursorAccessToken(integration) {
+    try {
+        const connection = await integration.connection.active(CURSOR_INTEGRATION_ID);
+        if (!connection)
+            return undefined;
+        return await accessTokenFromCredential(await integration.connection.resolve(connection));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/opencode2/types.d.ts

@@ -0,0 +1,316 @@
+/**
+ * Local structural types for the OpenCode 2.0 beta plugin API.
+ *
+ * Why not import from `@opencode-ai/plugin`?
+ *   • The 2.0 types live on the `@next` dist-tag (`0.0.0-next-*`), which cannot
+ *     coexist with this package's existing `@opencode-ai/plugin@^1.17.13`
+ *     dependency under the same module specifier.
+ *   • 2.0 is beta and its schema churns; a hand-maintained subset of only what
+ *     we touch is more stable than pinning a moving target.
+ *
+ * These mirror `@opencode-ai/plugin@next` `dist/promise/*.d.ts` as of
+ * `0.0.0-next-16281`. `test/opencode2-conformance.test-d.ts` asserts our
+ * default export still satisfies the real 2.0 `Plugin` interface.
+ *
+ * Effect `Schema` brands (Provider.ID, Model.ID, …) are modelled as plain
+ * `string`; brands are compile-time only and erase at runtime.
+ */
+export type Registration = {
+    readonly dispose: () => Promise<void>;
+};
+export type Hooks<Spec> = <Name extends keyof Spec>(name: Name, callback: (input: Spec[Name]) => Promise<void> | void) => Promise<Registration>;
+export type Transform<Input> = (callback: (input: Input) => void) => Promise<Registration>;
+export type ProviderInfo = {
+    id: string;
+    name: string;
+    /** `"aisdk:<pkg>"` selects the AI SDK path; a bare specifier selects native. */
+    package: string;
+    integrationID?: string;
+    disabled?: boolean;
+    settings?: Record<string, any>;
+    headers?: Record<string, string>;
+    body?: Record<string, any>;
+};
+export type ModelVariantInfo = {
+    id: string;
+    settings?: Record<string, any>;
+    headers?: Record<string, string>;
+    body?: Record<string, any>;
+};
+export type ModelInfo2 = {
+    id: string;
+    /** Wire id sent to the provider. Lets one Cursor model back several entries. */
+    modelID: string;
+    providerID: string;
+    name: string;
+    family?: string;
+    capabilities: {
+        tools: boolean;
+        input: readonly string[];
+        output: readonly string[];
+    };
+    variants: readonly ModelVariantInfo[];
+    time: {
+        released: number;
+    };
+    cost: readonly unknown[];
+    status: "alpha" | "beta" | "deprecated" | "active";
+    enabled: boolean;
+    limit: {
+        context: number;
+        input?: number;
+        output: number;
+    };
+    settings?: Record<string, any>;
+    headers?: Record<string, string>;
+    body?: Record<string, any>;
+    package?: string;
+};
+export type CredentialOAuth = {
+    type: "oauth";
+    methodID: string;
+    refresh: string;
+    access: string;
+    expires: number;
+    metadata?: Record<string, unknown>;
+};
+export type CredentialKey = {
+    type: "key";
+    key: string;
+    metadata?: Record<string, unknown>;
+};
+export type CredentialValue = CredentialOAuth | CredentialKey;
+export type ConnectionInfo = {
+    type: "credential";
+    id: string;
+    label: string;
+} | {
+    type: "env";
+    name: string;
+};
+/**
+ * Read accessors we never call are intentionally loose (`any`). Modelling the
+ * host's Effect-schema records exactly would make the conformance guard churn on
+ * unrelated upstream edits without protecting anything we depend on. The
+ * `update` signatures — the ones we actually build the catalog with — stay precise.
+ */
+export type CatalogDraft = {
+    readonly provider: {
+        list(): readonly any[];
+        get(providerID: string): any;
+        /** Upsert: creates the provider when absent. */
+        update(providerID: string, update: (provider: ProviderInfo) => void): void;
+        remove(providerID: string): void;
+    };
+    readonly model: {
+        get(providerID: string, modelID: string): any;
+        /** Upsert: creates provider and/or model when absent. */
+        update(providerID: string, modelID: string, update: (model: ModelInfo2) => void): void;
+        remove(providerID: string, modelID: string): void;
+        readonly default: {
+            get(): {
+                providerID: string;
+                modelID: string;
+            } | undefined;
+            set(providerID: string, modelID: string): void;
+        };
+    };
+};
+export type CatalogDomain = {
+    readonly transform: Transform<CatalogDraft>;
+    readonly reload: () => Promise<void>;
+};
+export type IntegrationTextPrompt = {
+    type: "text";
+    key: string;
+    message: string;
+    placeholder?: string;
+};
+export type IntegrationOAuthMethod = {
+    id: string;
+    type: "oauth";
+    label: string;
+    prompts?: IntegrationTextPrompt[];
+};
+export type IntegrationKeyMethod = {
+    type: "key";
+    label?: string;
+};
+export type IntegrationEnvMethod = {
+    type: "env";
+    names: string[];
+};
+export type IntegrationMethod = IntegrationOAuthMethod | IntegrationKeyMethod | IntegrationEnvMethod;
+export type IntegrationOAuthAuthorization = {
+    readonly url: string;
+    readonly instructions: string;
+    readonly expiresAt?: number;
+} & ({
+    readonly mode: "auto";
+    readonly callback: Promise<CredentialOAuth>;
+} | {
+    readonly mode: "code";
+    readonly callback: (code: string) => Promise<CredentialOAuth>;
+});
+export type IntegrationOAuthMethodRegistration = {
+    readonly integrationID: string;
+    readonly method: IntegrationOAuthMethod;
+    readonly authorize: (inputs: Record<string, string>) => Promise<IntegrationOAuthAuthorization>;
+    readonly refresh?: (credential: CredentialOAuth) => Promise<CredentialOAuth>;
+    readonly label?: (credential: CredentialOAuth) => string | undefined;
+};
+export type IntegrationMethodRegistration = IntegrationOAuthMethodRegistration | {
+    readonly integrationID: string;
+    readonly method: IntegrationKeyMethod;
+} | {
+    readonly integrationID: string;
+    readonly method: IntegrationEnvMethod;
+};
+export type IntegrationRef = {
+    id: string;
+    name: string;
+};
+export type IntegrationDraft = {
+    list(): readonly any[];
+    get(id: string): any;
+    update(id: string, update: (integration: IntegrationRef) => void): void;
+    remove(id: string): void;
+    readonly method: {
+        list(integrationID: string): readonly any[];
+        update(input: IntegrationMethodRegistration): void;
+        remove(integrationID: string, method: any): void;
+    };
+};
+export type IntegrationDomain = {
+    readonly transform: Transform<IntegrationDraft>;
+    readonly reload: () => Promise<void>;
+    readonly connection: {
+        readonly active: (integrationID: string) => Promise<ConnectionInfo | undefined>;
+        readonly resolve: (connection: ConnectionInfo) => Promise<CredentialValue | undefined>;
+    };
+};
+export type AISDKHooks = {
+    sdk: {
+        readonly model: ModelInfo2;
+        readonly package: string;
+        readonly options: Record<string, any>;
+        sdk?: any;
+    };
+    language: {
+        readonly model: ModelInfo2;
+        readonly sdk: any;
+        readonly options: Record<string, any>;
+        language?: unknown;
+    };
+};
+export type AISDKDomain = {
+    readonly hook: Hooks<AISDKHooks>;
+};
+export type ToolDefinition = {
+    readonly name: string;
+    readonly description: string;
+    readonly input: unknown;
+    readonly output?: unknown;
+    readonly execute: (input: any, context: any) => Promise<any>;
+};
+export type ToolDraft = {
+    add(tool: ToolDefinition): void;
+};
+export type ToolHookBase = {
+    readonly tool: string;
+    readonly sessionID: string;
+    readonly agent: string;
+    readonly messageID: string;
+    readonly callID: string;
+};
+export type ToolHooks = {
+    readonly "execute.before": ToolHookBase & {
+        input: unknown;
+    };
+    readonly "execute.after": ToolHookBase & {
+        readonly input: unknown;
+    } & ({
+        readonly status: "completed";
+        result: any;
+    } | {
+        readonly status: "error";
+        error: any;
+    });
+};
+export type ToolDomain = {
+    readonly transform: Transform<ToolDraft>;
+    readonly hook: Hooks<ToolHooks>;
+};
+export type SessionContext = {
+    readonly sessionID: string;
+    readonly agent: string;
+    readonly model: {
+        providerID: string;
+        id: string;
+        variant?: string;
+    };
+    system: Array<any>;
+    messages: Array<any>;
+    tools: Record<string, {
+        description: string;
+        input: unknown;
+    }>;
+};
+export type SessionHooks = {
+    readonly context: SessionContext;
+};
+/** Only the `location.directory` field we actually read; the rest of the real `SessionInfo` is loose. */
+export type SessionInfo = {
+    readonly id: string;
+    readonly location: {
+        readonly directory: string;
+    };
+};
+export type SessionDomain = {
+    readonly hook: Hooks<SessionHooks>;
+    readonly get: (input: {
+        sessionID: string;
+    }) => Promise<SessionInfo>;
+};
+export type WebSearchDefinition = {
+    readonly id: string;
+    readonly name: string;
+    readonly execute: (input: any, context: {
+        readonly signal: AbortSignal;
+    }) => Promise<readonly any[]>;
+};
+export type WebSearchDraft = {
+    add(definition: WebSearchDefinition): void;
+    readonly default: {
+        get(): string | undefined;
+        set(providerID: string): void;
+    };
+};
+export type WebSearchDomain = {
+    readonly transform: Transform<WebSearchDraft>;
+    readonly reload: () => Promise<void>;
+};
+export type EventDomain = {
+    readonly subscribe: (...args: any[]) => any;
+};
+export type App = {
+    readonly name: string;
+    readonly version: string;
+    readonly channel: string;
+};
+export type PluginContext = {
+    readonly app: App;
+    readonly options: Readonly<Record<string, any>>;
+    readonly aisdk: AISDKDomain;
+    readonly catalog: CatalogDomain;
+    readonly event: EventDomain;
+    readonly integration: IntegrationDomain;
+    readonly session: SessionDomain;
+    readonly tool: ToolDomain;
+    readonly websearch: WebSearchDomain;
+};
+export type Cleanup = () => Promise<void> | void;
+export type Plugin2 = {
+    readonly id: string;
+    readonly setup: (context: PluginContext) => Promise<Cleanup | void> | Cleanup | void;
+};

package/dist/opencode2/types.js

@@ -0,0 +1,18 @@
+/**
+ * Local structural types for the OpenCode 2.0 beta plugin API.
+ *
+ * Why not import from `@opencode-ai/plugin`?
+ *   • The 2.0 types live on the `@next` dist-tag (`0.0.0-next-*`), which cannot
+ *     coexist with this package's existing `@opencode-ai/plugin@^1.17.13`
+ *     dependency under the same module specifier.
+ *   • 2.0 is beta and its schema churns; a hand-maintained subset of only what
+ *     we touch is more stable than pinning a moving target.
+ *
+ * These mirror `@opencode-ai/plugin@next` `dist/promise/*.d.ts` as of
+ * `0.0.0-next-16281`. `test/opencode2-conformance.test-d.ts` asserts our
+ * default export still satisfies the real 2.0 `Plugin` interface.
+ *
+ * Effect `Schema` brands (Provider.ID, Model.ID, …) are modelled as plain
+ * `string`; brands are compile-time only and erase at runtime.
+ */
+export {};

package/dist/plugin-core.d.ts

@@ -0,0 +1,27 @@
+import { createCursorLanguageModel } from "./language-model.js";
+import type { CreateCursorOptions } from "./index.js";
+/**
+ * Runtime-agnostic pieces shared by every plugin surface:
+ *   • classic Hooks plugin      (`plugin.ts`)
+ *   • OpenCode 1.18 v2 plugin   (`plugin-v2.ts`)
+ *   • OpenCode 2.0 beta plugin  (`plugin-opencode2.ts`)
+ *
+ * Nothing here may import a host plugin API — the 1.18 and 2.0 APIs are
+ * source-incompatible, so anything host-shaped belongs in the entrypoint.
+ */
+/** Minimal AI SDK provider surface OpenCode expects from an `aisdk` package. */
+export type CursorSdk = {
+    languageModel(modelId: string): ReturnType<typeof createCursorLanguageModel>;
+};
+export declare function createSdk(options: CreateCursorOptions): CursorSdk;
+/**
+ * Whether an OpenCode `aisdk` package string refers to this provider.
+ *
+ * Matches on the provider id first (the common case once the catalog entry is
+ * ours), then on the package specifier so a bare `cursor-opencode-provider`,
+ * an `aisdk:`-prefixed form, or a resolved `dist/index.js` file URL all hit.
+ */
+export declare function isCursorPackage(pkg: string, providerID: string): boolean;
+/** API base for auth, model discovery, and GetServerConfig. */
+export declare function cursorApiBaseURL(): string;
+export declare function cursorGetServerConfigTelemetryEnabled(): boolean;

package/dist/plugin-core.js

@@ -0,0 +1,31 @@
+import { CURSOR_API_HOST, CURSOR_PROVIDER_ID } from "./shared.js";
+import { createCursorLanguageModel } from "./language-model.js";
+export function createSdk(options) {
+    const providerId = options.name || CURSOR_PROVIDER_ID;
+    return {
+        languageModel(modelId) {
+            return createCursorLanguageModel(modelId, providerId, options);
+        },
+    };
+}
+/**
+ * Whether an OpenCode `aisdk` package string refers to this provider.
+ *
+ * Matches on the provider id first (the common case once the catalog entry is
+ * ours), then on the package specifier so a bare `cursor-opencode-provider`,
+ * an `aisdk:`-prefixed form, or a resolved `dist/index.js` file URL all hit.
+ */
+export function isCursorPackage(pkg, providerID) {
+    if (providerID === CURSOR_PROVIDER_ID)
+        return true;
+    return (pkg.includes("cursor-opencode-provider") ||
+        /cursor-opencode-provider[/\\]dist[/\\]index\.js/.test(pkg));
+}
+/** API base for auth, model discovery, and GetServerConfig. */
+export function cursorApiBaseURL() {
+    return process.env.CURSOR_API_BASE_URL ?? `https://${CURSOR_API_HOST}`;
+}
+export function cursorGetServerConfigTelemetryEnabled() {
+    return (process.env.CURSOR_GET_SERVER_CONFIG_TELEMETRY === "1" ||
+        process.env.CURSOR_GET_SERVER_CONFIG_TELEMETRY === "true");
+}

package/dist/plugin-opencode2.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin2 } from "./opencode2/types.js";
+declare const plugin: Plugin2;
+export default plugin;