cursor-opencode-provider 0.8.0 → 0.8.3

package/SECURITY.md

@@ -1,31 +1,52 @@
-# Security notes
+# Security
 
-This provider mirrors OpenCode’s trust model for project configuration. That has implications for what ends up in Cursor context.
+## Threat Model
 
-## Project `instructions` can include arbitrary local paths
+### Overview
 
-OpenCode’s `opencode.json` / `opencode.jsonc` `instructions` array may list:
+cursor-opencode-provider is an OpenCode plugin and AI SDK provider that speaks Cursor's private agent protocol. Through the host it can trigger powerful tools (shell, file operations, network access via host MCP/tools) and it sends workspace context, instructions, and tool results to Cursor.
+
+### No Sandbox
+
+Neither this provider nor OpenCode's permission system is a security sandbox. Permissions help users review and control actions; they are not an isolation boundary.
+
+If you need isolation, run the host in a disposable container, virtual machine, or similarly restricted environment. Review project instructions and third-party tool or MCP server configuration before allowing them to execute.
+
+### Project `instructions` can include arbitrary local paths
+
+This provider mirrors OpenCode's trust model for project configuration. That has implications for what ends up in Cursor context.
+
+OpenCode's `opencode.json` / `opencode.jsonc` `instructions` array may list:
 
 - relative paths / globs (e.g. `.cursor/rules/*.md`)
 - absolute paths
 - home-relative paths (`~/…`)
-- remote URLs (`https://…`; this provider fetches HTTPS only)
+- remote URLs supported by the host
 
-OpenCode itself expands `~/`, accepts absolute paths, and injects those file contents into the model prompt for **every** provider. This package does the same discovery when building Cursor `RequestContext.rules`.
+OpenCode owns instruction discovery and supplies the resulting system prompt
+to the AI SDK provider. This package forwards that prompt as Cursor's
+always-apply system-instructions rule; it does not independently read instruction
+or skill file bodies or fetch instruction URLs. Its merged-config read supplies
+MCP server ids, plugin metadata and interaction guidance
+([`src/context/rules.ts`](src/context/rules.ts),
+[`src/context/build.ts`](src/context/build.ts)).
 
 So a project config like:
 
 ```json
 {
-  "instructions": ["~/.ssh/id_rsa", "/etc/passwd"]
+  "instructions": ["docs/project-guide.md", "/absolute/path/to/approved-guide.md"]
 }
 ```
 
-can cause those files to be read and sent to the model provider (OpenCode prompt path and/or this provider’s Cursor `RequestContext`). That is intentional OpenCode parity, not a Cursor-only hole. There is no path allowlist that rejects absolute/`~/` instruction paths (matching OpenCode; OpenCode has not treated this as a defect).
+can cause those files to be read by OpenCode and included in the prompt sent to
+Cursor. The provider does not add an instruction-path allowlist or remove content
+already supplied by the host. Review instruction paths before enabling project
+configuration, especially if they could refer to sensitive local files.
 
 Treat project `opencode.json` as **trusted**. Do not open untrusted repositories with project config enabled if that is unacceptable.
 
-## Mitigation: disable project config
+#### Mitigation: disable project config
 
 To ignore project-level OpenCode config (including project `instructions` and project `AGENTS.md` / `CLAUDE.md` / `CONTEXT.md` discovery), set:
 
@@ -33,10 +54,37 @@ To ignore project-level OpenCode config (including project `instructions` and pr
 export OPENCODE_DISABLE_PROJECT_CONFIG=1
 ```
 
-OpenCode honors this flag when loading config and assembling prompts. This provider honors the same flag when collecting rules for Cursor `RequestContext`, so project `instructions` are not merged and project instruction files are not auto-discovered. Global config under `~/.config/opencode` (and `~/.claude/CLAUDE.md` when applicable) still applies.
+Set this before starting OpenCode and use the host's project-config controls to
+suppress project instructions. The provider also skips its own project config
+metadata reads when this flag is set; global config still applies. It cannot
+remove instruction text that a host has already included in the supplied prompt
+([`loadMergedConfig`](src/context/rules.ts)).
 
 Truthy values: `1` or `true` (case-insensitive), same as OpenCode.
 
-## Related hardening in this provider
+Instruction URL fetching and redirect policy belong to the host; this provider
+has no separate instruction-fetch policy.
+
+### Out of Scope
+
+| Category | Rationale |
+| --- | --- |
+| **Sandbox escapes** | The host permission system is not a sandbox (see above) |
+| **Cursor / LLM data handling** | Data sent to Cursor is governed by Cursor's policies and your account terms |
+| **MCP server behavior** | External MCP servers you configure are outside our trust boundary |
+| **Malicious project config** | Users control their own configuration; trusted project `instructions` reading absolute/`~/` paths is expected OpenCode parity (see above) |
+| **Host tool execution after user approval** | Actions the host runs under its normal permission prompts are expected behavior |
+
+---
+
+## Reporting Security Issues
+
+Do not report a suspected vulnerability in a public GitHub issue, discussion, or pull request.
+
+Use GitHub's private [vulnerability reporting form](https://github.com/oakimov/cursor-opencode-provider/security/advisories/new). This keeps the report and subsequent discussion private between the reporter and the repository maintainers.
+
+Include the affected version, environment (OpenCode 1.x vs 2.0, plugin entrypoint), impact, reproduction steps, and any suggested mitigation. The initial message should not include credentials, personal data, or exploit code beyond what is needed to reproduce the issue. If the report requires sensitive supporting material, first send a minimal description and ask the maintainers to coordinate a suitable transfer method.
+
+Reports must describe a concrete, reproducible security impact. Automated scanner output or model-generated speculation without validation may not receive a response.
 
-- Remote `instructions` URLs are **HTTPS-only** (`http://` is skipped). Redirects (including to a local proxy) are intentional and not blocked.
+We will make a reasonable effort to acknowledge valid reports, but we cannot promise a specific response or remediation timeline.

package/dist/activity.d.ts

@@ -1,15 +1,87 @@
+/** A host tool may keep its Run open this long from its own start. */
+export declare const RUNNING_TOOL_CAP_MS: number;
+type RunningTool = {
+    sessionId: string;
+    startedAt: number;
+};
+/**
+ * Everything the tracker knows, as plain data. The plugin that receives host
+ * events and the provider that holds the Run can be different module copies
+ * (OpenCode 2 loads one per location), so the process-wide tracker keeps this
+ * in `processShared`: parent links, activity and prompts must all be seen by
+ * the copy that renews the Run's lease.
+ */
+export type SessionActivityState = {
+    parentBySession: Map<string, string>;
+    lastActivityBySession: Map<string, number>;
+    /** Open host prompts: `${sessionId}\0${requestId}` → session id and when it opened. */
+    openPrompts: Map<string, {
+        sessionId: string;
+        openedAt: number;
+    }>;
+    /** `${sessionId}\0${callId}` → when that host tool started running. */
+    runningTools: Map<string, RunningTool>;
+};
+export declare function createSessionActivityState(): SessionActivityState;
 export type SessionActivitySource = {
     lastActivityAt(sessionId: string): number | undefined;
+    /**
+     * Latest 4h ceiling among host tools still running in this session or a
+     * descendant. Undefined when none are still inside their own ceiling.
+     */
+    runningToolDeadline?(sessionId: string, now: number, toolCapMs: number): number | undefined;
 };
-/** Tracks OpenCode message progress and propagates it through subagent ancestry. */
+/**
+ * Tracks OpenCode message progress and propagates it through subagent ancestry.
+ *
+ * A permission or question prompt the host has open is waiting on the user, not
+ * stalled: the host emits no events until the user answers, so an open prompt
+ * counts as current activity for its session and every ancestor.
+ */
 export declare class SessionActivityTracker implements SessionActivitySource {
     private readonly parentBySession;
     private readonly lastActivityBySession;
+    private readonly openPrompts;
+    private readonly runningTools;
+    constructor(state?: SessionActivityState);
     linkSession(sessionId: string, parentId?: string): void;
     recordActivity(sessionId: string, at?: number): void;
     lastActivityAt(sessionId: string): number | undefined;
+    /** The host opened a permission or question prompt in `sessionId`. */
+    openPrompt(sessionId: string, requestId: string, at?: number): void;
+    /** The prompt was answered, rejected or cancelled. */
+    closePrompt(sessionId: string, requestId: string, at?: number): void;
+    /**
+     * The host started running this tool. A repeated start keeps the original
+     * time so a later event cannot extend the 4h ceiling.
+     */
+    toolStarted(sessionId: string, callId: string, at?: number): void;
+    /** Drop every running tool for this session. Activity history stays. */
+    endRunningTools(sessionId: string, at?: number): void;
+    /** The host finished the tool. The normal inactivity cap applies from now. */
+    toolEnded(sessionId: string, callId: string, at?: number): void;
+    runningToolDeadline(sessionId: string, now: number, toolCapMs: number): number | undefined;
     removeSession(sessionId: string): void;
     clear(): void;
+    /** A prompt is open in `sessionId` or in one of its descendants. */
+    private awaitsUser;
     private prune;
+    private belongsTo;
+    private clearRunningTools;
 }
 export declare const sessionActivity: SessionActivityTracker;
+/**
+ * Open or close a host prompt from an OpenCode event. OpenCode 1.x publishes
+ * `permission.asked` / `permission.replied` and `question.asked` /
+ * `question.replied` / `question.rejected` (older releases used
+ * `permission.updated` and `permissionID`); OpenCode 2 publishes the same
+ * permission events plus `form.created` / `form.replied` / `form.cancelled`.
+ */
+export declare function applyHostPromptEvent(tracker: SessionActivityTracker, type: unknown, payload: unknown): void;
+/**
+ * A host tool that is actually running holds the Run past the inactivity cap.
+ * OpenCode 1 reports that on the tool part (`running`, and not provider-executed).
+ * OpenCode 2 reports it on `session.tool.called` when `executed` is not true.
+ */
+export declare function applyHostToolEvent(tracker: SessionActivityTracker, type: unknown, payload: unknown): void;
+export {};

package/dist/activity.js

@@ -1,10 +1,35 @@
+import { processShared } from "./process-shared.js";
+/** A host tool may keep its Run open this long from its own start. */
+export const RUNNING_TOOL_CAP_MS = 4 * 60 * 60 * 1_000;
+export function createSessionActivityState() {
+    return {
+        parentBySession: new Map(),
+        lastActivityBySession: new Map(),
+        openPrompts: new Map(),
+        runningTools: new Map(),
+    };
+}
 const MAX_ANCESTRY_DEPTH = 64;
 const MAX_TRACKED_SESSIONS = 1_024;
 const ACTIVITY_RETENTION_MS = 24 * 60 * 60 * 1_000;
-/** Tracks OpenCode message progress and propagates it through subagent ancestry. */
+/**
+ * Tracks OpenCode message progress and propagates it through subagent ancestry.
+ *
+ * A permission or question prompt the host has open is waiting on the user, not
+ * stalled: the host emits no events until the user answers, so an open prompt
+ * counts as current activity for its session and every ancestor.
+ */
 export class SessionActivityTracker {
-    parentBySession = new Map();
-    lastActivityBySession = new Map();
+    parentBySession;
+    lastActivityBySession;
+    openPrompts;
+    runningTools;
+    constructor(state = createSessionActivityState()) {
+        this.parentBySession = state.parentBySession;
+        this.lastActivityBySession = state.lastActivityBySession;
+        this.openPrompts = state.openPrompts;
+        this.runningTools = state.runningTools;
+    }
     linkSession(sessionId, parentId) {
         if (!sessionId)
             return;
@@ -39,19 +64,114 @@ export class SessionActivityTracker {
         this.prune(at);
     }
     lastActivityAt(sessionId) {
-        this.prune(Date.now());
+        const now = Date.now();
+        this.prune(now);
+        if (this.awaitsUser(sessionId))
+            return now;
         return this.lastActivityBySession.get(sessionId);
     }
+    /** The host opened a permission or question prompt in `sessionId`. */
+    openPrompt(sessionId, requestId, at = Date.now()) {
+        if (!sessionId || !requestId)
+            return;
+        const key = `${sessionId}\0${requestId}`;
+        this.openPrompts.delete(key);
+        this.openPrompts.set(key, { sessionId, openedAt: at });
+        this.recordActivity(sessionId, at);
+    }
+    /** The prompt was answered, rejected or cancelled. */
+    closePrompt(sessionId, requestId, at = Date.now()) {
+        if (!sessionId || !requestId)
+            return;
+        this.openPrompts.delete(`${sessionId}\0${requestId}`);
+        this.recordActivity(sessionId, at);
+    }
+    /**
+     * The host started running this tool. A repeated start keeps the original
+     * time so a later event cannot extend the 4h ceiling.
+     */
+    toolStarted(sessionId, callId, at = Date.now()) {
+        if (!sessionId || !callId || !Number.isFinite(at))
+            return;
+        const key = `${sessionId}\0${callId}`;
+        if (!this.runningTools.has(key))
+            this.runningTools.set(key, { sessionId, startedAt: at });
+        this.recordActivity(sessionId, at);
+    }
+    /** Drop every running tool for this session. Activity history stays. */
+    endRunningTools(sessionId, at = Date.now()) {
+        if (!sessionId)
+            return;
+        let ended = false;
+        for (const [key, tool] of this.runningTools) {
+            if (tool.sessionId !== sessionId)
+                continue;
+            this.runningTools.delete(key);
+            ended = true;
+        }
+        if (ended)
+            this.recordActivity(sessionId, at);
+    }
+    /** The host finished the tool. The normal inactivity cap applies from now. */
+    toolEnded(sessionId, callId, at = Date.now()) {
+        if (!sessionId || !callId)
+            return;
+        this.runningTools.delete(`${sessionId}\0${callId}`);
+        this.recordActivity(sessionId, at);
+    }
+    runningToolDeadline(sessionId, now, toolCapMs) {
+        let deadline;
+        for (const tool of this.runningTools.values()) {
+            if (!this.belongsTo(tool.sessionId, sessionId))
+                continue;
+            const cap = tool.startedAt + toolCapMs;
+            if (now >= cap)
+                continue;
+            deadline = deadline === undefined ? cap : Math.max(deadline, cap);
+        }
+        return deadline;
+    }
     removeSession(sessionId) {
         this.parentBySession.delete(sessionId);
         this.lastActivityBySession.delete(sessionId);
+        for (const [key, prompt] of this.openPrompts) {
+            if (prompt.sessionId === sessionId)
+                this.openPrompts.delete(key);
+        }
+        this.clearRunningTools(sessionId);
     }
     clear() {
         this.parentBySession.clear();
         this.lastActivityBySession.clear();
+        this.openPrompts.clear();
+        this.runningTools.clear();
+    }
+    /** A prompt is open in `sessionId` or in one of its descendants. */
+    awaitsUser(sessionId) {
+        for (const prompt of this.openPrompts.values()) {
+            let current = prompt.sessionId;
+            for (let depth = 0; current && depth < MAX_ANCESTRY_DEPTH; depth++) {
+                if (current === sessionId)
+                    return true;
+                current = this.parentBySession.get(current);
+            }
+        }
+        return false;
     }
     prune(now) {
         const oldestAllowed = now - ACTIVITY_RETENTION_MS;
+        // A prompt whose reply never arrived must not hold a Run open forever.
+        for (const [key, prompt] of this.openPrompts) {
+            if (prompt.openedAt >= oldestAllowed)
+                break;
+            this.openPrompts.delete(key);
+        }
+        while (this.openPrompts.size > MAX_TRACKED_SESSIONS) {
+            const oldest = this.openPrompts.keys().next().value;
+            if (!oldest)
+                break;
+            this.openPrompts.delete(oldest);
+        }
         for (const [sessionId, activityAt] of this.lastActivityBySession) {
             if (activityAt >= oldestAllowed)
                 break;
@@ -71,6 +191,112 @@ export class SessionActivityTracker {
                 break;
             this.parentBySession.delete(oldest);
         }
+        for (const [key, tool] of this.runningTools) {
+            if (tool.startedAt < oldestAllowed)
+                this.runningTools.delete(key);
+        }
+        // A tool whose end event never arrived must not grow the map without bound.
+        while (this.runningTools.size > MAX_TRACKED_SESSIONS) {
+            const oldest = this.runningTools.keys().next().value;
+            if (!oldest)
+                break;
+            this.runningTools.delete(oldest);
+        }
+    }
+    belongsTo(toolSessionId, sessionId) {
+        let current = toolSessionId;
+        for (let depth = 0; current && depth < MAX_ANCESTRY_DEPTH; depth++) {
+            if (current === sessionId)
+                return true;
+            current = this.parentBySession.get(current);
+        }
+        return false;
+    }
+    clearRunningTools(sessionId) {
+        for (const [key, tool] of this.runningTools) {
+            if (tool.sessionId === sessionId)
+                this.runningTools.delete(key);
+        }
+    }
+}
+export const sessionActivity = new SessionActivityTracker(processShared("session-activity.v1", createSessionActivityState));
+/**
+ * Open or close a host prompt from an OpenCode event. OpenCode 1.x publishes
+ * `permission.asked` / `permission.replied` and `question.asked` /
+ * `question.replied` / `question.rejected` (older releases used
+ * `permission.updated` and `permissionID`); OpenCode 2 publishes the same
+ * permission events plus `form.created` / `form.replied` / `form.cancelled`.
+ */
+export function applyHostPromptEvent(tracker, type, payload) {
+    const data = payload && typeof payload === "object" ? payload : {};
+    const text = (value) => typeof value === "string" ? value : "";
+    switch (type) {
+        case "permission.asked":
+        case "permission.updated":
+        case "question.asked":
+            tracker.openPrompt(text(data.sessionID), text(data.id));
+            break;
+        case "permission.replied":
+        case "question.replied":
+        case "question.rejected":
+            tracker.closePrompt(text(data.sessionID), text(data.requestID) || text(data.permissionID));
+            break;
+        case "form.created": {
+            const form = data.form && typeof data.form === "object" ? data.form : {};
+            tracker.openPrompt(text(form.sessionID), text(form.id));
+            break;
+        }
+        case "form.replied":
+        case "form.cancelled":
+            tracker.closePrompt(text(data.sessionID), text(data.id));
+            break;
+    }
+}
+/**
+ * A host tool that is actually running holds the Run past the inactivity cap.
+ * OpenCode 1 reports that on the tool part (`running`, and not provider-executed).
+ * OpenCode 2 reports it on `session.tool.called` when `executed` is not true.
+ */
+export function applyHostToolEvent(tracker, type, payload) {
+    const data = payload && typeof payload === "object" ? payload : {};
+    const text = (value) => typeof value === "string" ? value : "";
+    if (type === "message.part.updated") {
+        const part = data.part && typeof data.part === "object" ? data.part : undefined;
+        if (!part || part.type !== "tool")
+            return;
+        const sessionId = text(part.sessionID);
+        const callId = text(part.callID) || text(part.callId);
+        const state = part.state && typeof part.state === "object" ? part.state : undefined;
+        const metadata = part.metadata && typeof part.metadata === "object"
+            ? part.metadata
+            : undefined;
+        if (!sessionId || !callId || !state)
+            return;
+        if (state.status === "running" && metadata?.providerExecuted !== true)
+            tracker.toolStarted(sessionId, callId);
+        else if (state.status === "completed" || state.status === "error")
+            tracker.toolEnded(sessionId, callId);
+        return;
+    }
+    if (type === "session.tool.called") {
+        const sessionId = text(data.sessionID);
+        const callId = text(data.id) || text(data.callID);
+        if (!sessionId || !callId || data.executed === true)
+            return;
+        tracker.toolStarted(sessionId, callId);
+        return;
+    }
+    if (type === "session.tool.success" || type === "session.tool.failed") {
+        const sessionId = text(data.sessionID);
+        const callId = text(data.id) || text(data.callID);
+        if (sessionId && callId)
+            tracker.toolEnded(sessionId, callId);
+        return;
+    }
+    if (type === "session.idle") {
+        const info = data.info && typeof data.info === "object" ? data.info : undefined;
+        const sessionId = text(data.sessionID) || text(info?.id);
+        if (sessionId)
+            tracker.endRunningTools(sessionId);
     }
 }
-export const sessionActivity = new SessionActivityTracker();

package/dist/agent-url.js

@@ -2,10 +2,13 @@ import { createHash } from "node:crypto";
 import { fetchAgentUrl } from "./transport/connect.js";
 import { errorMessage, trace } from "./debug.js";
 import { CURSOR_API_HOST } from "./shared.js";
+import { processShared } from "./process-shared.js";
+import { CursorAuthError, CursorProtocolError, CursorProviderError, CursorServerError, CursorTransportError, toCursorProviderError, } from "./errors.js";
 const DEFAULT_API_BASE = `https://${CURSOR_API_HOST}`;
 // In-process memo of the region-specific Run stream origin (agentnUrl). Resolved
-// once per process — the auth loader warms it, and the first startSession reuses
-// it — and held for the process lifetime. Region routing is near-static, and
+// once per process, shared by every copy of this package that the host loads.
+// The auth loader warms it and the first startSession reuses it. It is held
+// for the process lifetime. Region routing is near-static, and
 // re-resolving mid-session would break a held-open bidi Run stream anyway.
 //
 // Unlike the models/version caches this is NOT persisted to disk. A wrong agent
@@ -26,9 +29,23 @@ function resolveCacheKey(token, options) {
     const tokenHash = createHash("sha256").update(token).digest("hex").slice(0, 16);
     return `${tokenHash}|${normalizeApiBaseURL(options.apiBaseURL ?? options.baseURL)}|telem:${options.telemetryEnabled === true}`;
 }
-const _resolved = new Map();
-// In-flight fetches share the same key as resolved URLs so concurrent callers dedup per account.
-const _inflight = new Map();
+const _resolved = processShared("agent-url.resolved.v1", () => new Map());
+const _inflight = processShared("agent-url.inflight.v2", () => new Map());
+// A shared promise must not reject with another module graph's error instance,
+// nor let one caller's replay-safety mutation alter a sibling caller's error.
+async function localResult(promise) {
+    const result = await promise;
+    if ("url" in result)
+        return result.url;
+    const { message, ...options } = result.failure;
+    switch (options.origin) {
+        case "auth": throw new CursorAuthError(message, options);
+        case "transport": throw new CursorTransportError(message, options);
+        case "server": throw new CursorServerError(message, options);
+        case "protocol": throw new CursorProtocolError(message, options);
+        default: throw new CursorProviderError(message, options);
+    }
+}
 /**
  * Resolve the Run stream origin for this account via the `GetServerConfig`
  * Connect RPC. Memoized for the process lifetime.
@@ -49,26 +66,37 @@ export async function resolveAgentUrl(token, options = {}) {
     const inflight = _inflight.get(cacheKey);
     if (inflight) {
         trace("agent-url: awaiting in-flight GetServerConfig");
-        return inflight;
+        return localResult(inflight);
     }
     const promise = (async () => {
         try {
             const url = await fetchAgentUrl(token, options);
             _resolved.set(cacheKey, url);
             trace(`agent-url: resolved via GetServerConfig → ${url}`);
-            return url;
+            return { url };
         }
         catch (err) {
             const reason = errorMessage(err);
             trace(`agent-url: GetServerConfig failed (${reason}); no fallback agent host will be used`);
-            throw err;
+            const failure = toCursorProviderError(err, { replaySafe: true });
+            return { failure: {
+                    message: failure.message,
+                    origin: failure.origin,
+                    transient: failure.transient,
+                    replaySafe: failure.replaySafe,
+                    statusCode: failure.statusCode,
+                    grpcStatus: failure.grpcStatus,
+                    rstCode: failure.rstCode,
+                    code: failure.code,
+                    retryAfterMs: failure.retryAfterMs,
+                } };
         }
         finally {
             _inflight.delete(cacheKey);
         }
     })();
     _inflight.set(cacheKey, promise);
-    return promise;
+    return localResult(promise);
 }
 /** Reset the in-process memo. Tests only. */
 export function resetAgentUrlCache() {

package/dist/auth-renewal.d.ts

@@ -33,7 +33,7 @@ export type SessionRenewal = {
  * older stored credential (persisting failed, or a host that persists only
  * later) gets the newest token instead of renewing again.
  */
-export declare function latestSessionTokens(tokens: SessionTokens): SessionTokens;
+export declare function latestSessionTokens(tokens: SessionTokens, baseUrl?: string): SessionTokens;
 export declare function isSessionRenewalDue(token: string, now?: number): boolean;
 /**
  * Return a usable session token, renewing it first when it is due (or when