cursor-opencode-provider 0.8.1 → 0.8.3

package/SECURITY.md

@@ -21,19 +21,28 @@ OpenCode's `opencode.json` / `opencode.jsonc` `instructions` array may list:
 - relative paths / globs (e.g. `.cursor/rules/*.md`)
 - absolute paths
 - home-relative paths (`~/…`)
-- remote URLs (`https://…`; this provider fetches HTTPS only)
+- remote URLs supported by the host
 
-OpenCode itself expands `~/`, accepts absolute paths, and injects those file contents into the model prompt for **every** provider. This package does the same discovery when building Cursor `RequestContext.rules`.
+OpenCode owns instruction discovery and supplies the resulting system prompt
+to the AI SDK provider. This package forwards that prompt as Cursor's
+always-apply system-instructions rule; it does not independently read instruction
+or skill file bodies or fetch instruction URLs. Its merged-config read supplies
+MCP server ids, plugin metadata and interaction guidance
+([`src/context/rules.ts`](src/context/rules.ts),
+[`src/context/build.ts`](src/context/build.ts)).
 
 So a project config like:
 
 ```json
 {
-  "instructions": ["~/.ssh/id_rsa", "/etc/passwd"]
+  "instructions": ["docs/project-guide.md", "/absolute/path/to/approved-guide.md"]
 }
 ```
 
-can cause those files to be read and sent to the model provider (OpenCode prompt path and/or this provider's Cursor `RequestContext`). That is intentional OpenCode parity, not a Cursor-only hole. There is no path allowlist that rejects absolute/`~/` instruction paths (matching OpenCode; OpenCode has not treated this as a defect).
+can cause those files to be read by OpenCode and included in the prompt sent to
+Cursor. The provider does not add an instruction-path allowlist or remove content
+already supplied by the host. Review instruction paths before enabling project
+configuration, especially if they could refer to sensitive local files.
 
 Treat project `opencode.json` as **trusted**. Do not open untrusted repositories with project config enabled if that is unacceptable.
 
@@ -45,13 +54,16 @@ To ignore project-level OpenCode config (including project `instructions` and pr
 export OPENCODE_DISABLE_PROJECT_CONFIG=1
 ```
 
-OpenCode honors this flag when loading config and assembling prompts. This provider honors the same flag when collecting rules for Cursor `RequestContext`, so project `instructions` are not merged and project instruction files are not auto-discovered. Global config under `~/.config/opencode` (and `~/.claude/CLAUDE.md` when applicable) still applies.
+Set this before starting OpenCode and use the host's project-config controls to
+suppress project instructions. The provider also skips its own project config
+metadata reads when this flag is set; global config still applies. It cannot
+remove instruction text that a host has already included in the supplied prompt
+([`loadMergedConfig`](src/context/rules.ts)).
 
 Truthy values: `1` or `true` (case-insensitive), same as OpenCode.
 
-#### Related hardening in this provider
-
-- Remote `instructions` URLs are **HTTPS-only** (`http://` is skipped). Redirects (including to a local proxy) are intentional and not blocked.
+Instruction URL fetching and redirect policy belong to the host; this provider
+has no separate instruction-fetch policy.
 
 ### Out of Scope
 

package/dist/activity.d.ts

@@ -1,15 +1,87 @@
+/** A host tool may keep its Run open this long from its own start. */
+export declare const RUNNING_TOOL_CAP_MS: number;
+type RunningTool = {
+    sessionId: string;
+    startedAt: number;
+};
+/**
+ * Everything the tracker knows, as plain data. The plugin that receives host
+ * events and the provider that holds the Run can be different module copies
+ * (OpenCode 2 loads one per location), so the process-wide tracker keeps this
+ * in `processShared`: parent links, activity and prompts must all be seen by
+ * the copy that renews the Run's lease.
+ */
+export type SessionActivityState = {
+    parentBySession: Map<string, string>;
+    lastActivityBySession: Map<string, number>;
+    /** Open host prompts: `${sessionId}\0${requestId}` → session id and when it opened. */
+    openPrompts: Map<string, {
+        sessionId: string;
+        openedAt: number;
+    }>;
+    /** `${sessionId}\0${callId}` → when that host tool started running. */
+    runningTools: Map<string, RunningTool>;
+};
+export declare function createSessionActivityState(): SessionActivityState;
 export type SessionActivitySource = {
     lastActivityAt(sessionId: string): number | undefined;
+    /**
+     * Latest 4h ceiling among host tools still running in this session or a
+     * descendant. Undefined when none are still inside their own ceiling.
+     */
+    runningToolDeadline?(sessionId: string, now: number, toolCapMs: number): number | undefined;
 };
-/** Tracks OpenCode message progress and propagates it through subagent ancestry. */
+/**
+ * Tracks OpenCode message progress and propagates it through subagent ancestry.
+ *
+ * A permission or question prompt the host has open is waiting on the user, not
+ * stalled: the host emits no events until the user answers, so an open prompt
+ * counts as current activity for its session and every ancestor.
+ */
 export declare class SessionActivityTracker implements SessionActivitySource {
     private readonly parentBySession;
     private readonly lastActivityBySession;
+    private readonly openPrompts;
+    private readonly runningTools;
+    constructor(state?: SessionActivityState);
     linkSession(sessionId: string, parentId?: string): void;
     recordActivity(sessionId: string, at?: number): void;
     lastActivityAt(sessionId: string): number | undefined;
+    /** The host opened a permission or question prompt in `sessionId`. */
+    openPrompt(sessionId: string, requestId: string, at?: number): void;
+    /** The prompt was answered, rejected or cancelled. */
+    closePrompt(sessionId: string, requestId: string, at?: number): void;
+    /**
+     * The host started running this tool. A repeated start keeps the original
+     * time so a later event cannot extend the 4h ceiling.
+     */
+    toolStarted(sessionId: string, callId: string, at?: number): void;
+    /** Drop every running tool for this session. Activity history stays. */
+    endRunningTools(sessionId: string, at?: number): void;
+    /** The host finished the tool. The normal inactivity cap applies from now. */
+    toolEnded(sessionId: string, callId: string, at?: number): void;
+    runningToolDeadline(sessionId: string, now: number, toolCapMs: number): number | undefined;
     removeSession(sessionId: string): void;
     clear(): void;
+    /** A prompt is open in `sessionId` or in one of its descendants. */
+    private awaitsUser;
     private prune;
+    private belongsTo;
+    private clearRunningTools;
 }
 export declare const sessionActivity: SessionActivityTracker;
+/**
+ * Open or close a host prompt from an OpenCode event. OpenCode 1.x publishes
+ * `permission.asked` / `permission.replied` and `question.asked` /
+ * `question.replied` / `question.rejected` (older releases used
+ * `permission.updated` and `permissionID`); OpenCode 2 publishes the same
+ * permission events plus `form.created` / `form.replied` / `form.cancelled`.
+ */
+export declare function applyHostPromptEvent(tracker: SessionActivityTracker, type: unknown, payload: unknown): void;
+/**
+ * A host tool that is actually running holds the Run past the inactivity cap.
+ * OpenCode 1 reports that on the tool part (`running`, and not provider-executed).
+ * OpenCode 2 reports it on `session.tool.called` when `executed` is not true.
+ */
+export declare function applyHostToolEvent(tracker: SessionActivityTracker, type: unknown, payload: unknown): void;
+export {};

package/dist/activity.js

@@ -1,10 +1,35 @@
+import { processShared } from "./process-shared.js";
+/** A host tool may keep its Run open this long from its own start. */
+export const RUNNING_TOOL_CAP_MS = 4 * 60 * 60 * 1_000;
+export function createSessionActivityState() {
+    return {
+        parentBySession: new Map(),
+        lastActivityBySession: new Map(),
+        openPrompts: new Map(),
+        runningTools: new Map(),
+    };
+}
 const MAX_ANCESTRY_DEPTH = 64;
 const MAX_TRACKED_SESSIONS = 1_024;
 const ACTIVITY_RETENTION_MS = 24 * 60 * 60 * 1_000;
-/** Tracks OpenCode message progress and propagates it through subagent ancestry. */
+/**
+ * Tracks OpenCode message progress and propagates it through subagent ancestry.
+ *
+ * A permission or question prompt the host has open is waiting on the user, not
+ * stalled: the host emits no events until the user answers, so an open prompt
+ * counts as current activity for its session and every ancestor.
+ */
 export class SessionActivityTracker {
-    parentBySession = new Map();
-    lastActivityBySession = new Map();
+    parentBySession;
+    lastActivityBySession;
+    openPrompts;
+    runningTools;
+    constructor(state = createSessionActivityState()) {
+        this.parentBySession = state.parentBySession;
+        this.lastActivityBySession = state.lastActivityBySession;
+        this.openPrompts = state.openPrompts;
+        this.runningTools = state.runningTools;
+    }
     linkSession(sessionId, parentId) {
         if (!sessionId)
             return;
@@ -39,19 +64,114 @@ export class SessionActivityTracker {
         this.prune(at);
     }
     lastActivityAt(sessionId) {
-        this.prune(Date.now());
+        const now = Date.now();
+        this.prune(now);
+        if (this.awaitsUser(sessionId))
+            return now;
         return this.lastActivityBySession.get(sessionId);
     }
+    /** The host opened a permission or question prompt in `sessionId`. */
+    openPrompt(sessionId, requestId, at = Date.now()) {
+        if (!sessionId || !requestId)
+            return;
+        const key = `${sessionId}\0${requestId}`;
+        this.openPrompts.delete(key);
+        this.openPrompts.set(key, { sessionId, openedAt: at });
+        this.recordActivity(sessionId, at);
+    }
+    /** The prompt was answered, rejected or cancelled. */
+    closePrompt(sessionId, requestId, at = Date.now()) {
+        if (!sessionId || !requestId)
+            return;
+        this.openPrompts.delete(`${sessionId}\0${requestId}`);
+        this.recordActivity(sessionId, at);
+    }
+    /**
+     * The host started running this tool. A repeated start keeps the original
+     * time so a later event cannot extend the 4h ceiling.
+     */
+    toolStarted(sessionId, callId, at = Date.now()) {
+        if (!sessionId || !callId || !Number.isFinite(at))
+            return;
+        const key = `${sessionId}\0${callId}`;
+        if (!this.runningTools.has(key))
+            this.runningTools.set(key, { sessionId, startedAt: at });
+        this.recordActivity(sessionId, at);
+    }
+    /** Drop every running tool for this session. Activity history stays. */
+    endRunningTools(sessionId, at = Date.now()) {
+        if (!sessionId)
+            return;
+        let ended = false;
+        for (const [key, tool] of this.runningTools) {
+            if (tool.sessionId !== sessionId)
+                continue;
+            this.runningTools.delete(key);
+            ended = true;
+        }
+        if (ended)
+            this.recordActivity(sessionId, at);
+    }
+    /** The host finished the tool. The normal inactivity cap applies from now. */
+    toolEnded(sessionId, callId, at = Date.now()) {
+        if (!sessionId || !callId)
+            return;
+        this.runningTools.delete(`${sessionId}\0${callId}`);
+        this.recordActivity(sessionId, at);
+    }
+    runningToolDeadline(sessionId, now, toolCapMs) {
+        let deadline;
+        for (const tool of this.runningTools.values()) {
+            if (!this.belongsTo(tool.sessionId, sessionId))
+                continue;
+            const cap = tool.startedAt + toolCapMs;
+            if (now >= cap)
+                continue;
+            deadline = deadline === undefined ? cap : Math.max(deadline, cap);
+        }
+        return deadline;
+    }
     removeSession(sessionId) {
         this.parentBySession.delete(sessionId);
         this.lastActivityBySession.delete(sessionId);
+        for (const [key, prompt] of this.openPrompts) {
+            if (prompt.sessionId === sessionId)
+                this.openPrompts.delete(key);
+        }
+        this.clearRunningTools(sessionId);
     }
     clear() {
         this.parentBySession.clear();
         this.lastActivityBySession.clear();
+        this.openPrompts.clear();
+        this.runningTools.clear();
+    }
+    /** A prompt is open in `sessionId` or in one of its descendants. */
+    awaitsUser(sessionId) {
+        for (const prompt of this.openPrompts.values()) {
+            let current = prompt.sessionId;
+            for (let depth = 0; current && depth < MAX_ANCESTRY_DEPTH; depth++) {
+                if (current === sessionId)
+                    return true;
+                current = this.parentBySession.get(current);
+            }
+        }
+        return false;
     }
     prune(now) {
         const oldestAllowed = now - ACTIVITY_RETENTION_MS;
+        // A prompt whose reply never arrived must not hold a Run open forever.
+        for (const [key, prompt] of this.openPrompts) {
+            if (prompt.openedAt >= oldestAllowed)
+                break;
+            this.openPrompts.delete(key);
+        }
+        while (this.openPrompts.size > MAX_TRACKED_SESSIONS) {
+            const oldest = this.openPrompts.keys().next().value;
+            if (!oldest)
+                break;
+            this.openPrompts.delete(oldest);
+        }
         for (const [sessionId, activityAt] of this.lastActivityBySession) {
             if (activityAt >= oldestAllowed)
                 break;
@@ -71,6 +191,112 @@ export class SessionActivityTracker {
                 break;
             this.parentBySession.delete(oldest);
         }
+        for (const [key, tool] of this.runningTools) {
+            if (tool.startedAt < oldestAllowed)
+                this.runningTools.delete(key);
+        }
+        // A tool whose end event never arrived must not grow the map without bound.
+        while (this.runningTools.size > MAX_TRACKED_SESSIONS) {
+            const oldest = this.runningTools.keys().next().value;
+            if (!oldest)
+                break;
+            this.runningTools.delete(oldest);
+        }
+    }
+    belongsTo(toolSessionId, sessionId) {
+        let current = toolSessionId;
+        for (let depth = 0; current && depth < MAX_ANCESTRY_DEPTH; depth++) {
+            if (current === sessionId)
+                return true;
+            current = this.parentBySession.get(current);
+        }
+        return false;
+    }
+    clearRunningTools(sessionId) {
+        for (const [key, tool] of this.runningTools) {
+            if (tool.sessionId === sessionId)
+                this.runningTools.delete(key);
+        }
+    }
+}
+export const sessionActivity = new SessionActivityTracker(processShared("session-activity.v1", createSessionActivityState));
+/**
+ * Open or close a host prompt from an OpenCode event. OpenCode 1.x publishes
+ * `permission.asked` / `permission.replied` and `question.asked` /
+ * `question.replied` / `question.rejected` (older releases used
+ * `permission.updated` and `permissionID`); OpenCode 2 publishes the same
+ * permission events plus `form.created` / `form.replied` / `form.cancelled`.
+ */
+export function applyHostPromptEvent(tracker, type, payload) {
+    const data = payload && typeof payload === "object" ? payload : {};
+    const text = (value) => typeof value === "string" ? value : "";
+    switch (type) {
+        case "permission.asked":
+        case "permission.updated":
+        case "question.asked":
+            tracker.openPrompt(text(data.sessionID), text(data.id));
+            break;
+        case "permission.replied":
+        case "question.replied":
+        case "question.rejected":
+            tracker.closePrompt(text(data.sessionID), text(data.requestID) || text(data.permissionID));
+            break;
+        case "form.created": {
+            const form = data.form && typeof data.form === "object" ? data.form : {};
+            tracker.openPrompt(text(form.sessionID), text(form.id));
+            break;
+        }
+        case "form.replied":
+        case "form.cancelled":
+            tracker.closePrompt(text(data.sessionID), text(data.id));
+            break;
+    }
+}
+/**
+ * A host tool that is actually running holds the Run past the inactivity cap.
+ * OpenCode 1 reports that on the tool part (`running`, and not provider-executed).
+ * OpenCode 2 reports it on `session.tool.called` when `executed` is not true.
+ */
+export function applyHostToolEvent(tracker, type, payload) {
+    const data = payload && typeof payload === "object" ? payload : {};
+    const text = (value) => typeof value === "string" ? value : "";
+    if (type === "message.part.updated") {
+        const part = data.part && typeof data.part === "object" ? data.part : undefined;
+        if (!part || part.type !== "tool")
+            return;
+        const sessionId = text(part.sessionID);
+        const callId = text(part.callID) || text(part.callId);
+        const state = part.state && typeof part.state === "object" ? part.state : undefined;
+        const metadata = part.metadata && typeof part.metadata === "object"
+            ? part.metadata
+            : undefined;
+        if (!sessionId || !callId || !state)
+            return;
+        if (state.status === "running" && metadata?.providerExecuted !== true)
+            tracker.toolStarted(sessionId, callId);
+        else if (state.status === "completed" || state.status === "error")
+            tracker.toolEnded(sessionId, callId);
+        return;
+    }
+    if (type === "session.tool.called") {
+        const sessionId = text(data.sessionID);
+        const callId = text(data.id) || text(data.callID);
+        if (!sessionId || !callId || data.executed === true)
+            return;
+        tracker.toolStarted(sessionId, callId);
+        return;
+    }
+    if (type === "session.tool.success" || type === "session.tool.failed") {
+        const sessionId = text(data.sessionID);
+        const callId = text(data.id) || text(data.callID);
+        if (sessionId && callId)
+            tracker.toolEnded(sessionId, callId);
+        return;
+    }
+    if (type === "session.idle") {
+        const info = data.info && typeof data.info === "object" ? data.info : undefined;
+        const sessionId = text(data.sessionID) || text(info?.id);
+        if (sessionId)
+            tracker.endRunningTools(sessionId);
     }
 }
-export const sessionActivity = new SessionActivityTracker();

package/dist/agent-url.js

@@ -2,10 +2,13 @@ import { createHash } from "node:crypto";
 import { fetchAgentUrl } from "./transport/connect.js";
 import { errorMessage, trace } from "./debug.js";
 import { CURSOR_API_HOST } from "./shared.js";
+import { processShared } from "./process-shared.js";
+import { CursorAuthError, CursorProtocolError, CursorProviderError, CursorServerError, CursorTransportError, toCursorProviderError, } from "./errors.js";
 const DEFAULT_API_BASE = `https://${CURSOR_API_HOST}`;
 // In-process memo of the region-specific Run stream origin (agentnUrl). Resolved
-// once per process — the auth loader warms it, and the first startSession reuses
-// it — and held for the process lifetime. Region routing is near-static, and
+// once per process, shared by every copy of this package that the host loads.
+// The auth loader warms it and the first startSession reuses it. It is held
+// for the process lifetime. Region routing is near-static, and
 // re-resolving mid-session would break a held-open bidi Run stream anyway.
 //
 // Unlike the models/version caches this is NOT persisted to disk. A wrong agent
@@ -26,9 +29,23 @@ function resolveCacheKey(token, options) {
     const tokenHash = createHash("sha256").update(token).digest("hex").slice(0, 16);
     return `${tokenHash}|${normalizeApiBaseURL(options.apiBaseURL ?? options.baseURL)}|telem:${options.telemetryEnabled === true}`;
 }
-const _resolved = new Map();
-// In-flight fetches share the same key as resolved URLs so concurrent callers dedup per account.
-const _inflight = new Map();
+const _resolved = processShared("agent-url.resolved.v1", () => new Map());
+const _inflight = processShared("agent-url.inflight.v2", () => new Map());
+// A shared promise must not reject with another module graph's error instance,
+// nor let one caller's replay-safety mutation alter a sibling caller's error.
+async function localResult(promise) {
+    const result = await promise;
+    if ("url" in result)
+        return result.url;
+    const { message, ...options } = result.failure;
+    switch (options.origin) {
+        case "auth": throw new CursorAuthError(message, options);
+        case "transport": throw new CursorTransportError(message, options);
+        case "server": throw new CursorServerError(message, options);
+        case "protocol": throw new CursorProtocolError(message, options);
+        default: throw new CursorProviderError(message, options);
+    }
+}
 /**
  * Resolve the Run stream origin for this account via the `GetServerConfig`
  * Connect RPC. Memoized for the process lifetime.
@@ -49,26 +66,37 @@ export async function resolveAgentUrl(token, options = {}) {
     const inflight = _inflight.get(cacheKey);
     if (inflight) {
         trace("agent-url: awaiting in-flight GetServerConfig");
-        return inflight;
+        return localResult(inflight);
     }
     const promise = (async () => {
         try {
             const url = await fetchAgentUrl(token, options);
             _resolved.set(cacheKey, url);
             trace(`agent-url: resolved via GetServerConfig → ${url}`);
-            return url;
+            return { url };
         }
         catch (err) {
             const reason = errorMessage(err);
             trace(`agent-url: GetServerConfig failed (${reason}); no fallback agent host will be used`);
-            throw err;
+            const failure = toCursorProviderError(err, { replaySafe: true });
+            return { failure: {
+                    message: failure.message,
+                    origin: failure.origin,
+                    transient: failure.transient,
+                    replaySafe: failure.replaySafe,
+                    statusCode: failure.statusCode,
+                    grpcStatus: failure.grpcStatus,
+                    rstCode: failure.rstCode,
+                    code: failure.code,
+                    retryAfterMs: failure.retryAfterMs,
+                } };
         }
         finally {
             _inflight.delete(cacheKey);
         }
     })();
     _inflight.set(cacheKey, promise);
-    return promise;
+    return localResult(promise);
 }
 /** Reset the in-process memo. Tests only. */
 export function resetAgentUrlCache() {

package/dist/auth-renewal.d.ts

@@ -33,7 +33,7 @@ export type SessionRenewal = {
  * older stored credential (persisting failed, or a host that persists only
  * later) gets the newest token instead of renewing again.
  */
-export declare function latestSessionTokens(tokens: SessionTokens): SessionTokens;
+export declare function latestSessionTokens(tokens: SessionTokens, baseUrl?: string): SessionTokens;
 export declare function isSessionRenewalDue(token: string, now?: number): boolean;
 /**
  * Return a usable session token, renewing it first when it is due (or when