stageflow 0.30.0 → 0.31.0

package/dist/agent/cursorProvider.d.ts

@@ -1,7 +1,15 @@
 import { type StageProviderSupport } from "./providerSupport.js";
 export declare function cursorExtensionEntryInPackage(packageRoot: string): string | undefined;
+export declare function resolveBundledCursorExtensionPath(): string | undefined;
+/** `$STAGEFLOW_HOME/agent/npm` install (Pi-style); after bundled dependency. */
+export declare function resolveAgentHomeCursorExtensionPath(): string | undefined;
 export declare function resolveCursorExtensionPath(): string | undefined;
 export declare function isCursorModelRef(modelRef: string): boolean;
 export declare function workshopCursorBridgeHint(toolNames: readonly string[]): string;
 export declare function cursorBridgePrompt(message: string, modelId: string | undefined, toolNames: readonly string[]): string;
 export declare const cursorProviderSupport: StageProviderSupport;
+export declare function readCursorApiKey(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function getCursorHostStatus(env?: NodeJS.ProcessEnv): {
+    cursorSdkReady: boolean;
+    cursorApiKeyConfigured: boolean;
+};

package/dist/agent/cursorProvider.js

@@ -5,10 +5,13 @@
  * module's prepare()/env sealing path.
  */
 import { existsSync, readFileSync } from "node:fs";
-import os from "node:os";
+import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { readSecretFromEnvOrFile } from "../config/secretFromEnvOrFile.js";
+import { globalStageflowHome } from "../project/globalHome.js";
 import { registerProviderSupport, } from "./providerSupport.js";
+import { stageflowAgentAuthPath } from "../runtime/credentialBinding.js";
 const CURSOR_SETTING_SOURCES_ENV = "PI_CURSOR_SETTING_SOURCES";
 /**
  * Locate the pi-cursor-sdk extension entry without opening full global package
@@ -17,21 +20,18 @@ const CURSOR_SETTING_SOURCES_ENV = "PI_CURSOR_SETTING_SOURCES";
  * Resolution order:
  * 1. STAGEFLOW_CURSOR_EXTENSION (absolute path to the extension .ts/.js)
  * 2. Path package from the Pi agent settings.json (same source interactive pi uses)
- * 3. npm install under <pi-agent>/npm/node_modules/pi-cursor-sdk
+ * 3. npm dependency `pi-cursor-sdk` bundled with the Stageflow install (repo or global)
+ * 4. npm install under <stageflow-agent>/npm/node_modules/pi-cursor-sdk
  *    (`dist/index.js` for 0.3+, `src/index.ts` for older publishes)
- * 4. Sibling checkout at ../pi-cursor-sdk relative to this repo
+ * 5. Sibling checkout at ../pi-cursor-sdk relative to this repo
  *
- * A stage worker's HOME is an empty attempt directory, so the Pi agent dir is
- * the directory of STAGEFLOW_PI_HOME_AUTH_PATH when the Host set it, not
- * os.homedir().
+ * A stage worker's HOME is an empty attempt directory; the agent dir comes from
+ * STAGEFLOW_AGENT_AUTH_PATH when the Host set it.
  */
 const CURSOR_PACKAGE_ENTRIES = ["dist/index.js", "src/index.ts"];
-/** Pi agent dir. Stage workers must not use os.homedir(): HOME is the attempt dir. */
+/** Stageflow agent dir ($STAGEFLOW_HOME/agent). Stage workers must not use os.homedir(): HOME is the attempt dir. */
 function piAgentDir() {
-    const auth = process.env.STAGEFLOW_PI_HOME_AUTH_PATH?.trim();
-    if (auth)
-        return path.dirname(path.resolve(auth));
-    return path.join(os.homedir(), ".pi", "agent");
+    return path.dirname(stageflowAgentAuthPath());
 }
 export function cursorExtensionEntryInPackage(packageRoot) {
     for (const rel of CURSOR_PACKAGE_ENTRIES) {
@@ -42,6 +42,21 @@ export function cursorExtensionEntryInPackage(packageRoot) {
     }
     return undefined;
 }
+export function resolveBundledCursorExtensionPath() {
+    const require = createRequire(import.meta.url);
+    let packageRoot;
+    try {
+        packageRoot = path.dirname(require.resolve("pi-cursor-sdk/package.json"));
+    }
+    catch {
+        return undefined;
+    }
+    return cursorExtensionEntryInPackage(packageRoot);
+}
+/** `$STAGEFLOW_HOME/agent/npm` install (Pi-style); after bundled dependency. */
+export function resolveAgentHomeCursorExtensionPath() {
+    return cursorExtensionEntryInPackage(path.join(piAgentDir(), "npm", "node_modules", "pi-cursor-sdk"));
+}
 export function resolveCursorExtensionPath() {
     const fromEnv = process.env.STAGEFLOW_CURSOR_EXTENSION?.trim();
     if (fromEnv && existsSync(fromEnv)) {
@@ -51,7 +66,11 @@ export function resolveCursorExtensionPath() {
     if (fromSettings) {
         return fromSettings;
     }
-    const npmEntry = cursorExtensionEntryInPackage(path.join(piAgentDir(), "npm", "node_modules", "pi-cursor-sdk"));
+    const bundled = resolveBundledCursorExtensionPath();
+    if (bundled) {
+        return bundled;
+    }
+    const npmEntry = resolveAgentHomeCursorExtensionPath();
     if (npmEntry) {
         return npmEntry;
     }
@@ -78,7 +97,7 @@ function sealCursorSettingSources() {
 function missingExtensionReason(modelRef) {
     return [
         `Model "${modelRef}" requires pi-cursor-sdk, but no extension entry was found.`,
-        "Install with `pi install npm:pi-cursor-sdk`, or set STAGEFLOW_CURSOR_EXTENSION",
+        `Install Stageflow with npm (includes pi-cursor-sdk), or set STAGEFLOW_CURSOR_EXTENSION`,
         "to the absolute path of pi-cursor-sdk/dist/index.js (or src/index.ts).",
         "Also ensure a Cursor SDK API key is available via Pi /login or CURSOR_API_KEY.",
     ].join(" ");
@@ -122,6 +141,37 @@ export const cursorProviderSupport = {
         ].join(" ");
     },
 };
+const CURSOR_API_KEY_FILE_NAME = "cursor-api-key";
+export function readCursorApiKey(env = process.env) {
+    let fromEnv;
+    try {
+        fromEnv = readSecretFromEnvOrFile(env, "CURSOR_API_KEY");
+    }
+    catch {
+        return undefined;
+    }
+    if (fromEnv !== undefined && fromEnv.trim() !== "") {
+        return fromEnv.trim();
+    }
+    const filePath = path.join(globalStageflowHome(), "agent", CURSOR_API_KEY_FILE_NAME);
+    if (!existsSync(filePath)) {
+        return undefined;
+    }
+    try {
+        const raw = readFileSync(filePath, "utf8").replace(/\r?\n$/, "").trim();
+        return raw.length > 0 ? raw : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function getCursorHostStatus(env = process.env) {
+    const key = readCursorApiKey(env);
+    return {
+        cursorSdkReady: resolveCursorExtensionPath() !== undefined,
+        cursorApiKeyConfigured: key !== undefined,
+    };
+}
 registerProviderSupport(cursorProviderSupport);
 function resolveFromPiSettings() {
     const agentDir = piAgentDir();

package/dist/agent/providerAuth.d.ts

@@ -25,12 +25,16 @@ export type ProvidersListResult = {
     via: "pi";
     providers: ProviderSummary[];
 };
-export type PiHomeDetectResult = {
-    piHomeUsable: boolean;
+export type ProvidersDetectResult = {
     credentialSource?: CredentialSource;
     provisional: boolean;
     source: CredentialSource;
+    authConfigured: boolean;
+    cursorSdkReady: boolean;
+    cursorApiKeyConfigured: boolean;
 };
+/** @deprecated Use ProvidersDetectResult */
+export type PiHomeDetectResult = ProvidersDetectResult;
 export type ProviderAuthRuntime = {
     getProviders(): readonly Provider[];
     getProvider(providerId: string): Provider | undefined;
@@ -84,7 +88,7 @@ export type OauthLoginResult = {
 };
 export declare function loginWithOauth(cwd: string, providerId: string, interaction: AuthInteraction, ctx?: ProviderAuthContext): Promise<OauthLoginResult>;
 export declare function logoutProvider(cwd: string, providerId: string, ctx?: ProviderAuthContext): Promise<ProviderAuthStatus>;
-export declare function detectPiHome(cwd: string): PiHomeDetectResult;
+export declare function detectPiHome(cwd: string): ProvidersDetectResult;
 export declare function getCredentialSourceSettings(cwd: string): {
     credentialSource?: CredentialSource;
     binding: {

package/dist/agent/providerAuth.js

@@ -1,5 +1,6 @@
 import { CredentialSynchronizationError, ModelRuntime, } from "@earendil-works/pi-coding-agent";
-import { isUsableAuthFile, parseCredentialSource, piHomeAuthPath, resolveCredentialBinding, writeCredentialSourceToContext, } from "../runtime/credentialBinding.js";
+import { parseCredentialSource, resolveCredentialBinding, writeCredentialSourceToContext, isUsableAuthFile, } from "../runtime/credentialBinding.js";
+import { getCursorHostStatus } from "./cursorProvider.js";
 import { readPersistedCredentialSourceFromContext, } from "../runtime/settingsFile.js";
 import { resolveProjectContext } from "../project/resolveProjectContext.js";
 export function makeMutationLock() {
@@ -251,10 +252,11 @@ export function detectPiHome(cwd) {
     const binding = resolveCredentialBinding(projectCtx);
     const persisted = readPersistedCredentialSourceFromContext(projectCtx);
     return {
-        piHomeUsable: isUsableAuthFile(piHomeAuthPath()),
         ...(persisted !== undefined ? { credentialSource: persisted } : {}),
         provisional: binding.provisional,
         source: binding.source,
+        authConfigured: isUsableAuthFile(binding.authPath),
+        ...getCursorHostStatus(),
     };
 }
 export function getCredentialSourceSettings(cwd) {
@@ -272,7 +274,7 @@ export function getCredentialSourceSettings(cwd) {
 export function setCredentialSource(cwd, credentialSource) {
     const parsed = parseCredentialSource(credentialSource);
     if (parsed === undefined) {
-        throw new ProviderAuthError('credentialSource must be "pi_home" or "sf_owned"', 400);
+        throw new ProviderAuthError('credentialSource must be "sf_owned"', 400);
     }
     const projectCtx = resolveProjectContext(cwd);
     writeCredentialSourceToContext(projectCtx, parsed);

package/dist/cli/doctorCommand.js

@@ -215,6 +215,13 @@ async function freeDiskCheck(home, env) {
         const size = await readFilesystemSize(home);
         const floor = resolveMinFreeDiskFloor(env.STAGEFLOW_MIN_FREE_DISK_BYTES, size.totalBytes);
         const freeGiB = (size.freeBytes / (1024 * 1024 * 1024)).toFixed(2);
+        if (floor === 0) {
+            return {
+                id: "free_disk",
+                status: "pass",
+                message: `${home} has ${freeGiB} GiB free (free-disk admission disabled)`,
+            };
+        }
         if (size.freeBytes < floor) {
             return {
                 id: "free_disk",

package/dist/cli/providersCommand.d.ts

@@ -1,6 +1,6 @@
 import type { AuthInteraction } from "@earendil-works/pi-ai";
 import { type ProviderAuthContext } from "../agent/providerAuth.js";
-export declare const PROVIDERS_USAGE = "Usage:\n  sf providers list\n  sf providers status [--provider <id>]\n  sf providers detect\n  sf providers source [get | set <pi_home|sf_owned>]\n  sf providers login <providerId> [--type api_key|oauth] [--api-key-env <VAR>]\n  sf providers logout <providerId>";
+export declare const PROVIDERS_USAGE = "Usage:\n  sf providers list\n  sf providers status [--provider <id>]\n  sf providers detect\n  sf providers source [get | set sf_owned]\n  sf providers login <providerId> [--type api_key|oauth] [--api-key-env <VAR>]\n  sf providers logout <providerId>";
 export type ProvidersCommandIo = {
     log: (line: string) => void;
     error: (line: string) => void;

package/dist/cli/providersCommand.js

@@ -6,7 +6,7 @@ export const PROVIDERS_USAGE = `Usage:
   sf providers list
   sf providers status [--provider <id>]
   sf providers detect
-  sf providers source [get | set <pi_home|sf_owned>]
+  sf providers source [get | set sf_owned]
   sf providers login <providerId> [--type api_key|oauth] [--api-key-env <VAR>]
   sf providers logout <providerId>`;
 const defaultIo = {
@@ -167,7 +167,7 @@ export async function runProvidersCommand(args, cwd, io = {}, ctx = defaultConte
                     ? `credentialSource=${detected.credentialSource}`
                     : "credentialSource=(unset)";
                 out.log([
-                    `piHomeUsable=${detected.piHomeUsable}`,
+                    `authConfigured=${detected.authConfigured}`,
                     sourceLine,
                     `provisional=${detected.provisional}`,
                     `bindingSource=${detected.source}`,
@@ -188,8 +188,8 @@ export async function runProvidersCommand(args, cwd, io = {}, ctx = defaultConte
                 }
                 if (action === "set") {
                     const value = parsed.positionals[1];
-                    if (value !== "pi_home" && value !== "sf_owned") {
-                        out.error('source set requires pi_home or sf_owned');
+                    if (value !== "sf_owned") {
+                        out.error('source set requires sf_owned');
                         out.error(PROVIDERS_USAGE);
                         return 1;
                     }

package/dist/cli.js

@@ -69,7 +69,7 @@ const USAGE = `Usage:
   sf providers list
   sf providers status [--provider <id>]
   sf providers detect
-  sf providers source [get | set <pi_home|sf_owned>]
+  sf providers source [get | set sf_owned]
   sf providers login <providerId> [--type api_key|oauth] [--api-key-env <VAR>]
   sf providers logout <providerId>
   sf skills list

package/dist/package-meta.d.ts

@@ -1,3 +1,3 @@
 export declare const PACKAGE_NAME = "stageflow";
-export declare const PACKAGE_VERSION = "0.30.0";
+export declare const PACKAGE_VERSION = "0.31.0";
 export declare const BUILD_SHA: string;

package/dist/package-meta.js

@@ -1,3 +1,3 @@
 export const PACKAGE_NAME = "stageflow";
-export const PACKAGE_VERSION = "0.30.0";
+export const PACKAGE_VERSION = "0.31.0";
 export const BUILD_SHA = process.env.STAGEFLOW_BUILD_SHA ?? "unknown";

package/dist/runstore/diskUsage.d.ts

@@ -32,7 +32,7 @@ export declare function durableRootDiskBreakdown(durableRoot: string, options?:
 export declare function parseDiskBytesThreshold(raw: string | undefined, filesystemTotalBytes: number): number | undefined;
 /**
  * Resolve `STAGEFLOW_MIN_FREE_DISK_BYTES`: bytes or `%` of filesystem.
- * Unset / empty / invalid → `max(2 GiB, 10% of filesystemTotalBytes)`.
+ * Unset / empty / invalid → `0` (admission check disabled). Set explicitly to enable.
  */
 export declare function resolveMinFreeDiskFloor(raw: string | undefined, filesystemTotalBytes: number): number;
 /**

package/dist/runstore/diskUsage.js

@@ -162,20 +162,15 @@ export function parseDiskBytesThreshold(raw, filesystemTotalBytes) {
         return undefined;
     return n;
 }
-const DEFAULT_MIN_FREE_DISK_BYTES = 2 * 1024 * 1024 * 1024;
 /**
  * Resolve `STAGEFLOW_MIN_FREE_DISK_BYTES`: bytes or `%` of filesystem.
- * Unset / empty / invalid → `max(2 GiB, 10% of filesystemTotalBytes)`.
+ * Unset / empty / invalid → `0` (admission check disabled). Set explicitly to enable.
  */
 export function resolveMinFreeDiskFloor(raw, filesystemTotalBytes) {
     const parsed = parseDiskBytesThreshold(raw, filesystemTotalBytes);
     if (parsed !== undefined)
         return parsed;
-    const total = Number.isFinite(filesystemTotalBytes) && filesystemTotalBytes > 0
-        ? filesystemTotalBytes
-        : 0;
-    const tenPercent = Math.floor(total * 0.1);
-    return Math.max(DEFAULT_MIN_FREE_DISK_BYTES, tenPercent);
+    return 0;
 }
 /**
  * One named warning when free space is below `STAGEFLOW_DISK_WARN_BYTES`. Never throws.

package/dist/runtime/credentialBinding.d.ts

@@ -7,14 +7,17 @@ export type CredentialBinding = {
     provisional: boolean;
 };
 export type ResolveCredentialBindingOptions = {
-    piHomeAuthPath?: string;
+    agentAuthPath?: string;
 };
 export declare function sfOwnedAgentDir(): string;
 export declare function sfOwnedAuthPath(): string;
-export declare const PI_HOME_AUTH_PATH_ENV = "STAGEFLOW_PI_HOME_AUTH_PATH";
-/** A stage worker's HOME is an empty attempt dir, so the Host passes its own Pi auth path through the environment. */
+export declare const STAGEFLOW_AGENT_AUTH_PATH_ENV = "STAGEFLOW_AGENT_AUTH_PATH";
+/** @deprecated Use STAGEFLOW_AGENT_AUTH_PATH_ENV. */
+export declare const PI_HOME_AUTH_PATH_ENV = "STAGEFLOW_AGENT_AUTH_PATH";
+export declare function stageflowAgentAuthPath(override?: string): string;
+/** @deprecated Use stageflowAgentAuthPath */
 export declare function piHomeAuthPath(override?: string): string;
 export declare function isUsableAuthFile(authPath: string): boolean;
 export declare function ensureSfOwnedAuthStore(): string;
-export declare function resolveCredentialBinding(ctx: ProjectContext | string, options?: ResolveCredentialBindingOptions): CredentialBinding;
+export declare function resolveCredentialBinding(ctx: ProjectContext | string, _options?: ResolveCredentialBindingOptions): CredentialBinding;
 export { readCredentialSourceFromFile, writeCredentialSourceToFile, } from "./settingsFile.js";

package/dist/runtime/credentialBinding.js

@@ -1,5 +1,4 @@
 import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
 import path from "node:path";
 import { ensureGlobalHome } from "../project/globalHome.js";
 import { resolveProjectContext, } from "../project/resolveProjectContext.js";
@@ -11,12 +10,23 @@ export function sfOwnedAgentDir() {
 export function sfOwnedAuthPath() {
     return path.join(sfOwnedAgentDir(), "auth.json");
 }
-export const PI_HOME_AUTH_PATH_ENV = "STAGEFLOW_PI_HOME_AUTH_PATH";
-/** A stage worker's HOME is an empty attempt dir, so the Host passes its own Pi auth path through the environment. */
+export const STAGEFLOW_AGENT_AUTH_PATH_ENV = "STAGEFLOW_AGENT_AUTH_PATH";
+/** @deprecated Use STAGEFLOW_AGENT_AUTH_PATH_ENV. */
+export const PI_HOME_AUTH_PATH_ENV = STAGEFLOW_AGENT_AUTH_PATH_ENV;
+export function stageflowAgentAuthPath(override) {
+    if (override !== undefined) {
+        return path.resolve(override);
+    }
+    const fromEnv = process.env[STAGEFLOW_AGENT_AUTH_PATH_ENV]?.trim() ||
+        process.env.STAGEFLOW_PI_HOME_AUTH_PATH?.trim();
+    if (fromEnv) {
+        return path.resolve(fromEnv);
+    }
+    return sfOwnedAuthPath();
+}
+/** @deprecated Use stageflowAgentAuthPath */
 export function piHomeAuthPath(override) {
-    return (override ??
-        (process.env[PI_HOME_AUTH_PATH_ENV] || undefined) ??
-        path.join(os.homedir(), ".pi", "agent", "auth.json"));
+    return stageflowAgentAuthPath(override);
 }
 export function isUsableAuthFile(authPath) {
     if (!existsSync(authPath))
@@ -43,35 +53,14 @@ export function ensureSfOwnedAuthStore() {
     }
     return authPath;
 }
-export function resolveCredentialBinding(ctx, options = {}) {
+export function resolveCredentialBinding(ctx, _options = {}) {
     const projectCtx = typeof ctx === "string" ? resolveProjectContext(ctx) : ctx;
-    const piHome = piHomeAuthPath(options.piHomeAuthPath);
     const persisted = readCredentialSourceFromContext(projectCtx);
-    if (persisted !== undefined) {
-        if (persisted === "sf_owned") {
-            return {
-                source: "sf_owned",
-                authPath: ensureSfOwnedAuthStore(),
-                provisional: false,
-            };
-        }
-        return {
-            source: "pi_home",
-            authPath: piHome,
-            provisional: false,
-        };
-    }
-    if (isUsableAuthFile(piHome)) {
-        return {
-            source: "pi_home",
-            authPath: piHome,
-            provisional: true,
-        };
-    }
+    const authPath = ensureSfOwnedAuthStore();
     return {
         source: "sf_owned",
-        authPath: ensureSfOwnedAuthStore(),
-        provisional: true,
+        authPath,
+        provisional: persisted === undefined,
     };
 }
 export { readCredentialSourceFromFile, writeCredentialSourceToFile, } from "./settingsFile.js";

package/dist/runtime/pipelineScheduler.js

@@ -971,6 +971,7 @@ export async function runPipelineDag(options) {
                     attempt,
                     env: stageBinding.env,
                     bindingKind: stageBinding.kind,
+                    model: stage.model,
                     grants,
                     attemptHome,
                     ...(browserEnv !== undefined ? { browserEnv } : {}),

package/dist/runtime/runManager.js

@@ -1979,6 +1979,7 @@ export class RunManager {
                 sessionFilePath,
                 env: stageBinding.env,
                 bindingKind: stageBinding.kind,
+                ...(resumedStage !== undefined ? { model: resumedStage.model } : {}),
                 ...(this.options.operatorCatalog !== undefined
                     ? { operatorCatalog: this.options.operatorCatalog }
                     : {}),
@@ -2506,17 +2507,26 @@ export class RunManager {
         };
     }
     async checkDiskFloorAdmission() {
+        const raw = process.env.STAGEFLOW_MIN_FREE_DISK_BYTES;
+        if (raw === undefined || raw.trim() === "") {
+            return undefined;
+        }
         try {
             const readFree = this.options.freeSpaceReader ?? readFilesystemSize;
             const size = await readFree(globalStageflowHome());
-            const minFreeBytes = resolveMinFreeDiskFloor(process.env.STAGEFLOW_MIN_FREE_DISK_BYTES, size.totalBytes);
+            const minFreeBytes = resolveMinFreeDiskFloor(raw, size.totalBytes);
+            if (minFreeBytes === 0) {
+                return undefined;
+            }
             if (size.freeBytes < minFreeBytes) {
                 return this.insufficientDiskFailure(size.freeBytes, minFreeBytes);
             }
             return undefined;
         }
         catch (err) {
-            // Default floor is always active via resolveMinFreeDiskFloor — fail closed.
+            if (resolveMinFreeDiskFloor(raw, 0) === 0 && !raw.trim().endsWith("%")) {
+                return undefined;
+            }
             return {
                 ok: false,
                 reason: `Disk free-space check failed: ${err instanceof Error ? err.message : String(err)}`,

package/dist/runtime/settingsFile.d.ts

@@ -2,9 +2,9 @@ import type { ProjectContext } from "../project/resolveProjectContext.js";
 import type { StageflowContext } from "../project/resolveStageflowContext.js";
 export declare const SETTINGS_FILE_NAME = "settings.json";
 export declare const INVALID_SLOT_COUNT_MESSAGE = "maxConcurrent must be an integer >= 1";
-export declare const INVALID_CREDENTIAL_SOURCE_MESSAGE = "credentialSource must be \"pi_home\" or \"sf_owned\"";
+export declare const INVALID_CREDENTIAL_SOURCE_MESSAGE = "credentialSource must be \"sf_owned\"";
 export declare const INVALID_WORKSHOP_MODEL_MESSAGE = "workshopModel must be a non-empty string";
-export type CredentialSource = "pi_home" | "sf_owned";
+export type CredentialSource = "sf_owned";
 export type FactorySettings = {
     maxConcurrent?: number;
     credentialSource?: CredentialSource;

package/dist/runtime/settingsFile.js

@@ -5,7 +5,7 @@ import { globalStageflowHome } from "../project/globalHome.js";
 import { storeRootFor } from "../runstore/paths.js";
 export const SETTINGS_FILE_NAME = "settings.json";
 export const INVALID_SLOT_COUNT_MESSAGE = "maxConcurrent must be an integer >= 1";
-export const INVALID_CREDENTIAL_SOURCE_MESSAGE = 'credentialSource must be "pi_home" or "sf_owned"';
+export const INVALID_CREDENTIAL_SOURCE_MESSAGE = 'credentialSource must be "sf_owned"';
 export const INVALID_WORKSHOP_MODEL_MESSAGE = "workshopModel must be a non-empty string";
 export function globalSettingsFilePath() {
     return path.join(globalStageflowHome(), SETTINGS_FILE_NAME);
@@ -29,9 +29,12 @@ export function parseSlotCount(value) {
     return value;
 }
 export function parseCredentialSource(value) {
-    if (value === "pi_home" || value === "sf_owned") {
+    if (value === "sf_owned") {
         return value;
     }
+    if (value === "pi_home") {
+        return "sf_owned";
+    }
     return undefined;
 }
 export function parseWorkshopModelSetting(value) {

package/dist/runtime/stageProcessLauncher.d.ts

@@ -18,6 +18,7 @@ export type StageLaunchInput = {
     grants?: ResolvedStageGrants;
     attemptHome?: string;
     browserEnv?: Record<string, string>;
+    model?: string;
 };
 export type StageLaunchResult = {
     type: "succeeded";

package/dist/runtime/stageProcessLauncher.js

@@ -1,9 +1,10 @@
 import * as childProcess from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { logger as rootLogger, resolveLogMaxLineBytes, } from "../logging/logger.js";
+import { isCursorModelRef, readCursorApiKey } from "../agent/cursorProvider.js";
 import { BROWSER_ENV_PREFIX } from "../browser/browserHost.js";
 import { PACKAGE_VERSION } from "../package-meta.js";
-import { PI_HOME_AUTH_PATH_ENV, piHomeAuthPath } from "./credentialBinding.js";
+import { PI_HOME_AUTH_PATH_ENV, stageflowAgentAuthPath } from "./credentialBinding.js";
 import { redactString } from "../logging/redact.js";
 import { getNamedSecrets } from "../logging/namedSecrets.js";
 import { readMaxActiveStageProcesses, } from "./stageConcurrency.js";
@@ -338,8 +339,15 @@ export class StageProcessLauncher {
             : overlaid;
         const childEnv = {
             ...withBrowser,
-            [PI_HOME_AUTH_PATH_ENV]: piHomeAuthPath(),
+            [PI_HOME_AUTH_PATH_ENV]: stageflowAgentAuthPath(),
         };
+        const cursorApiKey = readCursorApiKey(hostEnv);
+        if (isCursorModelRef(input.model ?? "") &&
+            cursorApiKey !== undefined &&
+            cursorApiKey !== "" &&
+            childEnv.CURSOR_API_KEY === undefined) {
+            childEnv.CURSOR_API_KEY = cursorApiKey;
+        }
         const child = this.forkFn(this.cliEntry, args, {
             cwd: input.rootDir,
             env: { ...childEnv, [SF_STAGE_WORKER]: "1" },

package/dist/server/bootstrap.js

@@ -20,6 +20,7 @@ import { createRunChangeBus, getRunChangeBusFromWrappedStore, isRunStoreWrapped,
 import { createMcpHttpHandler, resolveMcpStateless, } from "../mcp/server.js";
 import { loadHostConfig, } from "../config/hostConfig.js";
 import { bootProviderConfig } from "../agent/bootProviderConfig.js";
+import { readCursorApiKey } from "../agent/cursorProvider.js";
 import { applyPendingRestoreAtBoot, } from "../runstore/restore.js";
 import { assertTmpdirUsable } from "../runstore/assertTmpdir.js";
 import { logger as rootLogger } from "../logging/logger.js";
@@ -80,6 +81,11 @@ export async function bootstrapStageflowHost(options) {
     const ctx = await resolveStageflowContext(invocationCwd);
     const cwd = ctx.invocationCwd;
     ensureGlobalHome();
+    const cursorKey = readCursorApiKey(env);
+    if (cursorKey !== undefined &&
+        (env.CURSOR_API_KEY === undefined || env.CURSOR_API_KEY.trim() === "")) {
+        process.env.CURSOR_API_KEY = cursorKey;
+    }
     assertTmpdirUsable(env);
     const hostConfig = options.hostConfig ??
         (options.skipHostConfig