feat(cursor): support browser login for the agent SDK

[Yash-Singh1]

What changed

Adds Cursor SDK browser sign-in to Settings > Providers > Cursor, with cancellation, account switching, and sign-out. Login links open on the client, so sign-in works with remote environments too.

Each provider instance stores its own credential. Chat sessions, model discovery, and text generation use it; an explicit CURSOR_API_KEY still takes precedence. Account changes stop sessions using the old credential, and cancelled or expired login flows cannot save a late result.

Why

The V2 Cursor integration only accepted CURSOR_API_KEY, so an existing Cursor CLI or editor login still appeared unauthenticated. The bundled SDK supports Cursor.auth.login(), which provides its own browser flow and mints the credential needed by SDK operations.

Targets Julius's t3code/codex-turn-mapping branch, not main.

Validation

• 98 focused server and settings tests passed, covering persistence, instance isolation, cancellation, expiry, API-key precedence, chat credentials, and session cleanup.
• Server and web typechecks passed. Targeted lint passed with one existing warning in ProviderSettingsPanel.tsx.
• Desktop build passed. The maintainer completed browser sign-in in the dev desktop app and confirmed it worked.
• Settings tests and lint passed after the UI corrections.

UI changes

The signed-out row has one Sign in button. Signed-in accounts have Switch account and Sign out actions. The account email remains under Display name and is not repeated in the setup row.

Before the UI cleanup during manual testing:

Final signed-in state, with the account email hidden by the app's privacy control:

Checklist

• Changes are limited to Cursor SDK authentication
• Explained what changed and why
• Before/after UI cleanup images attached

Implemented with GPT-6 Astra in the Codex harness.

[macroscopeapp]

Effect Service Conventions found 2 blocking convention violations. See the inline review comments in apps/server/src/provider/Drivers/CursorDriver.ts and apps/server/src/provider/CursorAuth.ts.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a new browser-login workflow with persistent credentials, account switching, sign-out, and session lifecycle changes across the server and settings UI. Because it changes authentication-sensitive production behavior and introduces a substantial user-facing capability, human review is appropriate.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.7 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: 5437ec2 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Effect Service Conventions found 6 blocking violations in apps/server/src/provider/CursorAuth.ts: wrapped credential-store, SDK login, and crypto failures do not preserve their immediate causes. See the inline review comments.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Correction: the 6 actionable findings are contained in the submitted inline review; no additional findings are described in the summary comment.

^{Posted via Macroscope — Effect Service Conventions}