Cursor auth improvements - #2398
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7b74545e58
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 11eb33724e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f4a49bc42
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0244d9861
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5c0cbd5f6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 892208d292
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6f7cbca540
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| { | ||
| return true | ||
| } | ||
| return cachedEntry()?.authenticationFailurePolicy == .stopFallback |
There was a problem hiding this comment.
When Cursor is in Auto with Cookie source set to Off, a previously committed browser login can still have a cached stopFallback entry, and this line treats that stale cookie cache as an explicit selection. That makes CursorAppTokenFetchStrategy.isAvailable return false, while CursorStatusFetchStrategy.isAvailable also returns false for .off, so users with a valid Cursor app token get no Cursor usage or cost even though Off is meant to disable only the cookie ladder. Ignore cached browser entries when cursorSettings?.cookieSource == .off so the app-token path can still run.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
Codex review: needs real behavior proof before merge. Reviewed August 12, 2026, 8:51 AM ET / 12:51 UTC. ClawSweeper reviewWhat this changesThis PR adds Cursor usage-source selection for automatic, desktop-app-token, or browser-cookie authentication across the app, CLI, cost reporting, tests, and documentation. Merge readiness⛔ Blocked until stronger real behavior proof is added - 5 items remain Keep open: current main does not provide this source picker, but the branch still disables a valid app-token path when Cookie source is Off and a cached browser selection exists. Priority: P1 Review scores
Verification
How this fits togetherCodexBar selects a local Cursor app token or browser cookie session, then fetches usage and cost data for the menu bar and CLI. The new setting controls which credential path may run and which account can own the resulting data. flowchart LR
A[Cursor source setting] --> B[Credential strategy selection]
B --> C[Cursor app token]
B --> D[Browser cookie ladder]
C --> E[Usage and cost fetches]
D --> E
E --> F[Menu bar and CLI output]
Before merge
Findings
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Preserve app-token fallback when Cookie source Off disables browser credentials, add a regression test, then attach redacted current-head proof of Auto, App Token, and Browser Cookies routing. Do we have a high-confidence way to reproduce the issue? Yes, from source: use Auto with Cookie source Off, a cached Cursor entry whose policy is stop-fallback, and a usable app token; the cache suppresses OAuth while the web strategy rejects Off. Is this the best way to solve the issue? No, not yet: the source-picker design is coherent, but the cached-selection condition must honor Cookie source Off before this can safely preserve the documented fallback behavior. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against a90dfed5c264. LabelsLabel changes:
Label justifications:
EvidenceAcceptance criteria:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (15 earlier review cycles; latest 8 shown)
|
|
Thanks for the Cursor source-picker work — the Auto/App-Token/Cookies split is a sensible shape. This branch has been merge-dirty against |
04d3c3c to
f182967
Compare
clawsweeper
Bot
added
proof: sufficient
f182967 to
40631e2
Compare
clawsweeper
Bot
added
P1
clawsweeper
Bot
removed
the
rating: 🦐 gold shrimp
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
clawsweeper
Bot
added
rating: 🦐 gold shrimp
|
Status update: PR #2598 just landed on main, which changes the ground under this PR. Automatic mode now prefers a usable Cursor.app local session ahead of browser cookies (with explicit browser selection staying authoritative), so this PR's Automatic routing and app-token reader are superseded. What remains valuable from this PR and worth a narrow rebase:
The Cookie-Off routing defect found in review should not be carried over. @markmay — if you'd like to rebase this down to the picker + App-Token-only mode on top of current main, I'm happy to review promptly; otherwise I can extract those parts with credit. Thanks for the groundwork — the app-token preference idea shipped, and the explicit modes are a good follow-up. |
2 participants
Summary
cursor.oauth) and hides the now-irrelevant Cookie source picker; no browser/cookie stack is touched.cursor.web).CursorSettingsStore,CursorProviderImplementation, and the CLI (--source auto|oauth|web), including a Linux CLI fast-path that skips the macOS-only browser stack when oauth is forced.docs/cursor.md.Testing
Tests/CodexBarTests/CursorAppTokenStrategyTests.swiftand updatedTestsLinux/CursorLinuxTests.swift.f182967eb:swift build --target CodexBarCoreandswift build --target CodexBarCLIpassed; portable/package/docs/locale/JS/TS checks and SwiftFormat passed on a CLT-only host.swift test --filter Cursor/ SwiftLint still need the repository's macOS 26 / Xcode 26 CI environment.Changelog
Cursor: add a Usage source setting to choose between the app's local token and browser cookies (or Auto, which prefers the app token).
Real behavior proof
Exact head
f182967eb, packaged and launched locally. Live Cursor account used for the after-fix runs below (email kept; no cookies/tokens).CLI confirmation
CodexBar.app/Contents/Helpers/CodexBarCLI usage --provider cursor --source … --format text --no-colorat that head:Observed attribution:
--source autoand--source oauthboth resolve to(app)/ app-token path--source webresolves to(web)/ browser-cookie pathSigned app confirmation
Local validation build used the packaged
CodexBar.appfrom the PR worktree.codesign --verify --deep --strictpassed with:(Ad-hoc local validation build — not a Developer ID release signing identity.)
Screenshot using Cursor App Token source