Prefer Cursor app sessions in Automatic mode - #2598
Conversation
|
Proof before live login:
Pending live gate: Peter must complete Cursor login. The reader consumes:
Then run:
The live gate passes when verbose output includes |
74d0434 to
dea9085
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74d0434f07
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| return Date(timeIntervalSince1970: expiration.doubleValue) | ||
| } | ||
|
|
||
| func makeCookie() throws -> HTTPCookie { |
There was a problem hiding this comment.
When this file is compiled on Linux, HTTPCookie and HTTPCookiePropertyKey are provided by FoundationNetworking rather than Foundation; after moving app-auth code out of CursorStatusProbe.swift, the conditional import FoundationNetworking no longer covers this reference. The Linux CodexBarCore/CLI build will fail with cannot find type 'HTTPCookie' in scope, so add the same conditional import to this file.
Useful? React with 👍 / 👎.
| cookies.filter { cookie in | ||
| guard CursorAppAuthSession.isPersistedCookie(cookie) else { return true } | ||
| let value = cookie.value.removingPercentEncoding ?? cookie.value | ||
| return value.components(separatedBy: "::").last != appSession.accessToken |
There was a problem hiding this comment.
When Cursor's state DB returns an expired or invalid token but cursor-session.json still holds an older derived app-auth cookie for a different token, this predicate keeps the older cookie because only the matching access token is filtered. If no cached or browser session wins afterward, fetchStoredSession will authenticate with that stale app account instead of falling through away from app auth, so remove all persisted app-auth cookies whenever a live app session is unusable.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
Codex review: found issues before merge. Reviewed August 15, 2026, 12:32 AM ET / 04:32 UTC. ClawSweeper reviewWhat this changesThe PR makes Automatic Cursor usage resolution prefer a valid local Cursor.app session over cached or imported browser cookies, with fallback, identity display, tests, and documentation. Merge readiness⛔ Blocked by patch quality or review findings - 7 items remain The branch needs a compatibility repair: saving a successful Cursor.app session replaces the legacy stored-session fallback. The owner-authored provider-auth and credential-storage policy also requires maintainer sign-off. Priority: P1 Review scores
Verification
How this fits togetherCodexBar’s Cursor provider resolves local or browser authentication into a usage snapshot for the menu card and CLI. This change alters session selection before the existing Cursor usage request and persistence paths. flowchart LR
A[Cursor settings] --> B[Session selection]
C[Cursor app database] --> B
D[Cached or browser cookies] --> B
B --> E[Cursor usage request]
E --> F[Usage snapshot]
F --> G[Menu card and CLI]
Decision needed
Why: VISION.md requires sign-off for provider-auth and credential-storage behavior changes, and this policy can change the account an existing user sees after upgrade. Before merge
Findings
Agent review detailsSecurityNone. Review metrics
Merge-risk optionsMaintainer options:
Technical reviewBest possible solution: Keep app-first Automatic mode only after retaining legacy non-app session data as a fallback and recording redacted local runtime evidence for the selected-account path. Do we have a high-confidence way to reproduce the issue? Yes, from source: start with a legacy non-app cookie in the Cursor session store, complete one successful app-auth fetch, then make app auth unavailable; the changed write leaves no legacy stored fallback. Is this the best way to solve the issue? No: app-first resolution can be viable, but overwriting older stored credentials contradicts the documented fallback order; preserve them or store the derived app session independently. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 71bbd263c902. LabelsLabel changes:
Label justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (10 earlier review cycles; latest 8 shown)
|
clawsweeper
Bot
added
status: 📣 needs proof
clawsweeper
Bot
added
rating: 🦪 silver shellfish
clawsweeper
Bot
added
the
rating: 🦞 diamond lobster
clawsweeper
Bot
added
status: 👀 ready for maintainer look
clawsweeper
Bot
added
rating: 🧂 unranked krab
1 participant
Summary
Refs #2398
Proof
make checkswift test --filter CursorStatusProbeTests(46 tests)swift test --filter CursorMenuCardModelTests(5 tests)swift test --filter CursorImportedSessionScanningTests(13 tests)swift test --filter CursorUsageEventsFetcherTests(26 tests)swift test --filter CodexBackgroundRefreshCoalescingTests(23 tests after test-only scheduler stabilization)make testwas attempted repeatedly. Concurrent Swift test harnesses from other local worker checkouts caused unrelated timer/account suites to hit the harness timeout; the harness recovered many selections individually, and the affected coalescing suite passes in isolation. No Cursor suite failed.Pending live gate
Cursor 3.14.7 is installed and its first-launch state database exists. Live authentication is intentionally pending Peter's login. After login, run:
/Users/steipete/Projects/CodexBar/.build/arm64-apple-macosx/debug/CodexBarCLI usage --provider cursor --source auto --verboseVerbose output must include
Using Cursor.app local auth, followed by a successful Cursor usage card for the chosen account.