fix(linux): restore Cursor app authentication

[DonnieFi]

Cursor Linux app-auth PR draft

Summary

Restore Linux Cursor usage through the signed-in Cursor app token, including the Grok Bot allowance, while preserving
manual-cookie precedence and keeping explicit web mode independent of app credentials.

Reference: upstream PR #1908, merged at 7807679535394caa78b75526caf433057377648f.

Thanks @DonnieFi for the original contribution.

Maintainer improvements

• Rebases the Linux app-auth change onto the current upstream main.
• Keeps manual cookies and cached/stored sessions ahead of the app token, and makes explicit Linux web mode manual-cookie only.
• Validates absolute-only XDG_CONFIG_HOME handling, including a literal ~/custom regression case.
• Covers cached-session precedence, explicit-web isolation, app-token expiry, read-only database access, and best-effort Grok Bot behavior.
• Clarifies Linux paths, fallback order, CLI behavior, and contributor credit in the docs and changelog.

Behavior

• Linux reads Cursor's XDG state database read-only and uses the existing Cursor usage endpoints.
• Resolution order is manual cookie, cached/stored session, then the app token.
• Explicit --source web requires a manual cookie and never reads app credentials.
• Grok Bot failure does not discard valid Cursor usage.

Proof

• Focused Linux suites: 15 tests in 2 suites passed.
• Full suite: make test passed 94 tests in 9 suites (69 selections, 6 groups).
• Release CLI build passed and is installed at /home/red/.local/bin/codexbar.
• Live CLI smoke passed for Cursor and Grok Bot usage; output was redacted before capture.

The screenshot is the supplied redacted CLI card capture and shows Cursor, Third Party, and Grok Bot windows.

make check reaches the repository checks but cannot complete on Debian because its installer regression requires macOS
AppleScript. The Linux lint lane reaches portable checks but SwiftLint cannot load Debian SourceKit.

Exact reviewed source head: ca649a5850f14d39cc90b262b7b2749ea5836035 (rebased onto upstream main at 7fdc176).

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb8657cb00

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor HOME when resolving the Linux Cursor database

When XDG_CONFIG_HOME is unset and the CLI runs with HOME different from the account’s passwd home (common in containers, systemd services, or isolated environments), the newly enabled Linux store defaults home from NSHomeDirectory(), which ignores the process HOME value on Linux. It therefore looks under the passwd home’s .config directory instead of $HOME/.config, so a valid Cursor login is reported as missing; derive the fallback from the supplied environment’s absolute HOME before falling back to NSHomeDirectory().

Useful? React with 👍 / 👎.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 10, 2026, 9:01 AM ET / 13:01 UTC (Revision 2).

ClawSweeper review

What this changes

Restores Linux Cursor authentication using the signed-in app’s local token, preserves cookie precedence, and adds path-resolution tests, documentation, and runtime evidence.

Merge readiness

✅ Ready for maintainer review

The previous HOME blocker is resolved, and no actionable introduced defects remain. Current main and v0.58.0 still lack this Linux authentication path, so the PR remains useful.

Priority: P2
Reviewed head: 32fdadaa26972c88724cbac1e43b28a7f7313d4b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused restoration with real CLI evidence, useful regression coverage, and the previous blocker addressed.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The recorded Linux release-CLI automatic-auth run and inspected terminal capture demonstrate Cursor and Grok Bot usage through the restored provider path. The later HOME correction has focused regression coverage; existing live proof remains relevant.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The recorded Linux release-CLI automatic-auth run and inspected terminal capture demonstrate Cursor and Grok Bot usage through the restored provider path. The later HOME correction has focused regression coverage; existing live proof remains relevant.
Evidence reviewed	8 items	Applicable repository policy: Read the complete root AGENTS.md and checked for nested policies; only the root policy exists. Applied its credential isolation, provider identity, focused testing, and concurrency guidance. No maintainer-notes directory exists. Previous finding resolved: The latest commit replaces the eager system-home default with an optional injected home and absolute process HOME fallback. Four added test declarations cover redirected HOME, invalid HOME, injected-home precedence, and XDG precedence. This addresses the retained finding and rank-up move. Credential and account boundaries: Manual credentials return before app lookup; cached and stored sessions precede Linux app auth. Transient errors and explicitly selected cached-session rejection stop fallback. Explicit web mode disables app lookup, usable tokens require more than 60 seconds remaining, and Linux does not persist the derived app token. Existing provider requests retain server authentication checks.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s Cursor provider resolves local credentials and requests account usage from Cursor. The resulting usage windows feed CLI JSON and cards, including the optional Grok Bot allowance.

flowchart TD
 A[CLI source and cookie settings] --> B[Credential selection]
 C[Manual or cached cookies] --> B
 D[Cursor local database] --> E[Check token expiry]
 E --> B
 B --> F[Cursor usage endpoints]
 F --> G[Usage JSON and cards]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +119/-23; tests +310/-2	Production growth restores platform wiring and credential fallback; most added lines provide focused Linux regression coverage.

Technical review

Best possible solution:

Reuse the shared token reader and usage endpoints while retaining Linux cookie precedence, explicit web isolation, and environment-aware database discovery.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes the failure: current main excludes the app-token reader on Linux and rejects automatic mode without manual cookies. This review did not execute a failing current-main run.

Is this the best way to solve the issue?

Yes. Reusing the existing authentication and usage machinery is a focused restoration, and the revised HOME handling resolves the prior review’s concrete defect.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7fdc17636f16.

Labels

Label justifications:

• P2: Restores an established provider workflow with a bounded Linux-only impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The recorded Linux release-CLI automatic-auth run and inspected terminal capture demonstrate Cursor and Grok Bot usage through the restored provider path. The later HOME correction has focused regression coverage; existing live proof remains relevant.
• proof: sufficient: Contributor real behavior proof is sufficient. The recorded Linux release-CLI automatic-auth run and inspected terminal capture demonstrate Cursor and Grok Bot usage through the restored provider path. The later HOME correction has focused regression coverage; existing live proof remains relevant.

Evidence

What I checked:

• Applicable repository policy: Read the complete root AGENTS.md and checked for nested policies; only the root policy exists. Applied its credential isolation, provider identity, focused testing, and concurrency guidance. No maintainer-notes directory exists. (AGENTS.md:1, 32fdadaa2697)
• Previous finding resolved: The latest commit replaces the eager system-home default with an optional injected home and absolute process HOME fallback. Four added test declarations cover redirected HOME, invalid HOME, injected-home precedence, and XDG precedence. This addresses the retained finding and rank-up move. (Sources/CodexBarCore/Providers/Cursor/CursorAppAuth.swift:240, 32fdadaa2697)
• Credential and account boundaries: Manual credentials return before app lookup; cached and stored sessions precede Linux app auth. Transient errors and explicitly selected cached-session rejection stop fallback. Explicit web mode disables app lookup, usable tokens require more than 60 seconds remaining, and Linux does not persist the derived app token. Existing provider requests retain server authentication checks. (Sources/CodexBarCore/Providers/Cursor/CursorStatusProbe+SessionResolution.swift:179, 32fdadaa2697)
• Current-main and release necessity: Inspected the pinned main provider descriptor and v0.58.0 app-auth source. Main permits Linux browser-support exemption only for manual cookies, while the release compiles the app-auth session/store only on macOS. The earlier merged implementation therefore does not make this restoration redundant. (Sources/CodexBarCore/Providers/Cursor/CursorAppAuth.swift:105, 88fa2f45fa1e)
• Related merged feature: GitHub confirms feat(linux): support Cursor provider via app auth token #1908 merged the earlier Linux app-token support. Its documented manual-cookie and cached-session precedence supports the restoration’s intended behavior. (780767953539)
• After-fix Linux runtime proof: Read both proof artifacts and inspected the prepared terminal screenshot. The recorded Linux x86_64 release-CLI run exercises automatic Cursor usage and cards, reporting finite Cursor/Grok Bot fields; the screenshot displays their usage windows. The artifact identifies ca649a5 as the live-tested source. Later changes add regression coverage and repair HOME resolution without replacing the authenticated request path. (.github/pr-proof/cursor-linux-app-auth.log:39, 32fdadaa2697)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• DonnieFi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-10T12:49:11.799Z sha 92cfffe :: blocked before merge. :: [P2] Honor HOME in the newly enabled Linux database lookup

[DonnieFi]

@clawsweeper re-review

Addressed the P2 HOME fallback: absolute HOME is now preferred over NSHomeDirectory() when XDG_CONFIG_HOME is unset/relative, with regression coverage for redirected HOME, non-absolute HOME, injected home precedence, and absolute XDG still winning. Focused Linux suites: 19 tests passed.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.