fix(server): treat Cursor API keys as authenticated

[altaywtf]

Fixes #7244.

Cursor CLI documents CURSOR_API_KEY as a first-class login (auth docs). T3 only trusted agent about userEmail and always sent ACP cursor_login, so a key-only install looked logged out and then tried to open a browser.

The about probe now marks the provider ready when CURSOR_API_KEY is set, and ACP skips authenticate in that case.

Cursor Grok 4.6 / Cursor

Note

Treat CURSOR_API_KEY environment variable as authenticated in Cursor provider

• Adds applyCursorApiKeyAuth in CursorProvider.ts that converts an unauthenticated CursorAboutResult to an apiKey authenticated state when CURSOR_API_KEY is set.
• Adds skipAuthenticate option to AcpSessionRuntime so Cursor ACP sessions skip the authenticate RPC when CURSOR_API_KEY is present.
• Updates error messages to mention set CURSOR_API_KEY as an alternative to agent login.
• Behavioral Change: provider status checks now report authentication as ready via API key when CURSOR_API_KEY is set, even if the agent about probe reports unauthenticated.

^{Macroscope summarized 813a936.}

---

Note

Medium Risk
Touches authentication and ACP session setup for Cursor; behavior changes when CURSOR_API_KEY is set, but scope is limited to the Cursor provider path with unit tests covering edge cases.

Overview
Cursor CURSOR_API_KEY is now treated as valid auth when agent about reports logged out, so key-only setups no longer show the provider as unauthenticated or trigger browser login via ACP.

applyCursorApiKeyAuth runs after the about probe and only upgrades unauthenticated results when a non-empty CURSOR_API_KEY is in the environment; existing interactive logins win if both are present, and unknown/unverifiable about states are unchanged. Unauthenticated help text now mentions agent login or setting CURSOR_API_KEY.

ACP initialization gains optional skipAuthenticate, set when an API key is present for Cursor probe and session runtimes so cursor_login authenticate is not sent (avoiding unwanted browser flows).

^{Reviewed by Cursor Bugbot for commit 813a936. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b7fd9f4f-657d-42d4-88a9-09e53b966c45

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the Cursor provider integration so API-key-only Cursor CLI setups (CURSOR_API_KEY) are treated as authenticated, preventing T3 Code from incorrectly reporting “logged out” and from triggering ACP authenticate (which can try to open a browser). This aligns T3 Code’s behavior with Cursor CLI’s documented auth flow and addresses #7244.

Changes:

• Treat CURSOR_API_KEY as an authenticated state for the Cursor provider “about” probe.
• Skip ACP authenticate for Cursor when CURSOR_API_KEY is present to avoid interactive login attempts.
• Update install docs/README and add unit tests around the new API-key auth behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents Cursor auth as agent login or CURSOR_API_KEY.
docs/user/install.md	Updates provider install/auth guidance and links Cursor auth docs.
apps/server/src/provider/Layers/CursorProvider.ts	Adds CURSOR_API_KEY detection, upgrades auth state when key is present, and passes skipAuthenticate into ACP runtime(s).
apps/server/src/provider/Layers/CursorProvider.test.ts	Updates expected messages and adds tests for the API-key auth upgrade behavior.
apps/server/src/provider/acp/CursorAcpSupport.ts	Propagates skipAuthenticate into Cursor ACP runtime construction.
apps/server/src/provider/acp/AcpSessionRuntime.ts	Adds optional skipAuthenticate flag to conditionally omit ACP authenticate.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e4b7212. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR modifies authentication behavior by enabling API key-based authentication and skipping the authenticate step when CURSOR_API_KEY is set. Authentication flow changes are sensitive and warrant human review regardless of implementation simplicity.

^{You can customize Macroscope's approvability policy. Learn more.}