feat(oauth): support cursor-agent CLI as Cursor credential source

[payne0420]

Summary

• Adds cursor-agent CLI's ~/.config/cursor/auth.json as a fallback credential source for Cursor auto-import (when Cursor IDE's state.vscdb is not available)
• Makes machineId optional throughout the import flow (cursor-agent doesn't provide one)
• Derives a stable machineId from the access token hash in the executor when none is stored
• Fixes CursorAuthModal crash when machineId is absent from auto-import response

Test plan

• Auto-import detects cursor-agent credentials (source: "cursor-agent")
• Import succeeds without machineId
• CursorAuthModal renders correctly with optional machineId field
• Cursor API requests work end-to-end with derived machineId
• Existing IDE-based imports (with machineId) still work unchanged

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request expands the Cursor credential import functionality by adding support for the cursor-agent CLI's auth.json file as a fallback to the Cursor IDE's SQLite database. The changes make the machineId field optional throughout the import flow, including the API routes, service validation logic, and the frontend authentication modal. Feedback focuses on improving the robustness of JSON parsing in the auto-import route and ensuring that the new dynamic authMethod is correctly persisted to the database during the import process.

[gemini-code-assist]

The JSON.parse call can return null if the file contains the string "null". Accessing .accessToken on a null value will throw an error. Using optional chaining is safer here.

Suggested change

	const auth = JSON.parse(raw);
	if (auth.accessToken && typeof auth.accessToken === "string") {
	const auth = JSON.parse(raw);
	if (auth?.accessToken && typeof auth.accessToken === "string") {

[gemini-code-assist]

The tokenData returned from validateImportToken now contains a dynamic authMethod (either "imported" or "cursor-agent"). However, the database save operation at line 64 (outside this diff hunk) still hardcodes authMethod: "imported". This should be updated to use tokenData.authMethod to correctly reflect the credential source in the database.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84b1bdfbb6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep Cursor machineId mandatory until runtime fallback exists

Allowing machineId to be omitted here means imports can be saved with providerSpecificData.machineId = null, but request execution still requires it: open-sse/executors/cursor.ts throws Machine ID is required for Cursor API in buildHeaders when the field is missing. This creates a user-visible break where cursor-agent auto-import appears successful and then all Cursor calls fail at runtime, so the import path should either derive/store a deterministic machine ID immediately or continue requiring machineId until executor fallback is implemented.

Useful? React with 👍 / 👎.

[diegosouzapw]

Thanks @trader-payne for this great contribution! 🎉 Adding cursor-agent CLI as a fallback credential source with clean separation of tryIdeAuth/tryAgentAuth and proper derived machineId is exactly what headless Cursor users need. Integrated into release/v3.6.6 — will ship with the next release. We appreciate your effort!