Skip to content

Add Grok Bot Support to Cursor Card - #3127

Merged
steipete merged 5 commits into
steipete:mainfrom
kvarga:feat/grokbot-provider
Aug 21, 2026
Merged

Add Grok Bot Support to Cursor Card#3127
steipete merged 5 commits into
steipete:mainfrom
kvarga:feat/grokbot-provider

Conversation

@kvarga

@kvarga kvarga commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Show Grok Bot weekly included usage as a fourth bar on the Cursor card (Total / Cursor / Third Party / Grok Bot).
  • Fetches POST /api/dashboard/get-sand-usage-status with the same Cursor session cookie. This is not a new provider and not the existing Grok CLI provider.
  • Accounts without a Bot allowance (hasNonZeroIncludedLimit: false) omit the bar. Sand fetch failures leave the monthly Cursor bars intact.

Test plan

  • make check
  • make test (77/77 groups)
  • Focused Cursor / Grok Bot tests
  • Live Cursor card: Grok Bot bar after Third Party
  • Attach screenshot of the Cursor menu card (UI change)
image

Commands run

  • make check
  • make test
  • ./Scripts/compile_and_run.sh

Grok Bot is billed on the Cursor session, so surface it as a fourth
Cursor card bar instead of a separate provider.

Co-authored-by: Cursor <cursoragent@cursor.com>
@clawsweeper

clawsweeper Bot commented Aug 21, 2026

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a88820af65

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Sources/CodexBarCore/Providers/Cursor/CursorStatusProbe.swift
Cap the best-effort Sand request at 5s and do not fail Cursor login
after usage-summary has already succeeded.

Co-authored-by: Cursor <cursoragent@cursor.com>
@clawsweeper clawsweeper Bot added merge-risk: 🚨 auth-provider 🚨 Merging this PR could break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. P2 Normal priority bug or improvement with limited blast radius. proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. proof: sufficient Contributor real behavior proof is sufficient. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Aug 21, 2026
@clawsweeper

clawsweeper Bot commented Aug 21, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed August 21, 2026, 7:07 PM ET / 23:07 UTC.

ClawSweeper review

What this changes

This PR adds a best-effort Cursor dashboard request that renders eligible Grok Bot weekly usage as an extra Cursor card and widget bar.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open for maintainer review. Current main does not contain this feature, and the current head addresses the earlier optional-fetch failure concern; the remaining question is whether default polling of Cursor’s dashboard endpoint with an existing session is an acceptable product and provider-contract tradeoff.

Priority: P2
Reviewed head: 69f1f188ace7f82883c894d5f42615e989ef0c67
Owner decision: Required. See Decision needed.

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) Direct UI proof and focused coverage support a good patch, with the remaining question limited to the default authenticated upstream request.
Proof confidence 🦞 diamond lobster (5/6) ✨ media proof bonus Sufficient (screenshot): The PR body provides a post-change Cursor menu-card screenshot showing the added Grok Bot bar and reports a live bundled-app run.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Verified Sufficient (screenshot): The PR body provides a post-change Cursor menu-card screenshot showing the added Grok Bot bar and reports a live bundled-app run.
Evidence reviewed 5 items Current main lacks the feature: The current-main tree has no Cursor Sand/Grok Bot implementation outside documentation or changelog text, so this PR remains necessary.
Bounded fail-soft implementation: The required usage summary remains the throwing task; the Sand request is captured as an optional result and has a five-second independent budget.
Presentation and parsing coverage: Focused tests cover endpoint headers and timeout, omitted allowances, snapshot mapping, and placement after the three monthly Cursor bars.
Findings None None.
Security None None.

Live Verification

Command: swift run CodexBarCLI --help

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

Assertions:

  • FAIL expect_output: codexbar usage

How this fits together

CodexBar converts authenticated Cursor usage responses into common usage windows for the menu card, menu-bar metric, and widget. This change adds an optional Cursor-owned weekly allowance while retaining the existing monthly usage lanes.

flowchart LR
A[Cursor session cookie] --> B[Cursor usage requests]
B --> C[Monthly usage summary]
B --> D[Grok Bot weekly status]
C --> E[Cursor usage snapshot]
D --> E
E --> F[Menu card]
E --> G[Widget rows]
Loading

Decision needed

Question Recommendation
Should CodexBar poll Cursor’s dashboard endpoint by default with the existing Cursor session cookie to expose this optional weekly allowance? Approve the bounded same-session request: Accept the documented best-effort POST because it targets the existing Cursor host and retains the five-second fail-soft boundary.

Why: Only maintainers can accept the ongoing authenticated upstream-contract and availability tradeoff for all Cursor users.

Before merge

  • Resolve merge risk (P1) - The new default authenticated Cursor dashboard call depends on an upstream contract and can still delay a Cursor refresh by up to five seconds when that endpoint stalls.
  • Complete next step (P2) - A maintainer must decide whether the new default authenticated Cursor request is acceptable; there is no discrete automated repair to apply.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Implementation and coverage production +190/-2; tests +212/-5; docs/changelog +8/-1 The new authenticated fetch is accompanied by parser, mapping, menu-card, and architecture-gate coverage.

Merge-risk options

Maintainer options:

  1. Accept the bounded Cursor contract (recommended)
    Merge with the five-second cap and fail-soft behavior after explicitly accepting the same-session dashboard request as a supported best-effort source.
  2. Make polling opt-in
    Require a Cursor setting before issuing the new dashboard request if default authenticated polling is not acceptable.
  3. Pause for a stable endpoint
    Defer this enhancement if the undocumented dashboard contract is too volatile for default provider refreshes.

Technical review

Best possible solution:

Keep Grok Bot as a Cursor-owned optional usage window, with the same-session request bounded and fail-soft, if maintainers accept the upstream endpoint contract.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is an additive provider-usage feature, and the PR supplies direct post-change menu-card evidence rather than a bug report.

Is this the best way to solve the issue?

Yes, conditional on maintainer approval of the endpoint contract: representing the allowance as a Cursor extra window avoids a duplicate provider and preserves the monthly lanes on failure.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 95afa63a5e8c.

Labels

Label justifications:

  • P2: This is a bounded Cursor usage enhancement with limited blast radius.
  • merge-risk: 🚨 auth-provider: The change sends the existing Cursor session cookie to an additional Cursor dashboard endpoint.
  • merge-risk: 🚨 availability: A stalled optional endpoint can delay a Cursor refresh until the capped timeout expires.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The PR body provides a post-change Cursor menu-card screenshot showing the added Grok Bot bar and reports a live bundled-app run.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides a post-change Cursor menu-card screenshot showing the added Grok Bot bar and reports a live bundled-app run.
  • proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The PR body provides a post-change Cursor menu-card screenshot showing the added Grok Bot bar and reports a live bundled-app run.

Evidence

What I checked:

Likely related people:

  • Peter Steinberger: Current-main blame attributes the concurrent Cursor fetch and menu-window resolver to Peter, and recent history includes the v0.54.0 release update and provider-presentation refactor. (role: recent Cursor fetch and presentation owner; confidence: high; commits: 22a2168842a9, 8314a74e8613; files: Sources/CodexBarCore/Providers/Cursor/CursorStatusProbe.swift, Sources/CodexBarCore/Providers/Cursor/CursorProviderDescriptor.swift)
  • hxy91819: Recent history identifies a focused Cursor refresh reliability fix, making this person relevant to the optional-request timeout boundary. (role: recent Cursor reliability contributor; confidence: medium; commits: 11939777228b; files: Sources/CodexBarCore/Providers/Cursor/CursorStatusProbe.swift)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Obtain maintainer confirmation that default polling of Cursor’s dashboard endpoint with the existing session is acceptable.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)
  • reviewed 2026-08-21T18:45:30.256Z sha 8cd1b28 :: needs maintainer review before merge. :: none

@steipete
steipete merged commit c87c35b into steipete:main Aug 21, 2026
1 check passed
steipete added a commit that referenced this pull request Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 auth-provider 🚨 Merging this PR could break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. P2 Normal priority bug or improvement with limited blast radius. proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. proof: sufficient Contributor real behavior proof is sufficient. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants