fix(cursor): enforce auth token for anthropic daemon route (#1377)

src/cliproxy/quota/quota-manager.ts

@@ -483,9 +483,8 @@ export async function reconcileExhaustedRotationAccounts(
     return [];
   }
 
-  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } = await import(
-    '../accounts/account-safety'
-  );
+  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } =
+    await import('../accounts/account-safety');
   restoreExpiredQuotaPauses();
 
   const config = loadOrCreateUnifiedConfig();
@@ -593,9 +592,8 @@ export async function preflightCheck(provider: CLIProxyProvider): Promise<Prefli
     return { proceed: true, accountId: defaultAccount?.id || '' };
   }
 
-  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } = await import(
-    '../accounts/account-safety'
-  );
+  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } =
+    await import('../accounts/account-safety');
   restoreExpiredQuotaPauses();
 
   const config = loadOrCreateUnifiedConfig();

src/cursor/cursor-daemon-entry.ts

@@ -55,6 +55,23 @@ interface OpenAIChatRequest {
 
 const MAX_BODY_SIZE = 10 * 1024 * 1024; // 10MB
 
+function getAnthropicRequestToken(headers: http.IncomingHttpHeaders): string {
+  const xApiKey = headers['x-api-key'];
+  if (typeof xApiKey === 'string' && xApiKey.trim().length > 0) {
+    return xApiKey.trim();
+  }
+
+  const authorization = headers.authorization;
+  if (typeof authorization === 'string') {
+    const match = authorization.match(/^Bearer\s+(.+)$/i);
+    if (match && match[1].trim().length > 0) {
+      return match[1].trim();
+    }
+  }
+
+  return '';
+}
+
 function writeJson(res: http.ServerResponse, statusCode: number, payload: unknown): void {
   res.writeHead(statusCode, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(payload));
@@ -309,6 +326,22 @@ export function startCursorDaemonServer(options: DaemonRuntimeOptions): http.Ser
         return;
       }
 
+      if (isAnthropicRoute) {
+        const expectedToken = (process.env.ANTHROPIC_AUTH_TOKEN || 'cursor-managed').trim();
+        const requestToken = getAnthropicRequestToken(req.headers);
+        if (!expectedToken || requestToken !== expectedToken) {
+          await pipeWebResponseToNode(
+            createAnthropicErrorResponse(
+              401,
+              'authentication_error',
+              'Invalid Anthropic auth token. Set ANTHROPIC_AUTH_TOKEN and send it via x-api-key or Authorization Bearer.'
+            ),
+            res
+          );
+          return;
+        }
+      }
+
       const daemonCredentials = {
         accessToken: authStatus.credentials.accessToken,
         machineId: authStatus.credentials.machineId,

src/management/checks/image-analysis-check.ts

@@ -112,9 +112,8 @@ export async function runImageAnalysisCheck(results: HealthCheck): Promise<void>
  * Fix image analysis configuration issues
  */
 export async function fixImageAnalysisConfig(): Promise<boolean> {
-  const { updateConfig, loadOrCreateUnifiedConfig } = await import(
-    '../../config/config-loader-facade'
-  );
+  const { updateConfig, loadOrCreateUnifiedConfig } =
+    await import('../../config/config-loader-facade');
 
   const config = loadOrCreateUnifiedConfig();
   let fixed = false;