fix(cursor): enforce auth token for anthropic daemon route (#1377)

src/cursor/cursor-daemon-entry.ts

@@ -55,6 +55,23 @@ interface OpenAIChatRequest {
 
 const MAX_BODY_SIZE = 10 * 1024 * 1024; // 10MB
 
+function getAnthropicRequestToken(headers: http.IncomingHttpHeaders): string {
+  const xApiKey = headers['x-api-key'];
+  if (typeof xApiKey === 'string' && xApiKey.trim().length > 0) {
+    return xApiKey.trim();
+  }
+
+  const authorization = headers.authorization;
+  if (typeof authorization === 'string') {
+    const match = authorization.match(/^Bearer\s+(.+)$/i);
+    if (match && match[1].trim().length > 0) {
+      return match[1].trim();
+    }
+  }
+
+  return '';
+}
+
 function writeJson(res: http.ServerResponse, statusCode: number, payload: unknown): void {
   res.writeHead(statusCode, { 'Content-Type': 'application/json' });
   res.end(JSON.stringify(payload));
@@ -309,6 +326,22 @@ export function startCursorDaemonServer(options: DaemonRuntimeOptions): http.Ser
         return;
       }
 
+      if (isAnthropicRoute) {
+        const expectedToken = (process.env.ANTHROPIC_AUTH_TOKEN || 'cursor-managed').trim();
+        const requestToken = getAnthropicRequestToken(req.headers);
+        if (!expectedToken || requestToken !== expectedToken) {
+          await pipeWebResponseToNode(
+            createAnthropicErrorResponse(
+              401,
+              'authentication_error',
+              'Invalid Anthropic auth token. Set ANTHROPIC_AUTH_TOKEN and send it via x-api-key or Authorization Bearer.'
+            ),
+            res
+          );
+          return;
+        }
+      }
+
       const daemonCredentials = {
         accessToken: authStatus.credentials.accessToken,
         machineId: authStatus.credentials.machineId,