daemon.cjs · part 108

60 text occurrences from desktop/Cursor.app/Contents/Resources/app/extensions/cursor-agent-host/dist/agent-host-daemon/dist/bin/daemon.cjs, part 108. Every entry preserves the shipped literal and its saved verdict or selection reason.

File contents and all parts · All files

optional string

Mobile hardware model such as `iPhone16,1`. The desktop editor leaves it unset.

Set only by the mobile apps from the OS's hardware identifier. A model name is a fixed vendor string, not user input.

optional string

Mobile OS version such as `26.0.1`. The desktop editor leaves it unset.

Set only by the mobile apps from the OS version API. A version number is not user input.

optional string

`phone`, `pad`, `mac`, or `unspecified` on iOS. The desktop editor leaves it unset.

One of four fixed words chosen by the mobile app from the device class.

optional string

Mobile install UUID used to bucket experiments. The desktop editor leaves it unset.

A random UUID generated by the mobile app at install; it identifies the device, never its contents.

optional string

`release`, `testflight`, or `debug` on iOS. The desktop editor leaves it unset.

One of three fixed words derived from how the mobile app was installed.

optional string

The mobile app's bundle identifier such as `co.anysphere.cursor`. The desktop editor leaves it unset.

The app's own signed identifier, fixed at build time; never derived from user data.

optional string

The two-letter ISO 3166-1 country of the device's App Store or Play Store account, such as `US`. The desktop editor leaves it unset.

Read by the mobile app from the store's storefront API and mapped through the ISO country table; anything else is dropped, so only a country code can be sent.

The desktop editor sends one flag and one enum. The seven optional strings are mobile-only device descriptors (model, OS version, form factor, install UUID, channel, bundle id, store country), each a fixed vendor or build value rather than anything typed or stored by the user.

Admits one private-inference agent turn: authenticates the caller, checks usage limits, and returns the id later usage reports are attributed to.

Every agent turn served by the customer's private gateway; the user sees the turn start, or a usage-limit or enrollment error before any model call.

Cursor meters private-inference turns per account even though it never sees the prompt; admission is the only point where the turn is tied to the signed-in user before the customer gateway is called.

The gateway model id of the configured row the turn runs on, e.g. `gpt-5-nano`.

Copied from the `model` key of a `[model.<key>]` table in the admin-managed private-inference config file; never typed by the user and never derived from the prompt or the workspace.

The conversation's UUID, for usage attribution.

A random UUID minted by the editor when the conversation is created.

A UUID minted per turn attempt so a retried admission maps to the same usage id.

A random UUID minted by the editor per attempt.

optional string

The Cursor model id (a model-picker slug such as `gpt-5.4`) whose prompt family the turn is built with, when the configured row names one. Sent alongside `prompt_model` for servers that predate the structured field; servers with it ignore this one.

Copied from the `cursor_model` key of a `[model.<key>]` table in the admin-managed private-inference config file; never typed by the user and never derived from the prompt or the workspace. The server accepts only Cursor model ids the caller may use.

message aiserver.v1.InferenceRequestedModel

The Cursor model whose prompt family the turn is built with, when the configured row names one: its model-picker id (such as `gpt-5.6-sol`) and the turn's reasoning tier as a `reasoning` parameter, in the same structured form the managed agent loop sends the server. No credentials and no max-mode flag are set.

The id is copied from the `cursor_model` key of a `[model.<key>]` table in the admin-managed private-inference config file, and the only parameter is a reasoning tier drawn from that table's `reasoning_efforts` rungs (or the gateway's advertised tiers) — the fixed words such as `low` or `high` the model picker offers; never typed by the user and never derived from the prompt or the workspace. The server accepts only Cursor models the caller may use.

Two admin-configured model ids, one fixed reasoning-tier word, and two random UUIDs; no prompt, file, or path can reach any field.

Reports the token counts of completed private-inference model calls so usage is metered without pricing, and reports each finished turn so an admitted turn that never produced model output is not charged.

Background upload after each model call served by the customer's private gateway and after each turn ends; nothing is shown unless the upload keeps failing.

Cursor never sees the model call, so the only usage evidence is what the gateway reported to the editor; the editor forwards those counts and nothing else. Likewise only the editor knows when a turn ended and whether the model ever answered, which is what lets Cursor void a turn that was admitted but did no work.

repeated message aiserver.v1.PrivateInferenceInvocationUsage

One record per completed model call: the admission's usage UUID, a per-call UUID, the gateway model id, the call's timestamp, its outcome, the inference-reason name (`agent`), and the token counts the gateway reported (input, output, cached, reasoning).

Every string field is a UUID, an admin-configured model id, or a fixed reason name from the client's own code; every other field is a timestamp, an enum, or an integer token count copied from the gateway's usage payload. The prompt, the response text, and provider credentials are not part of the record by construction.

repeated message aiserver.v1.PrivateInferenceTurnOutcome

One record per finished turn attempt: the admission's usage UUID, when the attempt ended, how many gateway calls it made, and whether any call returned output tokens.

The only string is the usage UUID the server itself minted at admission; the rest is a timestamp, an integer count, and a boolean. Nothing about the prompt, the response, or the reason the turn ended is carried.

Identifiers, one enum, timestamps, integer counts, and one boolean; the gateway's usage object is reduced to its numeric fields before it is stored or sent, and the turn record is a UUID plus three scalars.

use strict

private inference perimeter:

${exports2.PRIVATE_INFERENCE_BLOCKED_MESSAGE_PREFIX} ${serviceTypeName}/${methodName} is disabled under private inference

use strict

private inference lockdown: ${initiator} egress to an unparseable target is refused

private inference lockdown: ${initiator} egress to ${host} is refused

[PrivateInferenceHttpGuard] lockdown ${state}

[PrivateInferenceHttpGuard] installed (lockdown ${this.lockdownState})

${refusal.initiator} ${refusal.host ?? "<unparseable>"}

[PrivateInferenceHttpGuard] refused host=${refusal.host ?? "<unparseable>"} initiator=${refusal.initiator} from=${refusal.stackHint ?? "?"}

${line} (further refusals of this target are logged at trace level)

${protocol}//${authority}${port !== void 0 ? `:${port}` : ""}${path53}