v1.6.1

Security fix for macOS chat-only mode (#61). Upgrade from 1.6.0.

• Keychain link moved out of the agent's workspace. In 1.6.0, each chat-only request used one temp dir as both the agent's workspace and its HOME. On macOS that HOME links the real ~/Library/Keychains so the Cursor CLI can read its login, so the link sat inside the agent's working directory. The agent could list keychain files there, and in agent mode a request that edited or cleaned "the project" could reach them.
  • The temp dir now holds an empty workspace/ for the agent and a separate private home/ for HOME, the Cursor config and the keychain link.
• Temp dirs are always removed. A request that failed or was aborted left its temp dir, keychain link included, in $TMPDIR. Temp dirs are now removed however the run ends.

v1.5.0 and earlier are not affected.

After upgrading on macOS, you can remove temp dirs left behind by 1.6.0. rm removes the links without touching the real keychain:

find "$TMPDIR" -maxdepth 1 -name 'cursor-proxy-*' -mmin +60 -exec rm -rf {} +

Published on npm as cursor-api-proxy@1.6.1.