@kentcdodds/origin

@kentcdodds/origin

Intent

Give Kody agents a durable, secret-safe way to call the Cursor Origin REST API (repos, pull requests, installation discovery, and a raw request escape hatch) using an Origin App. Cloud Agents API keys are not Origin credentials.

This package mints short-lived app JWTs through secret_jwt_sign (EdDSA) and exchanges them for installation tokens. The Ed25519 private key never enters package or execute code.

What it does

• List Origin App installations and installation-visible repositories
• List pull requests for Origin repos the installation can see
• Mint installation access tokens (token value never returned)
• Raw authenticated requests to any /v1/origin path
• Cheap rate-limit check as a credential smoke test
• Persist originAppId / originInstallationId in package storage

Prerequisites / setup

Follow coding_guide_get({ guide: "provider_origin" }). Defaults this package reads:

1. User secret originAppPrivateKey — PKCS#8 Ed25519 PEM, with secret_jwt_sign and host api.cursor.com approved.
2. Package storage originAppId — app_01….
3. Package storage originInstallationId — i_01… (optional; the first installation is used when omitted).

Agents: see AGENTS.md for import paths and smoke checks.

Done when

• originAppPrivateKey is saved; JWT sign and api.cursor.com are approved
• originAppId (and optionally originInstallationId) are in package storage
• ./rate-limit returns limit/remaining (app JWT works)
• You can list installations / repos / pulls for an owner the app can see