Merge branch 'main' into feat/cursor-local-history-transcripts

2026-08-17 03:27:02 +08:00 · 2026-08-02 22:58:50 +08:00
parent 834288839b 7764eca0c3
commit 90d35085c0
30 changed files with 1345 additions and 672 deletions
@@ -1,4 +0,0 @@
---
-name: test-requirements
-description: 本仓库代码禁止写任何测试
---
@@ -1,4 +0,0 @@
-interface:
-  display_name: "测试要求"
-  short_description: "根据测试要求，生成测试用例"
-  default_prompt: "使用 $test-requirements 来根据测试要求，生成测试用例。"
@@ -0,0 +1,178 @@
+<script setup>
+import Button from "@/components/ui/Button.vue";
+import Card from "@/components/ui/Card.vue";
+import Tooltip from "@/components/ui/Tooltip.vue";
+import { showModal } from "@/composables/useModal";
+import {
+  disconnectCursorAccount,
+  getCursorAccountStatus,
+  startCursorAccountLogin,
+} from "@/services/clientApi";
+import { toUserError } from "@/state/appState";
+import { Browser } from "@wailsio/runtime";
+import { computed, onMounted, onUnmounted, ref } from "vue";
+
+const CURSOR_ACCOUNT_CONTRIBUTOR_URL = "https://github.com/aike0210";
+
+const cursorAccountStatus = ref({
+  state: "signed_out",
+  authId: "",
+  email: "",
+  error: "",
+});
+const cursorAccountBusy = ref(false);
+let cursorAccountTimer = null;
+
+const cursorAccountSignedIn = computed(
+  () => cursorAccountStatus.value.state === "signed_in",
+);
+const cursorAccountWaiting = computed(
+  () => cursorAccountStatus.value.state === "waiting",
+);
+const cursorAccountStateText = computed(() => {
+  if (cursorAccountSignedIn.value) return "已经登录";
+  if (cursorAccountWaiting.value) return "等待浏览器登录";
+  return "未连接";
+});
+
+async function showActionError(title, error) {
+  await showModal({
+    title,
+    content: String(error || "服务错误").trim() || "服务错误",
+  });
+}
+
+async function handleOpenContributor() {
+  try {
+    await Browser.OpenURL(CURSOR_ACCOUNT_CONTRIBUTOR_URL);
+  } catch (error) {
+    await showActionError("打开贡献者主页失败", toUserError(error));
+  }
+}
+
+async function refreshCursorAccountStatus() {
+  cursorAccountStatus.value = await getCursorAccountStatus();
+}
+
+async function handleCursorAccountLogin() {
+  cursorAccountBusy.value = true;
+  try {
+    cursorAccountStatus.value = await startCursorAccountLogin();
+  } catch (error) {
+    await showActionError("登录失败", toUserError(error));
+    await refreshCursorAccountStatus().catch(() => {});
+  } finally {
+    cursorAccountBusy.value = false;
+  }
+}
+
+async function handleCursorAccountDisconnect() {
+  const confirmed = await showModal({
+    title: "退出登录",
+    content: "只会退出 cursor-byok 中的 Cursor 账号，不会退出 Cursor 客户端。是否继续？",
+    confirmText: "退出登录",
+    cancelText: "取消",
+    showCancel: true,
+  });
+  if (!confirmed) return;
+
+  cursorAccountBusy.value = true;
+  try {
+    cursorAccountStatus.value = await disconnectCursorAccount();
+  } catch (error) {
+    await showActionError("退出登录失败", toUserError(error));
+  } finally {
+    cursorAccountBusy.value = false;
+  }
+}
+
+onMounted(async () => {
+  await refreshCursorAccountStatus().catch(() => {});
+  cursorAccountTimer = window.setInterval(() => {
+    if (cursorAccountWaiting.value) {
+      void refreshCursorAccountStatus().catch(() => {});
+    }
+  }, 1500);
+});
+
+onUnmounted(() => {
+  if (cursorAccountTimer) {
+    window.clearInterval(cursorAccountTimer);
+    cursorAccountTimer = null;
+  }
+});
+</script>
+
+<template>
+  <Card>
+    <div class="flex flex-col gap-3">
+      <div class="flex items-center justify-between gap-4">
+        <div class="flex min-w-0 flex-wrap items-center gap-2">
+          <h2 class="text-base font-medium text-white">Cursor 控制面账号</h2>
+          <span
+            class="rounded-full border border-[#3a3a3a] bg-[#202020] px-2 py-0.5 text-xs text-[#b8b8b8]"
+          >
+            {{ cursorAccountStateText }}
+          </span>
+        </div>
+        <div class="flex shrink-0 items-center gap-1 text-xs text-[#737373]">
+          <span>@aike0210</span>
+          <Tooltip>
+            <div class="flex min-w-[220px] flex-col gap-2">
+              <div>感谢 @aike0210 对 Cursor 控制面账号功能的贡献。</div>
+              <button
+                type="button"
+                class="flex items-center gap-2 text-left text-[#8ab4f8] transition-colors duration-150 hover:text-[#b6d0fb]"
+                @click="handleOpenContributor"
+              >
+                <span class="icon-[mdi--github] text-[14px]"></span>
+                <span>github.com/aike0210</span>
+                <span class="icon-[mdi--open-in-new] text-[12px]"></span>
+              </button>
+            </div>
+          </Tooltip>
+        </div>
+      </div>
+
+      <div class="flex items-end justify-between gap-4">
+        <div class="min-w-0">
+          <div
+            v-if="cursorAccountSignedIn && (cursorAccountStatus.email || cursorAccountStatus.authId)"
+            class="truncate text-sm text-[#d0d0d0]"
+          >
+            {{ cursorAccountStatus.email || cursorAccountStatus.authId }}
+          </div>
+          <div class="mt-1 text-sm text-[#a3a3a3]">
+            独立用于插件、Skills 和 MCP；不会改变 Cursor 客户端当前账号
+          </div>
+          <div v-if="cursorAccountWaiting" class="mt-1 text-sm text-[#d6a84b]">
+            请在浏览器完成登录，完成后返回 Cursor 重新打开插件市场
+          </div>
+          <div
+            v-if="cursorAccountStatus.error"
+            class="mt-1 break-all text-sm text-[#e06c75]"
+          >
+            {{ cursorAccountStatus.error }}
+          </div>
+        </div>
+        <Button
+          v-if="cursorAccountSignedIn"
+          class="shrink-0"
+          :disabled="cursorAccountBusy"
+          @click="handleCursorAccountDisconnect"
+        >
+          退出登录
+        </Button>
+        <Button
+          v-else
+          class="shrink-0"
+          variant="primary"
+          :disabled="cursorAccountBusy || cursorAccountWaiting"
+          @click="handleCursorAccountLogin"
+        >
+          {{ cursorAccountWaiting ? "等待登录..." : "登录 Cursor" }}
+        </Button>
+      </div>
+    </div>
+  </Card>
+</template>
@@ -2,16 +2,14 @@
  "02216368edc68816": "No release notes",
  "02bc2e95bf49e587": "No",
  "03b11112dc970014": "Base URL",
-  "047ec6b71d0cec08": "Control whether requests on the whitelist main path go through the local service or return to the original Cursor upstream endpoint",
  "04f632dd4f034d5e": "{0} context window must be a positive integer",
  "051836569928a9f9": "Edit",
  "054d763265603305": "e.g. 65536 (leave blank to use the default)",
-  "05c8a9238c702efa": "Direct Cursor Mode",
-  "0647728439b5da2e": "You can configure the routing mode and model channels. Runtime logs are stored in",
  "092b520558eff5f2": "Not tested",
  "09ebc2643631ba25": "Cost Estimate",
  "0b0e7478e41fe677": "{0} tooltip text cannot be empty",
  "0c3b4cf7aa259edb": "Operation failed",
+  "0d6b7efd5ccefd8a": "You can configure model channels. Runtime logs are stored in",
  "0dde813d719dbd01": "Failed to open homepage",
  "1117a2f86030d03b": "Cache reads and writes are included in Prompt-side statistics.",
  "11afd2a534395b18": "Valid",
@@ -20,9 +18,9 @@
  "15d124b200ddabed": "Maximum number of context tokens the model can accept in a single request. Leave blank to use the default.",
  "185aebe19c77425d": "{0} must be a JSON object",
  "18b7312022cd1840": "Start Service",
-  "1af38868896cf53d": "Routing mode only supports local or upstream",
  "1baddde657dd2720": "Current outbound requests use system proxy",
  "1bc77f5ab979f4c1": "Add Model Settings",
+  "1c631615c1d85c9e": "Log in to Cursor",
  "1e238093b79b3165": "Uses 65536 by default when left blank",
  "21296ab18ad9af25": "Extra Params JSON",
  "24343a2096988d42": "Failed to open",
@@ -46,10 +44,11 @@
  "37d23612f78a2e63": "Restart Now to Update",
  "392d0dceb45998d3": "Extreme",
  "393df9bb13ea4900": "Hit",
+  "3ab8cc15939f3b5c": "Log out",
  "3af7e5489e61ea51": "Refreshing",
-  "3bf8512aa520ed21": "Local Service Mode",
  "3c2a9f9901109e75": "{0} type only supports OpenAI or Anthropic",
  "3d13868593ae4eeb": "Interface Language",
+  "3d52574ce1500561": "Not connected",
  "3ea83f9f55062582": "Release date: {0}",
  "3edda85621fd03b2": "model adapters",
  "3fd47edce45b3603": "Close",
@@ -67,6 +66,7 @@
  "51194c3ad014fb29": "Retest required",
  "5205125c0e91d346": "Maximum tokens an Anthropic model may generate in a single response. Leave blank to use the default.",
  "56627c94a9decee6": "Max Output Tokens",
+  "58c6b0935a7216da": "Failed to open contributor profile",
  "593a972852ba0004": "Cursor Assistant | Permanently Free | Custom API",
  "59a2195a01a8b35b": "{0} must be a valid JSON object",
  "5aa8f5590c940829": "Non-cache Input: {0}",
@@ -84,7 +84,7 @@
  "66af574b8948fe83": "{0} API key cannot be empty",
  "6744b4c6a9aa0038": "Disabled",
  "675109292da4eb36": "Not tested yet",
-  "699fe7ade5407687": "Direct Mode",
+  "688102a402ba015a": "Waiting for login...",
  "6a7b96f399e58138": "e.g. sk-xxxxxx",
  "6aa8f49cc992dfd7": "Test",
  "6ae23d6d7cb18592": "Service error",
@@ -106,12 +106,11 @@
  "80296f4aa3f4543b": "Cache Read/Write",
  "81123c56d5d880d0": "API Key",
  "8139cb3dd11f5a67": "When enabled, the JSON object will override the final request headers. Duplicate headers are determined by this field, and values must be strings.",
+  "83be9cac28873059": "Cursor Control Plane Account",
  "8672864e90417138": "Max",
  "86df7ec743047234": "Service running",
-  "87ed126f7bd1121e": "Routing Mode",
  "899add6275682210": "Uses 200000 by default when left blank",
  "8a4ef3e48e4e8a5a": "Enabled",
-  "8c0d84831a3c3d5b": "Currently in Local Service Mode",
  "8c1935935600e336": "Model Test",
  "8cbcf741e727dbf7": "Model Settings",
  "8d1de152be6360ce": "Valid ratio: {0}",
@@ -133,7 +132,6 @@
  "9970736b36ff2b68": "The base URL of the model service, usually an OpenAI- or Anthropic-compatible endpoint.",
  "9a6e7d6c17471711": "Currently displayed using the default hit rate definition",
  "9b17fa889b307f7f": "Valid turns: {0}",
-  "9c38b6e9bf94abec": "Switched to Direct Cursor Mode",
  "9c41b3a9e12ac994": "Thinking Effort",
  "9d2ca261281a158a": "Later",
  "9d2fb46c0ba890b9": "Custom Path",
@@ -146,7 +144,6 @@
  "a325d25c69e7256d": "Model settings not found; cannot duplicate",
  "a4dd8bb7e8b6eb31": "Show API Key",
  "a54d745d9a9249e2": "When enabled, the JSON object will override the Anthropic request body. Duplicate fields are determined by this field.",
-  "a55a88237df85d98": "Currently in Direct Mode",
  "a567bdaa11367f26": "Medium",
  "a5f1bd344c92e195": "The API key required to call this model service.",
  "a693d69af48bfe48": "Save and Test",
@@ -159,7 +156,6 @@
  "aed55419ce62f08e": "Switching...",
  "b10041a13f5c55b1": "Model Output: {0} × ${1}/1M = {2}",
  "b1c27820fec23edb": "High",
-  "b42049dcf8a05ef7": "Switched to Local Service Mode",
  "b5409d4049286061": "Custom Path (Please enter the full request URL)",
  "b571037dc396a00c": "Total request tokens include both prompt and model output.",
  "b765005f69fa971f": "e.g. gpt-4.1",
@@ -174,18 +170,18 @@
  "bddd504af0c92fd0": "System PAC/automatic proxy detected; current version is handled as a direct connection",
  "bef280f9eb392495": "Conversation Turns",
  "c228558cf257fc49": "Delete failed",
-  "c3e9c3c60020b8b7": "Select Mode",
+  "c3d46b387eeadb23": "This only logs the Cursor account out of cursor-byok; it does not log out of the Cursor client. Continue?",
  "c5af02060847d167": "Thinking effort for Anthropic adaptive thinking. Requests will consistently use the new thinking.type=adaptive.",
  "c69f5bce63b9f14c": "Settings Folder",
+  "c8a52b66651d294c": "Failed to log out",
  "c8c14507b2d37395": "Reasoning Effort",
  "c98e118e0a43f078": "Model",
  "c9dd59beefd7144f": "Cache Read / (Cache Read + Non-cache Input)",
  "ca00a39fcea70dc6": "Starting...",
  "ca1d1059408b3837": "Invalid turns: {0}",
  "cd7ca5fb221e1c53": "{0} cannot be empty",
-  "ce46f23cea3bf3c5": "When enabled, Cursor connects directly to the official service. Do not enable this.",
+  "cfa6c803eb3fc713": "Waiting for browser login",
  "d0325067fed88e5a": "Cache hit rate {0}",
-  "d08fd4224abcd69d": "Switch failed",
  "d1bde4a4e057b2c7": "[MainLayout] Failed to load author info",
  "d20ab96566d33f25": "{0} display name cannot be empty",
  "d2243e1d44b2a94e": "Edit Model Settings",
@@ -193,6 +189,7 @@
  "d373809ab86ba93b": "Copy",
  "d3b1da3088ddd334": "Model test failed",
  "d53d32f1a1211371": "Custom Headers JSON",
+  "d6ce4f0f88178144": "Used only for Plugins, Skills, and MCP; does not change the account in the Cursor client",
  "d7889896c5b7732a": "Anthropic Extra Params JSON",
  "d7da2aabd35772ec": "e.g. 200000 (leave blank to use the default)",
  "d95e5cb6bdcee553": "Include Cache Creation",
@@ -205,8 +202,12 @@
  "e01c5dae36cf8c35": "When enabled, the JSON object will override the OpenAI request body. Duplicate fields are determined by this field. OpenAI service_tier supports auto, default, flex, scale, priority.",
  "e14c41ef2b7253c9": "Total request tokens: {0}",
  "e406825e0a72d2c2": "Local Settings",
+  "e4343921c928a856": "Login failed",
+  "e4c0daa3c4bea691": "Thanks to @aike0210 for contributing the Cursor control-plane account feature.",
+  "e53580f8031f13c0": "Complete login in the browser, then return to Cursor and reopen the plugin marketplace",
  "e552c2accdbf5178": "Add Model",
  "e6faccfddce722e8": "Cache read tokens: {0}",
+  "e8a0a6053998ebfa": "Logged in",
  "eaffd48cd2ea9f1a": "e.g. https://api.anthropic.com",
  "eb1be07f2ca6e506": "Estimated based on Claude Opus 4.7 pricing.",
  "ec3b17a75db49e24": "{0} t/s | First token {1}",
@@ -2,16 +2,14 @@
  "02216368edc68816": "更新内容はありません",
  "02bc2e95bf49e587": "まだ",
  "03b11112dc970014": "ベース URL",
-  "047ec6b71d0cec08": "ホワイトリストのメイン経路のリクエストをローカルサービス経由にするか、元の Cursor 上流アドレスに戻すかを制御します",
  "04f632dd4f034d5e": "{0} のコンテキストウィンドウは正の整数である必要があります",
  "051836569928a9f9": "編集",
  "054d763265603305": "例: 65536（空欄でデフォルト値）",
-  "05c8a9238c702efa": "Cursor 直結モード",
-  "0647728439b5da2e": "ルーティングモードとモデルチャネルを設定できます。実行ログは次にあります",
  "092b520558eff5f2": "未テスト",
  "09ebc2643631ba25": "価値見積もり",
  "0b0e7478e41fe677": "{0} のツールチップは必須です",
  "0c3b4cf7aa259edb": "操作に失敗しました",
+  "0d6b7efd5ccefd8a": "モデルチャネルを設定できます。実行ログは次にあります",
  "0dde813d719dbd01": "ホームページを開けませんでした",
  "1117a2f86030d03b": "キャッシュの読み書きは Prompt 側の統計に含まれます。",
  "11afd2a534395b18": "有効",
@@ -20,9 +18,9 @@
  "15d124b200ddabed": "モデルが1回のリクエストで受け取れる最大コンテキスト Token 数。空欄の場合はデフォルト値を使用します。",
  "185aebe19c77425d": "{0}はJSONオブジェクトである必要があります",
  "18b7312022cd1840": "サービスを開始",
-  "1af38868896cf53d": "ルーティングモードは local または upstream のみサポートします",
  "1baddde657dd2720": "現在のアウトバウンドリクエストはシステムプロキシを使用しています",
  "1bc77f5ab979f4c1": "モデル設定を追加",
+  "1c631615c1d85c9e": "Cursor にログイン",
  "1e238093b79b3165": "空欄で 65536",
  "21296ab18ad9af25": "追加パラメータ JSON",
  "24343a2096988d42": "開けませんでした",
@@ -46,10 +44,11 @@
  "37d23612f78a2e63": "今すぐ再起動して更新",
  "392d0dceb45998d3": "最高",
  "393df9bb13ea4900": "ヒット",
+  "3ab8cc15939f3b5c": "ログアウト",
  "3af7e5489e61ea51": "更新中",
-  "3bf8512aa520ed21": "ローカルサービスモード",
  "3c2a9f9901109e75": "{0} のタイプは OpenAI または Anthropic のみサポートします",
  "3d13868593ae4eeb": "表示言語",
+  "3d52574ce1500561": "未接続",
  "3ea83f9f55062582": "公開日時: {0}",
  "3edda85621fd03b2": "件のモデルアダプター",
  "3fd47edce45b3603": "閉じる",
@@ -67,6 +66,7 @@
  "51194c3ad014fb29": "再テストが必要",
  "5205125c0e91d346": "Anthropic モデルが1回の応答で生成できる最大 Token 数。空欄の場合はデフォルト値を使用します。",
  "56627c94a9decee6": "最大出力 Token",
+  "58c6b0935a7216da": "コントリビューターのプロフィールを開けませんでした",
  "593a972852ba0004": "Cursor アシスタント | 永久無料 | カスタム API",
  "59a2195a01a8b35b": "{0}は有効なJSONオブジェクトである必要があります",
  "5aa8f5590c940829": "非キャッシュ入力：{0}",
@@ -84,7 +84,7 @@
  "66af574b8948fe83": "{0} の API キーは必須です",
  "6744b4c6a9aa0038": "無効化",
  "675109292da4eb36": "まだテストしていません",
-  "699fe7ade5407687": "直結モード",
+  "688102a402ba015a": "ログインを待っています...",
  "6a7b96f399e58138": "例: sk-xxxxxx",
  "6aa8f49cc992dfd7": "テスト",
  "6ae23d6d7cb18592": "サービスエラー",
@@ -106,12 +106,11 @@
  "80296f4aa3f4543b": "キャッシュ読み書き",
  "81123c56d5d880d0": "API キー",
  "8139cb3dd11f5a67": "有効にすると、JSONオブジェクトが最終的なリクエストヘッダーを上書きします。同名のヘッダーはこの設定が優先され、値は文字列である必要があります。",
+  "83be9cac28873059": "Cursor コントロールプレーンアカウント",
  "8672864e90417138": "最大",
  "86df7ec743047234": "サービス稼働中",
-  "87ed126f7bd1121e": "ルーティングモード",
  "899add6275682210": "空欄で 200000",
  "8a4ef3e48e4e8a5a": "有効",
-  "8c0d84831a3c3d5b": "現在はローカルサービスモードです",
  "8c1935935600e336": "モデルテスト",
  "8cbcf741e727dbf7": "モデル設定",
  "8d1de152be6360ce": "有効率: {0}",
@@ -133,7 +132,6 @@
  "9970736b36ff2b68": "モデルサービスの API ルート URL。通常は OpenAI または Anthropic 互換のエンドポイントです。",
  "9a6e7d6c17471711": "現在、デフォルトのヒット率定義に従って表示されています",
  "9b17fa889b307f7f": "有効ターン: {0}",
-  "9c38b6e9bf94abec": "Cursor 直結モードに切り替えました",
  "9c41b3a9e12ac994": "思考強度",
  "9d2ca261281a158a": "後で",
  "9d2fb46c0ba890b9": "カスタムパス",
@@ -146,7 +144,6 @@
  "a325d25c69e7256d": "モデル設定が存在しないため複製できません",
  "a4dd8bb7e8b6eb31": "API キーを表示",
  "a54d745d9a9249e2": "有効にすると、JSONオブジェクトがAnthropicのリクエストボディを上書きします。同名のフィールドはこの設定が優先されます。",
-  "a55a88237df85d98": "現在は直結モードです",
  "a567bdaa11367f26": "中",
  "a5f1bd344c92e195": "このモデルサービスを呼び出すために必要な API キーです。",
  "a693d69af48bfe48": "保存してテスト",
@@ -159,7 +156,6 @@
  "aed55419ce62f08e": "切替中...",
  "b10041a13f5c55b1": "モデル出力：{0} × ${1}/1M = {2}",
  "b1c27820fec23edb": "高",
-  "b42049dcf8a05ef7": "ローカルサービスモードに切り替えました",
  "b5409d4049286061": "カスタムパス（完全なリクエストURLを入力してください）",
  "b571037dc396a00c": "総リクエスト Token には Prompt とモデル出力の両方が含まれます。",
  "b765005f69fa971f": "例: gpt-4.1",
@@ -174,18 +170,18 @@
  "bddd504af0c92fd0": "システムのPAC/自動プロキシが検出されました。現在のバージョンは直接接続として処理されます",
  "bef280f9eb392495": "会話ターン",
  "c228558cf257fc49": "削除に失敗しました",
-  "c3e9c3c60020b8b7": "モードを選択",
+  "c3d46b387eeadb23": "cursor-byok 内の Cursor アカウントからのみログアウトします。Cursor クライアントからはログアウトしません。続行しますか？",
  "c5af02060847d167": "Anthropic adaptive thinkingの思考強度。リクエストは一貫して新しいthinking.type=adaptiveを使用します。",
  "c69f5bce63b9f14c": "設定フォルダー",
+  "c8a52b66651d294c": "ログアウトに失敗しました",
  "c8c14507b2d37395": "推論強度",
  "c98e118e0a43f078": "モデル",
  "c9dd59beefd7144f": "キャッシュ読み取り / (キャッシュ読み取り + 非キャッシュ入力)",
  "ca00a39fcea70dc6": "起動中...",
  "ca1d1059408b3837": "異常ターン: {0}",
  "cd7ca5fb221e1c53": "{0}は空にできません",
-  "ce46f23cea3bf3c5": "有効にすると、Cursor は公式サービスへ直接接続します。オンにしないでください",
+  "cfa6c803eb3fc713": "ブラウザでのログインを待っています",
  "d0325067fed88e5a": "キャッシュヒット率 {0}",
-  "d08fd4224abcd69d": "切替に失敗しました",
  "d1bde4a4e057b2c7": "[MainLayout] 作者情報の読み込みに失敗しました",
  "d20ab96566d33f25": "{0} の表示名は必須です",
  "d2243e1d44b2a94e": "モデル設定を編集",
@@ -193,6 +189,7 @@
  "d373809ab86ba93b": "コピー",
  "d3b1da3088ddd334": "モデルテストに失敗しました",
  "d53d32f1a1211371": "カスタムヘッダー JSON",
+  "d6ce4f0f88178144": "プラグイン、Skills、MCP 専用です。Cursor クライアントの現在のアカウントは変更しません",
  "d7889896c5b7732a": "Anthropic 追加パラメータ JSON",
  "d7da2aabd35772ec": "例: 200000（空欄でデフォルト値）",
  "d95e5cb6bdcee553": "キャッシュ作成を含める",
@@ -205,8 +202,12 @@
  "e01c5dae36cf8c35": "有効にすると、JSONオブジェクトがOpenAIのリクエストボディを上書きします。同名のフィールドはこの設定が優先されます。OpenAIのservice_tierはauto、default、flex、scale、priorityをサポートしています。",
  "e14c41ef2b7253c9": "総リクエスト Token: {0}",
  "e406825e0a72d2c2": "ローカル設定",
+  "e4343921c928a856": "ログインに失敗しました",
+  "e4c0daa3c4bea691": "Cursor コントロールプレーンアカウント機能への @aike0210 の貢献に感謝します。",
+  "e53580f8031f13c0": "ブラウザでログインを完了し、Cursor に戻ってプラグインマーケットを開き直してください",
  "e552c2accdbf5178": "モデルを追加",
  "e6faccfddce722e8": "キャッシュ読込 Token: {0}",
+  "e8a0a6053998ebfa": "ログイン済み",
  "eaffd48cd2ea9f1a": "例: https://api.anthropic.com",
  "eb1be07f2ca6e506": "Claude Opus 4.7の価格に基づいて見積もられます。",
  "ec3b17a75db49e24": "{0} t/s | 初回 Token {1}",
@@ -2,16 +2,14 @@
  "02216368edc68816": "Нет примечаний к выпуску",
  "02bc2e95bf49e587": "Пока нет настроенных",
  "03b11112dc970014": "Базовый URL",
-  "047ec6b71d0cec08": "Определяет, будут ли запросы основного маршрута из белого списка проходить через локальный сервис или исходный сервер Cursor",
  "04f632dd4f034d5e": "Размер контекстного окна {0} должен быть положительным целым числом",
  "051836569928a9f9": "Изменить",
  "054d763265603305": "например, 65536 (оставьте пустым для значения по умолчанию)",
-  "05c8a9238c702efa": "Прямое подключение к Cursor",
-  "0647728439b5da2e": "Здесь можно настроить режим маршрутизации и каналы моделей. Журналы выполнения находятся в",
  "092b520558eff5f2": "Не проверено",
  "09ebc2643631ba25": "Оценка стоимости",
  "0b0e7478e41fe677": "Текст подсказки {0} не может быть пустым",
  "0c3b4cf7aa259edb": "Не удалось выполнить операцию",
+  "0d6b7efd5ccefd8a": "Здесь можно настроить каналы моделей. Журналы выполнения находятся в",
  "0dde813d719dbd01": "Не удалось открыть домашнюю страницу",
  "1117a2f86030d03b": "Чтение и запись кеша включены в статистику Prompt.",
  "11afd2a534395b18": "Успешно",
@@ -20,9 +18,9 @@
  "15d124b200ddabed": "Максимальное число токенов контекста, которое модель может принять за один запрос. Оставьте поле пустым для значения по умолчанию.",
  "185aebe19c77425d": "{0} должен быть объектом JSON",
  "18b7312022cd1840": "Запустить сервис",
-  "1af38868896cf53d": "Режим маршрутизации поддерживает только local или upstream",
  "1baddde657dd2720": "Исходящие запросы используют системный прокси",
  "1bc77f5ab979f4c1": "Добавить настройки модели",
+  "1c631615c1d85c9e": "Войти в Cursor",
  "1e238093b79b3165": "Если оставить пустым, используется 65536",
  "21296ab18ad9af25": "Дополнительные параметры JSON",
  "24343a2096988d42": "Не удалось открыть",
@@ -46,10 +44,11 @@
  "37d23612f78a2e63": "Перезапустить и обновить",
  "392d0dceb45998d3": "Очень высокая",
  "393df9bb13ea4900": "Попадание",
+  "3ab8cc15939f3b5c": "Выйти",
  "3af7e5489e61ea51": "Обновление",
-  "3bf8512aa520ed21": "Режим локального сервиса",
  "3c2a9f9901109e75": "Тип {0} поддерживает только OpenAI или Anthropic",
  "3d13868593ae4eeb": "Язык интерфейса",
+  "3d52574ce1500561": "Не подключено",
  "3ea83f9f55062582": "Дата выпуска: {0}",
  "3edda85621fd03b2": "адаптеров моделей",
  "3fd47edce45b3603": "Закрыть",
@@ -67,6 +66,7 @@
  "51194c3ad014fb29": "Требуется повторная проверка",
  "5205125c0e91d346": "Максимальное число токенов, которое модель Anthropic может сгенерировать за один ответ. Оставьте поле пустым для значения по умолчанию.",
  "56627c94a9decee6": "Макс. выходных токенов",
+  "58c6b0935a7216da": "Не удалось открыть профиль участника",
  "593a972852ba0004": "Cursor Assistant | Всегда бесплатно | Пользовательский API",
  "59a2195a01a8b35b": "{0} должен быть допустимым объектом JSON",
  "5aa8f5590c940829": "Ввод без кеша: {0}",
@@ -84,7 +84,7 @@
  "66af574b8948fe83": "Ключ API {0} не может быть пустым",
  "6744b4c6a9aa0038": "Выключено",
  "675109292da4eb36": "Еще не проверено",
-  "699fe7ade5407687": "Прямой режим",
+  "688102a402ba015a": "Ожидание входа...",
  "6a7b96f399e58138": "например, sk-xxxxxx",
  "6aa8f49cc992dfd7": "Проверить",
  "6ae23d6d7cb18592": "Ошибка сервиса",
@@ -106,12 +106,11 @@
  "80296f4aa3f4543b": "Чтение/запись кеша",
  "81123c56d5d880d0": "Ключ API",
  "8139cb3dd11f5a67": "Если включено, объект JSON переопределит итоговые заголовки запроса. При совпадении имен используются значения отсюда; все значения должны быть строками.",
+  "83be9cac28873059": "Аккаунт управляющего уровня Cursor",
  "8672864e90417138": "Максимальная",
  "86df7ec743047234": "Сервис запущен",
-  "87ed126f7bd1121e": "Режим маршрутизации",
  "899add6275682210": "Если оставить пустым, используется 200000",
  "8a4ef3e48e4e8a5a": "Включено",
-  "8c0d84831a3c3d5b": "Сейчас используется режим локального сервиса",
  "8c1935935600e336": "Проверка модели",
  "8cbcf741e727dbf7": "Настройки модели",
  "8d1de152be6360ce": "Доля успешных: {0}",
@@ -133,7 +132,6 @@
  "9970736b36ff2b68": "Корневой адрес API сервиса модели, обычно совместимый с OpenAI или Anthropic.",
  "9a6e7d6c17471711": "Сейчас используется стандартный расчет доли попаданий",
  "9b17fa889b307f7f": "Успешных ходов: {0}",
-  "9c38b6e9bf94abec": "Включено прямое подключение к Cursor",
  "9c41b3a9e12ac994": "Интенсивность рассуждений",
  "9d2ca261281a158a": "Позже",
  "9d2fb46c0ba890b9": "Пользовательский путь",
@@ -146,7 +144,6 @@
  "a325d25c69e7256d": "Настройки модели не найдены; дублирование невозможно",
  "a4dd8bb7e8b6eb31": "Показать ключ API",
  "a54d745d9a9249e2": "Если включено, объект JSON переопределит тело запроса Anthropic. При совпадении полей используются значения отсюда.",
-  "a55a88237df85d98": "Сейчас используется прямой режим",
  "a567bdaa11367f26": "Средняя",
  "a5f1bd344c92e195": "Ключ API, необходимый для обращения к сервису модели.",
  "a693d69af48bfe48": "Сохранить и проверить",
@@ -159,7 +156,6 @@
  "aed55419ce62f08e": "Переключение...",
  "b10041a13f5c55b1": "Вывод модели: {0} × ${1}/1M = {2}",
  "b1c27820fec23edb": "Высокая",
-  "b42049dcf8a05ef7": "Включен режим локального сервиса",
  "b5409d4049286061": "Пользовательский путь (введите полный URL запроса)",
  "b571037dc396a00c": "Общее число токенов запроса включает Prompt и вывод модели.",
  "b765005f69fa971f": "например, gpt-4.1",
@@ -174,18 +170,18 @@
  "bddd504af0c92fd0": "Обнаружен системный PAC/автоматический прокси; в текущей версии используется прямое подключение",
  "bef280f9eb392495": "Ходы диалога",
  "c228558cf257fc49": "Не удалось удалить",
-  "c3e9c3c60020b8b7": "Выберите режим",
+  "c3d46b387eeadb23": "Будет выполнен выход только из аккаунта Cursor в cursor-byok. В клиенте Cursor вы останетесь в системе. Продолжить?",
  "c5af02060847d167": "Интенсивность для адаптивных рассуждений Anthropic. В запросах всегда используется новый режим thinking.type=adaptive.",
  "c69f5bce63b9f14c": "Папка настроек",
+  "c8a52b66651d294c": "Не удалось выйти",
  "c8c14507b2d37395": "Интенсивность рассуждений",
  "c98e118e0a43f078": "Модель",
  "c9dd59beefd7144f": "Чтение кеша / (Чтение кеша + Ввод без кеша)",
  "ca00a39fcea70dc6": "Запуск...",
  "ca1d1059408b3837": "Ошибочных ходов: {0}",
  "cd7ca5fb221e1c53": "{0} не может быть пустым",
-  "ce46f23cea3bf3c5": "Если включено, Cursor подключается напрямую к официальному сервису. Не включайте этот режим.",
+  "cfa6c803eb3fc713": "Ожидание входа в браузере",
  "d0325067fed88e5a": "Доля попаданий в кеш: {0}",
-  "d08fd4224abcd69d": "Не удалось переключить",
  "d1bde4a4e057b2c7": "[MainLayout] Не удалось загрузить сведения об авторе",
  "d20ab96566d33f25": "Отображаемое имя {0} не может быть пустым",
  "d2243e1d44b2a94e": "Изменить настройки модели",
@@ -193,6 +189,7 @@
  "d373809ab86ba93b": "Копировать",
  "d3b1da3088ddd334": "Проверка модели не пройдена",
  "d53d32f1a1211371": "Пользовательские заголовки JSON",
+  "d6ce4f0f88178144": "Используется только для Plugins, Skills и MCP; текущий аккаунт клиента Cursor не изменяется",
  "d7889896c5b7732a": "Дополнительные параметры Anthropic JSON",
  "d7da2aabd35772ec": "например, 200000 (оставьте пустым для значения по умолчанию)",
  "d95e5cb6bdcee553": "Учитывать создание кеша",
@@ -205,8 +202,12 @@
  "e01c5dae36cf8c35": "Если включено, объект JSON переопределит тело запроса OpenAI. При совпадении полей используются значения отсюда. OpenAI service_tier поддерживает auto, default, flex, scale и priority.",
  "e14c41ef2b7253c9": "Всего токенов запроса: {0}",
  "e406825e0a72d2c2": "Локальные настройки",
+  "e4343921c928a856": "Не удалось войти",
+  "e4c0daa3c4bea691": "Спасибо @aike0210 за вклад в функцию аккаунта панели управления Cursor.",
+  "e53580f8031f13c0": "Завершите вход в браузере, затем вернитесь в Cursor и снова откройте магазин плагинов",
  "e552c2accdbf5178": "Добавить модель",
  "e6faccfddce722e8": "Токены чтения из кеша: {0}",
+  "e8a0a6053998ebfa": "Выполнен вход",
  "eaffd48cd2ea9f1a": "например, https://api.anthropic.com",
  "eb1be07f2ca6e506": "Расчет основан на тарифах Claude Opus 4.7.",
  "ec3b17a75db49e24": "{0} т/с | Первый токен {1}",
@@ -2,16 +2,14 @@
  "02216368edc68816": "无更新说明",
  "02bc2e95bf49e587": "当前还没有配置任何",
  "03b11112dc970014": "接口地址",
-  "047ec6b71d0cec08": "控制白名单主链路请求走本地服务，还是回到原始 Cursor 上游地址",
  "04f632dd4f034d5e": "{0} 的上下文窗口必须为正整数",
  "051836569928a9f9": "编辑",
  "054d763265603305": "例如：65536（留空用默认值）",
-  "05c8a9238c702efa": "直连 Cursor 模式",
-  "0647728439b5da2e": "可配置运行模式和模型渠道；运行日志位于",
  "092b520558eff5f2": "未测试",
  "09ebc2643631ba25": "价值估算",
  "0b0e7478e41fe677": "{0} 的悬停提示不能为空",
  "0c3b4cf7aa259edb": "操作失败",
+  "0d6b7efd5ccefd8a": "可配置模型渠道；运行日志位于",
  "0dde813d719dbd01": "打开主页失败",
  "1117a2f86030d03b": "缓存读写已计入 Prompt 侧统计。",
  "11afd2a534395b18": "有效",
@@ -20,9 +18,9 @@
  "15d124b200ddabed": "模型单次可接受的最大上下文 Token 数。留空时使用默认值。",
  "185aebe19c77425d": "{0}必须是 JSON 对象",
  "18b7312022cd1840": "启动服务",
-  "1af38868896cf53d": "运行模式仅支持 local 或 upstream",
  "1baddde657dd2720": "当前出站请求使用系统代理",
  "1bc77f5ab979f4c1": "新增模型配置",
+  "1c631615c1d85c9e": "登录 Cursor",
  "1e238093b79b3165": "留空时默认 65536",
  "21296ab18ad9af25": "额外参数 JSON",
  "24343a2096988d42": "打开失败",
@@ -46,10 +44,11 @@
  "37d23612f78a2e63": "立即重启更新",
  "392d0dceb45998d3": "极高",
  "393df9bb13ea4900": "命中",
+  "3ab8cc15939f3b5c": "退出登录",
  "3af7e5489e61ea51": "刷新中",
-  "3bf8512aa520ed21": "本地服务模式",
  "3c2a9f9901109e75": "{0} 的类型仅支持 OpenAI 或 Anthropic",
  "3d13868593ae4eeb": "界面语言",
+  "3d52574ce1500561": "未连接",
  "3ea83f9f55062582": "发布时间：{0}",
  "3edda85621fd03b2": "个模型适配器",
  "3fd47edce45b3603": "关闭",
@@ -67,6 +66,7 @@
  "51194c3ad014fb29": "需重测",
  "5205125c0e91d346": "Anthropic 模型单次回复允许生成的最大 Token 数。留空时使用默认值。",
  "56627c94a9decee6": "最大输出 Token",
+  "58c6b0935a7216da": "打开贡献者主页失败",
  "593a972852ba0004": "Cursor助手｜永久免费｜自定义API",
  "59a2195a01a8b35b": "{0}必须是合法 JSON 对象",
  "5aa8f5590c940829": "非缓存输入：{0}",
@@ -84,7 +84,7 @@
  "66af574b8948fe83": "{0} 的访问密钥不能为空",
  "6744b4c6a9aa0038": "已关闭",
  "675109292da4eb36": "尚未测试",
-  "699fe7ade5407687": "直连模式",
+  "688102a402ba015a": "等待登录...",
  "6a7b96f399e58138": "例如：sk-xxxxxx",
  "6aa8f49cc992dfd7": "测试",
  "6ae23d6d7cb18592": "服务错误",
@@ -106,12 +106,11 @@
  "80296f4aa3f4543b": "缓存读写",
  "81123c56d5d880d0": "访问密钥",
  "8139cb3dd11f5a67": "开启后会把 JSON 对象覆盖到最终请求头。同名请求头以这里为准，值必须是字符串。",
+  "83be9cac28873059": "Cursor 控制面账号",
  "8672864e90417138": "最高",
  "86df7ec743047234": "服务运行中",
-  "87ed126f7bd1121e": "运行模式",
  "899add6275682210": "留空时默认 200000",
  "8a4ef3e48e4e8a5a": "已开启",
-  "8c0d84831a3c3d5b": "当前为本地服务模式",
  "8c1935935600e336": "模型测试",
  "8cbcf741e727dbf7": "模型配置",
  "8d1de152be6360ce": "有效占比：{0}",
@@ -133,7 +132,6 @@
  "9970736b36ff2b68": "模型服务的 API 根地址，通常为兼容 OpenAI 或 Anthropic 的接口入口。",
  "9a6e7d6c17471711": "当前按默认命中率口径显示",
  "9b17fa889b307f7f": "有效轮次：{0}",
-  "9c38b6e9bf94abec": "已切换到直连 Cursor 模式",
  "9c41b3a9e12ac994": "思考强度",
  "9d2ca261281a158a": "稍后",
  "9d2fb46c0ba890b9": "自定义路径",
@@ -146,7 +144,6 @@
  "a325d25c69e7256d": "模型配置不存在，无法复制",
  "a4dd8bb7e8b6eb31": "显示访问密钥",
  "a54d745d9a9249e2": "开启后会把 JSON 对象覆盖到 Anthropic 请求体。同名字段以这里为准。",
-  "a55a88237df85d98": "当前为直连模式",
  "a567bdaa11367f26": "中",
  "a5f1bd344c92e195": "调用该模型服务需要使用的访问密钥。",
  "a693d69af48bfe48": "保存并测试",
@@ -159,7 +156,6 @@
  "aed55419ce62f08e": "切换中...",
  "b10041a13f5c55b1": "模型输出：{0} × ${1}/1M = {2}",
  "b1c27820fec23edb": "高",
-  "b42049dcf8a05ef7": "已切换到本地服务模式",
  "b5409d4049286061": "自定义路径(请输入完整请求地址)",
  "b571037dc396a00c": "总请求 Token 包含 Prompt 和模型输出。",
  "b765005f69fa971f": "例如：gpt-4.1",
@@ -174,18 +170,18 @@
  "bddd504af0c92fd0": "检测到系统 PAC/自动代理，当前版本按直连处理",
  "bef280f9eb392495": "对话轮次",
  "c228558cf257fc49": "删除失败",
-  "c3e9c3c60020b8b7": "选择模式",
+  "c3d46b387eeadb23": "只会退出 cursor-byok 中的 Cursor 账号，不会退出 Cursor 客户端。是否继续？",
  "c5af02060847d167": "Anthropic adaptive thinking 的思考强度。请求会固定使用新版 thinking.type=adaptive。",
  "c69f5bce63b9f14c": "设置文件夹",
+  "c8a52b66651d294c": "退出登录失败",
  "c8c14507b2d37395": "推理强度",
  "c98e118e0a43f078": "模型",
  "c9dd59beefd7144f": "缓存读取 /（缓存读取 + 非缓存输入）",
  "ca00a39fcea70dc6": "启动中...",
  "ca1d1059408b3837": "异常轮次：{0}",
  "cd7ca5fb221e1c53": "{0}不能为空",
-  "ce46f23cea3bf3c5": "开启后，Cursor将直接接通官方，请勿开启",
+  "cfa6c803eb3fc713": "等待浏览器登录",
  "d0325067fed88e5a": "缓存命中率 {0}",
-  "d08fd4224abcd69d": "切换失败",
  "d1bde4a4e057b2c7": "[MainLayout] 加载作者信息失败",
  "d20ab96566d33f25": "{0} 的显示名称不能为空",
  "d2243e1d44b2a94e": "编辑模型配置",
@@ -193,6 +189,7 @@
  "d373809ab86ba93b": "拷贝",
  "d3b1da3088ddd334": "模型测试失败",
  "d53d32f1a1211371": "自定义请求头 JSON",
+  "d6ce4f0f88178144": "独立用于插件、Skills 和 MCP；不会改变 Cursor 客户端当前账号",
  "d7889896c5b7732a": "Anthropic 额外参数 JSON",
  "d7da2aabd35772ec": "例如：200000（留空用默认值）",
  "d95e5cb6bdcee553": "计入缓存创建",
@@ -205,8 +202,12 @@
  "e01c5dae36cf8c35": "开启后会把 JSON 对象覆盖到 OpenAI 请求体。同名字段以这里为准。OpenAI service_tier 支持 auto、default、flex、scale、priority。",
  "e14c41ef2b7253c9": "总请求：{0}",
  "e406825e0a72d2c2": "本地配置",
+  "e4343921c928a856": "登录失败",
+  "e4c0daa3c4bea691": "感谢 @aike0210 对 Cursor 控制面账号功能的贡献。",
+  "e53580f8031f13c0": "请在浏览器完成登录，完成后返回 Cursor 重新打开插件市场",
  "e552c2accdbf5178": "新增模型",
  "e6faccfddce722e8": "缓存读取：{0}",
+  "e8a0a6053998ebfa": "已经登录",
  "eaffd48cd2ea9f1a": "例如：https://api.anthropic.com",
  "eb1be07f2ca6e506": "按 Claude Opus 4.7 价格估算。",
  "ec3b17a75db49e24": "{0} t/s | 首字 {1}",
@@ -1,7 +1,10 @@
 import {
+  DisconnectCursorAccount,
+  GetCursorAccountStatus,
  GetState,
  LoadUserConfig,
  SaveUserConfig,
+  StartCursorAccountLogin,
  StartProxy,
  StopProxy,
 } from "@bindings/cursor/internal/bridge/proxyservice.js";
@@ -62,6 +65,18 @@ export function saveUserConfig(payload) {
  return withApiLogging("SaveUserConfig", payload, () => SaveUserConfig(payload));
 }

+export function getCursorAccountStatus() {
+  return withApiLogging("GetCursorAccountStatus", undefined, () => GetCursorAccountStatus());
+}
+
+export function startCursorAccountLogin() {
+  return withApiLogging("StartCursorAccountLogin", undefined, () => StartCursorAccountLogin());
+}
+
+export function disconnectCursorAccount() {
+  return withApiLogging("DisconnectCursorAccount", undefined, () => DisconnectCursorAccount());
+}
+
 export function getProxyState() {
  return withApiLogging("GetState", undefined, () => GetState());
 }
@@ -36,7 +36,6 @@ export const EXTRA_PARAMS_DEFAULT_JSON = `{
 export const CUSTOM_HEADERS_DEFAULT_JSON = `{
 }`;
 const SUPPORTED_OPENAI_ENDPOINTS = new Set([OPENAI_ENDPOINT_RESPONSES, OPENAI_ENDPOINT_CHAT_COMPLETIONS, OPENAI_ENDPOINT_CUSTOM]);
-const SUPPORTED_ROUTE_MODES = new Set(["local", "upstream"]);
 const PROXY_STATE_EVENT = "proxy:state";
 const USER_CONFIG_CHANGED_EVENT = "user-config:changed";
 const UPDATE_STATE_EVENT = "update:state";
@@ -47,11 +46,6 @@ const MODEL_ADAPTER_TEST_UPDATED_EVENT = "model-adapter-test:updated";
 const SUPPORTED_MODEL_ADAPTER_TEST_STATUSES = new Set(["idle", "running", "success", "error"]);
 const HOME_METRICS_MIN_LOADING_MS = 600;

-export const ROUTE_MODE_OPTIONS = [
-  { label: "本地服务模式", value: "local" },
-  { label: "直连 Cursor 模式", value: "upstream" },
-];
-
 function asString(value) {
  if (typeof value === "string") {
    return value.trim();
@@ -126,14 +120,6 @@ function formatReleaseDate(value) {
  return parsed.format("YYYY-MM-DD HH:mm");
 }

-function normalizeRouteMode(value, fallback = "local") {
-  const text = asString(value).toLowerCase();
-  if (SUPPORTED_ROUTE_MODES.has(text)) {
-    return text;
-  }
-  return fallback;
-}
-
 function normalizeBaseURL(value) {
  const text = asString(value);
  if (!text) {
@@ -479,13 +465,6 @@ export function validateModelAdapters(source) {
  return "";
 }

-function validateConfigPayload(payload) {
-  if (!SUPPORTED_ROUTE_MODES.has(normalizeRouteMode(payload?.routing?.mode, ""))) {
-    return "运行模式仅支持 local 或 upstream";
-  }
-  return "";
-}
-
 function canUseLocalStorage() {
  return typeof window !== "undefined" && typeof window.localStorage !== "undefined";
 }
@@ -531,7 +510,6 @@ function loadCachedState() {

 function normalizeConfig(source) {
  const raw = source && typeof source === "object" ? source : {};
-  const routing = raw.routing && typeof raw.routing === "object" ? raw.routing : {};
  const homeMetrics = raw.homeMetrics && typeof raw.homeMetrics === "object" ? raw.homeMetrics : {};
  return {
    log: asBoolean(raw.log),
@@ -539,9 +517,6 @@ function normalizeConfig(source) {
    backendListenAddr: asString(raw.configBackendListenAddr) || asString(raw.backendListenAddr),
    proxyListenAddr: asString(raw.configProxyListenAddr) || asString(raw.proxyListenAddr),
    modelAdapters: normalizeModelAdapters(raw.modelAdapters),
-    routing: {
-      mode: normalizeRouteMode(routing.mode),
-    },
    homeMetrics: {
      includeCacheWriteInHitRate: asBoolean(homeMetrics.includeCacheWriteInHitRate),
    },
@@ -584,7 +559,6 @@ function buildConfigPayload(source = appState) {
    backendListenAddr: normalized.backendListenAddr,
    proxyListenAddr: normalized.proxyListenAddr,
    modelAdapters: normalized.modelAdapters.map(({ id, ...adapter }) => adapter),
-    routing: normalized.routing,
    homeMetrics: normalized.homeMetrics,
    lastAgentModelHash: normalized.lastAgentModelHash,
  };
@@ -599,7 +573,6 @@ function applyConfigToState(config, { modelAdaptersOnly = false } = {}) {
  appState.modelAdapters = normalized.modelAdapters;
  appState.configBackendListenAddr = normalized.backendListenAddr;
  appState.configProxyListenAddr = normalized.proxyListenAddr;
-  appState.routingMode = normalized.routing.mode;
  appState.includeCacheWriteInHitRate = normalized.homeMetrics.includeCacheWriteInHitRate;
  return normalized;
 }
@@ -610,13 +583,6 @@ async function loadPersistedUserConfig() {

 async function persistConfigPayload(config, { modelAdaptersOnly = false } = {}) {
  const payload = buildConfigPayload(config);
-  const configValidationError = validateConfigPayload(payload);
-  if (configValidationError) {
-    return {
-      ok: false,
-      error: configValidationError,
-    };
-  }
  const validationError = validateModelAdapters(payload.modelAdapters);
  if (validationError) {
    return {
@@ -830,7 +796,6 @@ export const appState = reactive({
  modelAdapterTestResults: {},
  configBackendListenAddr: cachedConfig.backendListenAddr,
  configProxyListenAddr: cachedConfig.proxyListenAddr,
-  routingMode: cachedConfig.routing.mode,
  includeCacheWriteInHitRate: cachedConfig.homeMetrics.includeCacheWriteInHitRate,

  serviceRunning: asBoolean(cachedState.serviceRunning),
@@ -1118,9 +1083,6 @@ export async function persistUserConfig() {
  return persistConfigPayload({
    ...currentConfig,
    modelAdapters: normalizeModelAdapters(appState.modelAdapters),
-    routing: {
-      mode: appState.routingMode,
-    },
    homeMetrics: {
      ...currentConfig.homeMetrics,
      includeCacheWriteInHitRate: appState.includeCacheWriteInHitRate,
@@ -1146,16 +1108,6 @@ export async function saveIncludeCacheWriteInHitRate(value) {
  return result;
 }

-export async function saveRoutingMode(mode) {
-  const currentConfig = await loadPersistedUserConfig();
-  return persistConfigPayload({
-    ...currentConfig,
-    routing: {
-      mode: normalizeRouteMode(mode),
-    },
-  });
-}
-
 export async function reloadUserConfig(options = {}) {
  const config = await loadPersistedUserConfig();
  applyConfigToState(config, options);
@@ -2,20 +2,16 @@
 import Button from "@/components/ui/Button.vue";
 import Card from "@/components/ui/Card.vue";
 import LocaleSelect from "@/components/LocaleSelect.vue";
-import Select from "@/components/ui/Select.vue";
 import { showModal } from "@/composables/useModal";
 import {
  appState,
  openModelConfigWindow,
  persistUserConfig,
  reloadUserConfig,
-  ROUTE_MODE_OPTIONS,
  toUserError,
 } from "@/state/appState";
 import { onMounted } from "vue";

-const routeModeOptions = ROUTE_MODE_OPTIONS;
-
 async function showActionError(title, error) {
  await showModal({
    title,
@@ -55,7 +51,7 @@ onMounted(async () => {
        <div>
          <h2 class="text-base font-medium text-white">本地配置</h2>
          <div class="text-sm text-[#a3a3a3]">
-            可配置运行模式和模型渠道；运行日志位于 <code>~/.cursor-local-assistant-v2/logs/</code>
+            可配置模型渠道；运行日志位于 <code>~/.cursor-local-assistant-v2/logs/</code>
          </div>
        </div>
        <Button variant="primary" :disabled="appState.configSaving" @click="handleSaveConfig">
@@ -64,24 +60,6 @@ onMounted(async () => {
      </div>
    </Card>

-    <Card>
-      <div class="flex items-center justify-between gap-4">
-        <div>
-          <h2 class="text-base font-medium text-white">运行模式</h2>
-          <div class="text-sm text-[#a3a3a3]">
-            控制白名单主链路请求走本地服务，还是回到原始 Cursor 上游地址
-          </div>
-        </div>
-        <div class="w-[220px] max-w-full">
-          <Select
-            v-model="appState.routingMode"
-            :options="routeModeOptions"
-            placeholder="选择模式"
-          />
-        </div>
-      </div>
-    </Card>
-
    <Card>
      <div class="flex items-center justify-between gap-4">
        <div>
@@ -1,9 +1,8 @@
 <script setup>
 import Button from "@/components/ui/Button.vue";
 import Card from "@/components/ui/Card.vue";
-import Switch from "@/components/ui/Switch.vue";
 import HomeMetricsCard from "@/components/HomeMetricsCard.vue";
-import { useMessage } from "@/composables/useMessage";
+import CursorAccountCard from "@/components/CursorAccountCard.vue";
 import { showModal } from "@/composables/useModal";
 import { getAdRuntime } from "@/services/clientApi";
 import {
@@ -11,7 +10,6 @@ import {
  appViewState,
  openConfigWindow,
  openModelConfigWindow,
-  saveRoutingMode,
  syncHomeMetrics,
  syncServiceState,
  toUserError,
@@ -20,8 +18,6 @@ import {
 import { Events } from "@wailsio/runtime";
 import { computed, onBeforeUnmount, onMounted, ref } from "vue";

-const directModeEnabled = computed(() => appState.routingMode === "upstream");
-const message = useMessage();
 const AD_UPDATED_EVENT = "ad:updated";
 const OPEN_AD_EVENT = "cursor:open-ad";

@@ -127,15 +123,6 @@ async function handleOpenModelConfig() {
  }
 }

-async function handleDirectModeChange(enabled) {
-  const result = await saveRoutingMode(enabled ? "upstream" : "local");
-  if (!result.ok) {
-    await showActionError("切换失败", result.error);
-    return;
-  }
-  message.success(enabled ? "已切换到直连 Cursor 模式" : "已切换到本地服务模式");
-}
-
 onMounted(() => {
  unsubscribeAdUpdated = Events.On(AD_UPDATED_EVENT, handleAdUpdated);
  void syncAdRuntimeQuietly();
@@ -149,7 +136,7 @@ onBeforeUnmount(() => {
 </script>

 <template>
-  <div class="flex flex-col gap-4 p-4 pt-0 text-[#e5e5e5]">
+  <div class="flex h-full min-h-0 flex-col gap-4 overflow-y-auto p-4 pt-0 text-[#e5e5e5]">
    <HomeMetricsCard
      :metrics="appState.homeMetrics"
      :loading="appState.homeMetricsLoading"
@@ -180,20 +167,11 @@ onBeforeUnmount(() => {
          class="rounded-[8px] border border-[#4b1d1d] bg-[#2a1313] px-3 py-2 text-sm text-[#fca5a5]">
          {{ appState.serviceLastError }}
        </div>
-
-        <Switch
-          label="直连模式"
-          description="开启后，Cursor将直接接通官方，请勿开启"
-          enabled-text="当前为直连模式"
-          disabled-text="当前为本地服务模式"
-          :enabled="directModeEnabled"
-          :busy="appState.configSaving"
-          :disabled="appState.configSaving"
-          @change="handleDirectModeChange"
-        />
      </div>
    </Card>

+    <CursorAccountCard />
+
    <Card>
      <div class="flex items-center justify-between gap-4">
        <div>
@@ -1,6 +1,6 @@
 # Backend 架构说明

-`internal/backend` 当前支持本地助手模式与直连上游模式。
+`internal/backend` 只支持本地助手模式。

 关于 backend agent「最小事实集合」的第一阶段研究文档，见 [`../../docs/backend-agent-minimum-facts-phase1.md`](../../docs/backend-agent-minimum-facts-phase1.md)。

@@ -34,7 +34,6 @@ internal/backend/
    errors.go
    local.go
    middleware.go
-    policy.go
    route.go
    url.go

@@ -134,7 +133,7 @@ history/
 ## 请求流

 1. 请求进入 backend 根路由。
-2. `PolicyMiddleware` 根据 `routing.mode` 与 `X-Server-Upstream-URL` 选择本地或上游分支。
+2. `ServerContext` 解析 MITM 带入的原始目标地址，路由始终执行本地 action。
 3. `BidiAppend` / `RunSSE` 进入 `forwarder`。
 4. `forwarder` 先把当前 loop 状态写入 `state.json`，再把已发生语义事件追加到 `context.json`。
 5. 发给 LLM 的 prompt 只由 `context.json` 投射生成；`state.json` 不保存可投射历史。
@@ -524,7 +524,7 @@ func (service *Service) applyProviderModelEvent(stream *ActiveStream, event mode
 			stream.mu.Unlock()
 		}
 		if shouldEmitSyntheticThinking {
-			if err := service.broker.Publish(requestID, StreamEvent{Message: buildThinkingDeltaMessage("Thinking is encrypted. Please wait a moment.", event.ThinkingStyle)}); err != nil {
+			if err := service.broker.Publish(requestID, StreamEvent{Message: buildThinkingDeltaMessage("The reasoning process is encrypted. Please wait a moment. (This message does not affect any functionality; it only indicates the current reasoning status.)", event.ThinkingStyle)}); err != nil {
 				return err
 			}
 		}
@@ -27,10 +27,11 @@ const healthPath = "/healthz"
 const tabServerBaseURL = "https://tab.leokun.cn"

 type Host struct {
-	store      *serverconfig.Store
-	listenAddr string
-	configs    *serverconfig.Manager
-	healthHTTP *http.Client
+	store            *serverconfig.Store
+	listenAddr       string
+	configs          *serverconfig.Manager
+	healthHTTP       *http.Client
+	controlPlaneAuth upstream.AuthorizationProvider

 	runMu      sync.RWMutex
 	httpServer *http.Server
@@ -40,7 +41,7 @@ type Host struct {
 	mux http.Handler
 }

-func NewHost(store *serverconfig.Store) (*Host, error) {
+func NewHost(store *serverconfig.Store, controlPlaneAuth upstream.AuthorizationProvider) (*Host, error) {
 	if store == nil {
 		return nil, fmt.Errorf("backend config store is required")
 	}
@@ -50,10 +51,11 @@ func NewHost(store *serverconfig.Store) (*Host, error) {
 	}
 	cfg := configs.Current()
 	host := &Host{
-		store:      store,
-		listenAddr: cfg.BackendListenAddr,
-		configs:    configs,
-		healthHTTP: newLoopbackHTTPClient(),
+		store:            store,
+		listenAddr:       cfg.BackendListenAddr,
+		configs:          configs,
+		healthHTTP:       newLoopbackHTTPClient(),
+		controlPlaneAuth: controlPlaneAuth,
 	}
 	if err := host.rebuild(cfg); err != nil {
 		return nil, err
@@ -279,7 +281,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 		server.Use(
 			server.Recover(),
 			server.ServerContext(),
-			server.PolicyMiddleware(host.configs),
 			server.ErrorEncoder(),
 		),
 		server.Mount(ads.RoutePrefix, ads.NewHTTPHandler(appdata.AdsRootPath())),
@@ -292,17 +293,11 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 			server.Name("bidi_append"),
 			server.ConnectUnary(),
 			server.Local(server.HTTPHandlerAction(agentModule.LocalBidiHandler)),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "bidi_append",
-			})),
 		),
 		server.POST(legacyRunSSEProcedure,
 			server.Name("run_sse"),
 			server.ConnectStream(),
 			server.Local(server.HTTPHandlerAction(agentModule.LocalRunSSE)),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "run_sse",
-			})),
 		),
 		server.POST("/aiserver.v1.AiService/ServerTime",
 			server.Name("server_time"),
@@ -313,9 +308,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.ServerTimeResponse",
 				MockBuilder:   upstream.ServerTimeMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "server_time",
-			})),
 		),
 		server.POST("/aiserver.v1.AiService/GetServerConfig",
 			server.Name("server_config"),
@@ -326,9 +318,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetServerConfigResponse",
 				MockBuilder:   upstream.ServerConfigMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "server_config",
-			})),
 		),
 		server.POST("/aiserver.v1.AiService/AvailableModels",
 			server.Name("available_models"),
@@ -339,9 +328,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.AvailableModelsResponse",
 				MockBuilder:   upstream.AvailableModelsMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "available_models",
-			})),
 		),
 		server.POST("/aiserver.v1.AiService/GetDefaultModelNudgeData",
 			server.Name("default_model_nudge"),
@@ -352,9 +338,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetDefaultModelNudgeDataResponse",
 				MockBuilder:   upstream.DefaultModelNudgeMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "default_model_nudge",
-			})),
 		),
 		server.POST("/aiserver.v1.AnalyticsService/BootstrapStatsig",
 			server.Name("bootstrap_statsig"),
@@ -365,9 +348,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.BootstrapStatsigResponse",
 				MockBuilder:   upstream.BootstrapStatsigMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "bootstrap_statsig",
-			})),
 		),
 		server.POST("/aiserver.v1.AnalyticsService/GetFirstWindowStatsigDecision",
 			server.Name("first_window_statsig_decision"),
@@ -378,9 +358,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetFirstWindowStatsigDecisionResponse",
 				MockBuilder:   upstream.FirstWindowStatsigDecisionMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "first_window_statsig_decision",
-			})),
 		),
 		server.POST("/oauth/token",
 			server.Name("oauth_token"),
@@ -389,9 +366,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				Name:       "oauth_token",
 				StatusCode: http.StatusOK,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "oauth_token",
-			})),
 		),
 		server.POST("/aiserver.v1.AuthService/GetEmail",
 			server.Name("auth_service_get_email"),
@@ -400,50 +374,44 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				Name:       "auth_service_get_email",
 				StatusCode: http.StatusOK,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_service_get_email",
-			})),
 		),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/StreamCpp", "ai_stream_cpp", server.ConnectStream(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/StreamNextCursorPrediction", "ai_stream_next_cursor_prediction", server.ConnectStream(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/GetCppEditClassification", "ai_get_cpp_edit_classification", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/RefreshTabContext", "ai_refresh_tab_context", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/CppConfig", "ai_cpp_config", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/CppEditHistoryStatus", "ai_cpp_edit_history_status", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/CppAppend", "ai_cpp_append", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/CppEditHistoryAppend", "ai_cpp_edit_history_append", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/ReportAiCodeChangeMetrics", "ai_report_ai_code_change_metrics", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/WriteGitCommitMessage", "ai_write_git_commit_message", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.AiService/WriteGitBranchName", "ai_write_git_branch_name", server.ConnectUnary(), routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceFastRepoInitHandshakeV2Procedure, "repository_fast_repo_init_handshake_v2", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceFastRepoInitHandshakeProcedure, "repository_fast_repo_init_handshake", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceFastRepoSyncCompleteProcedure, "repository_fast_repo_sync_complete", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceSyncMerkleSubtreeV2Procedure, "repository_sync_merkle_subtree_v2", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceSyncMerkleSubtreeProcedure, "repository_sync_merkle_subtree", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceFastUpdateFileV2Procedure, "repository_fast_update_file_v2", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceFastUpdateFileProcedure, "repository_fast_update_file", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceEnsureIndexCreatedProcedure, "repository_ensure_index_created", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceGetCopyStatusProcedure, "repository_get_copy_status", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceGetUploadLimitsProcedure, "repository_get_upload_limits", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceGetNumFilesToSendProcedure, "repository_get_num_files_to_send", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceGetAvailableChunkingStrategiesProcedure, "repository_get_available_chunking_strategies", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceGetHighLevelFolderDescriptionProcedure, "repository_get_high_level_folder_description", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceRepositoryStatusProcedure, "repository_status", server.ConnectUnary(), agentModule, routeDeps),
-		repositoryServiceProcedure(forwarder.RepositoryServiceBatchRepositoryStatusProcedure, "repository_batch_status", server.ConnectUnary(), agentModule, routeDeps),
-		uploadServiceProcedure(forwarder.UploadServiceUploadDocumentationProcedure, "upload_documentation", server.ConnectUnary(), agentModule, routeDeps),
-		uploadServiceProcedure(forwarder.UploadServiceGetDocProcedure, "upload_get_doc", server.ConnectUnary(), agentModule, routeDeps),
-		uploadServiceProcedure(forwarder.UploadServiceGetPagesProcedure, "upload_get_pages", server.ConnectUnary(), agentModule, routeDeps),
-		uploadServiceProcedure(forwarder.UploadServiceUploadedStatusProcedure, "upload_uploaded_status", server.ConnectUnary(), agentModule, routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/StreamCpp", "ai_stream_cpp", server.ConnectStream(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/StreamNextCursorPrediction", "ai_stream_next_cursor_prediction", server.ConnectStream(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/GetCppEditClassification", "ai_get_cpp_edit_classification", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/RefreshTabContext", "ai_refresh_tab_context", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/CppConfig", "ai_cpp_config", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/CppEditHistoryStatus", "ai_cpp_edit_history_status", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/CppAppend", "ai_cpp_append", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/CppEditHistoryAppend", "ai_cpp_edit_history_append", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/ReportAiCodeChangeMetrics", "ai_report_ai_code_change_metrics", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/WriteGitCommitMessage", "ai_write_git_commit_message", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.AiService/WriteGitBranchName", "ai_write_git_branch_name", server.ConnectUnary(), routeDeps),
+		repositoryServiceProcedure(forwarder.RepositoryServiceFastRepoInitHandshakeV2Procedure, "repository_fast_repo_init_handshake_v2", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceFastRepoInitHandshakeProcedure, "repository_fast_repo_init_handshake", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceFastRepoSyncCompleteProcedure, "repository_fast_repo_sync_complete", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceSyncMerkleSubtreeV2Procedure, "repository_sync_merkle_subtree_v2", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceSyncMerkleSubtreeProcedure, "repository_sync_merkle_subtree", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceFastUpdateFileV2Procedure, "repository_fast_update_file_v2", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceFastUpdateFileProcedure, "repository_fast_update_file", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceEnsureIndexCreatedProcedure, "repository_ensure_index_created", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceGetCopyStatusProcedure, "repository_get_copy_status", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceGetUploadLimitsProcedure, "repository_get_upload_limits", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceGetNumFilesToSendProcedure, "repository_get_num_files_to_send", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceGetAvailableChunkingStrategiesProcedure, "repository_get_available_chunking_strategies", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceGetHighLevelFolderDescriptionProcedure, "repository_get_high_level_folder_description", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceRepositoryStatusProcedure, "repository_status", server.ConnectUnary(), agentModule),
+		repositoryServiceProcedure(forwarder.RepositoryServiceBatchRepositoryStatusProcedure, "repository_batch_status", server.ConnectUnary(), agentModule),
+		uploadServiceProcedure(forwarder.UploadServiceUploadDocumentationProcedure, "upload_documentation", server.ConnectUnary(), agentModule),
+		uploadServiceProcedure(forwarder.UploadServiceGetDocProcedure, "upload_get_doc", server.ConnectUnary(), agentModule),
+		uploadServiceProcedure(forwarder.UploadServiceGetPagesProcedure, "upload_get_pages", server.ConnectUnary(), agentModule),
+		uploadServiceProcedure(forwarder.UploadServiceUploadedStatusProcedure, "upload_uploaded_status", server.ConnectUnary(), agentModule),
 		server.Any("/aiserver.v1.AiService/*",
 			server.Name("ai_service"),
 			server.HTTP(),
 			server.Local(server.HTTPHandlerAction(agentModule.AiHandler)),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "ai_service",
-			})),
 		),
-		tabServerUpstreamProcedure("/aiserver.v1.CppService/AvailableModels", "cpp_available_models", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.CppService/RecordCppFate", "cpp_record_cpp_fate", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.CppService/AvailableModels", "cpp_available_models", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.CppService/RecordCppFate", "cpp_record_cpp_fate", server.ConnectUnary(), routeDeps),
 		server.Any("/aiserver.v1.CppService/*",
 			server.Name("cpp_service"),
 			server.HTTP(),
@@ -451,14 +419,11 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				http.NotFound(ctx.Writer, ctx.Request)
 				return nil
 			}),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "cpp_service",
-			})),
 		),
-		tabServerUpstreamProcedure("/aiserver.v1.FileSyncService/FSSyncFile", "file_sync_sync_file", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.FileSyncService/FSIsEnabledForUser", "file_sync_is_enabled_for_user", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.FileSyncService/FSConfig", "file_sync_config", server.ConnectUnary(), routeDeps),
-		tabServerUpstreamProcedure("/aiserver.v1.FileSyncService/FSUploadFile", "file_sync_upload_file", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.FileSyncService/FSSyncFile", "file_sync_sync_file", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.FileSyncService/FSIsEnabledForUser", "file_sync_is_enabled_for_user", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.FileSyncService/FSConfig", "file_sync_config", server.ConnectUnary(), routeDeps),
+		tabServerProcedure("/aiserver.v1.FileSyncService/FSUploadFile", "file_sync_upload_file", server.ConnectUnary(), routeDeps),
 		server.Any("/aiserver.v1.FileSyncService/*",
 			server.Name("file_sync"),
 			server.HTTP(),
@@ -466,25 +431,16 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				http.NotFound(ctx.Writer, ctx.Request)
 				return nil
 			}),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "file_sync",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetTokenUsage",
 			server.Name("dashboard_token_usage"),
 			server.HTTP(),
 			server.Local(server.HTTPHandlerAction(agentModule.AiHandler)),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_token_usage",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetGlassEarlyPreviewEnrollment",
 			server.Name("dashboard_glass_early_preview_enrollment"),
 			server.ConnectUnary(),
 			server.Local(server.HTTPHandlerAction(agentModule.AiHandler)),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_glass_early_preview_enrollment",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetCurrentPeriodUsage",
 			server.Name("dashboard_current_period_usage"),
@@ -495,9 +451,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetCurrentPeriodUsageResponse",
 				MockBuilder:   upstream.DashboardCurrentPeriodUsageMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_current_period_usage",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetTeams",
 			server.Name("dashboard_get_teams"),
@@ -508,22 +461,21 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetTeamsResponse",
 				MockBuilder:   upstream.DashboardTeamsMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_get_teams",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetManagedSkills",
 			server.Name("dashboard_get_managed_skills"),
 			server.ConnectUnary(),
-			server.Local(upstream.MockProtoAction(routeDeps, upstream.CompatRouteConfig{
-				Name:          "dashboard_get_managed_skills",
-				StatusCode:    http.StatusOK,
-				MockProtoType: "aiserver.v1.GetManagedSkillsResponse",
-				MockBuilder:   upstream.DashboardManagedSkillsMockBuilder,
-			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_get_managed_skills",
-			})),
+			server.Local(cursorControlPlaneAction(
+				host.controlPlaneAuth,
+				routeDeps,
+				"dashboard_get_managed_skills",
+				upstream.MockProtoAction(routeDeps, upstream.CompatRouteConfig{
+					Name:          "dashboard_get_managed_skills",
+					StatusCode:    http.StatusOK,
+					MockProtoType: "aiserver.v1.GetManagedSkillsResponse",
+					MockBuilder:   upstream.DashboardManagedSkillsMockBuilder,
+				}),
+			)),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetMe",
 			server.Name("dashboard_get_me"),
@@ -534,9 +486,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetMeResponse",
 				MockBuilder:   upstream.DashboardGetMeMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_get_me",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetUserPrivacyMode",
 			server.Name("dashboard_user_privacy_mode"),
@@ -547,9 +496,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetUserPrivacyModeResponse",
 				MockBuilder:   upstream.DashboardUserPrivacyModeMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_user_privacy_mode",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetPlanInfo",
 			server.Name("dashboard_plan_info"),
@@ -560,9 +506,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetPlanInfoResponse",
 				MockBuilder:   upstream.DashboardPlanInfoMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_plan_info",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/GetUsageLimitStatusAndActiveGrants",
 			server.Name("dashboard_usage_limit_status"),
@@ -573,9 +516,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.GetUsageLimitStatusAndActiveGrantsResponse",
 				MockBuilder:   upstream.DashboardUsageLimitStatusAndActiveGrantsMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_usage_limit_status",
-			})),
 		),
 		server.POST("/aiserver.v1.DashboardService/IsOnNewPricing",
 			server.Name("dashboard_is_on_new_pricing"),
@@ -586,11 +526,25 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				MockProtoType: "aiserver.v1.IsOnNewPricingResponse",
 				MockBuilder:   upstream.DashboardIsOnNewPricingMockBuilder,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard_is_on_new_pricing",
-			})),
 		),
-		// tabServerUpstreamProcedure("/aiserver.v1.DashboardService/GetEffectiveUserPlugins", "dashboard_get_effective_user_plugins", server.ConnectUnary(), routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/AddMarketplace", "dashboard_add_marketplace", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/AddMcpServersFromPlugin", "dashboard_add_mcp_servers_from_plugin", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/BatchGetPluginMcpConfig", "dashboard_batch_get_plugin_mcp_config", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/GetAvailableMcpServers", "dashboard_get_available_mcp_servers", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/GetEffectiveUserPlugins", "dashboard_get_effective_user_plugins", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/GetPlugin", "dashboard_get_plugin", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/GetPluginMcpConfig", "dashboard_get_plugin_mcp_config", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/InstallUserPlugin", "dashboard_install_user_plugin", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/ListMarketplacePlugins", "dashboard_list_marketplace_plugins", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/ListMarketplaces", "dashboard_list_marketplaces", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/ListUserPluginInstalls", "dashboard_list_user_plugin_installs", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/RefreshMarketplace", "dashboard_refresh_marketplace", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/RegisterMarketplaceAndPlugins", "dashboard_register_marketplace_and_plugins", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/RemoveMarketplace", "dashboard_remove_marketplace", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/ResolvePluginsByRef", "dashboard_resolve_plugins_by_ref", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/UninstallUserPlugin", "dashboard_uninstall_user_plugin", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.DashboardService/UpdateUserPluginInstall", "dashboard_update_user_plugin_install", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
+		cursorControlPlaneProcedure("/aiserver.v1.MCPRegistryService/GetKnownServers", "mcp_registry_get_known_servers", server.ConnectUnary(), host.controlPlaneAuth, routeDeps),
 		server.Any("/aiserver.v1.DashboardService/*",
 			server.Name("dashboard"),
 			server.HTTP(),
@@ -598,9 +552,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				http.NotFound(ctx.Writer, ctx.Request)
 				return nil
 			}),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "dashboard",
-			})),
 		),
 		server.Any("/aiserver.v1.NetworkService/*",
 			server.Name("network_service"),
@@ -609,9 +560,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				http.NotFound(ctx.Writer, ctx.Request)
 				return nil
 			}),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "network_service",
-			})),
 		),
 		server.Any("/aiserver.v1.InAppAdService/*",
 			server.Name("in_app_ad"),
@@ -620,9 +568,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				http.NotFound(ctx.Writer, ctx.Request)
 				return nil
 			}),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "in_app_ad",
-			})),
 		),
 		server.GET("/auth/full_stripe_profile",
 			server.Name("auth_full_stripe_profile"),
@@ -631,9 +576,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				Name:       "auth_full_stripe_profile",
 				StatusCode: http.StatusOK,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_full_stripe_profile",
-			})),
 		),
 		server.GET("/auth/stripe_profile",
 			server.Name("auth_stripe_profile"),
@@ -642,9 +584,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				Name:       "auth_stripe_profile",
 				StatusCode: http.StatusOK,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_stripe_profile",
-			})),
 		),
 		server.GET("/auth/has_valid_payment_method",
 			server.Name("auth_has_valid_payment_method"),
@@ -656,9 +595,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 					"hasValidPaymentMethod": true,
 				},
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_has_valid_payment_method",
-			})),
 		),
 		server.Any("/auth/poll",
 			server.Name("auth_poll"),
@@ -667,9 +603,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				Name:       "auth_poll",
 				StatusCode: http.StatusOK,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_poll",
-			})),
 		),
 		server.POST("/auth/logout",
 			server.Name("auth_logout"),
@@ -678,9 +611,6 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				Name:       "auth_logout",
 				StatusCode: http.StatusNoContent,
 			})),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_logout",
-			})),
 		),
 		server.Any("/auth/*",
 			server.Name("auth_proxy"),
@@ -689,58 +619,32 @@ func (host *Host) rebuildLocked(cfg serverconfig.Config) error {
 				http.NotFound(ctx.Writer, ctx.Request)
 				return nil
 			}),
-			server.Upstream(upstream.DirectAction(routeDeps, upstream.CompatRouteConfig{
-				Name: "auth_proxy",
-			})),
 		),
 	)

 	return nil
 }

-func directUpstreamProcedure(pattern string, name string, protocol server.RouteOption, deps upstream.Dependencies) server.Option {
-	direct := upstream.DirectAction(deps, upstream.CompatRouteConfig{Name: name})
-	action := func(ctx *server.Context) error {
-		if ctx != nil && ctx.UpstreamURL == nil && ctx.Request != nil && ctx.Request.URL != nil {
-			targetURL := *ctx.Request.URL
-			targetURL.Scheme = "https"
-			targetURL.Host = "api2.cursor.sh:443"
-			ctx.UpstreamURL = &targetURL
-		}
-		return direct(ctx)
-	}
-	return server.POST(pattern,
-		server.Name(name),
-		protocol,
-		server.Local(action),
-		server.Upstream(action),
-	)
-}
-
-func repositoryServiceProcedure(pattern string, name string, protocol server.RouteOption, module *forwarder.Module, deps upstream.Dependencies) server.Option {
+func repositoryServiceProcedure(pattern string, name string, protocol server.RouteOption, module *forwarder.Module) server.Option {
 	localAction := server.HTTPHandlerAction(module.RepositoryServiceHandler)
-	upstreamAction := upstream.DirectAction(deps, upstream.CompatRouteConfig{Name: name})
 	return server.POST(pattern,
 		server.Name(name),
 		protocol,
 		server.Local(localAction),
-		server.Upstream(upstreamAction),
 	)
 }

-func uploadServiceProcedure(pattern string, name string, protocol server.RouteOption, module *forwarder.Module, deps upstream.Dependencies) server.Option {
+func uploadServiceProcedure(pattern string, name string, protocol server.RouteOption, module *forwarder.Module) server.Option {
 	localAction := server.HTTPHandlerAction(module.UploadServiceHandler)
-	upstreamAction := upstream.DirectAction(deps, upstream.CompatRouteConfig{Name: name})
 	return server.POST(pattern,
 		server.Name(name),
 		protocol,
 		server.Local(localAction),
-		server.Upstream(upstreamAction),
 	)
 }

-func tabServerUpstreamProcedure(pattern string, name string, protocol server.RouteOption, deps upstream.Dependencies) server.Option {
-	direct := upstream.DirectAction(deps, upstream.CompatRouteConfig{Name: name})
+func tabServerProcedure(pattern string, name string, protocol server.RouteOption, deps upstream.Dependencies) server.Option {
+	forward := upstream.ForwardAction(deps, upstream.CompatRouteConfig{Name: name})
 	action := func(ctx *server.Context) error {
 		if ctx != nil && ctx.Request != nil && ctx.Request.URL != nil {
 			baseURL, err := url.Parse(tabServerBaseURL)
@@ -752,16 +656,55 @@ func tabServerUpstreamProcedure(pattern string, name string, protocol server.Rou
 			targetURL.Host = baseURL.Host
 			ctx.UpstreamURL = &targetURL
 		}
-		return direct(ctx)
+		return forward(ctx)
 	}
 	return server.POST(pattern,
 		server.Name(name),
 		protocol,
 		server.Local(action),
-		server.Upstream(action),
 	)
 }

+func cursorControlPlaneProcedure(
+	pattern string,
+	name string,
+	protocol server.RouteOption,
+	authorizationProvider upstream.AuthorizationProvider,
+	deps upstream.Dependencies,
+) server.Option {
+	notFound := func(ctx *server.Context) error {
+		http.NotFound(ctx.Writer, ctx.Request)
+		return nil
+	}
+	return server.POST(pattern,
+		server.Name(name),
+		protocol,
+		server.Local(cursorControlPlaneAction(authorizationProvider, deps, name, notFound)),
+	)
+}
+
+func cursorControlPlaneAction(
+	authorizationProvider upstream.AuthorizationProvider,
+	deps upstream.Dependencies,
+	name string,
+	fallback server.HandlerFunc,
+) server.HandlerFunc {
+	forward := upstream.AuthenticatedForwardAction(deps, upstream.CompatRouteConfig{Name: name}, authorizationProvider)
+	return func(ctx *server.Context) error {
+		if authorizationProvider == nil || !authorizationProvider.SignedIn() {
+			return fallback(ctx)
+		}
+		if ctx == nil || ctx.Request == nil || ctx.Request.URL == nil {
+			return fmt.Errorf("Cursor 控制面请求上下文无效")
+		}
+		targetURL := *ctx.Request.URL
+		targetURL.Scheme = "https"
+		targetURL.Host = "api2.cursor.sh:443"
+		ctx.UpstreamURL = &targetURL
+		return forward(ctx)
+	}
+}
+
 type serverSystemSettings struct {
 	configs *serverconfig.Manager
 }
@@ -171,20 +171,6 @@ func (manager *Manager) LegacyRuntimeSnapshot(_ context.Context) (legacyruntime.
 	}, nil
 }

-func (manager *Manager) RouteMode(hasUpstreamURL bool) string {
-	if !hasUpstreamURL {
-		return DefaultRoutingMode
-	}
-	if manager == nil {
-		return DefaultRoutingMode
-	}
-	mode := normalizeRoutingMode(manager.Current().Routing.Mode)
-	if mode == "" {
-		return DefaultRoutingMode
-	}
-	return mode
-}
-
 func (manager *Manager) setCurrent(cfg Config) {
 	next := cfg
 	manager.current.Store(&next)
@@ -136,6 +136,9 @@ func (store *Store) saveLocked(normalized Config) error {
 }

 func shouldPersistNormalizedConfig(raw []byte, current Config, normalized Config) bool {
+	if yamlHasKey(raw, "routing") {
+		return true
+	}
 	if !yamlHasKey(raw, "backendListenAddr") || !yamlHasKey(raw, "proxyListenAddr") {
 		return true
 	}
@@ -15,7 +15,6 @@ const (
 	DefaultBackendListenAddr                = "127.0.0.1:18090"
 	DefaultProxyListenAddr                  = "127.0.0.1:18080"
 	DefaultFrontendBaseURL                  = "http://127.0.0.1"
-	DefaultRoutingMode                      = "local"
 	DefaultProviderStreamIdleTimeoutSeconds = 240
 	MinProviderStreamIdleTimeoutSeconds     = 30
 )
@@ -43,10 +42,6 @@ type ModelAdapterConfig struct {
 	ThinkingBudgetTokens        int    `json:"thinkingBudgetTokens" yaml:"thinkingBudgetTokens"`
 }

-type RoutingConfig struct {
-	Mode string `json:"mode" yaml:"mode"`
-}
-
 type HomeMetricsConfig struct {
 	IncludeCacheWriteInHitRate bool `json:"includeCacheWriteInHitRate" yaml:"includeCacheWriteInHitRate"`
 }
@@ -57,7 +52,6 @@ type Config struct {
 	BackendListenAddr         string               `json:"backendListenAddr" yaml:"backendListenAddr"`
 	ProxyListenAddr           string               `json:"proxyListenAddr" yaml:"proxyListenAddr"`
 	ModelAdapters             []ModelAdapterConfig `json:"modelAdapters" yaml:"modelAdapters"`
-	Routing                   RoutingConfig        `json:"routing" yaml:"routing"`
 	HomeMetrics               HomeMetricsConfig    `json:"homeMetrics" yaml:"homeMetrics"`
 	LastAgentModelHash        string               `json:"lastAgentModelHash" yaml:"lastAgentModelHash"`
 }
@@ -69,9 +63,6 @@ func DefaultConfig() Config {
 		BackendListenAddr:         DefaultBackendListenAddr,
 		ProxyListenAddr:           DefaultProxyListenAddr,
 		ModelAdapters:             []ModelAdapterConfig{},
-		Routing: RoutingConfig{
-			Mode: DefaultRoutingMode,
-		},
 	}
 }

@@ -91,10 +82,6 @@ func NormalizeConfig(input Config) (Config, error) {
 	output.ProxyListenAddr = proxyListenAddr
 	output.HomeMetrics.IncludeCacheWriteInHitRate = input.HomeMetrics.IncludeCacheWriteInHitRate
 	output.LastAgentModelHash = strings.TrimSpace(input.LastAgentModelHash)
-	output.Routing.Mode = normalizeRoutingMode(input.Routing.Mode)
-	if output.Routing.Mode == "" {
-		output.Routing.Mode = DefaultRoutingMode
-	}
 	adapters, err := NormalizeModelAdapterConfigs(input.ModelAdapters)
 	if err != nil {
 		return Config{}, err
@@ -280,14 +267,3 @@ func normalizeModelAdapterType(value string) string {
 		return ""
 	}
 }
-
-func normalizeRoutingMode(value string) string {
-	switch strings.ToLower(strings.TrimSpace(value)) {
-	case "", "local":
-		return "local"
-	case "upstream":
-		return "upstream"
-	default:
-		return ""
-	}
-}
@@ -34,7 +34,6 @@ type Context struct {
 	StartedAt time.Time

 	UpstreamURL *url.URL
-	Mode        ExecutionMode
 	LastError   error

 	Logger *slog.Logger
@@ -48,7 +47,6 @@ func newContext(writer http.ResponseWriter, request *http.Request, route Route)
 		Protocol:  route.Protocol,
 		StartedAt: time.Now(),
 		Logger:    slog.Default(),
-		Mode:      ModeLocal,
 	}
 }

@@ -1,14 +1,12 @@
 package server

 import (
-	"cursor/internal/logger"
 	"errors"
 	"fmt"
 	"net/http"
 	"runtime/debug"
 	"strings"

-	serverconfig "cursor/internal/backend/server/config"
 	legacyruntime "cursor/internal/runtime"
 )

@@ -39,16 +37,6 @@ func ServerContext() Middleware {
 	}
 }

-func PolicyMiddleware(configs *serverconfig.Manager) Middleware {
-	return func(next HandlerFunc) HandlerFunc {
-		return func(ctx *Context) error {
-			ctx.Mode = parseExecutionMode(configs.RouteMode(ctx.UpstreamURL != nil))
-			logger.Infof("ctx.Mode=%s upstream=%t", ctx.Mode, ctx.UpstreamURL != nil)
-			return next(ctx)
-		}
-	}
-}
-
 func ErrorEncoder() Middleware {
 	return func(next HandlerFunc) HandlerFunc {
 		return func(ctx *Context) error {
@@ -1,19 +0,0 @@
-package server
-
-type ExecutionMode string
-
-const (
-	// ModeLocal 表示本地模式，适用于直接处理请求的情况。
-	ModeLocal ExecutionMode = "local"
-	// ModeUpstream 表示直连上游模式，适用于将请求转发到原始地址。
-	ModeUpstream ExecutionMode = "upstream"
-)
-
-func parseExecutionMode(value string) ExecutionMode {
-	switch value {
-	case string(ModeUpstream):
-		return ModeUpstream
-	default:
-		return ModeLocal
-	}
-}
@@ -17,7 +17,6 @@ type Route struct {
 	Protocol   ProtocolClass
 	Middleware []Middleware
 	Local      HandlerFunc
-	Upstream   HandlerFunc
 }

 type App struct {
@@ -129,12 +128,6 @@ func Local(action HandlerFunc) RouteOption {
 	}
 }

-func Upstream(action HandlerFunc) RouteOption {
-	return func(route *Route) {
-		route.Upstream = action
-	}
-}
-
 func (app *App) registerRoute(route Route) {
 	handler := app.buildRouteHandler(route)
 	if route.Method == "" {
@@ -148,12 +141,6 @@ func (app *App) buildRouteHandler(route Route) http.HandlerFunc {
 	chain := append([]Middleware{}, app.globalMiddlewares...)
 	chain = append(chain, route.Middleware...)
 	final := Chain(chain...)(func(ctx *Context) error {
-		if shouldUseUpstreamAction(ctx, route) && route.Upstream != nil {
-			return route.Upstream(ctx)
-		}
-		if shouldUseUpstreamAction(ctx, route) && ctx.UpstreamURL != nil {
-			return fmt.Errorf("route %s is missing upstream action while request targets upstream %s", route.Name, ctx.UpstreamURL.String())
-		}
 		if route.Local != nil {
 			return route.Local(ctx)
 		}
@@ -168,14 +155,6 @@ func (app *App) buildRouteHandler(route Route) http.HandlerFunc {
 	}
 }

-func shouldUseUpstreamAction(ctx *Context, route Route) bool {
-	_ = route
-	if ctx == nil {
-		return false
-	}
-	return ctx.Mode == ModeUpstream
-}
-
 func Chain(middlewares ...Middleware) Middleware {
 	return func(final HandlerFunc) HandlerFunc {
 		wrapped := final
@@ -2,6 +2,7 @@ package upstream

 import (
 	"bytes"
+	"fmt"
 	"io"
 	"net/http"
 	"strings"
@@ -19,7 +20,7 @@ type CompatRouteConfig struct {
 	ConsoleLog    bool
 }

-func DirectAction(deps Dependencies, cfg CompatRouteConfig) server.HandlerFunc {
+func ForwardAction(deps Dependencies, cfg CompatRouteConfig) server.HandlerFunc {
 	return func(ctx *server.Context) error {
 		reqCtx, route, err := newCompatRouteObjects(ctx, deps, cfg)
 		if err != nil {
@@ -29,6 +30,34 @@ func DirectAction(deps Dependencies, cfg CompatRouteConfig) server.HandlerFunc {
 	}
 }

+// AuthenticatedForwardAction forwards a Cursor control-plane request with the
+// independent desktop account after the local-mode identity rewrite has run.
+func AuthenticatedForwardAction(deps Dependencies, cfg CompatRouteConfig, authorizationProvider AuthorizationProvider) server.HandlerFunc {
+	return func(ctx *server.Context) error {
+		reqCtx, _, err := newCompatRouteObjects(ctx, deps, cfg)
+		if err != nil {
+			return err
+		}
+		if reqCtx == nil || reqCtx.Request == nil {
+			return fmt.Errorf("Cursor 控制面请求上下文无效")
+		}
+		if authorizationProvider == nil {
+			return fmt.Errorf("Cursor 账号服务未初始化")
+		}
+		authorization, err := authorizationProvider.Authorization(reqCtx.Request.Context())
+		if err != nil {
+			return err
+		}
+		_, err = ForwardToUpstream(reqCtx, ForwardOptions{
+			PatchHeaders: func(headers http.Header) {
+				headers.Set("Authorization", authorization)
+				headers.Set("x-cursor-checksum", BuildCursorChecksum(authorization))
+			},
+		})
+		return err
+	}
+}
+
 func FixedStatusAction(deps Dependencies, cfg CompatRouteConfig) server.HandlerFunc {
 	return func(ctx *server.Context) error {
 		reqCtx, route, err := newCompatRouteObjects(ctx, deps, cfg)
@@ -133,7 +162,6 @@ func newCompatRouteObjects(ctx *server.Context, deps Dependencies, cfg CompatRou
 		Headers:        ctx.Request.Header.Clone(),
 		ContentType:    strings.TrimSpace(ctx.Request.Header.Get("content-type")),
 		RequestBody:    body,
-		Mode:           ctx.Mode,
 		Deps:           &deps,
 		HTTPRequestID:  resolveHTTPRequestID(ctx.Request),
 	}
@@ -15,7 +15,6 @@ import (
 	"time"

 	"cursor/gen/aiserverv1"
-	"cursor/internal/backend/server"
 	"cursor/internal/logger"
 	"cursor/internal/netproxy"
 	legacyruntime "cursor/internal/runtime"
@@ -87,7 +86,7 @@ func buildUpstreamRequest(reqCtx *RequestContext, body []byte, options ForwardOp
 	}
 	upstreamRequest.Host = reqCtx.TargetURL.Host

-	if reqCtx.Mode == server.ModeLocal && shouldRewriteHost(reqCtx.TargetURL.Hostname()) {
+	if shouldRewriteHost(reqCtx.TargetURL.Hostname()) {
 		auth := formatBearerAuthorization(legacyruntime.LocalRelayToken)
 		if auth == "" {
 			return nil, nil, legacyruntime.ErrInvalidSystemSetting
@@ -20,6 +20,13 @@ type SystemSettingService interface {
 	ResolveModelAdapters(context.Context) ([]legacyruntime.ModelAdapterConfig, error)
 }

+// AuthorizationProvider supplies the independent Cursor account used only by
+// official control-plane requests such as Plugins, Skills, and MCP registry.
+type AuthorizationProvider interface {
+	Authorization(context.Context) (string, error)
+	SignedIn() bool
+}
+
 type HTTPClient interface {
 	Do(req *http.Request) (*http.Response, error)
 }
@@ -41,7 +48,6 @@ type RequestContext struct {
 	Headers        http.Header
 	ContentType    string
 	RequestBody    []byte
-	Mode           server.ExecutionMode
 	Deps           *Dependencies
 	HTTPRequestID  string
 }
@@ -24,6 +24,9 @@ type ModelAdapterTestResult = client.ModelAdapterTestResult
 // ModelAdapterTestResultsPayload 定义测速结果事件载荷。
 type ModelAdapterTestResultsPayload = client.ModelAdapterTestResultsPayload

+// CursorAccountStatus 是可安全展示给桌面前端的独立 Cursor 账号状态。
+type CursorAccountStatus = client.CursorAccountStatus
+
 // LicenseActionRequest 定义了当前模块中的 LicenseActionRequest 类型。
 type LicenseActionRequest = client.LicenseActionRequest

@@ -91,6 +94,21 @@ func (s *ProxyService) SaveUserConfig(cfg UserConfig) error {
 	return s.core.SaveUserConfig(cfg)
 }

+// GetCursorAccountStatus 返回 cursor-byok 独立 Cursor 账号的脱敏状态。
+func (s *ProxyService) GetCursorAccountStatus() CursorAccountStatus {
+	return s.core.GetCursorAccountStatus()
+}
+
+// StartCursorAccountLogin 打开官方浏览器登录并异步等待结果。
+func (s *ProxyService) StartCursorAccountLogin() (CursorAccountStatus, error) {
+	return s.core.StartCursorAccountLogin()
+}
+
+// DisconnectCursorAccount 只断开 cursor-byok 自己的账号。
+func (s *ProxyService) DisconnectCursorAccount() (CursorAccountStatus, error) {
+	return s.core.DisconnectCursorAccount()
+}
+
 // TestModelAdapter 用于处理与 TestModelAdapter 相关的逻辑。
 func (s *ProxyService) TestModelAdapter(adapter ModelAdapterConfig) (ModelAdapterTestResult, error) {
 	return s.core.TestModelAdapter(adapter)
@@ -0,0 +1,35 @@
+package client
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"cursor/internal/cursoraccount"
+)
+
+type CursorAccountStatus = cursoraccount.Status
+
+func (s *ProxyService) GetCursorAccountStatus() CursorAccountStatus {
+	if s == nil || s.cursorAccount == nil {
+		return CursorAccountStatus{State: cursoraccount.StateSignedOut}
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	s.cursorAccount.EnsureEmail(ctx)
+	return s.cursorAccount.Status()
+}
+
+func (s *ProxyService) StartCursorAccountLogin() (CursorAccountStatus, error) {
+	if s == nil || s.cursorAccount == nil {
+		return CursorAccountStatus{State: cursoraccount.StateError}, fmt.Errorf("Cursor 账号服务未初始化")
+	}
+	return s.cursorAccount.StartLogin()
+}
+
+func (s *ProxyService) DisconnectCursorAccount() (CursorAccountStatus, error) {
+	if s == nil || s.cursorAccount == nil {
+		return CursorAccountStatus{State: cursoraccount.StateSignedOut}, nil
+	}
+	return s.cursorAccount.Disconnect()
+}
@@ -265,6 +265,9 @@ func (s *ProxyService) ShutdownForQuit() {
 			finalErr = errors.Join(finalErr, err)
 		}
 	}
+	if s.cursorAccount != nil {
+		s.cursorAccount.Shutdown()
+	}
 	if finalErr != nil {
 		s.setLastError(finalErr)
 	}
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"path/filepath"
 	"sync"
 	"time"

@@ -11,6 +12,7 @@ import (
 	backend "cursor/internal/backend"
 	serverconfig "cursor/internal/backend/server/config"
 	"cursor/internal/certs"
+	"cursor/internal/cursoraccount"
 	"cursor/internal/logger"
 	"cursor/internal/mitm"
 	"cursor/internal/netproxy"
@@ -35,6 +37,8 @@ type ProxyService struct {
 	certManager *certs.Manager
 	// backendHost 表示当前嵌入式 backend 服务。
 	backendHost *backend.Host
+	// cursorAccount 持有仅供插件、Skills 和 MCP 控制面使用的真实 Cursor 身份。
+	cursorAccount *cursoraccount.Manager

 	// mu 表示当前声明中的 mu。
 	mu sync.RWMutex
@@ -84,8 +88,12 @@ func NewProxyService(proxy *mitm.ProxyServer, certManager *certs.Manager, caCert
 		publicClient:     netproxy.NewHTTPClient(publicAPITimeout),
 		modelTestResults: make(map[string]ModelAdapterTestResult),
 	}
+	service.cursorAccount = cursoraccount.NewManager(
+		filepath.Join(appdata.DataRootPath(), "cursor-account.json"),
+		netproxy.NewHTTPClient(publicAPITimeout),
+	)
 	service.store = serverconfig.NewStore(service.configPath, service.logsRoot)
-	host, err := backend.NewHost(service.store)
+	host, err := backend.NewHost(service.store, service.cursorAccount)
 	if err != nil {
 		logger.Errorf("init backend host failed: %v", err)
 	} else {
@@ -101,7 +109,7 @@ func (s *ProxyService) ensureBackendHost() error {
 	if s.backendHost != nil {
 		return nil
 	}
-	host, err := backend.NewHost(s.store)
+	host, err := backend.NewHost(s.store, s.cursorAccount)
 	if err != nil {
 		return err
 	}
@@ -0,0 +1,589 @@
+package cursoraccount
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"cursor/gen/aiserverv1"
+	"cursor/internal/backend/server/upstream"
+
+	"github.com/google/uuid"
+	"github.com/pkg/browser"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	StateSignedOut = "signed_out"
+	StateWaiting   = "waiting"
+	StateSignedIn  = "signed_in"
+	StateError     = "error"
+
+	websiteURL    = "https://cursor.com"
+	backendURL    = "https://api2.cursor.sh"
+	authClientID  = "KbZUR41cY7W6zRSdpSUJ7I7mLYBKOCmB"
+	loginTimeout  = 10 * time.Minute
+	pollInterval  = time.Second
+	refreshMargin = 2 * time.Minute
+)
+
+var ErrNotSignedIn = errors.New("尚未在 cursor-byok 中登录 Cursor 账号")
+
+// Status 是可安全返回给前端的脱敏账号状态。
+type Status struct {
+	State  string `json:"state"`
+	AuthID string `json:"authId"`
+	Email  string `json:"email"`
+	Error  string `json:"error"`
+}
+
+type credentials struct {
+	AccessToken  string `json:"accessToken"`
+	RefreshToken string `json:"refreshToken"`
+	AuthID       string `json:"authId"`
+	Email        string `json:"email,omitempty"`
+}
+
+type pollResponse struct {
+	AccessToken  string `json:"accessToken"`
+	RefreshToken string `json:"refreshToken"`
+	AuthID       string `json:"authId"`
+}
+
+type refreshResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+	ShouldLogout bool   `json:"shouldLogout"`
+}
+
+// Manager 持有 cursor-byok 自己的 Cursor 登录态，不读写 Cursor 客户端状态库。
+type Manager struct {
+	path   string
+	client *http.Client
+
+	mu              sync.RWMutex
+	credentials     credentials
+	state           string
+	lastError       string
+	loginCancel     context.CancelFunc
+	loginGeneration uint64
+
+	refreshMu sync.Mutex
+}
+
+func NewManager(path string, client *http.Client) *Manager {
+	if client == nil {
+		client = &http.Client{Timeout: 15 * time.Second}
+	}
+	manager := &Manager{
+		path:   strings.TrimSpace(path),
+		client: client,
+		state:  StateSignedOut,
+	}
+	if err := manager.load(); err != nil {
+		manager.state = StateError
+		manager.lastError = fmt.Sprintf("读取 Cursor 账号凭据失败: %v", err)
+	}
+	return manager
+}
+
+func (manager *Manager) Status() Status {
+	if manager == nil {
+		return Status{State: StateSignedOut}
+	}
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	return Status{
+		State:  manager.state,
+		AuthID: manager.credentials.AuthID,
+		Email:  manager.credentials.Email,
+		Error:  manager.lastError,
+	}
+}
+
+// EnsureEmail backfills a human-readable identity for credentials saved by
+// builds that only persisted authId. Profile lookup failure does not invalidate
+// an otherwise usable control-plane login.
+func (manager *Manager) EnsureEmail(ctx context.Context) {
+	if manager == nil || !manager.SignedIn() {
+		return
+	}
+	current, generation := manager.snapshotCredentials()
+	if strings.TrimSpace(current.Email) != "" {
+		return
+	}
+	authorization, err := manager.Authorization(ctx)
+	if err != nil {
+		return
+	}
+	profile, err := manager.fetchProfile(ctx, authorization)
+	if err != nil || strings.TrimSpace(profile.GetEmail()) == "" {
+		return
+	}
+	current, currentGeneration := manager.snapshotCredentials()
+	if currentGeneration != generation {
+		return
+	}
+	current.Email = strings.TrimSpace(profile.GetEmail())
+	_ = manager.commitCredentials(generation, current)
+}
+
+func (manager *Manager) SignedIn() bool {
+	if manager == nil {
+		return false
+	}
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	return manager.state == StateSignedIn && strings.TrimSpace(manager.credentials.AccessToken) != ""
+}
+
+// StartLogin 启动官方浏览器 PKCE 登录，并在后台等待登录结果。
+func (manager *Manager) StartLogin() (Status, error) {
+	if manager == nil {
+		return Status{State: StateError}, fmt.Errorf("Cursor 账号服务未初始化")
+	}
+	verifierBytes := make([]byte, 32)
+	if _, err := rand.Read(verifierBytes); err != nil {
+		return manager.Status(), fmt.Errorf("生成 Cursor 登录校验码失败: %w", err)
+	}
+	verifier := base64.RawURLEncoding.EncodeToString(verifierBytes)
+	challengeBytes := sha256.Sum256([]byte(verifier))
+	challenge := base64.RawURLEncoding.EncodeToString(challengeBytes[:])
+	loginID := uuid.NewString()
+
+	loginURL, err := buildLoginURL(loginID, challenge)
+	if err != nil {
+		return manager.Status(), err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), loginTimeout)
+
+	manager.mu.Lock()
+	if manager.loginCancel != nil {
+		manager.loginCancel()
+	}
+	manager.loginGeneration++
+	generation := manager.loginGeneration
+	manager.loginCancel = cancel
+	manager.state = StateWaiting
+	manager.lastError = ""
+	manager.mu.Unlock()
+
+	if err := browser.OpenURL(loginURL); err != nil {
+		cancel()
+		manager.finishWithError(generation, fmt.Sprintf("打开 Cursor 登录页面失败: %v", err))
+		return manager.Status(), err
+	}
+
+	go manager.pollLogin(ctx, generation, loginID, verifier)
+	return manager.Status(), nil
+}
+
+// Disconnect 只清除 cursor-byok 自己保存的账号，不调用 Cursor 客户端 logout。
+func (manager *Manager) Disconnect() (Status, error) {
+	if manager == nil {
+		return Status{State: StateSignedOut}, nil
+	}
+	manager.mu.Lock()
+	manager.loginGeneration++
+	if manager.loginCancel != nil {
+		manager.loginCancel()
+		manager.loginCancel = nil
+	}
+	manager.credentials = credentials{}
+	manager.state = StateSignedOut
+	manager.lastError = ""
+	manager.mu.Unlock()
+
+	err := os.Remove(manager.path)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		manager.mu.Lock()
+		manager.state = StateError
+		manager.lastError = fmt.Sprintf("清除 Cursor 账号凭据失败: %v", err)
+		manager.mu.Unlock()
+		return manager.Status(), err
+	}
+	return manager.Status(), nil
+}
+
+func (manager *Manager) Shutdown() {
+	if manager == nil {
+		return
+	}
+	manager.mu.Lock()
+	manager.loginGeneration++
+	if manager.loginCancel != nil {
+		manager.loginCancel()
+		manager.loginCancel = nil
+	}
+	manager.mu.Unlock()
+}
+
+// Authorization 返回官方控制面请求使用的真实 Cursor Bearer 身份。
+func (manager *Manager) Authorization(ctx context.Context) (string, error) {
+	if manager == nil {
+		return "", ErrNotSignedIn
+	}
+	manager.refreshMu.Lock()
+	defer manager.refreshMu.Unlock()
+
+	creds, generation := manager.snapshotCredentials()
+	if strings.TrimSpace(creds.AccessToken) == "" {
+		return "", ErrNotSignedIn
+	}
+	if !tokenNeedsRefresh(creds.AccessToken, time.Now()) {
+		return bearer(creds.AccessToken), nil
+	}
+	if strings.TrimSpace(creds.RefreshToken) == "" {
+		manager.setAuthorizationError(generation, "Cursor 登录已过期，请重新登录")
+		return "", fmt.Errorf("Cursor 登录已过期且没有刷新令牌")
+	}
+
+	updated, shouldLogout, err := manager.refresh(ctx, creds)
+	if err != nil {
+		manager.setAuthorizationError(generation, fmt.Sprintf("刷新 Cursor 登录失败: %v", err))
+		return "", err
+	}
+	if shouldLogout {
+		manager.invalidateAuthorization(generation, "Cursor 登录已失效，请重新登录")
+		return "", ErrNotSignedIn
+	}
+	if err := manager.commitCredentials(generation, updated); err != nil {
+		return "", err
+	}
+	return bearer(updated.AccessToken), nil
+}
+
+func (manager *Manager) pollLogin(ctx context.Context, generation uint64, loginID string, verifier string) {
+	defer func() {
+		manager.mu.Lock()
+		if manager.loginGeneration == generation {
+			manager.loginCancel = nil
+		}
+		manager.mu.Unlock()
+	}()
+
+	for {
+		result, pending, err := manager.pollOnce(ctx, loginID, verifier)
+		if err == nil && !pending {
+			creds := credentials{
+				AccessToken:  strings.TrimSpace(result.AccessToken),
+				RefreshToken: strings.TrimSpace(result.RefreshToken),
+				AuthID:       strings.TrimSpace(result.AuthID),
+			}
+			if creds.AccessToken == "" {
+				manager.finishWithError(generation, "Cursor 登录响应缺少 access token")
+				return
+			}
+			if profile, profileErr := manager.fetchProfile(ctx, bearer(creds.AccessToken)); profileErr == nil {
+				creds.Email = strings.TrimSpace(profile.GetEmail())
+			}
+			_ = manager.commitCredentials(generation, creds)
+			return
+		}
+		if err != nil && !isRetryablePollError(err) {
+			manager.finishWithError(generation, fmt.Sprintf("Cursor 登录失败: %v", err))
+			return
+		}
+
+		select {
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				manager.finishWithError(generation, "Cursor 登录等待超时，请重试")
+			}
+			return
+		case <-time.After(pollInterval):
+		}
+	}
+}
+
+func (manager *Manager) fetchProfile(ctx context.Context, authorization string) (*aiserverv1.GetMeResponse, error) {
+	body, err := proto.Marshal(&aiserverv1.GetMeRequest{})
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, backendURL+"/aiserver.v1.DashboardService/GetMe", bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("authorization", authorization)
+	req.Header.Set("x-cursor-checksum", upstream.BuildCursorChecksum(authorization))
+	req.Header.Set("content-type", "application/proto")
+	req.Header.Set("accept", "application/proto")
+	req.Header.Set("connect-protocol-version", "1")
+	resp, err := manager.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	responseBody, err := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("GetMe 返回 HTTP %d", resp.StatusCode)
+	}
+	profile := &aiserverv1.GetMeResponse{}
+	if err := proto.Unmarshal(responseBody, profile); err != nil {
+		return nil, err
+	}
+	return profile, nil
+}
+
+func (manager *Manager) pollOnce(ctx context.Context, loginID string, verifier string) (pollResponse, bool, error) {
+	endpoint, err := url.Parse(backendURL + "/auth/poll")
+	if err != nil {
+		return pollResponse{}, false, err
+	}
+	query := endpoint.Query()
+	query.Set("uuid", loginID)
+	query.Set("verifier", verifier)
+	endpoint.RawQuery = query.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+	if err != nil {
+		return pollResponse{}, false, err
+	}
+	resp, err := manager.client.Do(req)
+	if err != nil {
+		return pollResponse{}, false, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusNotFound {
+		_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 64*1024))
+		return pollResponse{}, true, nil
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+	if err != nil {
+		return pollResponse{}, false, err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return pollResponse{}, false, fmt.Errorf("登录服务返回 HTTP %d", resp.StatusCode)
+	}
+	result := pollResponse{}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return pollResponse{}, false, fmt.Errorf("解析登录响应失败: %w", err)
+	}
+	return result, false, nil
+}
+
+func (manager *Manager) refresh(ctx context.Context, current credentials) (credentials, bool, error) {
+	payload, err := json.Marshal(map[string]string{
+		"grant_type":    "refresh_token",
+		"client_id":     authClientID,
+		"refresh_token": current.RefreshToken,
+	})
+	if err != nil {
+		return credentials{}, false, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, backendURL+"/oauth/token", bytes.NewReader(payload))
+	if err != nil {
+		return credentials{}, false, err
+	}
+	req.Header.Set("content-type", "application/json")
+	resp, err := manager.client.Do(req)
+	if err != nil {
+		return credentials{}, false, err
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+	if err != nil {
+		return credentials{}, false, err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return credentials{}, false, fmt.Errorf("刷新服务返回 HTTP %d", resp.StatusCode)
+	}
+	result := refreshResponse{}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return credentials{}, false, fmt.Errorf("解析刷新响应失败: %w", err)
+	}
+	if result.ShouldLogout {
+		return credentials{}, true, nil
+	}
+	if strings.TrimSpace(result.AccessToken) == "" {
+		return credentials{}, false, fmt.Errorf("刷新响应缺少 access token")
+	}
+	current.AccessToken = strings.TrimSpace(result.AccessToken)
+	if strings.TrimSpace(result.RefreshToken) != "" {
+		current.RefreshToken = strings.TrimSpace(result.RefreshToken)
+	}
+	return current, false, nil
+}
+
+func (manager *Manager) load() error {
+	if manager.path == "" {
+		return fmt.Errorf("Cursor 账号凭据路径为空")
+	}
+	data, err := os.ReadFile(manager.path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	loaded := credentials{}
+	if err := json.Unmarshal(data, &loaded); err != nil {
+		return err
+	}
+	loaded.AccessToken = strings.TrimSpace(loaded.AccessToken)
+	loaded.RefreshToken = strings.TrimSpace(loaded.RefreshToken)
+	loaded.AuthID = strings.TrimSpace(loaded.AuthID)
+	loaded.Email = strings.TrimSpace(loaded.Email)
+	if loaded.AccessToken == "" {
+		return nil
+	}
+	manager.credentials = loaded
+	manager.state = StateSignedIn
+	return nil
+}
+
+func (manager *Manager) save(value credentials) error {
+	if manager.path == "" {
+		return fmt.Errorf("Cursor 账号凭据路径为空")
+	}
+	if err := os.MkdirAll(filepath.Dir(manager.path), 0o700); err != nil {
+		return err
+	}
+	data, err := json.MarshalIndent(value, "", "  ")
+	if err != nil {
+		return err
+	}
+	tempPath := manager.path + ".tmp"
+	if err := os.WriteFile(tempPath, append(data, '\n'), 0o600); err != nil {
+		return err
+	}
+	if err := os.Chmod(tempPath, 0o600); err != nil {
+		_ = os.Remove(tempPath)
+		return err
+	}
+	if err := os.Rename(tempPath, manager.path); err != nil {
+		_ = os.Remove(tempPath)
+		return err
+	}
+	return os.Chmod(manager.path, 0o600)
+}
+
+func (manager *Manager) snapshotCredentials() (credentials, uint64) {
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	return manager.credentials, manager.loginGeneration
+}
+
+func (manager *Manager) finishWithError(generation uint64, message string) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.loginGeneration != generation {
+		return
+	}
+	manager.state = StateError
+	manager.lastError = strings.TrimSpace(message)
+}
+
+func (manager *Manager) commitCredentials(generation uint64, value credentials) error {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.loginGeneration != generation {
+		return ErrNotSignedIn
+	}
+	if err := manager.save(value); err != nil {
+		manager.state = StateError
+		manager.lastError = fmt.Sprintf("保存 Cursor 登录凭据失败: %v", err)
+		return err
+	}
+	manager.credentials = value
+	manager.state = StateSignedIn
+	manager.lastError = ""
+	return nil
+}
+
+func (manager *Manager) setAuthorizationError(generation uint64, message string) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.loginGeneration != generation {
+		return
+	}
+	manager.state = StateError
+	manager.lastError = strings.TrimSpace(message)
+}
+
+func (manager *Manager) invalidateAuthorization(generation uint64, message string) {
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	if manager.loginGeneration != generation {
+		return
+	}
+	manager.loginGeneration++
+	manager.credentials = credentials{}
+	manager.state = StateError
+	manager.lastError = strings.TrimSpace(message)
+	_ = os.Remove(manager.path)
+}
+
+func buildLoginURL(loginID string, challenge string) (string, error) {
+	parsed, err := url.Parse(websiteURL + "/loginDeepControl")
+	if err != nil {
+		return "", err
+	}
+	query := parsed.Query()
+	query.Set("challenge", challenge)
+	query.Set("uuid", loginID)
+	query.Set("mode", "login")
+	query.Set("supportsSelectedTeamLogin", "true")
+	parsed.RawQuery = query.Encode()
+	return parsed.String(), nil
+}
+
+func bearer(token string) string {
+	value := strings.TrimSpace(token)
+	if strings.HasPrefix(strings.ToLower(value), "bearer ") {
+		return value
+	}
+	return "Bearer " + value
+}
+
+func tokenNeedsRefresh(token string, now time.Time) bool {
+	parts := strings.Split(strings.TrimSpace(token), ".")
+	if len(parts) < 2 {
+		return false
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return false
+	}
+	claims := struct {
+		ExpiresAt json.Number `json:"exp"`
+	}{}
+	decoder := json.NewDecoder(bytes.NewReader(payload))
+	decoder.UseNumber()
+	if err := decoder.Decode(&claims); err != nil || claims.ExpiresAt == "" {
+		return false
+	}
+	expiresAt, err := claims.ExpiresAt.Int64()
+	if err != nil {
+		return false
+	}
+	return !now.Add(refreshMargin).Before(time.Unix(expiresAt, 0))
+}
+
+func isRetryablePollError(err error) bool {
+	if err == nil {
+		return false
+	}
+	var urlErr *url.Error
+	if errors.As(err, &urlErr) {
+		return true
+	}
+	message := strings.ToLower(err.Error())
+	return strings.Contains(message, "http 429") || strings.Contains(message, "http 5")
+}