Honor Cursor source policy in dashboard

Author: umutkeltek

Sources/CodexBarCLI/CLICostCommand.swift

@@ -374,7 +374,7 @@ extension CodexBarCLI {
 
     /// Resolve the configured Cursor cookie settings (source + manual header) the same way the CLI
     /// usage path does, so Cursor cost honors Off/Manual instead of always auto-resolving a session.
-    /// Shared by `cost` and the serve `/cost` route.
+    /// Shared by `cost`, the serve `/cost` route, and dashboard snapshot collection.
     static func cursorCookieSettings(
         config: CodexBarConfig,
         providers: [UsageProvider]) throws -> ProviderSettingsSnapshot.CursorProviderSettings?

Sources/CodexBarCLI/CLIDashboardCommand.swift

@@ -31,7 +31,7 @@ struct DashboardSnapshotResult {
 /// existing authenticated HTTP cache.
 struct DashboardSnapshotProducer: Sendable {
     let collectUsage: @Sendable ([UsageProvider]) async throws -> UsageCommandOutput
-    let collectCost: @Sendable ([UsageProvider]) async -> [CostPayload]
+    let collectCost: @Sendable ([UsageProvider], CodexBarConfig) async -> [CostPayload]
     let now: @Sendable () -> Date
 
     func collect(
@@ -43,7 +43,9 @@ struct DashboardSnapshotProducer: Sendable {
             rawOverride: nil,
             enabled: config.enabledProviders())
         let usageOutput = try await self.collectUsage(selection.asList)
-        let costPayloads = await self.collectCost(CodexBarCLI.costProviders(from: selection))
+        let costPayloads = await self.collectCost(
+            CodexBarCLI.costProviders(from: selection),
+            config)
 
         let payload = DashboardSnapshotBuilder.makeSnapshot(
             usagePayloads: usageOutput.payload,
@@ -65,16 +67,18 @@ struct DashboardSnapshotProducer: Sendable {
                     selection: .custom(providers),
                     context: context.usage)
             },
-            collectCost: { providers in
+            collectCost: { providers, config in
                 let costFetcher = CostUsageFetcher()
-                return await CodexBarCLI.serveCollectCostPayloads(
+                return await CodexBarCLI.collectConfiguredCostPayloads(
                     providers: providers,
+                    config: config,
                     context: context.costCollection)
-                { provider in
+                { provider, cursorCookieHeaderOverride in
                     do {
                         let snapshot = try await costFetcher.loadTokenSnapshot(
                             provider: provider,
                             forceRefresh: false,
+                            cursorCookieHeaderOverride: cursorCookieHeaderOverride,
                             refreshPricingInBackground: context.costRefreshesPricingInBackground)
                         return CodexBarCLI.makeCostPayload(provider: provider, snapshot: snapshot, error: nil)
                     } catch {

Sources/CodexBarCLI/CLIServeCommand.swift

@@ -1287,21 +1287,48 @@ extension CodexBarCLI {
                 message: "cost is only supported for \(Self.costSupportedProviderNames())")
         }
 
-        // Cursor cost honors the same cookie policy here as the `cost` command: return a provider
-        // error when the source is Off and forward the Manual header for an enabled fetch.
+        let fetcher = CostUsageFetcher()
+        let payload = await Self.collectConfiguredCostPayloads(
+            providers: providers,
+            config: context.config,
+            context: context.collection)
+        { provider, cursorCookieHeaderOverride in
+            do {
+                let snapshot = try await fetcher.loadTokenSnapshot(
+                    provider: provider,
+                    forceRefresh: false,
+                    cursorCookieHeaderOverride: cursorCookieHeaderOverride,
+                    refreshPricingInBackground: Self.serveCostRefreshesPricingInBackground)
+                return Self.makeCostPayload(provider: provider, snapshot: snapshot, error: nil)
+            } catch {
+                return Self.makeCostPayload(provider: provider, snapshot: nil, error: error)
+            }
+        }
+
+        return Self.serveJSON(payload)
+    }
+
+    static func collectConfiguredCostPayloads(
+        providers: [UsageProvider],
+        config: CodexBarConfig,
+        context: ServeCostCollectionContext,
+        fetch: @Sendable @escaping (UsageProvider, String?) async -> CostPayload) async -> [CostPayload]
+    {
+        // Keep every dashboard transport aligned with the configured Cursor credential source.
+        // Policy failures remain row-local so other providers still render.
         let cursorCookieSettings: ProviderSettingsSnapshot.CursorProviderSettings?
         let cursorCookieSettingsError: Error?
         do {
-            cursorCookieSettings = try Self.cursorCookieSettings(config: context.config, providers: providers)
+            cursorCookieSettings = try Self.cursorCookieSettings(config: config, providers: providers)
             cursorCookieSettingsError = nil
         } catch {
             cursorCookieSettings = nil
             cursorCookieSettingsError = error
         }
-        let fetcher = CostUsageFetcher()
-        let payload = await Self.serveCollectCostPayloads(
+
+        return await Self.serveCollectCostPayloads(
             providers: providers,
-            context: context.collection)
+            context: context)
         { provider in
             if let error = Self.cursorCostAvailabilityError(
                 provider,
@@ -1310,21 +1337,10 @@ extension CodexBarCLI {
             {
                 return Self.makeCostPayload(provider: provider, snapshot: nil, error: error)
             }
-            do {
-                let snapshot = try await fetcher.loadTokenSnapshot(
-                    provider: provider,
-                    forceRefresh: false,
-                    cursorCookieHeaderOverride: Self.cursorCostHeaderOverride(
-                        provider,
-                        settings: cursorCookieSettings),
-                    refreshPricingInBackground: Self.serveCostRefreshesPricingInBackground)
-                return Self.makeCostPayload(provider: provider, snapshot: snapshot, error: nil)
-            } catch {
-                return Self.makeCostPayload(provider: provider, snapshot: nil, error: error)
-            }
+            return await fetch(
+                provider,
+                Self.cursorCostHeaderOverride(provider, settings: cursorCookieSettings))
         }
-
-        return Self.serveJSON(payload)
     }
 
     static func serveCollectCostPayloads(

Tests/CodexBarTests/DashboardSnapshotBuilderTests.swift

@@ -4,6 +4,85 @@ import Testing
 @testable import CodexBarCLI
 
 struct DashboardSnapshotBuilderTests {
+    @Test
+    func `dashboard cost collection does not fetch Cursor when cookie source is off`() async {
+        let recorder = DashboardCostFetchRecorder()
+        let config = CodexBarConfig(providers: [
+            ProviderConfig(id: .cursor, enabled: true, cookieSource: .off),
+        ])
+
+        let payload = await CodexBarCLI.collectConfiguredCostPayloads(
+            providers: [.cursor],
+            config: config,
+            context: self.costCollectionContext())
+        { provider, header in
+            await recorder.record(provider: provider, cursorCookieHeaderOverride: header)
+            return CodexBarCLI.makeCostPayload(provider: provider, snapshot: nil, error: nil)
+        }
+
+        #expect(await recorder.calls().isEmpty)
+        #expect(payload.count == 1)
+        #expect(payload[0].provider == "cursor")
+        #expect(payload[0].error?.message.contains("cookie source is set to Off") == true)
+    }
+
+    @Test
+    func `dashboard cost collection forwards configured Cursor manual cookie`() async {
+        let recorder = DashboardCostFetchRecorder()
+        let config = CodexBarConfig(providers: [
+            ProviderConfig(
+                id: .cursor,
+                enabled: true,
+                cookieHeader: "  session=manual  ",
+                cookieSource: .manual),
+        ])
+
+        let payload = await CodexBarCLI.collectConfiguredCostPayloads(
+            providers: [.cursor],
+            config: config,
+            context: self.costCollectionContext())
+        { provider, header in
+            await recorder.record(provider: provider, cursorCookieHeaderOverride: header)
+            return CodexBarCLI.makeCostPayload(provider: provider, snapshot: nil, error: nil)
+        }
+
+        let calls = await recorder.calls()
+        #expect(calls.count == 1)
+        #expect(calls[0].provider == .cursor)
+        #expect(calls[0].cursorCookieHeaderOverride == "session=manual")
+        #expect(payload.count == 1)
+        #expect(payload[0].error == nil)
+    }
+
+    @Test
+    func `dashboard producer forwards its config to cost collection`() async throws {
+        let recorder = DashboardCostConfigRecorder()
+        let config = CodexBarConfig(providers: [
+            ProviderConfig(
+                id: .cursor,
+                enabled: true,
+                cookieHeader: "session=manual",
+                cookieSource: .manual),
+        ])
+        let producer = DashboardSnapshotProducer(
+            collectUsage: { _ in UsageCommandOutput() },
+            collectCost: { providers, config in
+                await recorder.record(providers: providers, config: config)
+                return []
+            },
+            now: { Date(timeIntervalSince1970: 1_800_000_000) })
+
+        _ = try await producer.collect(
+            config: config,
+            refreshInterval: 0,
+            codexBarVersion: "9.8.7")
+
+        let call = try #require(await recorder.call())
+        #expect(call.providers == [.cursor])
+        #expect(call.cookieSource == .manual)
+        #expect(call.cookieHeader == "session=manual")
+    }
+
     @Test
     func `producer keeps stable order redaction and partial errors`() async throws {
         let generatedAt = Date(timeIntervalSince1970: 1_800_000_000)
@@ -27,7 +106,7 @@ struct DashboardSnapshotBuilderTests {
                 output.exitCode = .failure
                 return output
             },
-            collectCost: { _ in [] },
+            collectCost: { _, _ in [] },
             now: { generatedAt })
         let config = CodexBarConfig(providers: [
             ProviderConfig(id: .claude, enabled: true),
@@ -53,6 +132,15 @@ struct DashboardSnapshotBuilderTests {
         #expect(object["generatedAt"] as? String == "2027-01-15T08:00:00Z")
     }
 
+    private func costCollectionContext() -> ServeCostCollectionContext {
+        ServeCostCollectionContext(
+            configFingerprint: "dashboard-cost-policy",
+            providerTimeout: nil,
+            requestDeadline: nil,
+            now: { ContinuousClock().now },
+            providerOperations: CLIServeOperationCoordinator())
+    }
+
     @Test
     func `builds stable display-oriented dashboard snapshot`() throws {
         let generatedAt = Date(timeIntervalSince1970: 1_800_000_000)
@@ -496,3 +584,44 @@ struct DashboardSnapshotBuilderTests {
         return try #require(JSONSerialization.jsonObject(with: data) as? [String: Any])
     }
 }
+
+private actor DashboardCostFetchRecorder {
+    struct Call: Sendable {
+        let provider: UsageProvider
+        let cursorCookieHeaderOverride: String?
+    }
+
+    private var recordedCalls: [Call] = []
+
+    func record(provider: UsageProvider, cursorCookieHeaderOverride: String?) {
+        self.recordedCalls.append(Call(
+            provider: provider,
+            cursorCookieHeaderOverride: cursorCookieHeaderOverride))
+    }
+
+    func calls() -> [Call] {
+        self.recordedCalls
+    }
+}
+
+private actor DashboardCostConfigRecorder {
+    struct Call: Sendable {
+        let providers: [UsageProvider]
+        let cookieSource: ProviderCookieSource?
+        let cookieHeader: String?
+    }
+
+    private var recordedCall: Call?
+
+    func record(providers: [UsageProvider], config: CodexBarConfig) {
+        let cursor = config.providerConfig(for: .cursor)
+        self.recordedCall = Call(
+            providers: providers,
+            cookieSource: cursor?.cookieSource,
+            cookieHeader: cursor?.cookieHeader)
+    }
+
+    func call() -> Call? {
+        self.recordedCall
+    }
+}