[adampeterhiggins]

Summary

POC for running multiple native logins per provider in parallel. Each provider's settings gain a homePath field that gives the provider instance its own credential location, so each instance can stay signed in to a different account. Since provider instances already appear as separate entries in the model picker, the picker becomes the account selector — no new auth-profile entity needed.

Per-driver mapping (all fields render automatically in the instance settings form):

Provider	Field	Mechanism	Isolates
Cursor	homePath	Shadow HOME (see note)	auth.json, CLI config, sessions
Grok	homePath	GROK_HOME	auth.json, CLI config
Devin	homePath	XDG_DATA_HOME	credentials.toml
OpenCode	homePath	XDG_DATA_HOME	auth.json

Claude (CLAUDE_CONFIG_DIR), Codex (CODEX_HOME + shadow home), and Antigravity already isolate per instance and are unchanged.

Cursor needs a shadow HOME, not CURSOR_CONFIG_DIR. Cursor's credential store resolves auth.json from homedir() on macOS and $XDG_CONFIG_HOME on Linux — CURSOR_CONFIG_DIR only relocates cli-config.json, so a config-dir override leaves every instance sharing ~/.cursor/auth.json (verified: agent about reports the global account under a fresh config dir). Instead, homePath is materialized as a shadow home directory: .cursor and .config/cursor stay real/private while every other home entry (~/.ssh, ~/.gitconfig, ~/Library, …) symlinks back to the real home, so the agent's own tools keep working. The instance runs with HOME=<shadow> plus AGENT_CLI_CREDENTIAL_STORE=file so cursor-agent login writes auth.json into the shadow rather than the shared macOS keychain (reachable via the ~/Library symlink). Re-materialized on each instance start to fix stale links and sync entries added to the real home later.

• Shared mergeProviderHomePathEnvironment resolves homePath (with ~ expansion) into the instance env; CursorHome materializes the shadow home and merges HOME
• The instance env reaches every subprocess: status/about probes, ACP model discovery, adapter sessions, skills probes, login/logout, usage limits
• cursorUsageLimits credential lookup is home-anchored on every platform (matching the CLI), so the instance HOME points it at the right auth.json; Grok and OpenCode probes already honor GROK_HOME/XDG_DATA_HOME
• GROK_HOME, XDG_DATA_HOME, XDG_CONFIG_HOME, CURSOR_CONFIG_DIR tilde-expanded in the shared instance env merge (same as CODEX_HOME/CLAUDE_CONFIG_DIR)
• Docs: providers-cursor.md covers the shadow-home behavior; "separate accounts" sections added to providers-devin.md and providers-opencode.md

OpenCode's auth login is an interactive TUI, so its second login is created in a terminal with the same XDG_DATA_HOME; every other provider signs in through the instance's own browser sign-in action.

Test plan

• CursorHome.test.ts: env merge, ~ resolution, credential-store default, HOME precedence, shadow-home materialization (private dirs, shared symlinks, .config filtering, real-home rejection)
• mergeProviderHomePathEnvironment tests: empty path passthrough, multi-var injection, config-over-env precedence
• cursorUsageLimits test: reads auth.json from the instance HOME
• ProviderInstanceEnvironment.test.ts: tilde expansion for all six profile-dir vars
• Focused vitest run: all pass; 2 pre-existing "Cursor skills" failures confirmed on HEAD (macOS /var vs /private/var)
• Manual: CURSOR_CONFIG_DIR=/tmp/… cursor-agent about still reports the global account (proves config-dir is insufficient); HOME=/tmp/… cursor-agent about reports logged-out with an empty home and the correct account with an auth.json present
• Manual: XDG_DATA_HOME=/tmp/... devin auth status confirms credential path relocates
• Manual: two Cursor instances, sign in via browser on each, verify distinct account per instance card

Generated with Devin