Where does the bug appear (feature/product)?
Cloud Agent (GitHub, Slack, Web, Linear)
Describe the Bug
Hey Cursor team, I ran into a Git auth issue in Cursor Cloud. The workspace had a global Git URL rewrite injecting an old x-access-token:[email protected] credential. After the token expired, git push failed even though gh auth login succeeded. The fix was removing the stale URL rewrite / re-running gh auth setup-git. Might be worth making Cursor refresh or clean these rewrites automatically when auth expires.
Thanks.
Steps to Reproduce
Open a project in Cursor Cloud.
Use a Cursor agent to create a new feature/change.
Commit the changes.
Merge the feature branch into master.
Attempt to push changes:
Expected Behavior
After authenticating GitHub in Cursor Cloud, git push should use the current GitHub authentication automatically.
If a Cursor Cloud-generated token expires, Git should refresh the credentials or provide a clear message instead of silently using an invalid token.
Operating System
Windows 10/11
Version Information
Version: 3.13.10 (user setup)
VS Code Extension API: 1.128.0
Commit: 4f02290ccd9304f0e6bf8ee85f6e9106f02ac1f0
Date: 2026-07-23T21:41:07.333Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Windows_NT x64 10.0.26200
Does this stop you from using Cursor
No - Cursor works, but with this issue
Hey there,
What’s going on: in Cursor Cloud, git is authenticated with a short-lived, Cursor-managed GitHub token that gets injected as that global x-access-token:[email protected] URL rewrite you found. It refreshes automatically whenever the agent does git or backend work (an agent turn, viewing a diff, and so on), but it does not refresh for commands you run yourself in the workspace terminal. So if you do manual git work like merging and pushing more than about an hour after the last agent activity, the rewrite still points at the expired token and the push fails. And because the token is embedded inline in that rewrite, git never consults a credential helper for those URLs, which is why gh auth login / gh auth setup-git didn’t take effect until you removed the rewrite.
Two ways to unblock:
- Let the agent run the push (or just send it any message first). Any agent-driven git operation re-mints the token and refreshes the rewrite, and then the push goes through.
- Your manual fix works too (clearing the stale
insteadOf rewrite and re-running gh auth setup-git). Just note that Cursor will re-install a fresh managed rewrite on the next agent interaction, so that’s expected, not the fix getting undone.
On your suggestions (auto-refreshing or cleaning the rewrite when the token expires, plus a clear error instead of a silent failure): both are good calls. This is something we’ve seen reported before, and I’ve passed your report along. I’ll follow up here if there’s an update.