cursor-keys 0.0.0-stage → 1.1.0

package/src/config.mjs

@@ -0,0 +1,176 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export const DEFAULT_CONFIG_DIR = path.join(
+  os.homedir(),
+  ".config",
+  "cursor-keys",
+);
+export const CONFIG_FILE = path.join(DEFAULT_CONFIG_DIR, "config.json");
+export const DEFAULT_PROFILES_ROOT = path.join(
+  os.homedir(),
+  ".cursor-profiles",
+);
+
+const HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+
+/** @param {string} p */
+export function expandHome(p) {
+  if (!p || typeof p !== "string") return p;
+  if (p === "~") return os.homedir();
+  if (p.startsWith("~/")) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+
+/** @param {string} p */
+export function collapseHome(p) {
+  const home = os.homedir();
+  if (p === home) return "~";
+  if (p.startsWith(home + path.sep)) return "~" + p.slice(home.length);
+  return p;
+}
+
+export function defaultConfig() {
+  return {
+    profilesRoot: collapseHome(DEFAULT_PROFILES_ROOT),
+    baseUrl: "https://connect.iobonzai.com/cursor",
+    projects: {},
+  };
+}
+
+export function loadConfig() {
+  if (!fs.existsSync(CONFIG_FILE)) {
+    return defaultConfig();
+  }
+  const raw = fs.readFileSync(CONFIG_FILE, "utf8");
+  const data = JSON.parse(raw);
+  return validateConfig(data);
+}
+
+export function saveConfig(config) {
+  const validated = validateConfig(config);
+  fs.mkdirSync(DEFAULT_CONFIG_DIR, { recursive: true });
+  fs.writeFileSync(
+    CONFIG_FILE,
+    JSON.stringify(validated, null, 2) + "\n",
+    "utf8",
+  );
+  return validated;
+}
+
+/**
+ * @param {unknown} data
+ */
+export function validateConfig(data) {
+  if (!data || typeof data !== "object") {
+    throw new Error("Invalid config: expected object");
+  }
+  const profilesRoot =
+    typeof data.profilesRoot === "string"
+      ? data.profilesRoot
+      : collapseHome(DEFAULT_PROFILES_ROOT);
+  const baseUrl =
+    typeof data.baseUrl === "string" && data.baseUrl
+      ? data.baseUrl
+      : "https://connect.iobonzai.com/cursor";
+  const projects = {};
+  if (data.projects && typeof data.projects === "object") {
+    for (const [name, entry] of Object.entries(data.projects)) {
+      if (!name || typeof entry !== "object" || !entry) continue;
+      const repoPath = typeof entry.path === "string" ? entry.path : "";
+      const color = typeof entry.color === "string" ? entry.color : "";
+      if (!repoPath) throw new Error(`Project "${name}" missing path`);
+      if (color && !HEX_COLOR.test(color)) {
+        throw new Error(`Project "${name}" invalid color (use #RRGGBB)`);
+      }
+      projects[name] = {
+        path: repoPath,
+        color: color || pickColorForName(name),
+      };
+    }
+  }
+  return { profilesRoot, baseUrl, projects };
+}
+
+/** "https://connect.iobonzai.com/cursor" -> "connect.iobonzai.com/cursor" */
+export function baseUrlFragment(config) {
+  return String(config.baseUrl || "").replace(/^https?:\/\//, "");
+}
+
+const COLOR_PALETTE = [
+  "#4f8cff",
+  "#ff6b6b",
+  "#51cf66",
+  "#ffd43b",
+  "#845ef7",
+  "#20c997",
+  "#ff922b",
+  "#e64980",
+  "#339af0",
+  "#94d82d",
+];
+
+/** Deterministic palette color from project name */
+export function pickColorForName(name) {
+  let hash = 0;
+  for (let i = 0; i < name.length; i++) {
+    hash = (hash * 31 + name.charCodeAt(i)) >>> 0;
+  }
+  return COLOR_PALETTE[hash % COLOR_PALETTE.length];
+}
+
+/** Like pickColorForName, but avoids colors already used by other projects */
+export function pickUnusedColor(name, usedColors) {
+  const used = new Set(usedColors);
+  const preferred = pickColorForName(name);
+  if (!used.has(preferred)) return preferred;
+  return COLOR_PALETTE.find((c) => !used.has(c)) || preferred;
+}
+
+/**
+ * @param {ReturnType<typeof loadConfig>} config
+ * @param {string} name
+ */
+export function getProject(config, name) {
+  const entry = config.projects[name];
+  if (!entry) return null;
+  return {
+    name,
+    path: path.resolve(expandHome(entry.path)),
+    color: entry.color,
+    profileDir: path.join(expandHome(config.profilesRoot), name),
+  };
+}
+
+/**
+ * @param {ReturnType<typeof loadConfig>} config
+ * @param {string} cwd
+ */
+export function findProjectByPath(config, cwd) {
+  const resolved = path.resolve(cwd);
+  let best = null;
+  let bestLen = 0;
+  for (const [name, entry] of Object.entries(config.projects)) {
+    const repo = path.resolve(expandHome(entry.path));
+    if (resolved === repo || resolved.startsWith(repo + path.sep)) {
+      if (repo.length > bestLen) {
+        bestLen = repo.length;
+        best = name;
+      }
+    }
+  }
+  return best ? getProject(config, best) : null;
+}
+
+export function profileUserDir(profileDir) {
+  return path.join(profileDir, "User");
+}
+
+export function profileStateDb(profileDir) {
+  return path.join(profileUserDir(profileDir), "globalStorage", "state.vscdb");
+}
+
+export function profileSettingsPath(profileDir) {
+  return path.join(profileUserDir(profileDir), "settings.json");
+}

package/src/detect.mjs

@@ -0,0 +1,214 @@
+import { execSync, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export function findCursorCli() {
+  // Prefer the app-bundle CLI: ~/.local/bin/cursor is a shim that depends on
+  // PATH, which is unreliable from the extension host (minimal GUI PATH).
+  const candidates = [
+    "/Applications/Cursor.app/Contents/Resources/app/bin/cursor",
+    "/usr/local/bin/cursor",
+    path.join(os.homedir(), ".local", "bin", "cursor"),
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return c;
+  }
+  const fromPath = spawnSync("which", ["cursor"], { encoding: "utf8" });
+  if (fromPath.status === 0 && fromPath.stdout.trim()) {
+    return fromPath.stdout.trim();
+  }
+  return null;
+}
+
+export function mainCursorUserDir() {
+  if (process.platform === "darwin") {
+    return path.join(
+      os.homedir(),
+      "Library",
+      "Application Support",
+      "Cursor",
+      "User",
+    );
+  }
+  if (process.platform === "win32") {
+    const appData =
+      process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(appData, "Cursor", "User");
+  }
+  return path.join(os.homedir(), ".config", "Cursor", "User");
+}
+
+export function mainCursorProfileRoot() {
+  return path.dirname(mainCursorUserDir());
+}
+
+/**
+ * Parse ps output for cursor processes and their --user-data-dir
+ * @returns {Map<string, number>} profileRoot -> count of processes
+ */
+export function listRunningCursorProfiles() {
+  const map = new Map();
+  let output = "";
+  try {
+    if (process.platform === "win32") {
+      output = execSync(
+        "wmic process where \"name='Cursor.exe'\" get CommandLine",
+        {
+          encoding: "utf8",
+          stdio: ["pipe", "pipe", "ignore"],
+        },
+      );
+    } else {
+      // ps -eo: ps axo intermittently misses GUI processes in some contexts
+      output = execSync("ps -eo command=", {
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "ignore"],
+      });
+    }
+  } catch {
+    return map;
+  }
+
+  const lines = output.split("\n");
+  for (const line of lines) {
+    if (!/cursor/i.test(line)) continue;
+    // Skip helper processes (renderer/gpu/network); only the main process
+    // (no --type= flag) represents a running profile window.
+    if (line.includes("--type=")) continue;
+    const dir = parseUserDataDirFromCommandLine(line);
+    if (dir) {
+      const normalized = path.resolve(dir);
+      map.set(normalized, (map.get(normalized) || 0) + 1);
+    }
+  }
+  return map;
+}
+
+/**
+ * @param {string} line
+ */
+export function parseUserDataDirFromCommandLine(line) {
+  const flag = "--user-data-dir";
+  const idx = line.indexOf(flag);
+  if (idx === -1) return null;
+  let rest = line.slice(idx + flag.length).trim();
+  if (rest.startsWith("=")) rest = rest.slice(1).trim();
+  if (!rest.length) return null;
+  if (rest[0] === '"' || rest[0] === "'") {
+    const q = rest[0];
+    const end = rest.indexOf(q, 1);
+    if (end === -1) return null;
+    return rest.slice(1, end);
+  }
+  const space = rest.search(/\s/);
+  return space === -1 ? rest : rest.slice(0, space);
+}
+
+export function isCursorRunning() {
+  try {
+    if (process.platform === "darwin" || process.platform === "linux") {
+      execSync("pgrep -x Cursor", { stdio: "ignore" });
+      return true;
+    }
+  } catch {
+    return false;
+  }
+  return listRunningCursorProfiles().size > 0;
+}
+
+export function hasSqlite3() {
+  try {
+    execSync("which sqlite3", { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check if secret key row exists (never reads value)
+ * @param {string} stateDbPath
+ * @param {string} key
+ */
+export function stateDbHasKey(stateDbPath, key) {
+  if (!fs.existsSync(stateDbPath) || !hasSqlite3()) return false;
+  try {
+    const out = execSync(
+      `sqlite3 ${shellQuote(stateDbPath)} "SELECT 1 FROM ItemTable WHERE key = ${shellQuote(key)} LIMIT 1;"`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] },
+    );
+    return out.trim() === "1";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * List ItemTable keys matching pattern (names only)
+ * @param {string} stateDbPath
+ * @param {string} likePattern SQL LIKE pattern
+ */
+export function stateDbKeysLike(stateDbPath, likePattern) {
+  if (!fs.existsSync(stateDbPath) || !hasSqlite3()) return [];
+  try {
+    const out = execSync(
+      `sqlite3 ${shellQuote(stateDbPath)} "SELECT key FROM ItemTable WHERE key LIKE ${shellQuote(likePattern)};"`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] },
+    );
+    return out
+      .split("\n")
+      .map((l) => l.trim())
+      .filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Check if Bonzai base URL appears in any ItemTable value (substring, no key dump)
+ * @param {string} stateDbPath
+ * @param {string} urlFragment
+ */
+export function stateDbValueContains(stateDbPath, urlFragment) {
+  if (!fs.existsSync(stateDbPath) || !hasSqlite3()) return false;
+  try {
+    const out = execSync(
+      `sqlite3 ${shellQuote(stateDbPath)} "SELECT 1 FROM ItemTable WHERE CAST(value AS TEXT) LIKE ${shellQuote("%" + urlFragment + "%")} LIMIT 1;"`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] },
+    );
+    return out.trim() === "1";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True if the value for `key` is byte-identical in both state DBs.
+ * Comparison happens inside SQL; the value never enters this process.
+ * @param {string} dbA
+ * @param {string} dbB
+ * @param {string} key
+ */
+export function stateDbValuesMatch(dbA, dbB, key) {
+  if (!fs.existsSync(dbA) || !fs.existsSync(dbB) || !hasSqlite3()) {
+    return false;
+  }
+  try {
+    const out = execSync(
+      `sqlite3 ${shellQuote(dbA)} "ATTACH DATABASE ${shellQuote(dbB)} AS other; SELECT CASE WHEN (SELECT value FROM ItemTable WHERE key = ${shellQuote(key)}) IS NOT NULL AND (SELECT value FROM ItemTable WHERE key = ${shellQuote(key)}) = (SELECT value FROM other.ItemTable WHERE key = ${shellQuote(key)}) THEN 1 ELSE 0 END;"`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] },
+    );
+    return out.trim() === "1";
+  } catch {
+    return false;
+  }
+}
+
+function shellQuote(s) {
+  return `'${String(s).replace(/'/g, `'\\''`)}'`;
+}
+
+export const SECRET_OPENAI_KEY = "secret://cursorAuth/openAIKey";
+export const SUBAGENT_OVERRIDES_KEY = "cursor/subagentModelOverrides";
+export const BONZAI_BASE_URL_FRAGMENT = "connect.iobonzai.com/cursor";

package/src/jsonc.mjs

@@ -0,0 +1,109 @@
+/**
+ * Strip JSONC comments and trailing commas (respects strings).
+ * @param {string} text
+ * @returns {string}
+ */
+export function stripJsonc(text) {
+  let out = "";
+  let i = 0;
+  const len = text.length;
+  let inString = false;
+  let stringQuote = "";
+  let escape = false;
+
+  while (i < len) {
+    const c = text[i];
+
+    if (inString) {
+      out += c;
+      if (escape) {
+        escape = false;
+      } else if (c === "\\") {
+        escape = true;
+      } else if (c === stringQuote) {
+        inString = false;
+      }
+      i++;
+      continue;
+    }
+
+    if (c === '"' || c === "'") {
+      inString = true;
+      stringQuote = c;
+      out += c;
+      i++;
+      continue;
+    }
+
+    if (c === "/" && i + 1 < len) {
+      const next = text[i + 1];
+      if (next === "/") {
+        i += 2;
+        while (i < len && text[i] !== "\n") i++;
+        continue;
+      }
+      if (next === "*") {
+        i += 2;
+        while (i + 1 < len && !(text[i] === "*" && text[i + 1] === "/")) i++;
+        i += 2;
+        continue;
+      }
+    }
+
+    out += c;
+    i++;
+  }
+
+  return removeTrailingCommas(out);
+}
+
+function removeTrailingCommas(json) {
+  let out = "";
+  let i = 0;
+  let inString = false;
+  let stringQuote = "";
+  let escape = false;
+
+  while (i < json.length) {
+    const c = json[i];
+
+    if (inString) {
+      out += c;
+      if (escape) escape = false;
+      else if (c === "\\") escape = true;
+      else if (c === stringQuote) inString = false;
+      i++;
+      continue;
+    }
+
+    if (c === '"' || c === "'") {
+      inString = true;
+      stringQuote = c;
+      out += c;
+      i++;
+      continue;
+    }
+
+    if (c === ",") {
+      let j = i + 1;
+      while (j < json.length && /\s/.test(json[j])) j++;
+      if (json[j] === "}" || json[j] === "]") {
+        i++;
+        continue;
+      }
+    }
+
+    out += c;
+    i++;
+  }
+
+  return out;
+}
+
+/**
+ * @param {string} text
+ * @returns {unknown}
+ */
+export function parseJsonc(text) {
+  return JSON.parse(stripJsonc(text));
+}

package/src/keychain.mjs

@@ -0,0 +1,136 @@
+import { execFileSync, execSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+
+const SERVICE_NAMES = ["Cursor Safe Storage", "cursor Safe Storage"];
+export const OPENAI_KEY_ROW = "secret://cursorAuth/openAIKey";
+
+function sh(s) {
+  return `'${String(s).replace(/'/g, `'\\''`)}'`;
+}
+
+let cachedPassword = null;
+
+/**
+ * Reads Cursor's own safeStorage password from the macOS Keychain.
+ * May trigger a one-time Keychain permission dialog.
+ */
+export function getSafeStoragePassword() {
+  if (cachedPassword) return cachedPassword;
+  for (const svc of SERVICE_NAMES) {
+    try {
+      const out = execSync(`security find-generic-password -s ${sh(svc)} -w`, {
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "ignore"],
+      });
+      const pw = out.trim();
+      if (pw) {
+        cachedPassword = pw;
+        return pw;
+      }
+    } catch {
+      /* try next service name */
+    }
+  }
+  throw new Error(
+    "Could not read 'Cursor Safe Storage' from Keychain (permission denied?)",
+  );
+}
+
+/** Chromium OSCrypt (macOS): PBKDF2-SHA1, salt 'saltysalt', 1003 iters, 16-byte key */
+function deriveKey(password) {
+  return crypto.pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
+}
+
+const IV = Buffer.alloc(16, 0x20); // 16 space bytes
+
+export function oscryptEncrypt(plaintext, password) {
+  const key = deriveKey(password);
+  const cipher = crypto.createCipheriv("aes-128-cbc", key, IV);
+  const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return Buffer.concat([Buffer.from("v10"), ct]);
+}
+
+/**
+ * @param {number[]|string} data byte array (Cursor's format) or base64 string
+ */
+export function oscryptDecrypt(data, password) {
+  const raw = Array.isArray(data)
+    ? Buffer.from(data)
+    : Buffer.from(data, "base64");
+  if (raw.subarray(0, 3).toString() !== "v10") {
+    throw new Error("Not a v10 OSCrypt blob");
+  }
+  const key = deriveKey(password);
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, IV);
+  return Buffer.concat([
+    decipher.update(raw.subarray(3)),
+    decipher.final(),
+  ]).toString("utf8");
+}
+
+/**
+ * Verify we can decrypt an existing Cursor secret. Returns only metadata,
+ * never the plaintext.
+ */
+export function verifyDecryption(stateDbPath) {
+  if (!fs.existsSync(stateDbPath)) return { ok: false, reason: "no state db" };
+  const row = execFileSync(
+    "sqlite3",
+    [
+      stateDbPath,
+      `SELECT value FROM ItemTable WHERE key = '${OPENAI_KEY_ROW}' LIMIT 1;`,
+    ],
+    { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] },
+  ).trim();
+  if (!row) return { ok: false, reason: "no key row" };
+  try {
+    const parsed = JSON.parse(row);
+    const password = getSafeStoragePassword();
+    const plain = oscryptDecrypt(parsed.data, password);
+    return {
+      ok: true,
+      length: plain.length,
+      looksLikeApiKey: plain.startsWith("sk-"),
+    };
+  } catch (e) {
+    return { ok: false, reason: e.message };
+  }
+}
+
+/**
+ * Write an API key into a profile's encrypted store, using Cursor's own
+ * encryption. The profile's Cursor window must be closed.
+ */
+export function setProfileApiKey(stateDbPath, apiKey) {
+  if (!fs.existsSync(stateDbPath)) {
+    throw new Error(`Profile state db missing: ${stateDbPath}`);
+  }
+  if (!apiKey || !apiKey.startsWith("sk-")) {
+    throw new Error("API key should start with 'sk-'");
+  }
+  const password = getSafeStoragePassword();
+  const buf = oscryptEncrypt(apiKey, password);
+  // Cursor stores secrets as Buffer JSON: {"type":"Buffer","data":[bytes...]}
+  const value = JSON.stringify({
+    type: "Buffer",
+    data: Array.from(buf),
+  }).replace(/'/g, "''");
+  // execFileSync: no shell, so JSON double quotes survive intact
+  execFileSync(
+    "sqlite3",
+    [
+      stateDbPath,
+      `INSERT OR REPLACE INTO ItemTable (key, value) VALUES ('${OPENAI_KEY_ROW}', '${value}');`,
+    ],
+    { stdio: "ignore" },
+  );
+  // round-trip verification
+  const check = verifyDecryption(stateDbPath);
+  if (!check.ok) {
+    throw new Error(
+      `Wrote key but round-trip verification failed: ${check.reason}`,
+    );
+  }
+  return check;
+}