cursor-keys 1.0.0 → 1.1.0

package/bin/cursor-keys.mjs

@@ -17,6 +17,12 @@ function printHelp() {
     "  init [--root DIR] [--all]   Scan for git repos and register projects",
   );
   console.log("  add <name> [options]        Create profile for a project");
+  console.log(
+    "  clone <name> [--from main]  Copy sign-in + settings from a donor profile",
+  );
+  console.log(
+    "  set-key <name>              Inject the project API key (encrypted)",
+  );
   console.log(
     "  open [name]                 Open Cursor with this project's profile",
   );

package/extension/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 L-ubu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursor-keys",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Per-project Cursor profiles so each window uses the correct BYOK API key. Zero dependencies.",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -13,6 +13,7 @@ import {
   getProject,
   loadConfig,
   pickColorForName,
+  pickUnusedColor,
   saveConfig,
   profileStateDb,
 } from "./config.mjs";
@@ -32,8 +33,10 @@ import {
   findCursorCli,
   listRunningCursorProfiles,
   mainCursorProfileRoot,
+  mainCursorUserDir,
   stateDbHasKey,
   stateDbValueContains,
+  stateDbValuesMatch,
   hasSqlite3,
 } from "./detect.mjs";
 import {
@@ -296,6 +299,13 @@ async function cmdInit(args) {
   );
 }
 
+function shouldShowFirstRunChecklist(profileDir) {
+  if (!needsFirstRunChecklist(profileDir)) return false;
+  const db = profileStateDb(profileDir);
+  // A cloned profile already carries a key row: setup is effectively done.
+  return !(fs.existsSync(db) && stateDbHasKey(db, SECRET_OPENAI_KEY));
+}
+
 async function cmdAdd(args) {
   const { flags, positional } = parseFlags(args);
   if (flags.help) {
@@ -319,8 +329,13 @@ async function cmdAdd(args) {
     throw new Error(`Repo path does not exist: ${repoPath}`);
   }
 
+  const usedColors = Object.entries(config.projects)
+    .filter(([other]) => other !== name)
+    .map(([, entry]) => entry.color);
   const color =
-    flags.color || config.projects[name]?.color || pickColorForName(name);
+    flags.color ||
+    config.projects[name]?.color ||
+    pickUnusedColor(name, usedColors);
   config.projects[name] = { path: collapseHome(repoPath), color };
   saveConfig(config);
 
@@ -348,7 +363,7 @@ async function cmdAdd(args) {
   console.log(ok(`Profile ready: ${collapseHome(project.profileDir)}`));
   console.log(`  Repo:  ${collapseHome(project.path)}`);
   console.log(`  Color: ${color} ${blockSwatch(color)}`);
-  if (needsFirstRunChecklist(project.profileDir)) {
+  if (shouldShowFirstRunChecklist(project.profileDir)) {
     printFirstRunChecklist(name, config.baseUrl);
   }
 }
@@ -405,7 +420,7 @@ async function cmdOpen(args) {
   console.log(`  ${dim}${collapseHome(project.path)}${reset}`);
   console.log(`  Profile ${blockSwatch(project.color)} ${project.color}`);
 
-  if (needsFirstRunChecklist(project.profileDir)) {
+  if (shouldShowFirstRunChecklist(project.profileDir)) {
     printFirstRunChecklist(name, config.baseUrl);
     markSetupDone(project.profileDir);
   }
@@ -499,9 +514,22 @@ async function cmdDoctor(args) {
     }
     const db = profileStateDb(p.profileDir);
     if (fs.existsSync(db)) {
+      const hasKey = stateDbHasKey(db, SECRET_OPENAI_KEY);
       console.log(
-        `  ${stateDbHasKey(db, SECRET_OPENAI_KEY) ? ok("✓") : warn("✗")} OpenAI/Bonzai API key row present`,
+        `  ${hasKey ? ok("✓") : warn("✗")} OpenAI/Bonzai API key row present`,
       );
+      if (hasKey) {
+        const mainDb = path.join(
+          mainCursorUserDir(),
+          "globalStorage",
+          "state.vscdb",
+        );
+        if (stateDbValuesMatch(db, mainDb, SECRET_OPENAI_KEY)) {
+          console.log(
+            `  ${warn("!")} Key is identical to the main profile (inherited via clone); run: cursor-keys set-key ${name}`,
+          );
+        }
+      }
       console.log(
         `  ${stateDbHasKey(db, SUBAGENT_OVERRIDES_KEY) ? ok("✓") : warn("✗")} Explore subagent overrides present`,
       );
@@ -747,7 +775,19 @@ async function cmdSetKey(args) {
     throw new Error(`Close the "${name}" Cursor window first, then retry.`);
   }
 
-  const key = flags.key || (await promptHidden(`API key for ${name}: `));
+  let key = flags.key;
+  if (!key) {
+    console.log(
+      `\nPaste the API key for ${bold}${name}${reset} below, then press Enter.`,
+    );
+    console.log(
+      `${dim}Input is hidden: nothing echoes while you paste or type.${reset}`,
+    );
+    key = await promptHidden("API key: ");
+  }
+  if (!key) {
+    throw new Error("No key entered. Aborted, nothing was written.");
+  }
   const result = setProfileApiKey(db, key);
   console.log(
     ok(`Key set for ${name}`) +

package/src/config.mjs

@@ -98,25 +98,34 @@ export function baseUrlFragment(config) {
   return String(config.baseUrl || "").replace(/^https?:\/\//, "");
 }
 
+const COLOR_PALETTE = [
+  "#4f8cff",
+  "#ff6b6b",
+  "#51cf66",
+  "#ffd43b",
+  "#845ef7",
+  "#20c997",
+  "#ff922b",
+  "#e64980",
+  "#339af0",
+  "#94d82d",
+];
+
 /** Deterministic palette color from project name */
 export function pickColorForName(name) {
-  const palette = [
-    "#4f8cff",
-    "#ff6b6b",
-    "#51cf66",
-    "#ffd43b",
-    "#845ef7",
-    "#20c997",
-    "#ff922b",
-    "#e64980",
-    "#339af0",
-    "#94d82d",
-  ];
   let hash = 0;
   for (let i = 0; i < name.length; i++) {
     hash = (hash * 31 + name.charCodeAt(i)) >>> 0;
   }
-  return palette[hash % palette.length];
+  return COLOR_PALETTE[hash % COLOR_PALETTE.length];
+}
+
+/** Like pickColorForName, but avoids colors already used by other projects */
+export function pickUnusedColor(name, usedColors) {
+  const used = new Set(usedColors);
+  const preferred = pickColorForName(name);
+  if (!used.has(preferred)) return preferred;
+  return COLOR_PALETTE.find((c) => !used.has(c)) || preferred;
 }
 
 /**

package/src/detect.mjs

@@ -183,6 +183,28 @@ export function stateDbValueContains(stateDbPath, urlFragment) {
   }
 }
 
+/**
+ * True if the value for `key` is byte-identical in both state DBs.
+ * Comparison happens inside SQL; the value never enters this process.
+ * @param {string} dbA
+ * @param {string} dbB
+ * @param {string} key
+ */
+export function stateDbValuesMatch(dbA, dbB, key) {
+  if (!fs.existsSync(dbA) || !fs.existsSync(dbB) || !hasSqlite3()) {
+    return false;
+  }
+  try {
+    const out = execSync(
+      `sqlite3 ${shellQuote(dbA)} "ATTACH DATABASE ${shellQuote(dbB)} AS other; SELECT CASE WHEN (SELECT value FROM ItemTable WHERE key = ${shellQuote(key)}) IS NOT NULL AND (SELECT value FROM ItemTable WHERE key = ${shellQuote(key)}) = (SELECT value FROM other.ItemTable WHERE key = ${shellQuote(key)}) THEN 1 ELSE 0 END;"`,
+      { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"] },
+    );
+    return out.trim() === "1";
+  } catch {
+    return false;
+  }
+}
+
 function shellQuote(s) {
   return `'${String(s).replace(/'/g, `'\\''`)}'`;
 }

package/src/profile.mjs

@@ -116,7 +116,14 @@ export function cloneStateDb(donorProfileDir, targetProfileDir) {
   ensureProfileStructure(targetProfileDir);
   fs.mkdirSync(path.dirname(dest), { recursive: true });
 
-  execSync(`sqlite3 ${shellQuote(src)} ".backup ${shellQuote(dest)}"`, {
+  // VACUUM INTO requires a fresh destination.
+  for (const suffix of ["", "-wal", "-shm", "-journal"]) {
+    fs.rmSync(dest + suffix, { force: true });
+  }
+
+  // VACUUM INTO snapshots a consistent copy even while the donor Cursor is
+  // running; `.backup` can spin at full CPU against a write-heavy donor.
+  execSync(`sqlite3 ${shellQuote(src)} "VACUUM INTO ${shellQuote(dest)}"`, {
     stdio: "ignore",
   });
 }