cursor-keys 1.3.0 → 1.3.1

package/README.md

@@ -103,7 +103,7 @@ One window, one profile, one key. Each project gets an isolated `--user-data-dir
 
 Settings flow one way, main to profiles: `sync` re-copies your main `settings.json` into every profile and re-applies that profile's title bar color on top. `open` does this automatically before every launch, and open windows hot-reload the file, so tweaks in your main Cursor show up everywhere. Changes made inside a profile window are overwritten on the next sync.
 
-`clone` copies your main Cursor state (SQLite backup) so profiles open signed-in with your theme and model config, then scrubs donor secrets (`secret://` rows, MCP OAuth tokens, extension secrets) out of the copy. The sign-in session itself is the one thing that does carry over, see [Security](#security). `set-key` encrypts your project key with Cursor's own safeStorage (Chromium OSCrypt, key from the "Cursor Safe Storage" macOS Keychain item) and writes it into the profile's secret store, round-trip verified. When macOS asks for Keychain permission, click **Allow**: one run, one prompt. Always Allow also works, but it permanently grants the calling binary access to that Keychain item, which is the same pattern infostealers abuse against browser safe storage.
+`clone` copies your main Cursor state (SQLite backup) so profiles open signed-in with your theme and model config, then scrubs donor secrets (`secret://` rows, MCP OAuth tokens, extension secrets) out of the copy and prunes the AI chat/agent history tables (`cursorDiskKV`, `composerHeaders`). That keeps clones at a few megabytes instead of a full copy of a donor database that can be gigabytes, and stops one project's conversation history from leaking into another project's profile. The sign-in session itself is the one thing that does carry over, see [Security](#security). Already have bulky profiles? `cursor-keys prune [name]` applies the same cleanup to existing ones. `set-key` encrypts your project key with Cursor's own safeStorage (Chromium OSCrypt, key from the "Cursor Safe Storage" macOS Keychain item) and writes it into the profile's secret store, round-trip verified. When macOS asks for Keychain permission, click **Allow**: one run, one prompt. Always Allow also works, but it permanently grants the calling binary access to that Keychain item, which is the same pattern infostealers abuse against browser safe storage.
 
 ## "Which key am I on?" in three layers
 
@@ -118,6 +118,7 @@ Settings flow one way, main to profiles: `sync` re-copies your main `settings.js
 | `init [--root DIR] [--all]`                    | Discover git repos and register them                            |
 | `add <name> [--path] [--color] [--clone main]` | Create a project profile                                        |
 | `clone <name> [--from main]`                   | Copy sign-in + settings + model config from a donor profile     |
+| `prune [name]`                                 | Delete AI chat history from profile DBs, reclaim disk space     |
 | `set-key <name>`                               | Inject the project API key (hidden prompt or stdin, encrypted)  |
 | `color <name> [#hex]`                          | Show or set the project title bar color                         |
 | `open [name]`                                  | Launch Cursor with the profile (auto-detect from cwd)           |
@@ -163,7 +164,7 @@ Full threat model in [SECURITY.md](SECURITY.md). The short version:
 
 - Keys go **straight into Cursor's own encrypted store** (`secret://cursorAuth/openAIKey`), encrypted with the same safeStorage mechanism Cursor uses. Never in config files, logs, or stdout. `set-key` takes the key from a hidden prompt or stdin, so it never appears in shell history or a process list.
 - `set-key` reads the "Cursor Safe Storage" Keychain item to encrypt, the same key Cursor itself uses. Nothing leaves your machine. Click **Allow** at the prompt; Always Allow permanently ACLs the calling binary to that item.
-- `clone` copies `state.vscdb` locally via SQLite backup, then **scrubs donor secrets from the copy**: all `secret://` rows (the donor's API key, extension secrets) and MCP OAuth tokens are deleted. MCP servers re-auth once per profile.
+- `clone` copies `state.vscdb` locally via SQLite backup, then **scrubs donor secrets from the copy**: all `secret://` rows (the donor's API key, extension secrets) and MCP OAuth tokens are deleted. MCP servers re-auth once per profile. The **AI history tables are pruned** too, so no chat or agent session data crosses between project profiles (and clones stay megabytes, not gigabytes).
 - What clone deliberately keeps is your Cursor **sign-in session** (so profiles open signed-in). That means N profiles hold N+1 copies of the session tokens, stored exactly as Cursor stores them. Delete profiles you no longer use: `cursor-keys rm <name> --delete`.
 - Supply chain: zero runtime dependencies, **no install scripts**, and releases are published from GitHub Actions with [npm provenance](https://docs.npmjs.com/generating-provenance-statements) over OIDC trusted publishing (no long-lived npm token).
 

package/bin/cursor-keys.mjs

@@ -24,6 +24,9 @@ function printHelp() {
   console.log(
     "  clone <name> [--from main]  Copy sign-in + settings from a donor profile",
   );
+  console.log(
+    "  prune [name]                Delete AI chat history, reclaim profile disk space",
+  );
   console.log(
     "  set-key <name>              Inject the project API key (encrypted)",
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursor-keys",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Per-project Cursor profiles so each window uses the correct BYOK API key. Zero dependencies.",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -49,6 +49,7 @@ import {
   needsFirstRunChecklist,
   printFirstRunChecklist,
   profileIntegrityChecks,
+  pruneStateDbHistory,
   writeProfileSettings,
 } from "./profile.mjs";
 import { setProfileApiKey } from "./keychain.mjs";
@@ -94,6 +95,8 @@ export async function runCommand(argv) {
       return cmdColor(rest);
     case "clone":
       return cmdClone(rest);
+    case "prune":
+      return cmdPrune(rest);
     case "rm":
       return cmdRm(rest);
     case "ls":
@@ -849,16 +852,71 @@ async function cmdClone(args) {
   }
 
   const scrubbed = cloneStateDb(donorRoot, project.profileDir);
+  const dbBytes = fs.statSync(profileStateDb(project.profileDir)).size;
   console.log(ok(`Cloned state from ${from} into ${name}`));
   console.log(
     `${dim}Scrubbed ${scrubbed} donor secret row(s) from the copy (API keys, MCP OAuth, extension secrets); sign-in retained.${reset}`,
   );
   console.log(
-    `${dim}Settings and model config carried over. Now set the project key:${reset}`,
+    `${dim}AI chat/agent history pruned, state DB is ${formatBytes(dbBytes)}. Settings and model config carried over. Now set the project key:${reset}`,
   );
   console.log(`  cursor-keys set-key ${name}`);
 }
 
+function formatBytes(n) {
+  if (n >= 1 << 30) return `${(n / (1 << 30)).toFixed(1)} GB`;
+  if (n >= 1 << 20) return `${(n / (1 << 20)).toFixed(1)} MB`;
+  return `${Math.max(1, Math.round(n / 1024))} KB`;
+}
+
+async function cmdPrune(args) {
+  const { flags, positional } = parseFlags(args);
+  if (flags.help) {
+    console.log("Usage: cursor-keys prune [name]");
+    console.log(
+      "Deletes AI chat/agent history from profile state DBs and reclaims the",
+    );
+    console.log("space. Sign-in, settings and model config are untouched.");
+    console.log("No name: prune every registered project.");
+    return;
+  }
+  const config = loadConfig();
+  const names = positional[0]
+    ? [positional[0]]
+    : Object.keys(config.projects).sort();
+  if (!names.length) {
+    console.log("No projects registered. Run: cursor-keys init");
+    return;
+  }
+  const running = listRunningCursorProfiles();
+  for (const name of names) {
+    const project = getProject(config, name);
+    if (!project) throw new Error(`Unknown project: ${name}`);
+    if (running.has(path.resolve(project.profileDir))) {
+      console.log(
+        warn(`skip ${name}: profile window is running, close it first`),
+      );
+      continue;
+    }
+    const db = profileStateDb(project.profileDir);
+    if (!fs.existsSync(db)) {
+      console.log(
+        warn(`skip ${name}: no state.vscdb (open Cursor once in this profile)`),
+      );
+      continue;
+    }
+    const { beforeBytes, afterBytes } = pruneStateDbHistory(db);
+    console.log(
+      ok(
+        `Pruned ${name}: ${formatBytes(beforeBytes)} -> ${formatBytes(afterBytes)} (freed ${formatBytes(beforeBytes - afterBytes)})`,
+      ),
+    );
+  }
+  console.log(
+    `${dim}Only AI chat/agent history was removed; sign-in, settings and model config are untouched.${reset}`,
+  );
+}
+
 async function cmdInstallExtension() {
   const repoRoot = path.resolve(
     path.dirname(fileURLToPath(import.meta.url)),

package/src/profile.mjs

@@ -88,6 +88,15 @@ export function symlinkSharedUserFiles(profileDir) {
  */
 export const CLONE_SCRUB_LIKE_PATTERNS = ["secret://%", "mcpOAuth.%"];
 
+/**
+ * Tables wiped from every cloned state DB. Cursor keeps AI agent/chat session
+ * data here (agentKv:blob:* blobs), which dominates DB size (gigabytes on a
+ * well-used donor) and would otherwise carry one project's conversation
+ * history into every other project profile. Everything clone exists for
+ * (sign-in, settings, model config) lives in ItemTable and stays.
+ */
+export const CLONE_PRUNE_TABLES = ["cursorDiskKV", "composerHeaders"];
+
 /**
  * @param {string} donorProfileDir - main Cursor or another profile root (parent of User)
  * @param {string} targetProfileDir
@@ -136,7 +145,38 @@ export function cloneStateDb(donorProfileDir, targetProfileDir) {
     stdio: "ignore",
   });
 
-  return scrubClonedSecrets(dest);
+  const scrubbed = scrubClonedSecrets(dest);
+  pruneStateDbHistory(dest);
+  return scrubbed;
+}
+
+/**
+ * Delete AI chat/agent history tables from a state DB and reclaim the space
+ * with VACUUM. Sign-in, settings, model config and extension state live in
+ * ItemTable and are untouched. Missing tables are skipped, so this is safe
+ * on any Cursor/VS Code state DB.
+ * @param {string} stateDbPath
+ * @returns {{ beforeBytes: number, afterBytes: number }}
+ */
+export function pruneStateDbHistory(stateDbPath) {
+  const beforeBytes = fs.statSync(stateDbPath).size;
+  const tables = execFileSync(
+    "sqlite3",
+    [stateDbPath, "SELECT name FROM sqlite_master WHERE type='table';"],
+    { encoding: "utf8" },
+  )
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const present = CLONE_PRUNE_TABLES.filter((t) => tables.includes(t));
+  if (present.length) {
+    const stmts = present.map((t) => `DELETE FROM "${t}";`).join(" ");
+    execFileSync("sqlite3", [stateDbPath, `${stmts} VACUUM;`], {
+      stdio: "ignore",
+    });
+  }
+  const afterBytes = fs.statSync(stateDbPath).size;
+  return { beforeBytes, afterBytes };
 }
 
 /**