tokentracker-cli 1.5.7 → 1.5.8

package/src/lib/cursor-config.js

@@ -4,7 +4,6 @@ const fs = require("node:fs");
 
 const { readJson } = require("./fs");
 const { readSqliteFirstValue } = require("./sqlite-reader");
-const { decodeCursorAccessToken } = require("./cursor-safe-storage");
 
 // ── Path resolution ──
 
@@ -55,11 +54,7 @@ function cursorDebugLog(message, env = process.env) {
 }
 
 function readCursorAccessTokenFromStateDb(stateDbPath, deps = {}) {
-  return readCursorStateValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, deps);
-}
-
-function readCursorStateValue(stateDbPath, sql, deps = {}) {
-  return readSqliteFirstValue(stateDbPath, sql, "value", {
+  return readSqliteFirstValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, "value", {
     execFileSync: deps.execFileSync,
     requireFn: deps.requireFn,
     env: deps.env,
@@ -70,28 +65,13 @@ function readCursorStateValue(stateDbPath, sql, deps = {}) {
   });
 }
 
-// Identity lookup does not access the OS secret store or decrypt the token.
-function readCursorUserIdFromStateDb(stateDbPath, deps = {}) {
-  const profile = readCursorStateValue(stateDbPath,
-    "SELECT value FROM ItemTable WHERE key = 'cursorAuth/cachedScopedProfile';", deps);
-  try {
-    const userId = normalizeCursorSubject(JSON.parse(profile)?.authId);
-    if (userId) return userId;
-  } catch {
-    // A missing or malformed cache must not prevent the membership fallback.
-  }
-  const membership = readCursorStateValue(stateDbPath,
-    "SELECT value FROM ItemTable WHERE key = 'cursorAuth/stripeMembershipAuthId';", deps);
-  return normalizeCursorSubject(membership);
-}
-
 /**
  * Extract Cursor session cookie from local SQLite + cli-config.json.
  * Returns { cookie, userId } or null on failure.
  *
  * Cookie format: WorkosCursorSessionToken=<userId>%3A%3A<jwt>
- * - JWT (plaintext or safeStorage) from state.vscdb → cursorAuth/accessToken
- * - userId from cli-config.json → authInfo.authId, state.vscdb, or JWT subject
+ * - JWT from state.vscdb → ItemTable → cursorAuth/accessToken
+ * - userId from cli-config.json → authInfo.authId
  *   - native Cursor email/password: "auth0|user_XXXXX"        → "user_XXXXX"
  *   - Google sign-in via WorkOS:    "google-oauth2|<numeric>" → kept verbatim
  *   - other WorkOS subjects:        "github|…", "oidc|…"      → kept verbatim
@@ -109,21 +89,20 @@ function extractCursorSessionToken({ home, platform, env, deps } = {}) {
  * extractCursorSessionToken so the token is not propagated unnecessarily.
  */
 function extractCursorAuth({ home, platform, env, deps } = {}) {
-  const { appDir, stateDbPath, cliConfigPath } = resolveCursorPaths({ home, platform, env });
+  const { stateDbPath, cliConfigPath } = resolveCursorPaths({ home, platform, env });
 
   // 1. Extract JWT from SQLite
   if (!fs.existsSync(stateDbPath)) {
     cursorDebugLog(`Cursor state DB not found at ${stateDbPath}`, deps?.env);
     return null;
   }
-  const jwt = decodeCursorAccessToken(readCursorAccessTokenFromStateDb(stateDbPath, deps), {
-    platform, appDir, deps,
-  });
-  if (!jwt) return null;
+  const jwt = readCursorAccessTokenFromStateDb(stateDbPath, deps);
+  // Encrypted Cursor Safe Storage values must not be treated as JWTs and must
+  // never trigger OS keychain decryption (see #1029 revert / #1043).
+  if (!jwt || jwt.length < 10 || jwt.startsWith('cursor-safe-storage:')) return null;
 
-  // 2. New Cursor versions keep identity in SQLite instead of cli-config.json.
-  let userId = extractUserIdFromCliConfig(cliConfigPath)
-    || readCursorUserIdFromStateDb(stateDbPath, deps);
+  // 2. Extract userId — try cli-config.json first, fall back to JWT decode
+  let userId = extractUserIdFromCliConfig(cliConfigPath);
   if (!userId) {
     userId = extractUserIdFromJwt(jwt);
   }
@@ -139,8 +118,7 @@ function extractCursorAuth({ home, platform, env, deps } = {}) {
 const WORKOS_OAUTH_SUBJECT_RE = /^(google-oauth2|github|oidc|auth0)\|[^|]+$/;
 
 function normalizeCursorSubject(subject) {
-  if (typeof subject !== "string" || !subject || /[\s;\x00-\x1f\x7f]/.test(subject)) return null;
-  if (/^user_[A-Za-z0-9_]+$/.test(subject)) return subject;
+  if (!subject) return null;
   // Native Cursor: "auth0|user_XXXXX" → strip provider prefix, return "user_XXXXX"
   const native = subject.match(/\|(user_[A-Za-z0-9_]+)$/);
   if (native) return native[1];
@@ -631,7 +609,6 @@ module.exports = {
   resolveCursorPaths,
   isCursorInstalled,
   readCursorAccessTokenFromStateDb,
-  readCursorUserIdFromStateDb,
   extractCursorAuth,
   extractCursorSessionToken,
   fetchCursorUsageCsv,