tokentracker-cli 1.5.7 → 1.5.9

package/src/commands/sync.js

@@ -2221,8 +2221,8 @@ async function cmdSync(argv, context = {}) {
     const cursorInstalled = cursorSyncDeps.isInstalled || isCursorInstalled;
     const cursorAuthExtractor = cursorSyncDeps.extractAuth || extractCursorSessionToken;
     const cursorUsageFetcher = cursorSyncDeps.fetchUsageCsv || fetchCursorUsageCsv;
-    if (sourceAllowed("cursor") && cursorInstalled({ home })) {
-      const cursorAuth = cursorAuthExtractor({ home });
+    if (sourceAllowed("cursor") && cursorInstalled({ home, trackerDir })) {
+      const cursorAuth = cursorAuthExtractor({ home, trackerDir });
       if (cursorAuth) {
         try {
           if (progress?.enabled) {

package/src/lib/cursor-config.js

@@ -3,8 +3,8 @@ const path = require("node:path");
 const fs = require("node:fs");
 
 const { readJson } = require("./fs");
+const { readCursorConnection, normalizeCursorSubject } = require("./cursor-login");
 const { readSqliteFirstValue } = require("./sqlite-reader");
-const { decodeCursorAccessToken } = require("./cursor-safe-storage");
 
 // ── Path resolution ──
 
@@ -33,7 +33,8 @@ function resolveCursorPaths({ home, platform = process.platform, env = process.e
   };
 }
 
-function isCursorInstalled({ home, platform, env } = {}) {
+function isCursorInstalled({ home, platform, env, trackerDir } = {}) {
+  if (readCursorConnection({ home, trackerDir }).status !== "disconnected") return true;
   const { appDir } = resolveCursorPaths({ home, platform, env });
   try {
     return fs.statSync(appDir).isDirectory();
@@ -55,11 +56,7 @@ function cursorDebugLog(message, env = process.env) {
 }
 
 function readCursorAccessTokenFromStateDb(stateDbPath, deps = {}) {
-  return readCursorStateValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, deps);
-}
-
-function readCursorStateValue(stateDbPath, sql, deps = {}) {
-  return readSqliteFirstValue(stateDbPath, sql, "value", {
+  return readSqliteFirstValue(stateDbPath, CURSOR_ACCESS_TOKEN_SQL, "value", {
     execFileSync: deps.execFileSync,
     requireFn: deps.requireFn,
     env: deps.env,
@@ -70,60 +67,46 @@ function readCursorStateValue(stateDbPath, sql, deps = {}) {
   });
 }
 
-// Identity lookup does not access the OS secret store or decrypt the token.
-function readCursorUserIdFromStateDb(stateDbPath, deps = {}) {
-  const profile = readCursorStateValue(stateDbPath,
-    "SELECT value FROM ItemTable WHERE key = 'cursorAuth/cachedScopedProfile';", deps);
-  try {
-    const userId = normalizeCursorSubject(JSON.parse(profile)?.authId);
-    if (userId) return userId;
-  } catch {
-    // A missing or malformed cache must not prevent the membership fallback.
-  }
-  const membership = readCursorStateValue(stateDbPath,
-    "SELECT value FROM ItemTable WHERE key = 'cursorAuth/stripeMembershipAuthId';", deps);
-  return normalizeCursorSubject(membership);
-}
-
 /**
- * Extract Cursor session cookie from local SQLite + cli-config.json.
+ * Prefer TokenTracker's browser connection, then Cursor's plaintext local login.
  * Returns { cookie, userId } or null on failure.
  *
  * Cookie format: WorkosCursorSessionToken=<userId>%3A%3A<jwt>
- * - JWT (plaintext or safeStorage) from state.vscdb → cursorAuth/accessToken
- * - userId from cli-config.json → authInfo.authId, state.vscdb, or JWT subject
+ * - JWT from state.vscdb → ItemTable → cursorAuth/accessToken
+ * - userId from cli-config.json → authInfo.authId
  *   - native Cursor email/password: "auth0|user_XXXXX"        → "user_XXXXX"
  *   - Google sign-in via WorkOS:    "google-oauth2|<numeric>" → kept verbatim
  *   - other WorkOS subjects:        "github|…", "oidc|…"      → kept verbatim
  */
-function extractCursorSessionToken({ home, platform, env, deps } = {}) {
-  const auth = extractCursorAuth({ home, platform, env, deps });
+function extractCursorSessionToken({ home, platform, env, deps, trackerDir } = {}) {
+  const auth = extractCursorAuth({ home, platform, env, deps, trackerDir });
   if (!auth) return null;
   return { cookie: auth.cookie, userId: auth.userId };
 }
 
 /**
  * Extract the Cursor web session and API bearer token from Cursor's own local
- * login state. The raw access token is needed for Cursor's first-party Connect
+ * login state or an explicit TokenTracker browser connection. The raw access token is needed for Cursor's first-party Connect
  * RPCs, while callers that only need the web cookie should continue using
  * extractCursorSessionToken so the token is not propagated unnecessarily.
  */
-function extractCursorAuth({ home, platform, env, deps } = {}) {
-  const { appDir, stateDbPath, cliConfigPath } = resolveCursorPaths({ home, platform, env });
+function extractCursorAuth({ home, platform, env, deps, trackerDir } = {}) {
+  const connection = readCursorConnection({ home, trackerDir });
+  if (connection.status !== "disconnected") return connection.auth || null;
+  const { stateDbPath, cliConfigPath } = resolveCursorPaths({ home, platform, env });
 
   // 1. Extract JWT from SQLite
   if (!fs.existsSync(stateDbPath)) {
     cursorDebugLog(`Cursor state DB not found at ${stateDbPath}`, deps?.env);
     return null;
   }
-  const jwt = decodeCursorAccessToken(readCursorAccessTokenFromStateDb(stateDbPath, deps), {
-    platform, appDir, deps,
-  });
-  if (!jwt) return null;
+  const jwt = readCursorAccessTokenFromStateDb(stateDbPath, deps);
+  // Encrypted Cursor Safe Storage values must not be treated as JWTs and must
+  // never trigger OS keychain decryption (see #1029 revert / #1043).
+  if (!jwt || jwt.length < 10 || jwt.startsWith('cursor-safe-storage:')) return null;
 
-  // 2. New Cursor versions keep identity in SQLite instead of cli-config.json.
-  let userId = extractUserIdFromCliConfig(cliConfigPath)
-    || readCursorUserIdFromStateDb(stateDbPath, deps);
+  // 2. Extract userId — try cli-config.json first, fall back to JWT decode
+  let userId = extractUserIdFromCliConfig(cliConfigPath);
   if (!userId) {
     userId = extractUserIdFromJwt(jwt);
   }
@@ -134,21 +117,6 @@ function extractCursorAuth({ home, platform, env, deps } = {}) {
   return { cookie, userId, accessToken: jwt };
 }
 
-// WorkOS OAuth subject prefixes Cursor accepts as-is in the session cookie.
-// Verified against cursor.com/api/usage-summary (issue #88).
-const WORKOS_OAUTH_SUBJECT_RE = /^(google-oauth2|github|oidc|auth0)\|[^|]+$/;
-
-function normalizeCursorSubject(subject) {
-  if (typeof subject !== "string" || !subject || /[\s;\x00-\x1f\x7f]/.test(subject)) return null;
-  if (/^user_[A-Za-z0-9_]+$/.test(subject)) return subject;
-  // Native Cursor: "auth0|user_XXXXX" → strip provider prefix, return "user_XXXXX"
-  const native = subject.match(/\|(user_[A-Za-z0-9_]+)$/);
-  if (native) return native[1];
-  // WorkOS-bridged OAuth: keep the full "<provider>|<id>" subject
-  if (WORKOS_OAUTH_SUBJECT_RE.test(subject)) return subject;
-  return null;
-}
-
 function extractUserIdFromCliConfig(configPath) {
   try {
     const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
@@ -217,7 +185,7 @@ function resolveCursorRedirect(location, baseUrl) {
  * Fetch full usage CSV from Cursor API.
  * Returns raw CSV string or throws on error.
  */
-function fetchCursorUsageCsv({ cookie, timeoutMs = 30000, fetchImpl = fetch }) {
+function fetchCursorUsageCsv({ cookie, timeoutMs = 90000, fetchImpl = fetch }) {
   return fetchImpl(CURSOR_CSV_URL, {
     method: "GET",
     headers: {
@@ -631,7 +599,6 @@ module.exports = {
   resolveCursorPaths,
   isCursorInstalled,
   readCursorAccessTokenFromStateDb,
-  readCursorUserIdFromStateDb,
   extractCursorAuth,
   extractCursorSessionToken,
   fetchCursorUsageCsv,

package/src/lib/cursor-login.js

@@ -0,0 +1,157 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+
+function cursorSessionPath({ home = os.homedir(), trackerDir } = {}) {
+  return path.join(trackerDir || path.join(home, ".tokentracker", "tracker"), "cursor-session.json");
+}
+
+function normalizeCursorSubject(subject) {
+  if (typeof subject !== "string") return null;
+  const native = subject.match(/\|(user_[A-Za-z0-9_]+)$/);
+  if (native) return native[1];
+  return /^(google-oauth2|github|oidc|auth0)\|[^|\s;]+$/.test(subject) ? subject : null;
+}
+
+function cursorAuthFromToken(accessToken, nowMs = Date.now()) {
+  if (typeof accessToken !== "string" || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(accessToken)) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(accessToken.split(".")[1], "base64url").toString());
+    const userId = normalizeCursorSubject(payload.sub);
+    if (!userId || !Number.isFinite(payload.exp) || payload.exp * 1000 <= nowMs + 60_000) return null;
+    return {
+      accessToken,
+      userId,
+      cookie: `WorkosCursorSessionToken=${userId}%3A%3A${accessToken}`,
+      expiresAt: new Date(payload.exp * 1000).toISOString(),
+      source: "browser",
+    };
+  } catch {
+    return null;
+  }
+}
+
+function readCursorConnection(options = {}) {
+  let raw;
+  try {
+    raw = fs.readFileSync(cursorSessionPath(options), "utf8");
+  } catch (error) {
+    return { status: error.code === "ENOENT" ? "disconnected" : "expired" };
+  }
+  try {
+    const auth = cursorAuthFromToken(JSON.parse(raw).accessToken);
+    return auth ? { status: "connected", auth } : { status: "expired" };
+  } catch {
+    return { status: "expired" };
+  }
+}
+
+// Only TokenTracker's explicitly authorized access token is stored. The short
+// synchronous commit keeps a cancelled/replaced login from writing afterwards.
+function writeCursorSession(options, accessToken) {
+  const target = cursorSessionPath(options);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  const temp = `${target}.${crypto.randomUUID()}.tmp`;
+  try {
+    fs.writeFileSync(temp, JSON.stringify({ accessToken }) + "\n", { mode: 0o600, flag: "wx" });
+    fs.renameSync(temp, target);
+  } finally {
+    try { fs.unlinkSync(temp); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+}
+
+function createCursorLogin({ trackerDir, home, fetchImpl = fetch, now = Date.now, validateSession } = {}) {
+  const options = { trackerDir, home };
+  let pending = null;
+
+  function start() {
+    const attemptId = crypto.randomUUID();
+    const verifier = crypto.randomBytes(32).toString("base64url");
+    const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
+    const url = new URL("https://cursor.com/loginDeepControl");
+    for (const [key, value] of Object.entries({ challenge, uuid: attemptId, mode: "login", redirectTarget: "cli", supportsSelectedTeamLogin: "true" })) {
+      url.searchParams.set(key, value);
+    }
+    pending = { attemptId, verifier, expiresAt: now() + LOGIN_TIMEOUT_MS, promise: null };
+    return { status: "pending", attemptId, authUrl: url.toString(), expiresAt: pending.expiresAt };
+  }
+
+  async function finishPoll(attempt) {
+    const expired = () => pending !== attempt || now() >= attempt.expiresAt;
+    try {
+      const url = new URL("https://api2.cursor.sh/auth/poll");
+      url.searchParams.set("uuid", attempt.attemptId);
+      url.searchParams.set("verifier", attempt.verifier);
+      const response = await fetchImpl(url.toString(), {
+        redirect: "error",
+        signal: AbortSignal.timeout(15_000),
+        headers: { Accept: "application/json" },
+      });
+      if (expired()) return { status: "expired" };
+      if (response.status === 404) return { status: "pending" };
+      if (!response.ok) {
+        if (response.status >= 500 || response.status === 429) return { status: "pending" };
+        pending = null;
+        return { status: "failed" };
+      }
+      const body = await response.json();
+      if (expired()) return { status: "expired" };
+      const auth = cursorAuthFromToken(body?.accessToken, now());
+      if (!auth) {
+        pending = null;
+        return { status: "failed" };
+      }
+      // A decoded JWT alone is not proof of a usable Cursor session.
+      try {
+        if (validateSession) await validateSession(auth);
+        else await require("./cursor-config").fetchCursorUsageSummary({ cookie: auth.cookie, fetchImpl });
+      } catch {
+        if (pending === attempt) pending = null;
+        return { status: "failed" };
+      }
+      if (expired()) return { status: "expired" };
+      try { writeCursorSession(options, auth.accessToken); } catch {
+        pending = null;
+        return { status: "failed" };
+      }
+      pending = null;
+      return { status: "connected", expiresAt: auth.expiresAt };
+    } catch {
+      return { status: expired() ? "expired" : "pending" };
+    }
+  }
+
+  function poll(attemptId) {
+    if (!pending || pending.attemptId !== attemptId || now() >= pending.expiresAt) {
+      return Promise.resolve({ status: "expired" });
+    }
+    const attempt = pending;
+    if (!attempt.promise) {
+      attempt.promise = finishPoll(attempt).finally(() => { attempt.promise = null; });
+    }
+    return attempt.promise;
+  }
+
+  function cancel(attemptId) {
+    if (pending?.attemptId === attemptId) pending = null;
+    return { status: "cancelled" };
+  }
+
+  function disconnect() {
+    pending = null;
+    try { fs.unlinkSync(cursorSessionPath(options)); } catch (error) { if (error.code !== "ENOENT") throw error; }
+    return { status: "disconnected" };
+  }
+
+  function status() {
+    const connection = readCursorConnection(options);
+    return { status: connection.status, ...(connection.auth ? { expiresAt: connection.auth.expiresAt } : {}) };
+  }
+
+  return { start, poll, cancel, disconnect, status };
+}
+
+module.exports = { createCursorLogin, cursorSessionPath, readCursorConnection, normalizeCursorSubject };

package/src/lib/local-api.js

@@ -1166,6 +1166,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
   let relayCookies = new Map();
   const localAuthToken = crypto.randomBytes(24).toString("hex");
   const trackerDataDir = isolatedTrackerDataDir || path.dirname(qp);
+  const cursorLogin = require("./cursor-login").createCursorLogin({ trackerDir: trackerDataDir });
   const cookiePath = path.join(trackerDataDir, "relay-cookies.json");
   const localSyncDeviceTokenStore = createCloudDeviceTokenStore(path.join(trackerDataDir, "cloud-device-token.json"));
   const localSyncDeviceTokenCache = new Map();
@@ -3279,6 +3280,48 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
       return true;
     }
 
+    // Explicit Cursor browser authorization. Never return the verifier or session token.
+    if (p === "/functions/tokentracker-cursor-connection") {
+      if (!isAuthorizedLocalMutation(req)) {
+        json(res, { error: "Unauthorized" }, 401);
+        return true;
+      }
+      res.setHeader("Cache-Control", "no-store");
+      const method = String(req.method || "GET").toUpperCase();
+      if (method === "GET") {
+        json(res, cursorLogin.status());
+        return true;
+      }
+      if (method !== "POST") {
+        json(res, { error: "Method Not Allowed" }, 405);
+        return true;
+      }
+      let body;
+      try { body = await readJsonBody(req); } catch {
+        json(res, { error: "Invalid JSON body" }, 400);
+        return true;
+      }
+      try {
+        let result;
+        switch (body?.action) {
+          case "start": result = cursorLogin.start(); break;
+          case "poll": result = await cursorLogin.poll(body.attemptId); break;
+          case "cancel": result = cursorLogin.cancel(body.attemptId); break;
+          case "disconnect": result = cursorLogin.disconnect(); break;
+          default:
+            json(res, { error: "Unknown Cursor connection action" }, 400);
+            return true;
+        }
+        if (result.status === "connected" || result.status === "disconnected") {
+          require("./usage-limits").resetUsageLimitsCache({ invalidateInFlight: true });
+        }
+        json(res, result);
+      } catch {
+        json(res, { error: "Could not update the Cursor connection" }, 500);
+      }
+      return true;
+    }
+
     // --- provider API keys saved from the Limits panel ---
     // The key lives in a 0600 file next to the queue, never in the launch
     // environment: a global `launchctl setenv` reaches every launchd app on