[t0g3pii]

Summary

Cursor state.vscdb
  cursorAuth/accessToken
    plaintext JWT  --> cookie as-is
    cursor-safe-storage:v1:<b64>
      Windows: Local State os_crypt key (DPAPI) -> AES-256-GCM
      macOS:   Keychain "Cursor Safe Storage" -> PBKDF2 -> AES-128-CBC
      --> JWT --> WorkosCursorSessionToken=<authId>::<token>
                 GET /api/usage-summary

Recent Cursor builds seal cursorAuth/accessToken as cursor-safe-storage:v1:… (Chromium/Electron OSCrypt). Codenotch still posted that ciphertext as the session cookie, so /api/usage-summary returned 401/403 and the notch showed "Sign in to Cursor to see usage." even though the editor was signed in.

This opens the sealed envelope before building the cookie:

• Windows: %APPDATA%\Cursor\Local State → DPAPI-unprotect os_crypt.encrypted_key → AES-256-GCM (v10)
• macOS: Keychain Cursor Safe Storage → PBKDF2-HMAC-SHA1 → AES-128-CBC (v10)
• Plaintext tokens from older builds still pass through unchanged

Fixes / relates to #493.

Evidence

• Before: sealed cursor-safe-storage:v1: blob used as cookie → needsAuth / "Sign in to Cursor to see usage."
  After: live decrypt on a signed-in Windows machine → JWT; GET https://cursor.com/api/usage-summary → HTTP 200 with membership + totalPercentUsed. Unit tests for plaintext pass-through, unknown version refusal, Windows v10 round-trip, Local State key parse, and live store decrypt: 5/5 passed.

Merge Danger

Door: two-way

Read-only credential path only; no writes to Cursor's store. Can be reverted by dropping the decrypt step (behavior returns to posting the sealed blob / needsAuth).

Blast Radius: Cursor provider

Only the Cursor session borrow path changes. Other providers untouched. First Keychain/DPAPI access may prompt once on some machines.