[paulocarinhena]

Summary

• Cursor 3.x stores the editor access token sealed (cursor-safe-storage:v1:). The widget treated that ciphertext as a JWT and reported unrecognized Cursor token.
• On Windows the sealed token is unlocked locally with the editor's own DPAPI key. A plaintext JWT still follows the original path, with no extra process and no CLI file.
• The Cursor CLI / cursor-agent session is used only when the editor database is missing, or when the sealed token cannot be read and the CLI login is the same account. A different login cannot replace the editor card.
• Version 1.0.2.

Test plan

• npm run typecheck
• npm run probe -- cursor on a Windows machine with a sealed editor token returns the Pro billing cycle
• Confirm a plaintext Cursor JWT (older install, or macOS/Linux) still loads with one request and no Keychain prompt
• Confirm a signed-out editor database still shows "not signed in" and does not pick up another account's auth.json
• macOS CI build passes