How authentication works (no login)

The cursor.com dashboard authenticates via a cookie built from Cursor's own local session:

WorkosCursorSessionToken=<userSub>::<accessToken>

This extension reads that token read-only from Cursor's global SQLite store (the same DB Cursor uses), only the four cursorAuth/* keys — never the whole file, never read-write, never VACUUM. It prefers Node's built-in node:sqlite (available in Cursor / Node ≥ 22.5) and falls back to the sqlite3 CLI (-readonly -json) if needed:

The cookie/JWT is held in memory only — never logged, never persisted. Cursor rotates the token; on HTTP 401/403 the extension re-reads the keys once and retries once, then shows a Reconnect hint.

If both readers fail, the panel says so explicitly (missing state.vscdb, missing sqlite3 CLI, invalid token, or 401/403) instead of a generic "Not connected". Details go to the Cursor Usage output channel without the JWT.

The sqlite3 CLI is only needed as a fallback on runtimes without node:sqlite (preinstalled on macOS; apt install sqlite3 / winget install SQLite.SQLite on Windows).

Settings

Refreshes on activation, then polls on the interval (hard-throttled to at most 1 network fetch per 60s). Use Cursor Usage: Refresh for a manual refresh.

Build & package

npm install
npm run build       # bundle with esbuild → dist/extension.js
npm run package     # produces cursor-usage.vsix

Install the .vsix: Command Palette → Extensions: Install from VSIX…

Commands

• Cursor Usage: Show — reveal the detail panel.
• Cursor Usage: Refresh — force a refresh (respects the 60s throttle).
• Cursor Usage: Open Dashboard — open the Cursor usage or spending dashboard in the browser.
• Cursor Usage: Check for Updates — check GitHub for a newer release now.

Updates

The extension checks the GitHub Releases API once a day (in the background) and notifies you when a newer version is available, with Update Now / Release Notes / Skip This Version actions.

Update Now installs the new version in place — it downloads the release .vsix to a temp file, hands it to VS Code's installer, cleans up, and then offers to reload the window. No manual download or drag-and-drop. Disable the check via cursorUsage.checkForUpdates, or run Cursor Usage: Check for Updates anytime.

The installed version is shown at the bottom of the panel and in the status-bar tooltip.

Caveats

These are undocumented internal cursor.com endpoints and can change without notice. This is for personal, read-only use. The extension never writes to state.vscdb and never logs or stores your session token.

License

MIT