diff --git a/src/web-server/routes/cursor-routes.ts b/src/web-server/routes/cursor-routes.ts
index 5309c581..defcc96e 100644
--- a/src/web-server/routes/cursor-routes.ts
+++ b/src/web-server/routes/cursor-routes.ts
@@ -31,6 +31,21 @@ interface DaemonStartPreconditionError {
   error: string;
 }
 
+export function getAutoDetectFailureStatus(
+  reason?: ReturnType<typeof autoDetectTokens>['reason']
+): number {
+  switch (reason) {
+    case 'sqlite_unavailable':
+      return 503;
+    case 'db_query_failed':
+      return 500;
+    case 'invalid_token_format':
+      return 400;
+    default:
+      return 404;
+  }
+}
+
 function getPublicAutoDetectError(result: ReturnType<typeof autoDetectTokens>): string {
   switch (result.reason) {
     case 'db_not_found':
@@ -138,12 +153,7 @@ router.post('/auth/auto-detect', async (_req: Request, res: Response): Promise<v
     const result = autoDetectTokens();
 
     if (!result.found || !result.accessToken || !result.machineId) {
-      const status =
-        result.reason === 'sqlite_unavailable'
-          ? 503
-          : result.reason === 'db_query_failed'
-            ? 500
-            : 404;
+      const status = getAutoDetectFailureStatus(result.reason);
       res.status(status).json({
         error: getPublicAutoDetectError(result),
         reason: result.reason ?? null,
diff --git a/tests/unit/web-server/cursor-routes.test.ts b/tests/unit/web-server/cursor-routes.test.ts
index 4334d750..5934ed9c 100644
--- a/tests/unit/web-server/cursor-routes.test.ts
+++ b/tests/unit/web-server/cursor-routes.test.ts
@@ -55,6 +55,15 @@ let getTokenStoragePath: () => string;
 let getDaemonStartPreconditionError: (
   input: { enabled: boolean; authenticated: boolean; tokenExpired?: boolean }
 ) => { status: number; error: string } | null;
+let getAutoDetectFailureStatus: (
+  reason?:
+    | 'db_not_found'
+    | 'sqlite_unavailable'
+    | 'db_query_failed'
+    | 'access_token_not_found'
+    | 'machine_id_not_found'
+    | 'invalid_token_format'
+) => number;
 
 function seedCursorConfig(overrides: {
   enabled?: boolean;
@@ -107,6 +116,7 @@ beforeAll(async () => {
 
   const cursorRoutesModule = await import('../../../src/web-server/routes/cursor-routes');
   getDaemonStartPreconditionError = cursorRoutesModule.getDaemonStartPreconditionError;
+  getAutoDetectFailureStatus = cursorRoutesModule.getAutoDetectFailureStatus;
 
   const app = express();
   app.use(express.json());
@@ -207,6 +217,10 @@ describe('Cursor Routes Logic', () => {
   });
 
   describe('HTTP contracts', () => {
+    it('maps invalid_token_format auto-detect failures to HTTP 400', () => {
+      expect(getAutoDetectFailureStatus('invalid_token_format')).toBe(400);
+    });
+
     it('GET /api/cursor/status returns current state', async () => {
       const res = await fetch(`${baseUrl}/api/cursor/status`);
       expect(res.status).toBe(200);
@@ -396,6 +410,11 @@ describe('Cursor Routes Logic', () => {
         return;
       }
 
+      const sqliteCheck = spawnSync('sqlite3', ['--version'], { stdio: 'ignore' });
+      if (sqliteCheck.status !== 0) {
+        return;
+      }
+
       const originalHome = process.env.HOME;
       const fakeHome = path.join(tempDir, 'query-failed-home');
       process.env.HOME = fakeHome;