fix(cursor): address code review feedback on auth module

- Sanitize SQL key parameter in queryStateDb to prevent injection
- Fix UUID regex: use exact {32} length, remove redundant hyphen from
  stripped character class
- Remove unused types from types.ts (YAGNI): CursorDaemonStatus,
  CursorModel, MessageRole, CursorMessage, CursorToolCall,
  CursorToolResult, ProtobufExtractResult — belong in their respective
  module PRs

src/cursor/cursor-auth.ts

@@ -52,9 +52,11 @@ export function getTokenStoragePath(): string {
  */
 function queryStateDb(dbPath: string, key: string): string | null {
   try {
+    // Escape single quotes to prevent SQL injection
+    const sanitizedKey = key.replace(/'/g, "''");
     const result = execFileSync(
       'sqlite3',
-      [dbPath, `SELECT value FROM itemTable WHERE key='${key}'`],
+      [dbPath, `SELECT value FROM itemTable WHERE key='${sanitizedKey}'`],
       { encoding: 'utf8', timeout: 5000, stdio: ['pipe', 'pipe', 'ignore'] }
     ).trim();
     return result || null;
@@ -130,9 +132,9 @@ export function validateToken(accessToken: string, machineId: string): boolean {
     return false;
   }
 
-  // Machine ID format validation (should be UUID-like)
+  // Machine ID format validation (UUID without hyphens = exactly 32 hex chars)
-  const uuidRegex = /^[a-f0-9-]{32,}$/i;
+  const hexRegex = /^[a-f0-9]{32}$/i;
-  if (!uuidRegex.test(machineId.replace(/-/g, ''))) {
+  if (!hexRegex.test(machineId.replace(/-/g, ''))) {
     return false;
   }
 

src/cursor/types.ts

@@ -1,7 +1,7 @@
 /**
  * Cursor IDE Type Definitions
  *
- * TypeScript interfaces for the Cursor module.
+ * TypeScript interfaces for the Cursor auth module.
  */
 
 /**
@@ -36,98 +36,6 @@ export interface CursorAuthStatus {
   expired?: boolean;
 }
 
-/**
- * Cursor daemon/process status
- */
-export interface CursorDaemonStatus {
-  /** Whether daemon is running */
-  running: boolean;
-  /** Port number daemon is listening on */
-  port: number;
-  /** Process ID (if available) */
-  pid?: number;
-}
-
-/**
- * Cursor AI model
- */
-export interface CursorModel {
-  /** Model ID */
-  id: string;
-  /** Display name */
-  name: string;
-  /** Provider (e.g., 'openai', 'anthropic') */
-  provider: string;
-  /** Whether this is the default model */
-  isDefault?: boolean;
-}
-
-/**
- * Message role
- */
-export type MessageRole = 'user' | 'assistant';
-
-/**
- * Cursor message for protobuf
- */
-export interface CursorMessage {
-  /** Message role */
-  role: MessageRole;
-  /** Message content */
-  content: string;
-  /** Tool calls (if any) */
-  tool_calls?: CursorToolCall[];
-  /** Tool results (if any) */
-  tool_results?: CursorToolResult[];
-}
-
-/**
- * Cursor tool call
- */
-export interface CursorToolCall {
-  /** Unique ID for this tool call */
-  id: string;
-  /** Type of tool call */
-  type: 'function';
-  /** Function details */
-  function: {
-    /** Function name */
-    name: string;
-    /** JSON-encoded arguments */
-    arguments: string;
-  };
-  /** Whether this is the last tool call in sequence */
-  isLast?: boolean;
-}
-
-/**
- * Cursor tool result
- */
-export interface CursorToolResult {
-  /** ID of the tool call this result is for */
-  tool_call_id: string;
-  /** Tool name */
-  name: string;
-  /** Result index */
-  index: number;
-  /** Raw arguments */
-  raw_args: string;
-}
-
-/**
- * Result from protobuf extraction
- */
-export interface ProtobufExtractResult {
-  /** Extracted text content */
-  text: string | null;
-  /** Error message (if extraction failed) */
-  error: string | null;
-  /** Extracted tool call (if any) */
-  toolCall: CursorToolCall | null;
-  /** Thinking/reasoning content (if any) */
-  thinking: string | null;
-}
-
 /**
  * Auto-detection result
  */