Merge pull request #6 from digitaldrreamer/claude/fix-cursor-oom

fix(cursor): stop OOM on large databases (v0.1.1)

Author: digitaldrreamer

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.1] — 2026-07-02
+
+### Fixed
+- **Cursor adapter out-of-memory crash.** Discovery selected `key, value` across
+  Cursor's entire `ItemTable` / `cursorDiskKV`, loading every blob (embeddings,
+  file caches — often gigabytes) into memory at once and crashing with "heap out
+  of memory" on large databases. Discovery now selects only keys; each row's
+  value is fetched lazily when it's actually scanned.
+
 ## [0.1.0] — 2026-07-02
 
 First public release.
@@ -36,4 +45,5 @@ First public release.
 - Extended-thinking blocks are passed through the proxy unredacted to preserve
   their signatures — see the README Limitations section.
 
+[0.1.1]: https://github.com/digitaldrreamer/broomsticks/releases/tag/v0.1.1
 [0.1.0]: https://github.com/digitaldrreamer/broomsticks/releases/tag/v0.1.0

package.json

@@ -1,6 +1,6 @@
 {
   "name": "broomsticks",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Sweep leaked secrets out of your AI coding-assistant chat transcripts (Claude Code, Codex, Cursor). Dry-run by default, backups before every write, zero runtime dependencies.",
   "type": "module",
   "bin": {

src/sources/cursor.mjs

@@ -60,21 +60,28 @@ function* walkVscdb(dir) {
 }
 
 /**
- * Open a SQLite database read-only and return all AI-related rows from the
- * known tables. Returns [] if the DB is unreadable or has no matching tables.
+ * Open a SQLite database read-only and return the AI-related (table, key) pairs
+ * from the known tables. Returns [] if the DB is unreadable or has no matching
+ * tables.
+ *
+ * Only the `key` column is selected here — never `value`. Cursor's tables can
+ * hold gigabytes of blobs (embeddings, file caches), so `SELECT key, value …`
+ * across a whole table loads every blob into memory at once and OOMs the
+ * process. Each row's value is fetched lazily, one at a time, in the Target's
+ * `read()`, so discovery only needs the (small) keys.
  *
  * @param {string} dbPath
- * @returns {Array<{table:string, key:string, value:string}>}
+ * @returns {Array<{table:string, key:string}>}
  */
-function readAiRows(dbPath) {
+function readAiKeys(dbPath) {
   let db
   try {
     db = new DatabaseSync(dbPath, { open: true, readOnly: true })
   } catch {
     return []
   }
 
-  const rows = []
+  const keys = []
 
   // Check which tables actually exist before querying
   let existingTables
@@ -92,14 +99,11 @@ function readAiRows(dbPath) {
   for (const table of TABLES) {
     if (!existingTables.has(table)) continue
     try {
-      const all = db.prepare(`SELECT key, value FROM [${table}]`).all()
-      for (const row of all) {
+      // key-only projection, streamed via iterate() so we never materialise the
+      // full key array either (values are never loaded in bulk — see above)
+      for (const row of db.prepare(`SELECT key FROM [${table}]`).iterate()) {
         if (typeof row.key === 'string' && AI_KEY_RE.test(row.key)) {
-          // value may be stored as Buffer (BLOB) or string — normalise to string
-          const value = Buffer.isBuffer(row.value)
-            ? row.value.toString('utf8')
-            : String(row.value ?? '')
-          rows.push({ table, key: row.key, value })
+          keys.push({ table, key: row.key })
         }
       }
     } catch {
@@ -108,7 +112,7 @@ function readAiRows(dbPath) {
   }
 
   db.close()
-  return rows
+  return keys
 }
 
 /**
@@ -123,9 +127,7 @@ export function discoverTargets() {
   const targets  = []
 
   for (const dbPath of walkVscdb(userRoot)) {
-    const rows = readAiRows(dbPath)
-
-    for (const { table, key, value } of rows) {
+    for (const { table, key } of readAiKeys(dbPath)) {
       // Capture loop vars in closure-safe consts
       const db   = dbPath
       const tbl  = table

test/cursor.test.mjs

@@ -62,3 +62,41 @@ test('cursor target read → redact → write persists the redaction', (t) => {
     rmSync(home, { recursive: true, force: true })
   }
 })
+
+// Regression guard for the OOM: discovery must not bulk-load row values. A big
+// non-AI blob (Cursor stores embeddings/caches this way) sitting next to a small
+// AI row must be ignored by discovery — previously `SELECT key, value FROM …`
+// pulled every blob into memory at once and crashed on large databases.
+test('cursor discovery ignores large non-AI blobs and reads values lazily', (t) => {
+  const home = mkdtempSync(join(tmpdir(), 'broom-cursor-oom-'))
+  const prevHome = process.env.HOME
+  process.env.HOME = home
+
+  try {
+    const root = cursorUserRoot()
+    if (!root.startsWith(home)) return t.skip('os.homedir() does not honor $HOME here')
+
+    const storage = join(root, 'globalStorage')
+    mkdirSync(storage, { recursive: true })
+    const dbPath = join(storage, 'state.vscdb')
+
+    const bigBlob = 'x'.repeat(8 * 1024 * 1024) // 8 MB non-AI value
+
+    const db = new DatabaseSync(dbPath)
+    db.exec('CREATE TABLE ItemTable (key TEXT PRIMARY KEY, value BLOB)')
+    const ins = db.prepare('INSERT INTO ItemTable (key, value) VALUES (?, ?)')
+    ins.run('workbench.embeddings.cache', bigBlob)      // non-AI: must be skipped
+    ins.run('history.entries', bigBlob)                 // non-AI: must be skipped
+    ins.run('composer.chat', `msg ${SECRET} msg`)       // AI: must be discovered
+    db.close()
+
+    const targets = discoverTargets()
+    assert.equal(targets.length, 1, 'only the AI row is discovered, not the blobs')
+    assert.equal(targets[0].label.endsWith(':composer.chat'), true)
+    assert.ok(targets[0].read().includes(SECRET), 'value is fetched lazily on read')
+  } finally {
+    if (prevHome === undefined) delete process.env.HOME
+    else process.env.HOME = prevHome
+    rmSync(home, { recursive: true, force: true })
+  }
+})