$ show kingparks/cursor-vip
cursor-vip is a client-side Go/TUI application that lets users share Cursor IDE Pro accounts. At runtime it presents a terminal wizard: it fingerprints the machine (MAC-based device ID + machine-id), contacts a private licensing backend (hardcoded hosts: cursor.jeter.eu.org), prints the user's promotion stats, expiry, and payment links, then starts one of several "modes" that make the locally installed Cursor app authenticate as a shared Pro user. Mode 1 is the minimalist mode; modes 2-4 run a local MITM proxy (go-mitmproxy fork) that requires the user to install a trusted root certificate and intercepts Cursor's API traffic, with mode 3 doing free-trial account rotation and mode 4 providing a dedicated "exclusive" account. The core Cursor-manipulation code lives in an `auth/` package absent from this snapshot - go.mod shows it vendors local forks of `machineid` and `go-mitmproxy` - so the visible code is only the client shell, payment flow, and OS plumbing. Architecturally it is a monolith split into packages: `tui` (terminal UI with embedded i18n locale files for 7 languages), `tui/client` (HTTP client using beego v1's httplib against the private API), `tui/shortcut` (a global keyboard hook recognizing typed 3-letter codes like `sm1`/`u3d`/`buy` to switch modes, refresh accounts, or buy access), and `tui/tool` (OS utilities: locale detection, system-proxy configuration for Windows/macOS/Linux, flock-based single-instance enforcement, and MAC fingerprinting). The build script targets 3 OSes x 3 architectures and obfuscates most binaries with `garble`, consistent with a grey-market licensing tool that expects to be reverse-engineered. The project is actively maintained (last commit March 2026) and clearly works for its user base, but the code is average quality: global mutable state in a `params` package, string-concatenated endpoint paths, no tests or CI, an unconditional `mode = 3` override bug in `GetConfig`, and deprecated dependencies (beego v1, dgrijalva/jwt-go v3.x). It also has a questionable security posture - it instructs Mac users to disable SIP, asks for a trusted root CA for the MITM proxy, and requires Windows admin privileges. Engineers should not reuse this codebase as-is for legitimate licensing work; the genuinely extractable parts are the cross-platform OS utilities (locale detection, proxy toggling, single-instance lock, device fingerprinting).
The LLM identified 4 files worth highlighting for reuse:
The GetLocale() function detects the OS language on Windows (PowerShell Get-Culture), macOS (osascript with a .GlobalPreferences.plist fallback), and Linux (LANG/LC_CTYPE env vars). It is self-contained and can be lifted into any Go CLI that needs to default its UI language without relying on framework glue.
EnsureSingleInstance() uses a flock-based lock file with a PID file, detects stale instances, kills the stale process, and re-acquires the lock. It is a portable, self-contained pattern useful for any daemon or CLI that must not run concurrently.
Together with setProxy_mac.go and setProxy_linux.go, this is a clean build-tag-separated system-proxy setter: Windows writes ProxyServer/ProxyEnable registry keys, macOS shells out to networksetup, Linux prints manual setup instructions. A reusable template for any desktop tool needing per-OS proxy toggling.
GetDeviceID() computes an MD5 device ID from physical MAC addresses, filtering out known VMware/Hyper-V/VirtualBox MAC prefixes and falling back to machine-id if no physical adapter is found. A reusable fingerprinting utility for licensing or anti-fraud contexts.