Bypassing Token Limits

Relevant source files

The following files were used as context for generating this wiki page:

• bypass_token_limit.py
• reset_machine_manual.py
• totally_reset_cursor.py
• locales/en.json
• check_user_authorized.py
• oauth_auth.py

The "Bypass Token Limit" feature is a module designed to modify the core files of the Cursor application to remove or significantly increase the token usage limits imposed on users. It achieves this by directly patching a specific JavaScript file, workbench.desktop.main.js, which is responsible for handling these limitations within the application's front end. This modification is presented to the user as a menu option within the main tool.

This functionality is integrated into several scripts within the repository, including bypass_token_limit.py, reset_machine_manual.py, and totally_reset_cursor.py, indicating it can be run as a standalone feature or as part of a broader reset process.

Sources: bypass_token_limit.py, locales/en.json:284-288, reset_machine_manual.py, totally_reset_cursor.py

Core Logic and File Modification

The central mechanism of this feature is the modify_workbench_js function. This function reads the workbench.desktop.main.js file, performs a series of string replacements on its content, and overwrites the original file with the modified version. A backup of the original file is created with a timestamp before modification.

Sources: bypass_token_limit.py:112-177, reset_machine_manual.py:228-293

Key Modifications

The primary goal is to alter the function responsible for token limits. The script replaces the original token limit logic with a hardcoded high value. Several other cosmetic changes are also applied to alter the user interface.

The following diagram illustrates the modification process.

Sources: bypass_token_limit.py:112-177, reset_machine_manual.py:228-293

The table below details the specific string replacements performed.

Original String (Pattern)	Replacement String	Purpose
async getEffectiveTokenLimit(e){const n=e.modelName;if(!n)return 2e5;	async getEffectiveTokenLimit(e){return 9000000;const n=e.modelName;if(!n)return 9e5;	Bypasses the token limit by hardcoding a return value of 9,000,000.
B(k,D(Ln,{title:"Upgrade to Pro",...	B(k,D(Ln,{title:"yeongpin GitHub",...	Replaces the "Upgrade to Pro" button with a link to the project's GitHub repository.
M(x,I(as,{title:"Upgrade to Pro",...	M(x,I(as,{title:"yeongpin GitHub",...	An alternative pattern for replacing the "Upgrade to Pro" button, likely for different OS or versions.
$(k,E(Ks,{title:"Upgrade to Pro",...	$(k,E(Ks,{title:"yeongpin GitHub",...	Another alternative pattern for replacing the "Upgrade to Pro" button.
<div>Pro Trial	<div>Pro	Changes the "Pro Trial" badge to "Pro".
py-1">Auto-select	py-1">Bypass-Version-Pin	Changes the text for the model selector.
var DWr=ne("<div class=settings__item_description>...	var DWr=ne("<div class=settings__item_description>... <h1>Pro</h1>");	Adds a "Pro" heading to the account settings description.
notifications-toasts	notifications-toasts hidden	Hides toast notifications, which may include usage warnings.

Sources: bypass_token_limit.py:127-148, reset_machine_manual.py:244-265

The core logic for the token limit bypass is this specific replacement:

# bypass_token_limit.py:143-144
r'async getEffectiveTokenLimit(e){const n=e.modelName;if(!n)return 2e5;':
r'async getEffectiveTokenLimit(e){return 9000000;const n=e.modelName;if(!n)return 9e5;',

This code snippet shows the exact pattern matching that replaces the original token limit check with a hardcoded high value.
Sources: bypass_token_limit.py:143-144

Execution Flow

The bypass_token_limit.py script serves as the primary entry point for this specific feature. When executed, it follows a simple, linear flow.

Sources: bypass_token_limit.py:180-191

The main execution logic is contained within the run function:

# bypass_token_limit.py:180-191
def run(translator=None):
    config = get_config(translator)
    if not config:
        return False
    print(f"\n{Fore.CYAN}{'='*50}{Style.RESET_ALL}")
    print(f"{Fore.CYAN}{EMOJI['RESET']} {translator.get('bypass_token_limit.title')}{Style.RESET_ALL}")
    print(f"{Fore.CYAN}{'='*50}{Style.RESET_ALL}")

    modify_workbench_js(get_workbench_cursor_path(translator), translator)

    print(f"\n{Fore.CYAN}{'='*50}{Style.RESET_ALL}")
    input(f"{EMOJI['INFO']} {translator.get('bypass_token_limit.press_enter')}...")

Sources: bypass_token_limit.py:180-191

Path Discovery

To modify the correct file, the script must first locate workbench.desktop.main.js within the Cursor application's resources. The get_workbench_cursor_path function is responsible for this discovery process. It uses a combination of configuration files and default search paths tailored to different operating systems.

Sources: bypass_token_limit.py:44-110, reset_machine_manual.py:140-206

The function checks the following locations:

Operating System	Default Search Paths
Windows	Reads cursor_path from config.ini and appends out\\vs\\workbench\\workbench.desktop.main.js.
macOS	/Applications/Cursor.app/Contents/Resources/app/out/vs/workbench/workbench.desktop.main.js
Linux	- /opt/Cursor/resources/app/out/vs/workbench/workbench.desktop.main.js - /usr/share/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js - /usr/lib/cursor/app/out/vs/workbench/workbench.desktop.main.js - ~/squashfs-root/usr/share/cursor/resources/app/... (for AppImage)

Sources: bypass_token_limit.py:51-63, reset_machine_manual.py:147-159

The path discovery logic is visualized below.

Sources: bypass_token_limit.py:44-110

Related Authorization Context

While the bypass feature directly manipulates a client-side file, understanding how tokens are used for authorization provides context. The check_user_authorized.py script demonstrates how an authorization token is used to make API calls to Cursor's backend. It constructs a request to the aiserver.v1.DashboardService/GetUsageBasedPremiumRequests endpoint, including a custom x-cursor-checksum header, to validate the token. A 200 status code indicates an authorized user, while 401 or 403 indicates an unauthorized one.

This shows that while the token limit can be bypassed on the client, the token itself is still used for server-side validation of other features.

Sources: check_user_authorized.py:65-101

Summary

The "Bypass Token Limit" feature is a client-side patch that modifies the Cursor application's JavaScript source code. By replacing the function that checks token usage with one that returns a static, high number, it effectively removes the token limit from the user's perspective. This is accomplished by the modify_workbench_js function, which is invoked by bypass_token_limit.py and other reset scripts. The system is robust in its ability to locate the target file across different operating systems and installation types.

Sources: bypass_token_limit.py, reset_machine_manual.py, totally_reset_cursor.py