@securityreviewai/securityreview-kit 0.1.27 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/securityreview-kit",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Bootstrap security-review-mcp for AI IDEs and CLI tools",
   "author": "Debarshi Das <debarshi.das@we45.com>",
   "license": "UNLICENSED",

package/src/utils/cursor-agent-path.js

@@ -0,0 +1,47 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { delimiter, join } from 'node:path';
+
+/**
+ * Extra PATH segments where Cursor / other CLIs are often installed.
+ * GUI-launched terminals load shell rc files; Node subprocesses often do not.
+ */
+export function augmentPathEnv(baseEnv = process.env) {
+    const home = homedir();
+    const extra = [
+        join(home, '.local', 'bin'),
+        join(home, '.cursor', 'bin'),
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+    ];
+    if (process.platform === 'win32') {
+        extra.push(join(home, 'AppData', 'Local', 'Programs', 'cursor'));
+    }
+    const pathKey = process.platform === 'win32' ? 'Path' : 'PATH';
+    const current = baseEnv[pathKey] || baseEnv.PATH || '';
+    const merged = [...extra.filter((p) => p), current].filter(Boolean).join(delimiter);
+    return { ...baseEnv, [pathKey]: merged, PATH: merged };
+}
+
+/**
+ * Executable that responds to `cursor-agent --version`, or null.
+ */
+export function resolveCursorAgentExecutable() {
+    const env = augmentPathEnv();
+    const candidates = [
+        'cursor-agent',
+        join(homedir(), '.local', 'bin', 'cursor-agent'),
+        join(homedir(), '.cursor', 'bin', 'cursor-agent'),
+    ];
+    for (const cmd of candidates) {
+        if (cmd !== 'cursor-agent' && !existsSync(cmd)) {
+            continue;
+        }
+        const r = spawnSync(cmd, ['--version'], { stdio: 'ignore', env });
+        if (r.status === 0) {
+            return cmd;
+        }
+    }
+    return null;
+}

package/src/utils/ide-cli-install.js

@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process';
+import { augmentPathEnv, resolveCursorAgentExecutable } from './cursor-agent-path.js';
 
 const AGENT_CLI_TARGETS = new Set(['cursor', 'claude', 'codex']);
 
-function commandOk(cmd, args = ['--version']) {
-    const r = spawnSync(cmd, args, { stdio: 'ignore' });
+function commandOk(cmd, args = ['--version'], env = process.env) {
+    const r = spawnSync(cmd, args, { stdio: 'ignore', env });
     return r.status === 0;
 }
 
@@ -23,11 +24,16 @@ export function ensureIdeCliForTarget(target, options = {}) {
     }
 
     if (target === 'cursor') {
-        if (commandOk('cursor-agent', ['--version'])) {
+        if (resolveCursorAgentExecutable()) {
             return { target, ok: true, already: true };
         }
         if (skipInstall) {
-            return { target, ok: false, message: 'cursor-agent not found on PATH' };
+            return {
+                target,
+                ok: false,
+                message:
+                    'cursor-agent not found (install from https://cursor.com/cli; Node may need ~/.local/bin — kit augments PATH when running the profiler)',
+            };
         }
         if (process.platform === 'win32') {
             return {
@@ -37,13 +43,22 @@ export function ensureIdeCliForTarget(target, options = {}) {
             };
         }
         const r = runShell('curl -fsSL https://cursor.com/install | bash');
-        return r.status === 0
-            ? { target, ok: true }
-            : { target, ok: false, message: 'Cursor CLI install script failed' };
+        if (r.status !== 0) {
+            return { target, ok: false, message: 'Cursor CLI install script failed' };
+        }
+        if (!resolveCursorAgentExecutable()) {
+            return {
+                target,
+                ok: false,
+                message:
+                    'cursor-agent not found after install; open a new shell or ensure ~/.local/bin exists and re-run init',
+            };
+        }
+        return { target, ok: true };
     }
 
     if (target === 'claude') {
-        if (commandOk('claude', ['--version'])) {
+        if (commandOk('claude', ['--version'], augmentPathEnv())) {
             return { target, ok: true, already: true };
         }
         if (skipInstall) {
@@ -62,7 +77,7 @@ export function ensureIdeCliForTarget(target, options = {}) {
     }
 
     if (target === 'codex') {
-        if (commandOk('codex', ['--version'])) {
+        if (commandOk('codex', ['--version'], augmentPathEnv())) {
             return { target, ok: true, already: true };
         }
         if (skipInstall) {

package/src/utils/profiler-agent.js

@@ -1,10 +1,11 @@
 import { spawnSync } from 'node:child_process';
 import { GUARDRAILS_PROFILER_SKILL_REL_DIR } from './constants.js';
+import { augmentPathEnv, resolveCursorAgentExecutable } from './cursor-agent-path.js';
 
 const PREFERRED_ORDER = ['cursor', 'claude', 'codex'];
 
-function commandOk(cmd, args = ['--version']) {
-    const r = spawnSync(cmd, args, { stdio: 'ignore' });
+function commandOk(cmd, args = ['--version'], env = process.env) {
+    const r = spawnSync(cmd, args, { stdio: 'ignore', env });
     return r.status === 0;
 }
 
@@ -29,11 +30,22 @@ export function buildProfilerAgentPrompt(projectName, agentTarget = 'cursor') {
  * Call this from init before profiling so the user does not leave the kit flow.
  */
 export function runCursorAgentLogin(cwd) {
-    if (!commandOk('cursor-agent', ['--version'])) {
-        return { ok: false, status: null, message: 'cursor-agent not on PATH' };
+    const bin = resolveCursorAgentExecutable();
+    if (!bin) {
+        return {
+            ok: false,
+            status: null,
+            message:
+                'cursor-agent not found (install from https://cursor.com/cli and ensure ~/.local/bin is on PATH, or re-run init without --skip-ide-cli-install)',
+        };
     }
-    const r = spawnSync('cursor-agent', ['login'], { cwd, stdio: 'inherit', env: { ...process.env } });
-    return { ok: r.status === 0, status: r.status };
+    const env = augmentPathEnv(process.env);
+    const r = spawnSync(bin, ['login'], { cwd, stdio: 'inherit', env });
+    const spawnErr = r.error ? r.error.message : null;
+    if (r.status === null && spawnErr) {
+        return { ok: false, status: null, message: spawnErr };
+    }
+    return { ok: r.status === 0, status: r.status, message: r.status !== 0 ? spawnErr : undefined };
 }
 
 export function pickProfilerAgentTarget(targets) {
@@ -57,7 +69,8 @@ export function pickProfilerAgentTarget(targets) {
  */
 export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true, streamProgress = true }) {
     const prompt = buildProfilerAgentPrompt(projectName, target);
-    const opts = { cwd, stdio: 'inherit', env: { ...process.env } };
+    const env = augmentPathEnv(process.env);
+    const opts = { cwd, stdio: 'inherit', env };
 
     if (streamProgress) {
         console.error(
@@ -67,8 +80,13 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
     }
 
     if (target === 'cursor') {
-        if (!commandOk('cursor-agent', ['--version'])) {
-            return { ok: false, message: 'cursor-agent not on PATH' };
+        const bin = resolveCursorAgentExecutable();
+        if (!bin) {
+            return {
+                ok: false,
+                message:
+                    'cursor-agent not found. Install via Cursor CLI (https://cursor.com/cli) or run init Step 1b without --skip-ide-cli-install; ensure your shell PATH includes ~/.local/bin (Node may not inherit it).',
+            };
         }
         const args = ['-p', prompt];
         if (streamProgress) {
@@ -77,12 +95,15 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
         if (cursorTrust) {
             args.push('--trust', '--approve-mcps');
         }
-        const r = spawnSync('cursor-agent', args, opts);
+        const r = spawnSync(bin, args, opts);
+        if (r.error) {
+            return { ok: false, message: r.error.message };
+        }
         return { ok: r.status === 0, status: r.status };
     }
 
     if (target === 'claude') {
-        if (!commandOk('claude', ['--version'])) {
+        if (!commandOk('claude', ['--version'], env)) {
             return { ok: false, message: 'claude not on PATH' };
         }
         const args = streamProgress
@@ -93,7 +114,7 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
     }
 
     if (target === 'codex') {
-        if (!commandOk('codex', ['--version'])) {
+        if (!commandOk('codex', ['--version'], env)) {
             return { ok: false, message: 'codex not on PATH' };
         }
         const args = streamProgress ? ['exec', '--json', prompt] : ['exec', prompt];