@securityreviewai/securityreview-kit 0.1.27 → 0.1.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securityreviewai/securityreview-kit",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Bootstrap security-review-mcp for AI IDEs and CLI tools",
   "author": "Debarshi Das <debarshi.das@we45.com>",
   "license": "UNLICENSED",

package/src/cli.js

@@ -35,7 +35,7 @@ export function run() {
         )
         .option(
             '--profiler-cursor-login',
-            'Before Cursor profiling, run cursor-agent login in this terminal (then profiling runs in the same init)',
+            'Before Cursor profiling, run `agent login` (or `cursor-agent login`) in this terminal (then profiling runs in the same init)',
         )
         .option(
             '--profiler-quiet',

package/src/commands/init.js

@@ -479,7 +479,12 @@ export async function initCommand(options) {
                     console.log(chalk.dim('  Typical fixes:'));
                     console.log(
                         chalk.dim(
-                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for “Run Cursor Agent login”, or pass `--profiler-cursor-login` with `--profile-repo`.',
+                            '    • Not signed in: re-run `securityreview-kit init` and choose Yes for “Run Cursor Agent login”, or pass `--profiler-cursor-login` with `--profile-repo`. Use `agent login` (or `cursor-agent login`) if prompted manually.',
+                        ),
+                    );
+                    console.log(
+                        chalk.dim(
+                            '    • CLI missing: install from https://cursor.com/docs/cli/installation and verify `agent --version` (new installs use the `agent` command; `cursor-agent` is legacy).',
                         ),
                     );
                     console.log(

package/src/generators/rules/guardrails-init-profile.md

@@ -23,10 +23,10 @@ Do **not** ask the user to verbally approve MCP for `security-review-mcp`. The r
 
 From the repo root, non-interactive runs should include workspace trust, MCP approval, and **streaming progress** (matches default `securityreview-kit init`):
 
-`cursor-agent -p "<your profiling instructions>" --output-format stream-json --stream-partial-output --trust --approve-mcps`
+`agent -p "<your profiling instructions>" --output-format stream-json --stream-partial-output --trust --approve-mcps` (or `cursor-agent` if that is what your install provides)
 
 Omit `--output-format` / `--stream-partial-output` if you want less verbose terminal output (or use `securityreview-kit init` with `--profiler-quiet`).
 
 During `securityreview-kit init`, choose **Yes** when asked to run Cursor login in-terminal, or pass **`--profiler-cursor-login`** with **`--profile-repo`** so login and profiling stay in one run.
 
-You can still sign in manually with `cursor-agent login`. To handle trust/login interactively in the terminal, omit `--trust` and `--approve-mcps`.
+You can still sign in manually with `agent login` (or `cursor-agent login`). To handle trust/login interactively in the terminal, omit `--trust` and `--approve-mcps`.

package/src/generators/rules/guardrails-profiler/SKILL.md

@@ -70,7 +70,7 @@ Build the object for `.guardrails/profile.json`:
   "schema_version": "1.0",
   "project_name": "<directory name>",
   "profiled_at": "<ISO 8601 timestamp>",
-  "profiled_by": "<ide or cli id, e.g. cursor-agent, claude, codex>",
+  "profiled_by": "<ide or cli id, e.g. agent, cursor-agent, claude, codex>",
   "detection_summary": {
     "languages": [],
     "frameworks": [],
@@ -149,4 +149,4 @@ If there are no signals:
 
 ## IDE-Specific Notes
 
-When run from Cursor Agent CLI, Claude Code, or Codex CLI, set `profiled_by` to a stable id (`cursor-agent`, `claude`, `codex`).
+When run from Cursor Agent CLI, Claude Code, or Codex CLI, set `profiled_by` to a stable id (`agent` or `cursor-agent`, `claude`, `codex`).

package/src/utils/cursor-agent-path.js

@@ -0,0 +1,67 @@
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { delimiter, isAbsolute, join } from 'node:path';
+
+/**
+ * Extra PATH segments where Cursor / other CLIs are often installed.
+ * GUI-launched terminals load shell rc files; Node subprocesses often do not.
+ */
+export function augmentPathEnv(baseEnv = process.env) {
+    const home = homedir();
+    const extra = [
+        join(home, '.local', 'bin'),
+        join(home, '.cursor', 'bin'),
+        '/opt/homebrew/bin',
+        '/usr/local/bin',
+    ];
+    if (process.platform === 'win32') {
+        extra.push(join(home, 'AppData', 'Local', 'Programs', 'cursor'));
+    }
+    const pathKey = process.platform === 'win32' ? 'Path' : 'PATH';
+    const current = baseEnv[pathKey] || baseEnv.PATH || '';
+    const merged = [...extra.filter((p) => p), current].filter(Boolean).join(delimiter);
+    return { ...baseEnv, [pathKey]: merged, PATH: merged };
+}
+
+/**
+ * Cursor Agent CLI binary (`agent` or legacy `cursor-agent`) that responds to `--version`, or null.
+ * New installs often only ship `agent` in ~/.local/bin (see https://cursor.com/docs/cli/installation).
+ */
+export function resolveCursorAgentExecutable() {
+    const env = augmentPathEnv();
+    const home = homedir();
+    const candidates = [
+        join(home, '.local', 'bin', 'agent'),
+        join(home, '.local', 'bin', 'cursor-agent'),
+        ...(process.platform === 'win32'
+            ? [
+                  join(home, '.local', 'bin', 'agent.cmd'),
+                  join(home, '.local', 'bin', 'cursor-agent.cmd'),
+              ]
+            : []),
+        join(home, '.cursor', 'bin', 'agent'),
+        join(home, '.cursor', 'bin', 'cursor-agent'),
+        'agent',
+        'cursor-agent',
+    ];
+    if (process.platform === 'win32') {
+        const base = join(home, 'AppData', 'Local', 'Programs', 'cursor');
+        candidates.splice(
+            candidates.length - 2,
+            0,
+            join(base, 'agent.exe'),
+            join(base, 'cursor-agent.exe'),
+        );
+    }
+    for (const cmd of candidates) {
+        if (isAbsolute(cmd) && !existsSync(cmd)) {
+            continue;
+        }
+        const r = spawnSync(cmd, ['--version'], { stdio: 'ignore', env });
+        if (r.status === 0) {
+            return cmd;
+        }
+    }
+    return null;
+}

package/src/utils/ide-cli-install.js

@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process';
+import { augmentPathEnv, resolveCursorAgentExecutable } from './cursor-agent-path.js';
 
 const AGENT_CLI_TARGETS = new Set(['cursor', 'claude', 'codex']);
 
-function commandOk(cmd, args = ['--version']) {
-    const r = spawnSync(cmd, args, { stdio: 'ignore' });
+function commandOk(cmd, args = ['--version'], env = process.env) {
+    const r = spawnSync(cmd, args, { stdio: 'ignore', env });
     return r.status === 0;
 }
 
@@ -23,11 +24,16 @@ export function ensureIdeCliForTarget(target, options = {}) {
     }
 
     if (target === 'cursor') {
-        if (commandOk('cursor-agent', ['--version'])) {
+        if (resolveCursorAgentExecutable()) {
             return { target, ok: true, already: true };
         }
         if (skipInstall) {
-            return { target, ok: false, message: 'cursor-agent not found on PATH' };
+            return {
+                target,
+                ok: false,
+                message:
+                    'Cursor Agent CLI not found (`agent` or `cursor-agent`). Install from https://cursor.com/docs/cli/installation.',
+            };
         }
         if (process.platform === 'win32') {
             return {
@@ -37,13 +43,22 @@ export function ensureIdeCliForTarget(target, options = {}) {
             };
         }
         const r = runShell('curl -fsSL https://cursor.com/install | bash');
-        return r.status === 0
-            ? { target, ok: true }
-            : { target, ok: false, message: 'Cursor CLI install script failed' };
+        if (r.status !== 0) {
+            return { target, ok: false, message: 'Cursor CLI install script failed' };
+        }
+        if (!resolveCursorAgentExecutable()) {
+            return {
+                target,
+                ok: false,
+                message:
+                    'Cursor Agent CLI (`agent` / `cursor-agent`) not found after install; open a new shell or ensure ~/.local/bin exists and re-run init',
+            };
+        }
+        return { target, ok: true };
     }
 
     if (target === 'claude') {
-        if (commandOk('claude', ['--version'])) {
+        if (commandOk('claude', ['--version'], augmentPathEnv())) {
             return { target, ok: true, already: true };
         }
         if (skipInstall) {
@@ -62,7 +77,7 @@ export function ensureIdeCliForTarget(target, options = {}) {
     }
 
     if (target === 'codex') {
-        if (commandOk('codex', ['--version'])) {
+        if (commandOk('codex', ['--version'], augmentPathEnv())) {
             return { target, ok: true, already: true };
         }
         if (skipInstall) {

package/src/utils/profiler-agent.js

@@ -1,10 +1,11 @@
 import { spawnSync } from 'node:child_process';
 import { GUARDRAILS_PROFILER_SKILL_REL_DIR } from './constants.js';
+import { augmentPathEnv, resolveCursorAgentExecutable } from './cursor-agent-path.js';
 
 const PREFERRED_ORDER = ['cursor', 'claude', 'codex'];
 
-function commandOk(cmd, args = ['--version']) {
-    const r = spawnSync(cmd, args, { stdio: 'ignore' });
+function commandOk(cmd, args = ['--version'], env = process.env) {
+    const r = spawnSync(cmd, args, { stdio: 'ignore', env });
     return r.status === 0;
 }
 
@@ -29,11 +30,22 @@ export function buildProfilerAgentPrompt(projectName, agentTarget = 'cursor') {
  * Call this from init before profiling so the user does not leave the kit flow.
  */
 export function runCursorAgentLogin(cwd) {
-    if (!commandOk('cursor-agent', ['--version'])) {
-        return { ok: false, status: null, message: 'cursor-agent not on PATH' };
+    const bin = resolveCursorAgentExecutable();
+    if (!bin) {
+        return {
+            ok: false,
+            status: null,
+            message:
+                'Cursor Agent CLI not found (`agent` or `cursor-agent`). Install from https://cursor.com/docs/cli/installation (add ~/.local/bin to PATH), or re-run init without --skip-ide-cli-install.',
+        };
     }
-    const r = spawnSync('cursor-agent', ['login'], { cwd, stdio: 'inherit', env: { ...process.env } });
-    return { ok: r.status === 0, status: r.status };
+    const env = augmentPathEnv(process.env);
+    const r = spawnSync(bin, ['login'], { cwd, stdio: 'inherit', env });
+    const spawnErr = r.error ? r.error.message : null;
+    if (r.status === null && spawnErr) {
+        return { ok: false, status: null, message: spawnErr };
+    }
+    return { ok: r.status === 0, status: r.status, message: r.status !== 0 ? spawnErr : undefined };
 }
 
 export function pickProfilerAgentTarget(targets) {
@@ -57,7 +69,8 @@ export function pickProfilerAgentTarget(targets) {
  */
 export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true, streamProgress = true }) {
     const prompt = buildProfilerAgentPrompt(projectName, target);
-    const opts = { cwd, stdio: 'inherit', env: { ...process.env } };
+    const env = augmentPathEnv(process.env);
+    const opts = { cwd, stdio: 'inherit', env };
 
     if (streamProgress) {
         console.error(
@@ -67,8 +80,13 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
     }
 
     if (target === 'cursor') {
-        if (!commandOk('cursor-agent', ['--version'])) {
-            return { ok: false, message: 'cursor-agent not on PATH' };
+        const bin = resolveCursorAgentExecutable();
+        if (!bin) {
+            return {
+                ok: false,
+                message:
+                    'Cursor Agent CLI not found (`agent` or `cursor-agent`). Install from https://cursor.com/docs/cli/installation and ensure ~/.local/bin exists; run init Step 1b without --skip-ide-cli-install (Node subprocesses get an augmented PATH, but the binary must be installed).',
+            };
         }
         const args = ['-p', prompt];
         if (streamProgress) {
@@ -77,12 +95,15 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
         if (cursorTrust) {
             args.push('--trust', '--approve-mcps');
         }
-        const r = spawnSync('cursor-agent', args, opts);
+        const r = spawnSync(bin, args, opts);
+        if (r.error) {
+            return { ok: false, message: r.error.message };
+        }
         return { ok: r.status === 0, status: r.status };
     }
 
     if (target === 'claude') {
-        if (!commandOk('claude', ['--version'])) {
+        if (!commandOk('claude', ['--version'], env)) {
             return { ok: false, message: 'claude not on PATH' };
         }
         const args = streamProgress
@@ -93,7 +114,7 @@ export function runProfilerAgent(cwd, { target, projectName, cursorTrust = true,
     }
 
     if (target === 'codex') {
-        if (!commandOk('codex', ['--version'])) {
+        if (!commandOk('codex', ['--version'], env)) {
             return { ok: false, message: 'codex not on PATH' };
         }
         const args = streamProgress ? ['exec', '--json', prompt] : ['exec', prompt];