claude-spotter 1.5.13 → 1.6.0

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 各節はそのversion公開時点の変更記録であり、後続versionにより置換された仕様を含む。
 現行runtime契約は[`docs/00_overview.md`](docs/00_overview.md)から辿る。
 
+## 1.6.0 — 2026-08-24
+
+- **Cursor を tool-db host として足した。** `src/host/adapters.mjs` に
+  `hostAgent: 'cursor'` / `tool-db.cursor.json` を追加し、MCP は `~/.cursor/mcp.json` と
+  project `.cursor/mcp.json`、skills / agents は `~/.cursor` と `.cursor` だけを読む。
+  Cursor 製品同梱の `skills-cursor` はカタログに入れない。Claude / Codex の DB は触らない。
+- **`spotter cursor-hook`** は `~/.cursor/hooks.json` の `sessionStart` へ flat
+  `{command, timeout: 5}` を冪等マージする。工場 hook は残し、Cursor envelope を Claude 形へ
+  変換しない。`spotter install` は `~/.cursor` があるときこの hook を配線し、
+  `tool-db.cursor.json` を seed する。
+
+## 1.5.14 — 2026-08-24
+
+- **挙動不変のOS層整理（harness用語統一campaignの分離規約）。** Windows絶対パス表記
+  （ドライブレター/UNC）の判定を`src/platform/paths.mjs`の`isWindowsAbsolutePath()`へ集約し、
+  tool-db側の独自regexを委譲へ置換。runtime-error-storeの`killWorkerTree`には
+  `terminateProcessTree`と意図的に別物である理由（絶対にrejectしないbest-effort掃除）を明記した。
+  公開面・挙動は不変。
+
 ## 1.5.13 — 2026-08-23
 
 - **OS依存を`src/platform/`へ集約。** 6ファイルへ重複していたWindowsのcmd.exe /c wrap・

package/bin/spotter.mjs

@@ -9,6 +9,7 @@ import { runStatus } from '../src/cli/status.mjs';
 import { runDbList, runDbRefresh, runDbRebuild } from '../src/cli/db-cmd.mjs';
 import { runCodexCommand } from '../src/cli/codex-cmd.mjs';
 import { runCodexHookCommand } from '../src/cli/codex-hook-cmd.mjs';
+import { runCursorHookCommand } from '../src/cli/cursor-hook-cmd.mjs';
 import { runAuditorCommand } from '../src/cli/auditor-cmd.mjs';
 import { runDiagnosticsCommand } from '../src/cli/diagnostics-cmd.mjs';
 import { runEvaluationCommand } from '../src/cli/evaluation-cmd.mjs';
@@ -66,6 +67,8 @@ Usage:
                                         run approved codex-sidecar worktree workflow
   spotter codex-hook install|uninstall|diagnostics
                                         (experimental) manage Codex native hooks
+  spotter cursor-hook install|uninstall|diagnostics
+                                        manage Cursor native catalog-refresh hooks
   spotter auditor judge --stage STAGE --input FILE
                                         (experimental) run primary auditor backend once
   spotter auditor matrix --stage STAGE --input FILE
@@ -128,6 +131,9 @@ async function main() {
     case 'codex-hook':
       await runCodexHookCommand({ argv: rest });
       return;
+    case 'cursor-hook':
+      await runCursorHookCommand({ argv: rest });
+      return;
     case 'auditor':
       await runAuditorCommand({ argv: rest });
       return;

package/docs/11_dashboard-operations.md

@@ -1,6 +1,6 @@
 # Spotter評価dashboard運用
 
-現行npm配布版: **v1.5.13**（2026-08-23）。v1.5.13はOS依存・ベンダー依存の内部配置だけを
+現行npm配布版: **v1.6.0**（2026-08-24）。v1.5.13はOS依存・ベンダー依存の内部配置だけを
 変更した挙動同一リファクタで、評価・dashboardのrouting構成は変更していない。
 
 この文書はservice設定の正本であり、各端末に現在installされているnpm versionの台帳ではない。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.5.13",
+  "version": "1.6.0",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/cli/cursor-hook-cmd.mjs

@@ -0,0 +1,242 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnRefreshDetached } from '../hooks/spawn-daemon.mjs';
+import {
+  die,
+  findSpotterMarker,
+  isChildCall,
+  readStdinJson,
+} from '../hooks/lib.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PACKAGE_ROOT = resolve(HERE, '..', '..');
+const SPOTTER_BIN = join(PACKAGE_ROOT, 'bin', 'spotter.mjs');
+const CURSOR_SESSION_START_TIMEOUT_SEC = 5;
+const CURSOR_HOOK_FRAGMENT = 'cursor-hook session-start';
+
+const CURSOR_HOOK_USAGE = `spotter cursor-hook — Cursor native hook adapter
+
+Usage:
+  spotter cursor-hook install [--cursor-home DIR]
+  spotter cursor-hook uninstall [--cursor-home DIR]
+  spotter cursor-hook diagnostics [--cursor-home DIR]
+  spotter cursor-hook session-start
+
+Installs a Cursor sessionStart hook that refreshes tool-db.cursor.json.
+Does not convert the Cursor envelope to Claude shape. Factory hooks stay in place.
+`;
+
+export async function runCursorHookCommand({ argv = process.argv.slice(2) } = {}) {
+  const sub = argv[0];
+  if (!sub || sub === '--help' || sub === '-h') {
+    process.stdout.write(CURSOR_HOOK_USAGE);
+    return;
+  }
+  if (sub === 'install') {
+    const opts = parseCursorHomeArgs(argv.slice(1));
+    const result = await installCursorHooks({ cursorHome: opts.cursorHome });
+    process.stdout.write(`${JSON.stringify({
+      installation: result.hooks.sessionStart === 'unchanged' ? 'already_wired' : 'wired',
+      hooksPath: result.hooksPath,
+      hooks: result.hooks,
+    }, null, 2)}\n`);
+    return;
+  }
+  if (sub === 'uninstall') {
+    const opts = parseCursorHomeArgs(argv.slice(1));
+    const result = await uninstallCursorHooks({ cursorHome: opts.cursorHome });
+    process.stdout.write(`${JSON.stringify({
+      hooksPath: result.hooksPath,
+      hooks: result.hooks,
+    }, null, 2)}\n`);
+    return;
+  }
+  if (sub === 'diagnostics') {
+    const opts = parseCursorHomeArgs(argv.slice(1));
+    const result = cursorHookDiagnostics({ cursorHome: opts.cursorHome });
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return;
+  }
+  if (sub === 'session-start') {
+    await runCursorSessionStartHook();
+    return;
+  }
+  process.stderr.write(`unknown cursor-hook subcommand: ${sub}\n${CURSOR_HOOK_USAGE}`);
+  process.exit(2);
+}
+
+export async function runCursorSessionStartHook({
+  readInput = readStdinJson,
+  spawnRefreshDetachedFn = spawnRefreshDetached,
+} = {}) {
+  if (isChildCall()) return;
+  const input = await readInput();
+  const cwd = cursorCwd(input);
+  if (!cwd) return;
+  const projectRoot = findSpotterMarker(cwd);
+  if (!projectRoot) return;
+  spawnRefreshDetachedFn({ projectRoot, hostAgent: 'cursor' });
+}
+
+export function cursorCwd(input) {
+  if (typeof input?.cwd === 'string' && input.cwd.length > 0) return input.cwd;
+  const root = input?.workspace_roots?.[0];
+  if (typeof root === 'string' && root.length > 0) return root;
+  return null;
+}
+
+export async function installCursorHooks({
+  cursorHome = defaultCursorHome(),
+  nodePath = process.execPath,
+  spotterBin = SPOTTER_BIN,
+} = {}) {
+  const hooksPath = join(cursorHome, 'hooks.json');
+  const file = await loadCursorHooks(hooksPath);
+  const command = hookCommand(nodePath, spotterBin);
+  const sessionStart = upsertSessionStart(file, command);
+  if (sessionStart === 'added') await persistCursorHooks(hooksPath, file);
+  return {
+    cursorHome,
+    hooksPath,
+    hooks: { sessionStart },
+  };
+}
+
+export async function uninstallCursorHooks({
+  cursorHome = defaultCursorHome(),
+} = {}) {
+  const hooksPath = join(cursorHome, 'hooks.json');
+  const file = await loadCursorHooks(hooksPath);
+  const removed = removeSessionStart(file);
+  if (removed) await persistCursorHooks(hooksPath, file);
+  return {
+    cursorHome,
+    hooksPath,
+    hooks: { sessionStart: removed ? 'removed' : 'not present' },
+  };
+}
+
+export function cursorHookDiagnostics({ cursorHome = defaultCursorHome() } = {}) {
+  const hooksPath = join(cursorHome, 'hooks.json');
+  const present = existsSync(hooksPath);
+  const file = present ? JSON.parse(readFileSync(hooksPath, 'utf8')) : { version: 1, hooks: {} };
+  if (file === null || typeof file !== 'object' || Array.isArray(file)) {
+    return {
+      installation: 'not-installed',
+      cursorHome,
+      hooksPath,
+      installedHooks: { sessionStart: false },
+    };
+  }
+  if (file.hooks == null || typeof file.hooks !== 'object' || Array.isArray(file.hooks)) {
+    file.hooks = {};
+  }
+  const installed = listFor(file, 'sessionStart').some((entry) => isSpotterCursorHook(entry));
+  return {
+    installation: installed ? 'installed' : 'not-installed',
+    cursorHome,
+    hooksPath,
+    installedHooks: { sessionStart: installed },
+  };
+}
+
+export function isCursorHomePresent(cursorHome = defaultCursorHome()) {
+  return existsSync(cursorHome);
+}
+
+function defaultCursorHome() {
+  return join(homedir(), '.cursor');
+}
+
+function parseCursorHomeArgs(argv) {
+  let cursorHome = defaultCursorHome();
+  for (let index = 0; index < argv.length; index += 1) {
+    if (argv[index] === '--cursor-home') {
+      const value = argv[index + 1];
+      if (!value || value.startsWith('--')) {
+        throw Object.assign(new Error('--cursor-home requires a value'), { exitCode: 2 });
+      }
+      cursorHome = value;
+      index += 1;
+    }
+  }
+  return { cursorHome };
+}
+
+function hookCommand(nodePath, spotterBin) {
+  return `${quoteArg(nodePath)} ${quoteArg(spotterBin)} cursor-hook session-start`;
+}
+
+function quoteArg(value) {
+  const text = String(value);
+  if (!/[\s"']/.test(text)) return text;
+  return `"${text.replaceAll('"', '\\"')}"`;
+}
+
+function isSpotterCursorHook(entry) {
+  return typeof entry?.command === 'string' && entry.command.includes(CURSOR_HOOK_FRAGMENT);
+}
+
+function listFor(file, event) {
+  const current = file.hooks?.[event];
+  return Array.isArray(current) ? current : [];
+}
+
+function upsertSessionStart(file, command) {
+  file.hooks ??= {};
+  const list = listFor(file, 'sessionStart');
+  for (const entry of list) {
+    if (typeof entry.command !== 'string') continue;
+    if (entry.command === command && entry.timeout === CURSOR_SESSION_START_TIMEOUT_SEC) {
+      return 'unchanged';
+    }
+    if (entry.command === command || isSpotterCursorHook(entry)) {
+      entry.command = command;
+      entry.timeout = CURSOR_SESSION_START_TIMEOUT_SEC;
+      file.hooks.sessionStart = list;
+      return 'added';
+    }
+  }
+  list.push({ command, timeout: CURSOR_SESSION_START_TIMEOUT_SEC });
+  file.hooks.sessionStart = list;
+  return 'added';
+}
+
+function removeSessionStart(file) {
+  const list = listFor(file, 'sessionStart');
+  const kept = list.filter((entry) => !isSpotterCursorHook(entry));
+  if (kept.length === list.length) return false;
+  if (kept.length > 0) file.hooks.sessionStart = kept;
+  else delete file.hooks.sessionStart;
+  return true;
+}
+
+async function loadCursorHooks(path) {
+  try {
+    const parsed = JSON.parse(await readFile(path, 'utf8'));
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error(`${path} は object である必要があります`);
+    }
+    if (parsed.hooks == null) parsed.hooks = {};
+    if (typeof parsed.hooks !== 'object' || Array.isArray(parsed.hooks)) {
+      throw new Error(`${path} の hooks は object である必要があります`);
+    }
+    return parsed;
+  } catch (err) {
+    if (err?.code === 'ENOENT') return { version: 1, hooks: {} };
+    throw err;
+  }
+}
+
+async function persistCursorHooks(path, file) {
+  await mkdir(dirname(path), { recursive: true });
+  file.version = file.version ?? 1;
+  await writeFile(path, `${JSON.stringify(file, null, 2)}\n`, 'utf8');
+}
+
+if (import.meta.url === `file://${process.argv[1]?.replace(/\\/g, '/')}`) {
+  runCursorHookCommand().catch((err) => die(err.message, err.exitCode ?? 2));
+}

package/src/cli/db-cmd.mjs

@@ -14,9 +14,9 @@ import { writeFile } from 'node:fs/promises';
 const DB_USAGE = `spotter db — manage the host-specific tool-db
 
 Usage:
-  spotter db list [--host-agent claude|codex|automation]
-  spotter db refresh [--host-agent claude|codex|automation]
-  spotter db rebuild [--host-agent claude|codex|automation]
+  spotter db list [--host-agent claude|codex|automation|cursor]
+  spotter db refresh [--host-agent claude|codex|automation|cursor]
+  spotter db rebuild [--host-agent claude|codex|automation|cursor]
 `;
 
 function requireProjectRoot() {

package/src/cli/install.mjs

@@ -24,6 +24,7 @@ import { version as SPOTTER_VERSION } from '../version.mjs';
 import { refresh } from '../tool-db/refresh.mjs';
 import { localDbPath, globalDbPath } from '../tool-db/loader.mjs';
 import { installCodexHooks } from './codex-hook-cmd.mjs';
+import { installCursorHooks, isCursorHomePresent } from './cursor-hook-cmd.mjs';
 import { prepareRuntimeErrorStoreDirectory } from '../core/runtime-error-store.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -57,9 +58,12 @@ export async function runInstall({
   cwd = process.cwd(),
   skipRefresh = false,
   skipCodexHooks = skipRefresh,
+  skipCursorHooks = skipRefresh,
   refreshFn = refresh,
   codexCliPresentFn = isCodexCliPresent,
   installCodexHooksFn = installCodexHooks,
+  cursorHomePresentFn = isCursorHomePresent,
+  installCursorHooksFn = installCursorHooks,
   prepareRuntimeErrorStoreDirectoryFn = prepareRuntimeErrorStoreDirectory,
   auditorContext,
   resolveDefaultAuditorContextFn = resolveDefaultAuditorContext,
@@ -150,6 +154,18 @@ export async function runInstall({
     }
   }
 
+  let cursorHooksRegistered = false;
+  if (target === 'project' && !skipCursorHooks) {
+    if (cursorHomePresentFn()) {
+      const result = await installCursorHooksFn();
+      cursorHooksRegistered = true;
+      console.log('  Cursor hooks registered');
+      console.log(`  Cursor hooks: ${result.hooksPath}`);
+    } else {
+      console.log('  Cursor home not found — Cursor hooks not registered');
+    }
+  }
+
   // Seed the tool-db so the first session has something to audit against.
   // Runs regardless of whether settings.json changed — re-running `spotter install`
   // on an already-installed project is the canonical way to refresh tool-db drift
@@ -170,12 +186,18 @@ export async function runInstall({
         console.log(`  Codex local DB:  ${localDbPath(cwd, 'codex')}`);
         console.log(`  Codex global DB: ${globalDbPath('codex')}`);
       }
+      if (cursorHooksRegistered) {
+        const cursorResolved = await refreshFn({ projectRoot: cwd, hostAgent: 'cursor', logFn: log });
+        console.log(`  ${cursorResolved.size} Cursor tool(s) resolved`);
+        console.log(`  Cursor local DB:  ${localDbPath(cwd, 'cursor')}`);
+        console.log(`  Cursor global DB: ${globalDbPath('cursor')}`);
+      }
     } catch (err) {
       // §0: throw (fallback 禁止). But surface the recovery path so the user isn't
       // left with "hooks registered, tool-db missing" and no clue what to run.
       process.stderr.write(`\nspotter install: tool-db seeding failed.\n`);
       process.stderr.write(`  hooks are registered but tool-db is not ready.\n`);
-      process.stderr.write(`  recover with: spotter db refresh and, for Codex, spotter db refresh --host-agent codex\n`);
+      process.stderr.write(`  recover with: spotter db refresh and, for Codex, spotter db refresh --host-agent codex; for Cursor, spotter db refresh --host-agent cursor\n`);
       throw err;
     }
   }
@@ -187,6 +209,11 @@ export async function runInstall({
   } else if (target === 'project' && !skipCodexHooks) {
     console.log('  Codex hooks are not active: rerun `spotter install` where `codex --version` succeeds');
   }
+  if (cursorHooksRegistered) {
+    console.log('  Cursor catalog refresh is active: new Cursor Agent sessions refresh tool-db.cursor.json');
+  } else if (target === 'project' && !skipCursorHooks) {
+    console.log('  Cursor hooks are not active: rerun `spotter install` where ~/.cursor exists');
+  }
 }
 
 async function readExistingAuditorContext(markerPath, resolveDefaultAuditorContextFn) {

package/src/core/runtime-error-store.mjs

@@ -292,6 +292,8 @@ function runRuntimeWorker(workerPath, args, timeoutMs, signal) {
   });
 }
 
+// platform/spawn.mjs の terminateProcessTree と似るが意図的に別物: こちらは受領記録の
+// best-effort掃除で、絶対にrejectせず（SIGKILL直行・225ms fallback）呼び出し元を止めない。
 function killWorkerTree(child) {
   if (!Number.isSafeInteger(child?.pid) || child.pid <= 0) return Promise.resolve();
   if (process.platform === 'win32') {

package/src/host/adapters.mjs

@@ -3,12 +3,13 @@
 // このtableだけが知る。呼び出し側（loader / refresh / CLI）は adapter を引いて
 // 使うだけで、`if (hostAgent === 'codex')` 分岐を業務ロジックに書かない。
 //
-// ベンダー固有の実装本体は従来どおり investigate-claude.mjs / investigate-codex.mjs
-// が持つ。片方のhostのrefreshがもう片方のDBをprune / overwriteしない契約
-// （AGENTS.md「ツールカタログはhost-local tool-db」）はこの分離が担保する。
+// ベンダー固有の実装本体は investigate-claude.mjs / investigate-codex.mjs /
+// investigate-cursor.mjs が持つ。片方のhostのrefreshがもう片方のDBをprune /
+// overwriteしない契約（AGENTS.md「ツールカタログはhost-local tool-db」）はこの分離が担保する。
 
 import { buildInvestigationSnapshot } from '../tool-db/investigate-claude.mjs';
 import { buildCodexInvestigationSnapshot } from '../tool-db/investigate-codex.mjs';
+import { buildCursorInvestigationSnapshot } from '../tool-db/investigate-cursor.mjs';
 
 const CLAUDE_ADAPTER = Object.freeze({
   hostAgent: 'claude',
@@ -32,10 +33,18 @@ const AUTOMATION_ADAPTER = Object.freeze({
     buildInvestigationSnapshot({ logFn, claudeBin, projectRoot }),
 });
 
+const CURSOR_ADAPTER = Object.freeze({
+  hostAgent: 'cursor',
+  toolDbFileName: 'tool-db.cursor.json',
+  buildSnapshot: ({ logFn, projectRoot }) =>
+    buildCursorInvestigationSnapshot({ logFn, projectRoot }),
+});
+
 const ADAPTERS = Object.freeze({
   claude: CLAUDE_ADAPTER,
   codex: CODEX_ADAPTER,
   automation: AUTOMATION_ADAPTER,
+  cursor: CURSOR_ADAPTER,
 });
 
 export function normalizeToolDbHostAgent(hostAgent = 'claude') {
@@ -45,7 +54,7 @@ export function normalizeToolDbHostAgent(hostAgent = 'claude') {
   if (Object.hasOwn(ADAPTERS, hostAgent)) {
     return hostAgent;
   }
-  throw new TypeError(`tool-db hostAgent must be claude, codex, or automation; got ${hostAgent}`);
+  throw new TypeError(`tool-db hostAgent must be claude, codex, automation, or cursor; got ${hostAgent}`);
 }
 
 export function getHostAdapter(hostAgent = 'claude') {

package/src/platform/paths.mjs

@@ -58,3 +58,8 @@ export function normalizeProjectPath(p) {
   s = s.replace(/\/+$/, '');
   return s;
 }
+
+// Windows絶対パス表記（ドライブレター/UNC）の判定。パス表記のOS差はこのfileが所有する。
+export function isWindowsAbsolutePath(value) {
+  return /^(?:[A-Za-z]:\\|\\\\)/u.test(value);
+}

package/src/tool-db/investigate-agents.mjs

@@ -49,7 +49,7 @@ export async function listAgentsAll({ logFn = () => {}, projectRoot } = {}) {
 
 // Scan `<dir>/<name>.md` files. Returns Map<agent-name, description>. Missing directories
 // or malformed agents are skipped silently.
-async function scanAgentsDir(dir, logFn) {
+export async function scanAgentsDir(dir, logFn) {
   const out = new Map();
   let entries;
   try {

package/src/tool-db/investigate-cursor.mjs

@@ -0,0 +1,123 @@
+// Cursor-native catalog investigation.
+//
+// Cursor の MCP / skills / agents は Claude / Codex の設定面とは別物なので、
+// この snapshot は ~/.cursor と project の .cursor だけを読む。
+// Claude の skills や Codex の mcp list を混ぜない。
+// ~/.cursor/skills-cursor は Cursor 製品同梱であり、工場カタログに入れない。
+
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { scanAgentsDir } from './investigate-agents.mjs';
+import { bellVisibleName, listMcpToolsOne } from './investigate-mcp.mjs';
+import { scanSkillsDir } from './investigate-skills.mjs';
+import { describeServer } from './mcp-config.mjs';
+
+export async function buildCursorInvestigationSnapshot({
+  logFn = () => {},
+  projectRoot,
+  cursorHome = join(homedir(), '.cursor'),
+} = {}) {
+  const snapshot = new Map();
+
+  const mcp = await listCursorMcpToolsAll({ logFn, projectRoot, cursorHome });
+  for (const [serverName, tools] of mcp.entries()) {
+    for (const tool of tools) {
+      if (!tool.description || tool.description.length === 0) continue;
+      snapshot.set(bellVisibleName(serverName, tool.name), tool.description);
+    }
+  }
+
+  const skills = await listCursorSkillsAll({ logFn, projectRoot, cursorHome });
+  for (const [name, description] of skills) {
+    snapshot.set(name, description);
+  }
+
+  const agents = await listCursorAgentsAll({ logFn, projectRoot, cursorHome });
+  for (const [name, description] of agents) {
+    snapshot.set(name, description);
+  }
+
+  return snapshot;
+}
+
+export async function listCursorMcpToolsAll({
+  logFn = () => {},
+  projectRoot,
+  cursorHome = join(homedir(), '.cursor'),
+} = {}) {
+  const servers = await listCursorMcpServers({ projectRoot, cursorHome });
+  const out = new Map();
+  for (const server of servers) {
+    try {
+      const tools = await listMcpToolsOne({ server, logFn, projectRoot });
+      out.set(server.name, tools);
+    } catch (err) {
+      logFn(`cursor mcp investigate failed for "${server.name}": ${err.message}`);
+    }
+  }
+  return out;
+}
+
+export async function listCursorMcpServers({
+  projectRoot,
+  cursorHome = join(homedir(), '.cursor'),
+} = {}) {
+  const user = await readMcpServersFile(join(cursorHome, 'mcp.json'));
+  const project = projectRoot ? await readMcpServersFile(join(projectRoot, '.cursor', 'mcp.json')) : {};
+  const merged = { ...user, ...project };
+  const servers = [];
+  for (const [name, entry] of Object.entries(merged)) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) continue;
+    const described = describeServer(name, entry);
+    if (described) servers.push(described);
+  }
+  return servers;
+}
+
+export async function listCursorSkillsAll({
+  logFn = () => {},
+  projectRoot,
+  cursorHome = join(homedir(), '.cursor'),
+} = {}) {
+  const out = new Map();
+  for (const [name, description] of await scanSkillsDir(join(cursorHome, 'skills'), logFn)) {
+    out.set(name, description);
+  }
+  if (projectRoot) {
+    for (const [name, description] of await scanSkillsDir(join(projectRoot, '.cursor', 'skills'), logFn)) {
+      out.set(name, description);
+    }
+  }
+  return out;
+}
+
+export async function listCursorAgentsAll({
+  logFn = () => {},
+  projectRoot,
+  cursorHome = join(homedir(), '.cursor'),
+} = {}) {
+  const out = new Map();
+  for (const [name, description] of await scanAgentsDir(join(cursorHome, 'agents'), logFn)) {
+    out.set(name, description);
+  }
+  if (projectRoot) {
+    for (const [name, description] of await scanAgentsDir(join(projectRoot, '.cursor', 'agents'), logFn)) {
+      out.set(name, description);
+    }
+  }
+  return out;
+}
+
+async function readMcpServersFile(path) {
+  let text;
+  try {
+    text = await readFile(path, 'utf8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return {};
+    throw err;
+  }
+  const data = JSON.parse(text);
+  if (!data || typeof data !== 'object') return {};
+  return (data.mcpServers && typeof data.mcpServers === 'object') ? data.mcpServers : {};
+}

package/src/tool-db/investigate-mcp.mjs

@@ -10,6 +10,7 @@
 //   5. ← tools/list result   (response with tools[] each having {name, description})
 
 import { spawn } from 'node:child_process';
+import { isWindowsAbsolutePath } from '../platform/paths.mjs';
 import { execFileWindowsSafe, windowsCompatibleCommand } from '../platform/spawn.mjs';
 import { listToolsHttp } from './investigate-mcp-http.mjs';
 import { readMcpServers, describeServer } from './mcp-config.mjs';
@@ -186,7 +187,7 @@ export function splitCommandLine(s) {
 }
 
 function extractUnquotedWindowsExecutable(s) {
-  if (!/^(?:[A-Za-z]:\\|\\\\)/u.test(s)) return null;
+  if (!isWindowsAbsolutePath(s)) return null;
   const match = s.match(/^(.+?\.(?:exe|cmd|bat))(?:\s+|$)(.*)$/iu);
   if (!match) return null;
   return { command: match[1], rest: match[2].trim() };

package/src/tool-db/investigate-skills.mjs

@@ -55,7 +55,7 @@ export async function listSkillsAll({ logFn = () => {}, projectRoot } = {}) {
 
 // Scan `<dir>/<name>/SKILL.md` files. Returns Map<skill-name, description>. Missing
 // directories or malformed skills are skipped silently.
-async function scanSkillsDir(dir, logFn) {
+export async function scanSkillsDir(dir, logFn) {
   const out = new Map();
   let entries;
   try {