fix(windows): detect cursor bundled node process

[akbash-bot]

Issue

Starting Cursor Agent as bare cursor-agent from a Windows PowerShell pane briefly labels it, then leaves it unknown. The pane disappears from agent commands and status tracking.

Problem

Cursor's short-lived launcher hands off to a bundled Node process. Herdr did not recognize the persistent process's versioned Cursor executable and entrypoint paths.

How did we fix it?

Herdr now recognizes Cursor when its bundled node.exe and index.js share the same versioned cursor-agent directory. Other scripts, alternate entrypoints, and lookalike paths driven by a different Node runtime remain unknown. Cursor status still comes from its existing screen manifest.

Verification

The reporter's exact Node command failed identification before the change and resolves to Cursor afterward. Focused negative cases remain unidentified. GitHub's Linux, macOS, Windows, and ConPTY checks pass. Local checks passed 3,487 tests; one live-handoff test cannot discover its replacement process because this harness places CARGO_TARGET_DIR outside the checkout, although its logs confirm the process starts.

refs #3032

[coderabbitai]

📝 Walkthrough

Walkthrough

Cursor Agent detection now validates bundled Windows Node invocations against the versioned Cursor path. Tests reject lookalike paths that use an unrelated Node runtime. The changelog uses the broader Windows panes wording.

Changes

Windows Cursor Agent detection

Layer / File(s)	Summary
Windows entrypoint detection and validation src/detect/mod.rs, docs/next/CHANGELOG.md	The detector validates matching node.exe and index.js paths under cursor-agent\versions\<version>. Bun behavior remains unchanged. Tests reject lookalike paths with an unrelated Node runtime. The changelog refers to Windows panes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to c4790

The change is mergeable with owner awareness or follow-up, but the Windows-specific matcher should be gated to Windows to prevent Unix builds from incorrectly recognizing matching Windows-style process arguments.

Possibly related PRs

• herdrdev/herdr#2496: Both changes improve Windows Cursor Agent detection in src/detect/mod.rs.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description clearly explains the Windows Cursor process-detection issue, the fix, and verification results.
Title check	✅ Passed	The title clearly and concisely describes the Windows Cursor bundled Node process-detection fix.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch akbash/3032-detect-cursor-node

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 93af3e36-dafd-431a-922a-ae2cb93c7c14

📥 Commits

Reviewing files that changed from the base of the PR and between ffc4e26 and 706b332.

📒 Files selected for processing (2)

• docs/next/CHANGELOG.md
• src/detect/mod.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[greptile-apps]

Greptile Summary

Herdr now preserves Cursor Agent detection after its Windows launcher hands off to the bundled Node process.

• Recognizes same-directory node.exe and index.js pairs beneath a versioned cursor-agent path.
• Adds positive and nearby negative process-identification tests.
• Documents the Windows handoff fix in the upcoming changelog.

Confidence Score: 4/5

The PR is not yet safe to merge because unrelated Node processes can still be misidentified as Cursor.

The reply states that the broad matcher was fixed by requiring node.exe and index.js to share a directory, but an arbitrary directory ending in cursor-agent/versions/ containing both files remains a concrete counterexample.

Files Needing Attention: src/detect/mod.rs

Important Files Changed

Filename	Overview
src/detect/mod.rs	Adds Cursor's bundled-Node detector and tests, but the attempted path-tightening still accepts unrelated same-directory lookalikes.
docs/next/CHANGELOG.md	Documents persistent Cursor Agent detection after the Windows launcher handoff.

_{Reviews (2): Last reviewed commit: "fix(windows): constrain cursor runtime d..." | Re-trigger Greptile}

[greptile-apps]

Cursor path suffix remains broad

When an unrelated node.exe and index.js share any directory ending in cursor-agent/versions/<nonempty>, this matcher identifies the process as Cursor, causing spurious Cursor-specific agent and status tracking.

Knowledge Base Used: Agent detection, Ghostty integration, and configuration

[akbash-bot]

disagree: Herdr process identity is signature-based rather than tied to a trusted install root. This requires the exact bundled node.exe/index.js pair in one cursor-agent/versions directory; requiring the default AppData root would break redirected LOCALAPPDATA. A process deliberately recreating the full official bundle signature is no more distinguishable than one naming itself cursor-agent.

[greptile-apps]

Fair point — the signature is more constrained than my initial comment implied. The conjunction of node.exe + index.js in the same directory, under a path component sequence of exactly cursor-agent/versions/<nonempty>, is specific enough that an accidental collision is extremely unlikely. And you're right that anchoring to AppData\Local would break redirected LOCALAPPDATA environments, which is a real Windows enterprise concern.

The threat model here is also relevant: this is process identification for tracking, not a trust boundary, so the bar for "specific enough" is whether false positives are plausible in normal operation — not whether the path is cryptographically verified.

I'll withdraw the concern. The current implementation is appropriate for Herdr's signature-based identity model.

Should I remember this as a rule: "Herdr process detection is signature-based; do not flag detectors for lacking a trusted install-root anchor, as path anchoring would break redirected LOCALAPPDATA and is outside the threat model"?

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 942b277d-9ccf-482c-8bd6-b2bd5d6a06ce

📥 Commits

Reviewing files that changed from the base of the PR and between 648027c and c479018.

📒 Files selected for processing (1)

• src/detect/mod.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.