chore(cursor): relocate cursor bundle to harnesses/cursor/bundle/ + agent restructuring by thenotoriousllama · Pull Request #268 · activeloopai/hivemind

thenotoriousllama · 2026-06-16T12:29:01Z

Summary

This is PR 3 in a stacked series. It contains two independent changes that both needed to land after the harnesses/ reorganisation from PR #265:

Cursor bundle path relocation - the deferred half of chore: consolidate agent harnesses under harnesses/ + add library/ docs #265. Moves cursor/bundle/ to harnesses/cursor/bundle/ for full consistency with every other agent harness.
Cursor agent restructuring - replaces the initial generic worker-bee roster with 25 hivemind-specific worker-bees tailored to this codebase's actual surfaces (TypeScript/Node, Deep Lake, CI/release pipeline, retrieval, MCP, harness integration).

Stacked on PR #267. The diff against main includes PR #267's changes since that PR is not yet merged; the PR #268-specific commits are the last four in the list.

1. Cursor bundle path relocation

Why deferred from #265: the cursor hook bundle and the cursor extension were coupled in the fork. PR #265 added harnesses/cursor/.gitkeep as a placeholder and noted this would follow. This is that follow-up.

Files changed (path-string updates only, zero behavior change):

File	Change
`esbuild.config.mjs`	`outdir`, `chmodSync`, `writeFileSync` targets
`.gitignore`	`cursor/bundle/` -> `harnesses/cursor/bundle/`
`package.json`	`files` array entry
`.github/workflows/ci.yaml`	4 bundle smoke-test paths (2 jobs)
`.github/workflows/release.yaml`	2 artifact paths
`README.md`	Build-output comment
`src/cli/install-cursor.ts`	`srcBundle` join path
5 test files	All `cursor/bundle` path references

2. Agent restructuring

Replaces the initial generic 37-bee roster (broad domain advisors) with 25 hivemind-specific worker-bees that know this codebase's actual conventions:

Added (hivemind-specific): typescript-node-worker-bee, deeplake-dataset-worker-bee, ci-release-worker-bee, retrieval-worker-bee, embeddings-runtime-worker-bee, harness-integration-worker-bee, mcp-protocol-worker-bee, mcp-tool-docs-worker-bee

Retained and updated: security-worker-bee, quality-worker-bee, git-worker-bee, github-repo-health-worker-bee, cursor-ide-worker-bee, dependency-audit-worker-bee, library-worker-bee, knowledge-worker-bee, wiki-worker-bee, adr-writing-worker-bee, branching-strategy-worker-bee, code-review-pr-worker-bee, changelog-release-notes-worker-bee, readme-writing-worker-bee, runbook-writing-worker-bee, technical-writing-craft-worker-bee, terminal-bash-worker-bee

Removed (too generic for this codebase): agile-scrum, kanban-flow, okr-goal-setting, retrospective, docs-site, api-docs, ai-tools-platform, ai-coding-tools, mind, db, python, react, devops, design-system, discovery-research, slack-app, markdown-mdx, and others

Also adds .cursor/model-comparison-matrix.md (380-line scored model-routing rubric) wired into /the-smoker.

Additional fixes

package-lock.json: moves @huggingface/transformers from dependencies to optionalDependencies (embeddings are opt-in).
.cursor/rules/plan-construction-protocol.mdc: fixes stale legion-shared/model-comparison-matrix.md path to .cursor/model-comparison-matrix.md.

Testing

npm run build: green, cursor bundle lands at harnesses/cursor/bundle/ with no top-level cursor/bundle/ created.

npm test: 4483-4487/4487 passing (the 4 cli-update failures are pre-existing sandbox TTY flakes, byte-identical to upstream/main, confirmed passing in real CI).

Contribution by Legion Code Inc. / Mario Aldayuz

Summary by CodeRabbit

Chores
- Reorganized internal build structure for Cursor bundle assets to improve build consistency and maintainability.
- Updated CI/CD workflows and test suites to reflect the new build artifact organization.

coderabbitai · 2026-06-16T12:29:11Z

📝 Walkthrough

Walkthrough

Renames the Cursor harness bundle output directory from cursor/bundle to harnesses/cursor/bundle across the esbuild config, .gitignore, package.json publish manifest, installCursor() runtime path, CI smoke-test and release workflow steps, and all related test fixtures.

Changes

Cursor Bundle Directory Relocation

Layer / File(s)	Summary
Build output path and published package manifest `esbuild.config.mjs`, `.gitignore`, `package.json`	esbuild `outdir`, post-build chmod/`package.json` writes, `.gitignore` exclusion, and `package.json` `files` whitelist all updated from `cursor/bundle` to `harnesses/cursor/bundle`.
Runtime install path `src/cli/install-cursor.ts`	`installCursor()` now resolves the Cursor hook bundle source from `pkgRoot()/harnesses/cursor/bundle`.
CI/CD workflow path corrections `.github/workflows/ci.yaml`, `.github/workflows/release.yaml`	Linux and Windows CI smoke-test entrypoint lists and release workflow git staging/cleanup steps corrected to `harnesses/cursor/bundle`.
Test fixture updates `tests/cli/cli-install-cursor-fs.test.ts`, `tests/claude-code/skillify-bundle-scan.test.ts`, `tests/claude-code/plugin-version-resolution.test.ts`, `tests/claude-code/skillify-session-start-injection.test.ts`, `tests/claude-code/version-define-bundles.test.ts`, `tests/claude-code/embeddings-bundle-scan.test.ts`	All test suites update hardcoded cursor bundle paths and scaffolded fake-package directories to `harnesses/cursor/bundle`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~4 minutes

Suggested reviewers

efenocchi
kaghni

Poem

🐇 Hopping through the harness path, I rearranged the trail,
cursor/bundle used to live where now it cannot sail.
Beneath harnesses/ it rests, all tidy in a row,
The CI checks, the tests, the build — they all follow below.
A small hop for a rabbit, a clean leap for the code! 🎉

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	❓ Inconclusive	The description covers the main changes thoroughly, including detailed rationale for both the bundle relocation and agent restructuring. However, it does not include the required Version Bump section or testing checklist from the template.	Add the 'Version Bump' section and 'Test plan' checklist from the template to clarify release versioning requirements and confirm test status.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main changes: relocating the cursor bundle directory and restructuring the cursor agent, which aligns with the substantive changes across the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

-  writeFileSync(join(tmpPkg, "cursor", "bundle", "pre-tool-use.js"), "// fake bundle");
-  writeFileSync(join(tmpPkg, "cursor", "bundle", "session-end.js"), "// fake bundle");
+  mkdirSync(join(tmpPkg, "harnesses", "cursor", "bundle"), { recursive: true });
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "session-start.js"), "// fake bundle");


-  writeFileSync(join(tmpPkg, "cursor", "bundle", "session-end.js"), "// fake bundle");
+  mkdirSync(join(tmpPkg, "harnesses", "cursor", "bundle"), { recursive: true });
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "session-start.js"), "// fake bundle");
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "capture.js"), "// fake bundle");


+  mkdirSync(join(tmpPkg, "harnesses", "cursor", "bundle"), { recursive: true });
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "session-start.js"), "// fake bundle");
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "capture.js"), "// fake bundle");
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "pre-tool-use.js"), "// fake bundle");


+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "session-start.js"), "// fake bundle");
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "capture.js"), "// fake bundle");
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "pre-tool-use.js"), "// fake bundle");
+  writeFileSync(join(tmpPkg, "harnesses", "cursor", "bundle", "session-end.js"), "// fake bundle");


Move the cursor hook bundle from the top-level cursor/bundle/ to harnesses/cursor/bundle/ for consistency with every other agent harness. Updates: - esbuild.config.mjs: outdir, chmodSync, writeFileSync - .gitignore: cursor/bundle/ -> harnesses/cursor/bundle/ - package.json: files array - .github/workflows/ci.yaml: 4 bundle smoke-test paths (2 jobs) - .github/workflows/release.yaml: 2 artifact paths - README.md: build-output comment - src/cli/install-cursor.ts: srcBundle pkgRoot join - 5 test files: all cursor/bundle path references updated to match

…el-matrix path Move @huggingface/transformers from dependencies to optionalDependencies in package-lock.json — embeddings are opt-in and should not be a hard install requirement, matching the intent of the main package.json. Fix the model-comparison-matrix.md reference in .cursor/rules/plan-construction-protocol.mdc from the stale legion-shared/ path to the correct .cursor/ location where the file actually lives.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/cli/cli-install-cursor-fs.test.ts`:
- Around line 114-118: The test for the missing-bundle path is using a
substring-based regex assertion with toThrow(/Cursor bundle missing/) that could
miss incorrect paths in the actual error message. Replace this substring
assertion with an exact error message assertion that includes the full expected
path harnesses/cursor/bundle. Update the expect() call to match the complete
error message that should be thrown by installCursor() to ensure it contains
both the descriptive text and the correct bundle path, following the coding
guideline to prefer asserting on specific values over generic substrings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b945f6ce-8b8a-4130-ac7c-65e52379e55f

📥 Commits

Reviewing files that changed from the base of the PR and between b9aef01 and d6b6c5b.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (12)

.github/workflows/ci.yaml
.github/workflows/release.yaml
.gitignore
esbuild.config.mjs
package.json
src/cli/install-cursor.ts
tests/claude-code/embeddings-bundle-scan.test.ts
tests/claude-code/plugin-version-resolution.test.ts
tests/claude-code/skillify-bundle-scan.test.ts
tests/claude-code/skillify-session-start-injection.test.ts
tests/claude-code/version-define-bundles.test.ts
tests/cli/cli-install-cursor-fs.test.ts

khustup2

Finishes the cursor bundle consolidation from #265. Mechanical, CI green (CodeQL red is pre-existing). LGTM.

thenotoriousllama · 2026-06-16T23:48:51Z

@khustup2 @claude @activeloop-bot I can't merge, can you?

…t review Brings the focused-PR (activeloopai#271) hardening back into the full sweep so activeloopai#270 is the single shippable PR (it correctly keeps the approved cursor relocation from activeloopai#268). Changes: CodeQL Critical (auth.ts): the OAuth browser opener fed a server-derived verification URL into `cmd /c start` on Windows (cmd re-parses its own command line). Now validate the URL (https scheme, parsed) and open via `rundll32 url.dll,FileProtocolHandler` with no shell interpreter. CodeQL High (tests): cli-install-cursor-fs.test.ts creates its temp root with mkdtempSync instead of a predictable tmpdir join. Wiki-summarizer prompt-injection blast radius (Option B, full fix): pivot the Claude summarizer to the stdout model. Session transcript + existing summary are inlined into the prompt as untrusted DATA (delivered over stdin), the agent emits the summary to stdout, and the worker sanitizes (control-char strip + 100k cap) and uploads it from memory. CLAUDE_FLAGS drops bypassPermissions and all --allowedTools, so the agent has zero tools. No tmp summary file is written or read back, removing the file-system race too. CodeRabbit review: pack-check secret patterns are case-insensitive (ID_RSA / Credentials.JSON / .ENV can't bypass the publish gate); grep-core.ts and deeplake-fs.ts wrap sqlIdent() identifiers in double quotes to match the codebase convention and preserve PostgreSQL case semantics; vfs-handler test asserts the stable "Failed to parse snapshot" prefix. Full suite green (cli-update failures are a pre-existing parallel-isolation flake that passes in isolation and on CI).

…MPLATE main advanced (activeloopai#268 cursor relocation + activeloopai#269 memory-backfill merged). activeloopai#269's src/skillify/stage-memory.ts imports WIKI_PROMPT_TEMPLATE and runs its own file-writing summarizer (agent writes the summary file, stage-memory reads it back). Option B had repurposed that shared template for the stdout/no-file model, so on merge stage-memory's agent was told to emit to stdout and never wrote the file, failing all 8 stage-memory.test.ts / stage-memory-wiring.test.ts assertions. Decouple instead of rewriting activeloopai#269: WIKI_PROMPT_TEMPLATE is restored to its original file-based contract (what stage-memory and the cross-fork Next Steps contract expect), and the Option B inline/stdout prompt moves to a dedicated WIKI_STDOUT_PROMPT_TEMPLATE that spawnWikiWorker passes to the live wiki-worker. stage-memory.ts and its tests are untouched and pass as-is. Merged upstream/main into the branch to sync (relocation now lands via activeloopai#268). Full npm test green except the pre-existing cli-index --version parallel-isolation flake (passes in isolation; present on main via activeloopai#269).

github-advanced-security AI found potential problems Jun 16, 2026

View reviewed changes

thenotoriousllama force-pushed the pr/03-cursor-hooks branch from dcf4bae to 9bf4c99 Compare June 16, 2026 19:31

thenotoriousllama changed the title ~~chore(cursor): relocate cursor bundle output to harnesses/cursor/bundle/~~ chore(cursor): relocate cursor bundle to harnesses/cursor/bundle/ + agent restructuring Jun 16, 2026

thenotoriousllama added 3 commits June 16, 2026 18:15

The Bees Knees!

d6b6c5b

thenotoriousllama force-pushed the pr/03-cursor-hooks branch from 9bf4c99 to d6b6c5b Compare June 16, 2026 22:16

coderabbitai Bot reviewed Jun 16, 2026

View reviewed changes

Comment thread tests/cli/cli-install-cursor-fs.test.ts

khustup2 approved these changes Jun 16, 2026

View reviewed changes

thenotoriousllama mentioned this pull request Jun 17, 2026

fix(security): focused codebase security hardening (sqlIdent, temp-dir, command-injection) #271

Closed

4 tasks

khustup2 merged commit 2ecc2d6 into activeloopai:main Jun 17, 2026
10 of 11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(cursor): relocate cursor bundle to harnesses/cursor/bundle/ + agent restructuring#268

chore(cursor): relocate cursor bundle to harnesses/cursor/bundle/ + agent restructuring#268
khustup2 merged 3 commits into
activeloopai:mainfrom
legioncodeinc:pr/03-cursor-hooks

thenotoriousllama commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

khustup2 left a comment

Uh oh!

thenotoriousllama commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

thenotoriousllama commented Jun 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

1. Cursor bundle path relocation

2. Agent restructuring

Additional fixes

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

khustup2 left a comment

Choose a reason for hiding this comment

Uh oh!

thenotoriousllama commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

thenotoriousllama commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading