COR-5419 Populate Cwd from workspace_roots[0] for Cursor handlers

[ashwin-corridor]

Summary

Populate ctx.Cwd for every unified Cursor handler from input.WorkspaceRoots[0], and add a Cwd field to PromptContext so the Cursor prompt path can carry the workspace root the same way the other unified contexts already do.

Cursor launches hook binaries from its config directory (~/.cursor) rather than the project root, so consumers that fall back to os.Getwd() end up reporting a misleading path. Every Cursor hook payload already includes a workspace_roots array with the actual project directories, so we just thread it through.

Changes in unified.go:

• StopContext — cursor-stop now sets Cwd from workspace_roots[0].
• OnBeforeExecution — cursor-before-shell falls back to workspace_roots[0] when input.Cwd is empty; cursor-before-mcp populates Cwd from workspace_roots[0].
• OnAfterFileEdit — cursor-after-file-edit populates Cwd from workspace_roots[0].
• PromptContext gains a Cwd field; cursor-before-submit-prompt populates it from workspace_roots[0].
• New unexported cursorWorkspaceRoot([]string) string helper.

Motivation

Unblocks the consumer-side fix in CorridorSecurity/corridor#4216, which lands a workaround that reads RawCursor.WorkspaceRoots directly. Once this hookshot version is picked up, the consumer can drop that workaround and rely on ctx.Cwd end-to-end on every Cursor handler.

Test plan

• go build ./... clean
• go vet ./... clean
• go test ./... — all existing tests pass
• Bump hookshot version in corridor and verify Directory Matches dashboard no longer shows ~/.cursor rows

Made with Cursor

---

[corridor-security]

Summary: This PR propagates accurate working directory (Cwd) values from Cursor's workspace_roots into multiple contexts and adds a helper; it introduces no command execution, file I/O, or network calls.

Risk: Low risk. The changes only pass contextual strings to handlers and improve the basis for path validation, with no new attack surface or exploitable paths identified.

Recommendations:

• When handlers use ctx.Cwd for path checks, normalize and bound paths with filepath.Clean and filepath.Rel to the intended project root, treating Cwd as untrusted input.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.