feat(cursor): add Cursor as a third agent to the installer

[drorIvry]

What

Folds Cursor into the multi-agent monorepo installer. The same curl | sh
one-liner now detects Cursor (alongside Claude Code + OpenAI Codex) and installs
the matching Rogue plugin into each, writing the shared ~/.rogue-env once.

The crux — Cursor has no plugin CLI

Claude and Codex install via their native plugin CLIs (claude plugin install /
codex plugin add), which git-clone the marketplace — no local files needed.
Cursor has no equivalent command. The only programmatic install is a file copy
into ~/.cursor/plugins/local/<name>. So the Cursor path downloads the release
tarball, extracts it, and copies plugins/cursor/ into place — mirroring the
standalone cursor repo's own installer. This copy-vs-CLI asymmetry is load-bearing.

Changes

• plugins/cursor/ — ported from rogue-plugin-cursor: python3 pure-relay
  dispatcher (rogue-hook.py), endpoint /api/v1/hooks/cursor, header
  x-rogue-source: cursor, commands/{setup,status}.md. Reuses the shared
  ~/.rogue-env. Two deliberate edits vs upstream: dropped the auto-update.sh
  sessionStart entry + script (the Cursor Team Marketplace is the native
  managed/auto-update path), and stripped a leftover /tmp debug-log block from
  rogue-hook.py.
• .cursor-plugin/marketplace.json — repo-root Team-Marketplace import target
  (source: ./plugins/cursor).
• install.sh / install.ps1 — Cursor detection (cursor on PATH or
  ~/.cursor present), download → extract → copy install, warn if python3 is
  absent. Windows included (%USERPROFILE%\.cursor\plugins\local\rogue).
• scripts/build-release.sh — emit versionless rogue-plugin-cursor.tar.gz.
• README.md / CLAUDE.md — document the third agent + the asymmetry.

Verification

• Dispatcher parses + runs, emits valid JSON, no debug file written.
• hooks.json valid, no auto-update entry.
• build-release.sh builds all three tarballs; cursor tarball contains the right tree.
• End-to-end extract+find+copy simulation lands the plugin correctly in a sandbox
  ~/.cursor/plugins/local/rogue.
• sh -n / bash -n clean.
• Security review (multi-agent): no high-confidence findings; tar-slip and
  relative-hook-path candidates both filtered out as below threshold.

Ships live once a GitHub release tagged with the rogue-plugin-cursor.tar.gz
asset exists on qualifire-dev/rogue-plugins (the one-liner's cursor download URL).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RLk1XJQ1uWYSdn5Ro31JHv

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 17 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f70a3f81-c363-4200-b08a-bfdb0c495fc3

📥 Commits

Reviewing files that changed from the base of the PR and between 4494ea3 and 211dea7.

📒 Files selected for processing (15)

• .cursor-plugin/marketplace.json
• .github/workflows/validate.yml
• CLAUDE.md
• README.md
• install.ps1
• install.sh
• plugins/cursor/.cursor-plugin/plugin.json
• plugins/cursor/commands/setup.md
• plugins/cursor/commands/status.md
• plugins/cursor/hooks/hooks.json
• plugins/cursor/scripts/hook.ps1
• plugins/cursor/scripts/hook.sh
• plugins/cursor/scripts/setup.ps1
• plugins/cursor/scripts/setup.sh
• scripts/build-release.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/cursor-plugin

---

_{Comment @coderabbitai help to get the list of available commands.}