chore: consolidate ops merge (#80/#82) with cloud-install (#83)

[navarrocorbi-prog]

Summary

Supersedes #85, #80, #82, and #83 (those PRs are closed).

Single merge vehicle for Cursor ops work already reviewed on #85, plus the cloud environment install from #83:

• herdr-thermos-audit skill / /audit + report-only hooks (from feat: herdr-thermos-audit skill + report-only canvas hooks #80)
• catalog hooks, artifact indexes, create-skill/subagent scaffolds (from feat(cursor): add catalog hooks without duplicating skills #82)
• CLI server_not_running structured reporting + OSC 8 local file links (already on Merge PRs 80 and 82 #85)
• durable Cloud Agent install: .cursor/scripts/cloud-install.sh → /opt/herdr binary, website npm ci, Cursor catalog refresh
• reconciled .cursor/environment.json (snapshot + one install script; no catalog-vs-cloud conflict)

Prior Greptile blockers on #85 (duplicate beforeSubmitPrompt, stale indexes) were already fixed on the ops-merge tip before this branch.

CI: Quality gate green.

Test plan

• Quality gate green on this PR
• .cursor/hooks.json has a single beforeSubmitPrompt array with audit + review + fetch
• Committed catalogs include audit + thermos-audit artifacts
• bash -n .cursor/scripts/cloud-install.sh
• Close feat: herdr-thermos-audit skill + report-only canvas hooks #80, feat(cursor): add catalog hooks without duplicating skills #82, chore: cloud agent environment install script #83, Merge PRs 80 and 82 #85
• Mark ready for review and merge (human)
• Do not merge feat(ui): motion, shell layout and unified sidebar foundation #79 in this wave

Supersedes

PR	Fate
#80	closed — superseded
#82	closed — superseded
#83	closed — cloud-install folded in
#85	closed — this branch = #85 tip + #83 reconcile

  

Greptile Summary

This change adds Cursor audit and review orchestration plus a Herdr audit-canvas restoration workflow.

Two confirmed failures need correction before merge:

• .cursor/hooks.json defines beforeSubmitPrompt twice, so JSON parsing leaves only the artifact-fetch hook and omits the audit and review policy hooks.
• .cursor/skills/herdr-thermos-audit/scripts/restore-canvas.sh only discovers pane labels, while the documented bootstrap labels the map, findings, and connections as tabs; those three views are therefore not restored.

Merge safety: not safe to merge until both failures are fixed.

Confidence Score: 4/5

T-Rex Logs

What T-Rex did

• Executed a focused duplicate-key parser check and validated the hook configuration before parsing and the effective beforeSubmitPrompt configuration to support the P1 finding.
• Validated the focused canvas restoration integration-check script against the documented tab-labeled bootstrap and confirmed tab-aware restoration behavior.
• Acknowledged two P1 finding proofs (proofs 2 and 4) and captured their scope around cursor parsing and related checks.
• Validated the cursor-duplicate-before-submit-prompt check by running the focused parser and inspecting the before and after outputs.
• Validated the canvas-tab-label restoration flow using a mocked CLI flow and confirmed all canvas labels are discovered.

_{Ran code and verified through T-Rex}

Comments Outside Diff (3)

1. .cursor/hooks.json, line 29-34 (link)

   Duplicate prompt hook registration

   beforeSubmitPrompt is declared twice. JSON parsing retains only the later declaration at lines 29–34, so the effective prompt-hook list contains only fetch-cursor-artifacts.sh; audit-report-only.sh and review-means-fix.sh from lines 15–28 never load. Keep all intended hooks in one beforeSubmitPrompt array.

   Context Used: Focking gretig zijn en niet stoppen tot perfectie.... (source)

   Artifacts

   
   

   Executed focused duplicate-key parser check source

   • Node script executed against `.cursor/hooks.json`; it prints the duplicate source region and asserts that JSON parsing retains only the later hook entry.

   Hook configuration source before parsing

   • Executed `sed` capture of `.cursor/hooks.json` lines 15-34 showing both `beforeSubmitPrompt` declarations and the overwritten hook commands.

   Parsed effective beforeSubmitPrompt configuration

   • Executed Node parser output showing one effective `beforeSubmitPrompt` command, `fetch-cursor-artifacts.sh`, confirming the earlier hooks are absent.

   

   _{Ran code and verified through T-Rex}

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: .cursor/hooks.json
   Line: 29-34
   
   Comment:
   **Duplicate prompt hook registration**
   
   `beforeSubmitPrompt` is declared twice. JSON parsing retains only the later declaration at lines 29–34, so the effective prompt-hook list contains only `fetch-cursor-artifacts.sh`; `audit-report-only.sh` and `review-means-fix.sh` from lines 15–28 never load. Keep all intended hooks in one `beforeSubmitPrompt` array.
   
   **Context Used:** Focking gretig zijn en niet stoppen tot perfectie.... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))
   
   ---
   
   For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

   

2. General comment

   Duplicate beforeSubmitPrompt key discards two configured hooks

   • Bug
     • .cursor/hooks.json declares hooks.beforeSubmitPrompt twice. The first declaration at lines 15-28 includes audit-report-only.sh, review-means-fix.sh, and fetch-cursor-artifacts.sh; the later declaration at lines 29-34 contains only fetch-cursor-artifacts.sh. The executed parser check observed a single effective command, .cursor/hooks/fetch-cursor-artifacts.sh.
   • Cause
     • Duplicate JSON object member names are parsed with later-key overwrite semantics by the exercised JavaScript JSON parser, replacing the earlier beforeSubmitPrompt array.
   • Fix
     • Remove the duplicate declaration at lines 29-34 and retain all intended hook objects in one beforeSubmitPrompt array.

   _{Ran code and verified through T-Rex}

3. General comment

   Restore discovery ignores labels created by the documented tab bootstrap

   • Bug
     • restore-canvas.sh reads only herdr pane list and selects each target using p.label. The documented bootstrap assigns map, findings, and connections with herdr tab create --label, leaving their initial panes unlabeled. In the executed bootstrap-shaped flow, only the explicitly pane-renamed where-live pane was rendered; the three tab-backed reports were skipped.
   • Cause
     • The discovery logic does not retrieve herdr tab list or map each pane's tab_id to its parent tab label.
   • Fix
     • Extend discovery to retrieve tab metadata, associate each focused-workspace pane with its tab_id label, and use that label when the pane itself has no label. Preserve pane labels for where-live.

   _{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
.cursor/hooks.json:29-34
**Duplicate prompt hook registration**

`beforeSubmitPrompt` is declared twice. JSON parsing retains only the later declaration at lines 29–34, so the effective prompt-hook list contains only `fetch-cursor-artifacts.sh`; `audit-report-only.sh` and `review-means-fix.sh` from lines 15–28 never load. Keep all intended hooks in one `beforeSubmitPrompt` array.

### Issue 2
.cursor/skills/herdr-thermos-audit/scripts/restore-canvas.sh:29-33
**Restore discovery ignores tab labels**

The restore lookup reads labels only from `herdr pane list`, but the documented bootstrap creates `map`, `findings`, and `connections` with `herdr tab create --label`. Those panes have no pane label, so restoration resolves only `where-live` and skips the map, findings, and connections reports. Join panes to their parent tab labels while retaining pane-label support before selecting canvas targets.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "chore(cursor): refresh artifact indexes ..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - Focking gretig zijn en niet stoppen tot perfectie.... (source)

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Warning

Review limit reached

@OnlineChef, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0394f91c-302b-4dac-9fa8-5401a16fb16b

📥 Commits

Reviewing files that changed from the base of the PR and between a260421 and a7ebd2b.

📒 Files selected for processing (30)

• .cursor/INDEX.md
• .cursor/agents/.index.yaml
• .cursor/agents/audit-canvas.md
• .cursor/agents/audit-scope-mapper.md
• .cursor/commands/.index.yaml
• .cursor/commands/audit.md
• .cursor/commands/create-skill.md
• .cursor/commands/create-subagent.md
• .cursor/commands/herdr-local-verify.md
• .cursor/hooks.json
• .cursor/hooks/audit-report-only.sh
• .cursor/hooks/herdr-canvas-shell.sh
• .cursor/hooks/lib/prompt-mode.sh
• .cursor/hooks/review-means-fix.sh
• .cursor/skills/.index.yaml
• .cursor/skills/create-skill/SKILL.md
• .cursor/skills/create-subagent/SKILL.md
• .cursor/skills/herdr-local-verify/SKILL.md
• .cursor/skills/herdr-thermos-audit/SKILL.md
• .cursor/skills/herdr-thermos-audit/UPSTREAM.md
• .cursor/skills/herdr-thermos-audit/references/connections.md
• .cursor/skills/herdr-thermos-audit/references/herdr-canvas.md
• .cursor/skills/herdr-thermos-audit/scripts/render-canvas.sh
• .cursor/skills/herdr-thermos-audit/scripts/restore-canvas.sh
• .gitignore
• AGENTS.md
• src/app/actions.rs
• src/app/input/terminal.rs
• src/cli.rs
• src/update.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Quality remediation needed

CI run 30720067651 failed for PR #87 on cursor/ops-merge-with-cloud-env-6b9d at a7ebd2bfa2de.

PR: #87

Failed jobs

• Test (failure, job id 91422274336, log remediation-logs/91422274336-Test.log)
• Lint (failure, job id 91422274349, log remediation-logs/91422274349-Lint.log)
• Quality gate (failure, job id 91422527361, log remediation-logs/91422527361-Quality_gate.log)

Top extracted errors

• 91422274336-Test.log:509 2026-08-01T21:53:31.3376615Z �[36;1m printf '::error::install-action: %s\n' "$*"�[0m
• 91422274336-Test.log:919 2026-08-01T21:55:36.0686905Z �[1m�[33mwarning�[0m: build failed, waiting for other jobs to finish...
• 91422274349-Lint.log:853 2026-08-01T21:55:20.3199346Z �[1m�[33mwarning�[0m: build failed, waiting for other jobs to finish...
• 91422527361-Quality_gate.log:37 2026-08-01T21:55:55.6439384Z �[36;1m echo "Quality gate failed; $name result was: $result"�[0m
• 91422527361-Quality_gate.log:60 2026-08-01T21:55:55.7361227Z Quality gate failed; lint result was: failure

Agent commands

• Inspect failed logs: gh run view 30720067651 --repo OnlineChefGroep/herdr --log-failed
• Watch required checks: gh pr checks 87 --repo OnlineChefGroep/herdr --watch
• Confirm current PR files: gh pr view 87 --repo OnlineChefGroep/herdr --json files
• Fix only the failing surfaces, push to cursor/ops-merge-with-cloud-env-6b9d, then let CI rerun.

Files touched

• .cursor/INDEX.md
• .cursor/agents/.index.yaml
• .cursor/agents/audit-canvas.md
• .cursor/agents/audit-scope-mapper.md
• .cursor/commands/.index.yaml
• .cursor/commands/audit.md
• .cursor/commands/create-skill.md
• .cursor/commands/create-subagent.md
• .cursor/commands/herdr-local-verify.md
• .cursor/hooks.json
• .cursor/hooks/audit-report-only.sh
• .cursor/hooks/herdr-canvas-shell.sh
• .cursor/hooks/lib/prompt-mode.sh
• .cursor/hooks/review-means-fix.sh
• .cursor/skills/.index.yaml
• .cursor/skills/create-skill/SKILL.md
• .cursor/skills/create-subagent/SKILL.md
• .cursor/skills/herdr-local-verify/SKILL.md
• .cursor/skills/herdr-thermos-audit/SKILL.md
• .cursor/skills/herdr-thermos-audit/UPSTREAM.md
• .cursor/skills/herdr-thermos-audit/references/connections.md
• .cursor/skills/herdr-thermos-audit/references/herdr-canvas.md
• .cursor/skills/herdr-thermos-audit/scripts/render-canvas.sh
• .cursor/skills/herdr-thermos-audit/scripts/restore-canvas.sh
• .gitignore
• AGENTS.md
• src/app/actions.rs
• src/app/input/terminal.rs
• src/cli.rs
• src/update.rs

[greptile-apps]

Restore discovery ignores tab labels

The restore lookup reads labels only from herdr pane list, but the documented bootstrap creates map, findings, and connections with herdr tab create --label. Those panes have no pane label, so restoration resolves only where-live and skips the map, findings, and connections reports. Join panes to their parent tab labels while retaining pane-label support before selecting canvas targets.

Context Used: Focking gretig zijn en niet stoppen tot perfectie.... (source)

Artifacts

Focused canvas restoration integration-check source

• Mocked Herdr CLI script supplies the documented pane/tab bootstrap shape and runs the checked-in and test-corrected discovery paths, demonstrating the label mismatch.

Checked-in restoration against documented tab-labeled bootstrap

• Executed checked-in restoration discovers only the pane-labeled where-live target and leaves map, findings, and connections unresolved, confirming the failure.

Tab-aware restoration against the same documented bootstrap

• Executed test-only tab-label-aware discovery renders all four expected pane targets, showing the required discovery behavior.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: .cursor/skills/herdr-thermos-audit/scripts/restore-canvas.sh
Line: 29-33

Comment:
**Restore discovery ignores tab labels**

The restore lookup reads labels only from `herdr pane list`, but the documented bootstrap creates `map`, `findings`, and `connections` with `herdr tab create --label`. Those panes have no pane label, so restoration resolves only `where-live` and skips the map, findings, and connections reports. Join panes to their parent tab labels while retaining pane-label support before selecting canvas targets.

**Context Used:** Focking gretig zijn en niet stoppen tot perfectie.... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.