fix: support Cursor's nested transcript directory layout

[cbb330]

Summary

• Cursor recently changed its transcript storage from a flat layout (agent-transcripts/<uuid>.jsonl) to a nested layout (agent-transcripts/<uuid>/<uuid>.jsonl). The discovery and source file lookup functions only handled the flat layout, causing sessions from newer Cursor versions to be invisible.
• Updates DiscoverCursorSessions and FindCursorSourceFile to handle both flat and nested layouts.
• Extracts dedup logic into cursorAddSeen helper to avoid repetition between the two code paths.

Test plan

• New table-driven tests for nested layout discovery (jsonl, txt, dedup, mixed flat+nested)
• New tests for FindCursorSourceFile with nested layout
• Existing flat-layout tests continue to pass
• Verified against real Cursor transcript directory on macOS (~/.cursor/projects/)

[roborev-ci]

roborev: Combined Review (b2fa058)

Synthesis unavailable. Showing individual review outputs.

codex — default (done)

Inspecting the patched parser paths and the surrounding Cursor discovery logic to validate correctness against the existing layout and tests.
The shell sandbox is rejecting the default invocation, so I’m switching to a minimal non-login shell read to finish the static inspection without executing the code.

Review Findings

• Severity: Medium

• Location: internal/parser/discovery.go:648

• Problem: FindCursorSourceFile now checks the flat path before the nested path for a given extension, but DiscoverCursorSessions will retain the nested file when both layouts coexist for the same session and extension. That makes discovery and source lookup disagree on which transcript is canonical, so later lookups can reopen a different/stale file than the one originally parsed.

• Fix: Make FindCursorSourceFile use the same precedence as discovery for same-extension conflicts, or extract the path selection into shared logic.

• Severity: Low

• Location: internal/parser/discovery.go:579

• Problem: The nested-layout scan accepts any .txt/.jsonl file directly inside agent-transcripts/<uuid>/, even though the documented layout is <uuid>/<uuid>.{txt,jsonl}. That can surface auxiliary files as separate sessions, and FindCursorSourceFile will not be able to resolve them later because it only searches for the filename matching the directory/session ID.

• Fix: In nested directories, only accept files whose stem matches the parent directory name.

Summary

Adds Cursor nested transcript-directory support to session discovery and source-file lookup.

---

codex — security (done)

Reviewing the diff in internal/parser/discovery*.go with focus on path handling, auth boundary assumptions, and any new injection or traversal exposure introduced by the nested Cursor transcript support.
The shell sandbox is rejecting normal reads, so I’m switching to non-login commands to inspect the relevant code directly and verify the path-resolution flow around the new nested layout handling.
Summary: The change adds support for Cursor’s nested transcript layout and preserves the existing FindCursorSourceFile root-containment check for returned source paths. I did not identify any new injection, authz, credential exposure, traversal, CI/CD, or sensitive-data handling issues in the added logic.

No issues found.

---

gemini — default (failed)

Error: Review failed. Check CI logs for details.

[roborev-ci]

roborev: Combined Review (1d697a8)

Verdict: No medium-or-higher findings; the reviewed changes look clean.

All available reviews found no Medium, High, or Critical issues.

• codex default review: no issues found
• codex security review: no issues found
• gemini review: no output generated

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[wesm]

thanks! will merge after CI runs