Support Cursor and Windsurf hook systems #1
Description
Cursor and Windsurf have programmable hook systems similar to Claude Code PreToolUse. Windsurf Cascade hooks support pre_run_command, pre_write_code, pre_mcp_tool_use with the same exit-code-2-to-block architecture. 94 unpatched CVEs affect Cursor and Windsurf (1.8M developers). Proposal: create install-hooks-windsurf.mjs, add Cursor allowlist integration, auto-detect which agents are installed. References: CVE-2026-22708 (Cursor sandbox bypass via shell builtins), IDEsaster research (30+ CVEs across all major IDEs).