Widen NTP main scrollbar and fix Cursor format hook on Windows#2851
Widen NTP main scrollbar and fix Cursor format hook on Windows#2851anpete wants to merge 5 commits into
Conversation
Use theme tokens for the main page scroller (12px, 15px on Windows) so it matches the customizer drawer, and run Prettier from a Node afterFileEdit hook to avoid spawning visible bash terminals on Windows.
Stick to WebKit-only styling so Windows does not fall back to classic scrollbars with arrow buttons.
Revert theme tokens and standard scrollbar properties; only widen the WebKit track from 4px to 8px.
[Beta] Generated file diffTime updated: Thu, 09 Jul 2026 12:56:46 GMT AppleFile has changed IntegrationFile has changed WindowsFile has changed |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7deaf33. Configure here.
|
|
||
| if (!existsSync(absolutePath)) { | ||
| return; | ||
| } |
There was a problem hiding this comment.
Hook skips files not directories
Low Severity
The new hook treats any existing path with existsSync as formatable. The removed format.sh used test -f and exited when the path was not a regular file, so a directory path would not invoke Prettier on a folder.
Reviewed by Cursor Bugbot for commit 7deaf33. Configure here.
|
This PR requires a manual review and approval from a member of one of the following teams:
|
There was a problem hiding this comment.
Injected PR Evaluation: Web Compatibility & Security
Scope: 4 files changed — .cursor/hooks/ dev tooling (bash → Node) + NTP scrollbar CSS (4px → 10px). Zero changes to injected/, messaging/, wrapper utilities, captured globals, or message bridge.
Web Compatibility Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| (none — injected) | — | — | No injected/src/ or third-party page-world code touched. |
special-pages/pages/new-tab/app/components/App.module.css |
87–88 | info | WebKit-only ::-webkit-scrollbar styling on .mainScroller (pre-existing pattern). Firefox uses scrollbar-width elsewhere; unchanged here. NTP-only embedded page — no arbitrary-site compat risk. |
special-pages/pages/new-tab/app/components/App.module.css |
87–88 | info | Main scrollbar widened from 4px → 10px, closer to drawer --ntp-drawer-scroll-width: 12px. Layout compensation via .tube { padding-left: calc(100vw - 100%) } (line 19–20) measures actual scrollbar gutter dynamically, so the width change should not cause persistent layout shift. |
.cursor/hooks/format.mjs |
— | info | Dev-only Cursor IDE hook; not bundled into browser builds. No web-compat surface. |
Security Assessment
| File | Lines | Severity | Finding |
|---|---|---|---|
| (none — injected) | — | — | No messaging transports, bridge trust boundaries, captured-globals, or postMessage usage changed. |
.cursor/hooks/format.mjs |
51–91 | info | Runs in local Node during Cursor afterFileEdit; stdin JSON is IDE-controlled. Uses spawnSync(process.execPath, [prettierCli, ...]) — no shell interpolation, good command-injection hygiene. Fail-open on errors (intentional for dev UX). |
.cursor/hooks/format.mjs |
82 | info | Absolute paths outside repo root still reach Prettier (same as deleted format.sh). Acceptable for local dev tooling; not a production attack surface. |
special-pages/.../App.module.css |
88 | info | Static CSS literal; no page-derived values, no injection vector. |
Risk Level
Low Risk — Cosmetic NTP special-page CSS and local Cursor dev-hook refactor; no injected script, API shim, messaging, or security-boundary changes.
Recommendations
- Visual QA (info): Spot-check NTP main scroller on macOS/Windows/iOS/Android WebViews — scrollbar should be easier to grab without layout regression.
- Consistency (optional): Consider a shared CSS variable (e.g.
--ntp-main-scroll-width) alongside--ntp-drawer-scroll-widthso main/drawer scrollbar widths stay aligned in future tweaks. - No injected-specific tests required — change set is outside the injected runtime surface.
Sent by Cursor Automation: Web compat and sec
|
@shakyShane hey could you take a look? just looping you in based on the asana activity https://app.asana.com/1/137249556945/project/1209698262999393/task/1209458074266070?focus=true |
|
Thanks @sashalavron - I’m going to give this a test locally since I’m concerned about the differences across platforms (we had a bunch of issues in the past). @anpete as mentioned why not break out the cursor fixes to a separate PR so we can get that moving |




https://app.asana.com/1/137249556945/project/1209363561374085/task/1209458074266070?focus=true
Description
afterFileEditbash format hook with a Node script so Windows does not spawn visiblebash --loginterminals on every agent edit.Testing Steps
?platform=windows) and confirm the main scrollbar is slightly wider than before, with no top/bottom arrow buttons.Checklist
Note
Low Risk
Dev-only hook change plus a small CSS tweak; no auth, data, or core product logic.
Overview
NTP: The main scroller’s WebKit scrollbar width in
App.module.cssis increased from 4px to 10px; track and thumb styling are unchanged.Cursor: The
afterFileEdithook inhooks.jsonnow runsnode .cursor/hooks/format.mjsinstead offormat.sh. The new script reads hook JSON from stdin, resolves the edited path, and runs Prettier viarequire.resolvewithwindowsHideand ignored stdio so Windows does not flashbash --loginterminals.format.shis removed. Errors are swallowed so formatting never blocks edits.Reviewed by Cursor Bugbot for commit 7deaf33. Bugbot is set up for automated code reviews on this repo. Configure here.