Cursor-agent on Windows launched from Git Bash rejects every hook: the PowerShell wrapper is run with bash eval

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor CLI

Describe the Bug

When cursor-agent is launched from a Git Bash terminal on Windows, every hook is rejected before it runs, and any tool call guarded by a hook is refused. Cursor builds a PowerShell wrapper around the hook command and the CLI executes that wrapper with the user’s shell, which is bash. Bash cannot parse & {. The CLI then exits 0 with subtype=success about 22 seconds later, so from outside it looks like the agent declined the tool. Launching the CLI from PowerShell avoids it.

The error, verbatim:

Rejected: Hook blocked with message: --: eval: line 1: syntax error near unexpected token &' --: eval: line 1: $OutputEncoding = [System.Text.Encoding]::UTF8; Get-Content -LiteralPath ‘\cursor-hooks-\payload.json’ -Raw | & { $input | & ‘’ }’

Steps to Reproduce

  1. Windows 11, Git Bash installed, any preToolUse hook in ~/.cursor/hooks.json.
  2. Open Git Bash (SHELL=C:\Program Files\Git\bin\bash.exe) and run cursor-agent.
  3. Ask for one tool call that runs a shell command.

Expected Behavior

The hook runs (with powershell.exe, which the wrapper is written for) and the tool call proceeds.

Operating System

Windows 10/11

Version Information

Cursor CLI 2026.09.15-d2fe57e (also 2026.09.18-9a7762b) — from agent about
Windows 11 Home 10.0.26200.9457
Git Bash 5.2.37(1)-release

For AI issues: which model did you use?

grok-4.6 (agent mode). The model is not the cause: the hook is rejected before any tool runs, and the wrapper text in the error is generated by Cursor.

For AI issues: add Request ID with privacy disabled

Not available: the run was on a test machine and the session has since been cleared.
Identifiers we do have: cursor-agent 2026.09.15-d2fe57e launched from Git Bash on 2026-09-21,
workspace E:\rc-ws\measure-cursor-cli; the identical failure on 2026-09-18 with the same CLI
build. The bug reproduces from the steps above without a request id.

Additional Information

Deterministic across two sittings eleven days apart; only the temp directory name differs. Attached: the stream-json of the run (M3.jsonl) and the hook log excerpt.

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

5

Hey, thanks for the detailed report, and for separating the model from the cause right away. That saves time.

This is a known issue we’re tracking, and I’ve added your report to it. On Windows, the CLI builds the hook command for PowerShell, but when cursor-agent inherits the Git Bash environment, it passes that command to bash. Bash can’t parse the wrapper, the hook fails, and the tool call gets marked as rejected, even though the hook just didn’t run.

The workaround you found is the right one. Start cursor-agent from a PowerShell or cmd window opened directly from the Start menu, not from Git Bash and not from anything launched from Git Bash. In that case, hooks run normally and allow or deny works as expected.

I can’t share an ETA yet, but I’ll reply in this thread once there’s an update.