Fix/resolve different bugs (#964)

* fix: don't overlap thinking banner over conversation

* feat: support message queue and add attention indicator

* fix(shell): use c to copy for claude

* fix: strip timestamp tags from cursor

* fix: select project when loading session from direct URL

* feat: support attached images for all providers

* feat(opencode): support permission options

* fix: resolve source control and chat UX bugs

- make staging real in the git panel: new /stage and /unstage endpoints,
  /status now reports the actual index via porcelain -z (handles renames,
  conflicts, and paths with spaces), and Stage/Unstage All run real git
  commands instead of toggling client-side state
- add branch search to the header dropdown and Branches tab
- persist the chosen permission mode per provider so a brand-new chat
  keeps it once the session id arrives, instead of reverting to default
- replace cmdk's fuzzy model search with strict token matching so
  "chatgpt" no longer surfaces unrelated models
- unit tests for the git status parser

* feat(git): commit graph in history view and cross-spawn everywhere

- render a VSCode-style commit graph in the source control history:
  lane-assignment algorithm, SVG strip with colored rails, merge and
  branch curves, commit dots, and branch/tag badges per commit
- /commits returns parents and ref decorations across all branches
  (--branches --remotes --tags --topo-order) using unit-separator
  fields so pipes in commit subjects can't break parsing
- collect stats via a single --shortstat pass instead of one
  `git show --stat` call per commit; raise the history limit to 50
- replace child_process spawn with cross-spawn in all runtimes,
  routes, and services: it resolves .cmd shims and PATHEXT on
  Windows (fixing taskmaster's npx invocations) and delegates to
  native spawn elsewhere, removing the per-file win32 ternaries
- unit tests for the log parser and lane assignment

* fix: remove gemini support since google discontinued it

* fix: address code review findings

- validate chat image attachments server-side: only files inside the
  ~/.cloudcli/assets upload store may reach provider file reads
- harden asset serving with nosniff and attachment disposition for
  SVGs to prevent stored XSS
- show the timestamp on image-only user messages
- serialize git stage/unstage calls and defer the status re-sync so
  rapid toggles can't interleave or flicker
- use a literal hex fallback for commit ref badges (alpha suffix on a
  var() string produced invalid CSS)
- stop binding a URL session to a guening
  project instead
- add the missing attentionRequiredIndicator key to all sidebar locales
- clean up dangling conjunctions left the
  de/ru/tr/ja/zh-CN/zh-TW READMEs

* fix: address code scanning findings

- enforce a second image trust boundary in the provider builders:
  buildClaudeUserContent/buildCodexInputItems only accept files inside
  the upload store or the run's working directory (CodeQL path
  injection)
- drop an always-true selectedProject check in handleSubmit
- remove the unused resume option from spawnCursor

* fix: use CodeQL-recognized containment check for image reads

Replace the path.relative guard in isPathInsideDirectory with the
resolve + startsWith(root + sep) idiom so the path-injection barrier
is visible to code scanning; behavior is unchanged.

* fix(security): canonicalize Claude image attachment reads

Resolve image attachment paths with realpath before reading so symlinks
inside allowed roots cannot escape to arbitrary files. Preserve support for
symlinked project/upload roots and add focused coverage for both cases.

* fix: show agent subtask

* fix(sessions): title app-created sessions from the first user message

App-created sessions (started by sending a message from cloudcli) were
titled with placeholder names — "Untitled Codex Session" from the disk
indexer and, briefly, "New session" from the empty canonical upsert —
before a later sync finally settled on the right text, causing the
sidebar title to flicker.

- Codex/OpenCode synchronizers now title app-created sessions (distinct
  app id mapped to a provider id) from the first user message, while
  sessions found purely by indexing keep their existing setup. Claude
  keeps its AI-generated titles; Cursor already used the first message.
- Decode OpenCode's JSON-string-literal prompts so titles no longer
  surface wrapped in quotes; hoist unwrapJsonStringLiteral into
  shared/utils since it's now used by both the reader and synchronizer.
- Guard the sidebar upsert merge so an empty summary can never blank out
  a title that is already set.
- Add codex/opencode synchronizer tests for the app-created vs indexed
  naming paths.

* fix(chat): make message queuing reliable across sessions and turn boundaries

Queued messages had four related defects:

- A queued message flashed and then vanished at flush time: concurrent
  transcript refreshes (the `complete` handler racing the watcher-triggered
  update) could resolve out of order, letting a stale response overwrite
  newer server messages after the optimistic row was pruned. Session slots
  now carry a monotonic fetch ticket and discard stale fetch/refresh/
  fetchMore responses.

- Switching sessions flushed the previous session's queued draft into the
  newly viewed one (sending it with the wrong provider's settings, e.g. a
  Claude model into a Codex session). The composer flush is now scoped to
  its session, and a draft restored into an idle session sends after a
  short grace period so a live-run ack can cancel it.

- The thinking banner never appeared for a queued turn: the chat handler's
  session-keyed completeRun safety net could fire after a queued message
  had already started the session's next run, emitting a spurious
  `complete` that killed it. The safety net is now scoped to its own run
  via completeRunIfCurrent (with a regression test).

- Queued messages only sent while their session was being viewed. Drafts
  now persist their send options (model, effort, permissions) at queue
  time, and a new app-level useQueuedMessageAutoSend hook dispatches a
  non-viewed session's queued message as soon as its run completes, using
  the storage key as the claim ticket to prevent double sends.

server/modules/providers/list/cursor/cursor-models.provider.ts

@@ -1,7 +1,6 @@
 import { access, readdir } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
 
 import crossSpawn from 'cross-spawn';
 
@@ -446,11 +445,6 @@ export const CURSOR_FALLBACK_MODELS: ProviderModelsDefinition = {
       label: "gpt-5.2-xhigh-fast",
       description: "GPT-5.2 Extra High Fast",
     },
-    {
-      value: "gemini-3.1-pro",
-      label: "gemini-3.1-pro",
-      description: "Gemini 3.1 Pro",
-    },
     {
       value: "gpt-5.4-mini-none",
       label: "gpt-5.4-mini-none",
@@ -531,16 +525,6 @@ export const CURSOR_FALLBACK_MODELS: ProviderModelsDefinition = {
       label: "gpt-5.1-high",
       description: "GPT-5.1 High",
     },
-    {
-      value: "gemini-3-flash",
-      label: "gemini-3-flash",
-      description: "Gemini 3 Flash",
-    },
-    {
-      value: "gemini-3.5-flash",
-      label: "gemini-3.5-flash",
-      description: "Gemini 3.5 Flash",
-    },
     {
       value: "gpt-5.1-codex-mini-low",
       label: "gpt-5.1-codex-mini-low",
@@ -589,7 +573,9 @@ type CursorModelRow = {
 
 const CURSOR_MODELS_TIMEOUT_MS = 10_000;
 const CURSOR_CHATS_ROOT = path.join(os.homedir(), '.cursor', 'chats');
-const spawnFunction = process.platform === 'win32' ? crossSpawn : spawn;
+// cross-spawn resolves .cmd shims/PATHEXT on Windows and delegates to
+// child_process.spawn everywhere else.
+const spawnFunction = crossSpawn;
 const ANSI_PATTERN = new RegExp(
   // eslint-disable-next-line no-control-regex
   '[\\u001B\\u009B][[\\]()#;?]*(?:'

server/modules/providers/list/cursor/cursor-session-synchronizer.provider.ts

@@ -141,7 +141,13 @@ export class CursorSessionSynchronizer implements IProviderSessionSynchronizer {
       }
 
       const text = typeof data.message?.content?.[0]?.text === 'string' ? data.message.content[0].text : '';
-      const firstLine = text.replace(/<\/?user_query>/g, '').trim().split('\n')[0];
+      // Drop Cursor's `<timestamp>…</timestamp>` prefix and `<user_query>` tags
+      // so the session name comes from the actual first line the user typed.
+      const firstLine = text
+        .replace(/<timestamp>[\s\S]*?<\/timestamp>/g, '')
+        .replace(/<\/?user_query>/g, '')
+        .trim()
+        .split('\n')[0];
 
       return {
         sessionId,

server/modules/providers/list/cursor/cursor-sessions.provider.ts

@@ -2,6 +2,7 @@ import crypto from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 
+import { parseImagesInputTag } from '@/shared/image-attachments.js';
 import type { IProviderSessions } from '@/shared/interfaces.js';
 import type { AnyRecord, FetchHistoryOptions, FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
 import {
@@ -24,7 +25,7 @@ type CursorJsonBlob = CursorDbBlob & {
   parsed: AnyRecord;
 };
 
-type CursorMessageBlob = {
+export type CursorMessageBlob = {
   id: string;
   sequence: number;
   rowid: number;
@@ -59,17 +60,42 @@ function unwrapUserQueryText(value: string, role: 'user' | 'assistant'): string
     return value;
   }
 
-  const normalized = value.trimStart();
+  // Cursor wraps user turns as `<timestamp>…</timestamp>\n<user_query>…</user_query>`.
+  // Show only the `<user_query>` content, trimmed so there are no blank lines
+  // at the top/bottom and the `<timestamp>` prefix is dropped entirely.
   const openTag = '<user_query>';
   const closeTag = '</user_query>';
-  if (!normalized.startsWith(openTag)) {
-    return value;
+  const openIndex = value.indexOf(openTag);
+  if (openIndex >= 0) {
+    const afterOpen = value.slice(openIndex + openTag.length);
+    const closeIndex = afterOpen.lastIndexOf(closeTag);
+    const inner = closeIndex >= 0 ? afterOpen.slice(0, closeIndex) : afterOpen;
+    return inner.trim();
   }
 
-  const afterOpen = normalized.slice(openTag.length);
-  const closeIndex = afterOpen.lastIndexOf(closeTag);
-  const inner = closeIndex >= 0 ? afterOpen.slice(0, closeIndex) : afterOpen;
-  return inner.trim();
+  // No `<user_query>` wrapper: still strip a leading `<timestamp>…</timestamp>`.
+  return value.replace(/^\s*<timestamp>[\s\S]*?<\/timestamp>\s*/, '').trim();
+}
+
+/**
+ * Unwraps one user-authored text payload and splits off the `<images_input>`
+ * attachment block appended by the chat composer. Assistant text passes
+ * through untouched.
+ */
+function extractUserTextAndImages(
+  value: string,
+  role: 'user' | 'assistant',
+): { text: string; images?: Array<{ path: string; name?: string }> } {
+  const unwrapped = unwrapUserQueryText(value, role);
+  if (role !== 'user') {
+    return { text: unwrapped };
+  }
+
+  const { text, attachments } = parseImagesInputTag(unwrapped);
+  return {
+    text,
+    images: attachments.length > 0 ? attachments : undefined,
+  };
 }
 
 function normalizeToolId(value: unknown): string | null {
@@ -401,8 +427,11 @@ export class CursorSessionsProvider implements IProviderSessions {
   /**
    * Converts Cursor SQLite message blobs into normalized messages and attaches
    * matching tool results to their tool_use entries.
+   *
+   * Public so tests can drive history normalization with synthetic blobs
+   * without needing a real Cursor store.db.
    */
-  private normalizeCursorBlobs(blobs: CursorMessageBlob[], sessionId: string | null): NormalizedMessage[] {
+  normalizeCursorBlobs(blobs: CursorMessageBlob[], sessionId: string | null): NormalizedMessage[] {
     const messages: NormalizedMessage[] = [];
     const toolUseMap = new Map<string, NormalizedMessage>();
     const baseTime = Date.now();
@@ -442,7 +471,16 @@ export class CursorSessionsProvider implements IProviderSessions {
                 text = unwrapUserQueryText(content.message.content, role);
               }
             }
-            if (text?.trim()) {
+            const { text: cleanText, images } = role === 'user'
+              ? (() => {
+                const parsed = parseImagesInputTag(text);
+                return {
+                  text: parsed.text,
+                  images: parsed.attachments.length > 0 ? parsed.attachments : undefined,
+                };
+              })()
+              : { text, images: undefined };
+            if (cleanText?.trim() || images) {
               messages.push(createNormalizedMessage({
                 id: baseId,
                 sessionId,
@@ -450,7 +488,8 @@ export class CursorSessionsProvider implements IProviderSessions {
                 provider: PROVIDER,
                 kind: 'text',
                 role,
-                content: text,
+                content: cleanText,
+                images,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -502,8 +541,8 @@ export class CursorSessionsProvider implements IProviderSessions {
             }
 
             if (part?.type === 'text' && part?.text) {
-              const normalizedPartText = unwrapUserQueryText(part.text, role);
-              if (!normalizedPartText) {
+              const { text: normalizedPartText, images } = extractUserTextAndImages(part.text, role);
+              if (!normalizedPartText && !images) {
                 continue;
               }
               messages.push(createNormalizedMessage({
@@ -514,6 +553,7 @@ export class CursorSessionsProvider implements IProviderSessions {
                 kind: 'text',
                 role,
                 content: normalizedPartText,
+                images,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -553,8 +593,8 @@ export class CursorSessionsProvider implements IProviderSessions {
           && content.content.trim()
           && !isInternalCursorText(content.content)
         ) {
-          const normalizedText = unwrapUserQueryText(content.content, role);
-          if (!normalizedText) {
+          const { text: normalizedText, images } = extractUserTextAndImages(content.content, role);
+          if (!normalizedText && !images) {
             continue;
           }
           messages.push(createNormalizedMessage({
@@ -565,6 +605,7 @@ export class CursorSessionsProvider implements IProviderSessions {
             kind: 'text',
             role,
             content: normalizedText,
+            images,
             sequence: blob.sequence,
             rowid: blob.rowid,
           }));