fix(desktop): let Cursor chats Read attached images

[arul28]

Problem
Cursor ADE chats could not Read attached screenshots. The model reported it could not open the image.

Cause
ADE inlines image bytes into the Cursor SDK send. Cursor then copies them to ~/.cursor/projects/<lane-slug>/assets/ and tells the model to Read that path. Oversized attachments are named as <project>/.ade/attachments/<uuid>.<ext>. Both sit outside a worktree lane, so the host path guard denied the Read.

Change and boundary
The Cursor hook allowlists those two roots for read only. Worker init now passes projectRoot so the attachments grant does not guess from the lane path (missing root fails closed). After realpath, the attachments directory basename must be attachments, so a junction onto .ade or .ade/secrets cannot inherit the grant. Writes, shell, other Cursor slugs, .ade/secrets, and out-of-tree redirects stay denied. Attachments are not copied into the lane. Other providers, Cursor Cloud, CLI/TUI/iOS surfaces, and the published ADE SDK are unchanged — they already share this host hook or do not evaluate it.

Verification

• cursorSdkPolicy.test.ts + cursorSdkPool.test.ts: 71 passed, 1 skipped
• /quality gate empty (High secrets-via-redirected-attachments fixed; layout inference removed)
• Windows: pathComparisonKey + realpathSync.native; posix symlink cases match existing skipIf(win32) pattern

Authored with Cursor Grok 4.6 via ADE.

  Open in ADE  ·  ade/ade-chat-image-access branch  ·  PR #1226

---

Note

Medium Risk
Changes security-sensitive Cursor SDK path guards and attachment read policy; mitigated by read-only grants, explicit project root, and realpath/symlink checks with new tests.

Overview
Fixes Cursor local chats failing to open attached screenshots because the SDK path guard only allowed reads inside the lane worktree, while Cursor tells the model to Read inlined images from ~/.cursor/projects/<slug>/assets/ and oversized attachments from <project>/.ade/attachments/.

The Cursor hook hard guard now read-only allowlists those two roots. Worker init carries a required projectRoot through cursorSdkProtocol, pool, worker, and agentChatService so .ade/attachments is not inferred from the lane (missing root fails closed). isAllowedProjectAttachmentRead uses realpath containment, requires the attachments directory basename to stay attachments, blocks .ade/secrets, and denies symlink/junction escapes; assets joins the existing Cursor support read roots. Writes, shell, and other slugs stay denied.

Tests cover assets, staged attachments, and symlink cases; chat docs describe the two-path image Read wiring.

^{Reviewed by Cursor Bugbot for commit e6c972e. Configure here.}

Summary by CodeRabbit

• New Features

  • Cursor-powered chat can now read staged project attachments and workspace image assets when appropriate.
  • Project context is included when processing Cursor requests, enabling more accurate access to relevant files.

• Bug Fixes

  • Improved file-access safeguards continue to block writes, secret files, shell access, unrelated projects, and unsafe symbolic-link targets.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
ade	Ignored		Sep 4, 2026 7:49pm UTC

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d1a0d2da-2275-4df8-855b-3913c231fe3a)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 487de0cd-58ad-4116-8769-ee210e14f1d0

📥 Commits

Reviewing files that changed from the base of the PR and between 3c94245 and e6c972e.

⛔ Files ignored due to path filters (3)

• docs/features/chat/README.md is excluded by !docs/**
• docs/features/chat/agent-routing.md is excluded by !docs/**
• docs/features/chat/composer-and-ui.md is excluded by !docs/**

📒 Files selected for processing (7)

• apps/desktop/src/main/services/chat/agentChatService.ts
• apps/desktop/src/main/services/chat/cursorSdkPolicy.test.ts
• apps/desktop/src/main/services/chat/cursorSdkPolicy.ts
• apps/desktop/src/main/services/chat/cursorSdkPool.test.ts
• apps/desktop/src/main/services/chat/cursorSdkPool.ts
• apps/desktop/src/main/services/chat/cursorSdkProtocol.ts
• apps/desktop/src/main/services/chat/cursorSdkWorker.ts

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The Cursor SDK now receives projectRoot during initialization. Path policy checks allow approved Cursor assets and staged project attachments while rejecting unsafe, foreign, secret, and write paths.

Changes

Cursor SDK path policy

Layer / File(s)	Summary
Attachment and asset path guards apps/desktop/src/main/services/chat/cursorSdkPolicy.ts, apps/desktop/src/main/services/chat/cursorSdkPolicy.test.ts	The policy allows reads from Cursor assets and the active project’s staged attachments. Tests cover denied writes, foreign projects, secrets, shell access, and unsafe symlink targets.

Project-root worker propagation

Layer / File(s)	Summary
Project-root worker propagation apps/desktop/src/main/services/chat/cursorSdkProtocol.ts, apps/desktop/src/main/services/chat/cursorSdkPool.ts, apps/desktop/src/main/services/chat/cursorSdkWorker.ts, apps/desktop/src/main/services/chat/agentChatService.ts, apps/desktop/src/main/services/chat/cursorSdkPool.test.ts	The project root is added to the worker initialization contract, passed through pool setup and chat service calls, and supplied to hook evaluation. Initialization tests verify the value.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to e6c97

The attachment-read support is narrowly scoped and covered by tests for writes, foreign paths, secrets, shell access, and symlink redirects. No current merge-blocking risk is established.

Suggested labels: desktop, docs

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 6 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enabling Cursor chats to read attached images in the desktop application.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 6 files. (1 skipped: 1 too large.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ade/ade-chat-image-access

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}