fix(cursor): cursor skills discovery

[nemesiscodex]

What Changed

Cursor skills now show up in the $ picker, scoped to the project or worktree where the thread actually runs.

• Server: a new CursorSkills scanner reads .cursor/skills and .agents/skills at user and project scope for a given working directory, applying Cursor's precedence and naming rules (directory name wins over frontmatter name, .cursor beats .agents, and project beats user). Discovery is bounded and best-effort, rejects roots and symlinks that escape their canonical boundaries, reads at most 64 KiB of metadata per SKILL.md, and never sends skill bodies over the wire.
• Contracts / RPC: providers.skillInventory takes a thread or project id—never a raw path—and ServerProvider optionally advertises skillInventoryMode: "project"; absence means snapshot mode. ProviderSkillInventory resolves the id to a cwd with the same helper provider sessions use, so a worktree thread lists that worktree's skills.
• Clients: web and mobile composer and message surfaces request thread-scoped inventories for durable threads and project-scoped inventories for local drafts, only for project-mode providers. Codex, Claude, and other snapshot-mode providers retain the existing zero-round-trip path.
• Docs: a skill-inventory section in docs/internals/providers.md documents inventory modes, cwd resolution, typed request failures, best-effort discovery, canonical containment, and traversal budgets.

Why

This addresses the Cursor portion of pingdotgg/t3code#2736, which reports that Cursor and OpenCode skills exist on disk but remain absent from T3 Code's provider inventory. OpenCode discovery remains outside this PR's scope.

The $ picker rendered ServerProvider.skills, an environment-wide snapshot computed once from wherever the server started. That is wrong for every project but one, and empty for Cursor: its ACP surface only exposes slash-command metadata mixed with built-ins, with no paths and no scope, so there was nothing reliable to snapshot.

Cursor's inventory depends on the directory where the agent will run, so the lookup must be per thread or project rather than per environment. Passing an id instead of a path, together with canonical containment of skill roots and symlinks, keeps the picker from becoming a filesystem probe.

UI Changes

The $ picker with Cursor selected: empty before, populated with the project's skills after.

Before

After

cursor-skills.mov

Checklist

• This PR is small (is not, sorry about that)
• This PR is focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

---

Note

Medium Risk
Adds filesystem traversal and a new read RPC scoped by thread/project; discovery is bounded and best-effort, but wrong cwd resolution would show incorrect skills for worktree threads.

Overview
Cursor skills now appear in the $ picker because inventory is resolved for the actual working directory (project root or worktree), not from a one-time environment snapshot.

Server: discoverCursorSkills scans eight precedence-ordered roots (user/project × .claude, .codex, .agents, .cursor), merges by directory name, and applies Cursor’s naming/description rules. CursorDriver exposes optional skillInventory; snapshots get skillInventoryMode: "project". providers.skillInventory accepts thread or project ids (not paths), resolves cwd via getThreadWorkspaceContextById and the same helper provider sessions use, then calls the driver.

Clients: Web and mobile use shared useProviderSkills / selectProviderSkills—snapshot providers stay zero-round-trip; project-mode providers fetch per (environment, scope, instance) with snapshot fallback before/after RPC failure.

Contracts: ServerProvider.skillInventoryMode, inventory input/result types, and orchestration read scope for the new RPC.

^{Reviewed by Cursor Bugbot for commit 6f02789. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add Cursor skill discovery and a providers.skillInventory RPC for project-scoped skills

• Introduces discoverCursorSkills in CursorSkills.ts, which scans eight filesystem roots (user and project, across .claude, .codex, .agents, .cursor) in precedence order and returns a merged, name-sorted list of skills.
• Adds a skillInventory capability to ProviderInstance and decorates provider snapshots with skillInventoryMode: "project" when the capability is present, signaling clients to fetch skills dynamically.
• Exposes a new providers.skillInventory WebSocket RPC that resolves the caller's scope (thread or project) to a working directory and returns skills from the provider instance or falls back to snapshot skills.
• Adds useProviderSkills hooks on web and mobile that transparently return snapshot skills for non-project-mode providers and issue a skillInventory request for project-mode providers.
• Extends ProjectionSnapshotQuery with getThreadWorkspaceContextById to resolve thread workspace and worktree paths needed for cwd resolution.
• Behavioral Change: composers and timelines on web and mobile now source skills from useProviderSkills instead of directly reading provider.skills, so displayed skills may differ when a project-mode provider is active.

^{Macroscope summarized 6f02789.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 089d20da-b1fa-42c7-8545-1379dabef4dd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions review: one finding in apps/server/src/provider/ProviderSkillInventory.ts.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit be0f379. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

...

^{You can customize Macroscope's approvability policy. Learn more.}