@cloudcli-ai/cloudcli 1.36.0 → 1.36.2

package/server/modules/assets/index.ts

@@ -0,0 +1,3 @@
+// Express router mounted at /api/assets by server/index.js (upload + serving
+// of chat image attachments stored in the global ~/.cloudcli/assets folder).
+export { default as assetsRoutes } from './assets.routes.js';

package/server/modules/assets/services/image-assets.service.ts

@@ -0,0 +1,82 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import { getGlobalImageAssetsDir, toPosixPath } from '@/shared/image-attachments.js';
+
+/**
+ * Image mime types accepted for chat attachment uploads. SVG is allowed for
+ * storage/preview even though some providers (Claude API) skip it at send time.
+ */
+const ALLOWED_IMAGE_MIME_TYPES = new Set([
+  'image/jpeg',
+  'image/png',
+  'image/gif',
+  'image/webp',
+  'image/svg+xml',
+]);
+
+// Used only by this service and the assets routes via the barrel file.
+type StoredImageAsset = {
+  /** Original upload filename, for display. */
+  name: string;
+  /** Absolute posix-normalized path inside the global assets folder. */
+  path: string;
+  size: number;
+  mimeType: string;
+};
+
+// Shape of one multer-stored file; kept local because only this module reads it.
+type UploadedImageFile = {
+  originalname: string;
+  filename: string;
+  size: number;
+  mimetype: string;
+};
+
+/** Returns whether one uploaded mime type may be stored as a chat image asset. */
+export function isAllowedImageMimeType(mimeType: string): boolean {
+  return ALLOWED_IMAGE_MIME_TYPES.has(mimeType);
+}
+
+/** Creates the global `~/.cloudcli/assets` folder if needed and returns it. */
+export async function ensureImageAssetsDir(): Promise<string> {
+  const assetsDir = getGlobalImageAssetsDir();
+  await fs.mkdir(assetsDir, { recursive: true });
+  return assetsDir;
+}
+
+/**
+ * Maps multer-stored upload files to the attachment records returned to the
+ * chat composer. The absolute path is what providers receive and what session
+ * history carries back to the UI.
+ */
+export function buildStoredImageRecords(files: UploadedImageFile[]): StoredImageAsset[] {
+  const assetsDir = getGlobalImageAssetsDir();
+  return files.map((file) => ({
+    name: file.originalname,
+    path: toPosixPath(path.join(assetsDir, file.filename)),
+    size: file.size,
+    mimeType: file.mimetype,
+  }));
+}
+
+/**
+ * Resolves one asset filename to its absolute path inside the global assets
+ * folder, or null when the name is empty, contains path separators/traversal,
+ * or would escape the folder. This is the only lookup the serving route uses,
+ * so nothing outside `~/.cloudcli/assets` can ever be read through it.
+ */
+export function resolveImageAssetFile(filename: string): string | null {
+  const trimmed = typeof filename === 'string' ? filename.trim() : '';
+  if (!trimmed || trimmed.includes('/') || trimmed.includes('\\') || trimmed.includes('..')) {
+    return null;
+  }
+
+  const assetsDir = path.resolve(getGlobalImageAssetsDir());
+  const resolved = path.resolve(assetsDir, trimmed);
+  if (!resolved.startsWith(assetsDir + path.sep)) {
+    return null;
+  }
+
+  return resolved;
+}

package/server/modules/assets/tests/image-assets.service.test.ts

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  buildStoredImageRecords,
+  isAllowedImageMimeType,
+  resolveImageAssetFile,
+} from '@/modules/assets/services/image-assets.service.js';
+
+const ASSETS_DIR = path.join(os.homedir(), '.cloudcli', 'assets');
+
+test('isAllowedImageMimeType accepts image formats and rejects the rest', () => {
+  assert.equal(isAllowedImageMimeType('image/png'), true);
+  assert.equal(isAllowedImageMimeType('image/svg+xml'), true);
+  assert.equal(isAllowedImageMimeType('application/pdf'), false);
+  assert.equal(isAllowedImageMimeType('text/html'), false);
+});
+
+test('buildStoredImageRecords returns absolute posix paths in the assets dir', () => {
+  const records = buildStoredImageRecords([
+    { originalname: 'shot.png', filename: '123-456-shot.png', size: 42, mimetype: 'image/png' },
+  ]);
+
+  assert.equal(records.length, 1);
+  assert.equal(records[0].name, 'shot.png');
+  assert.equal(records[0].size, 42);
+  assert.equal(records[0].mimeType, 'image/png');
+  assert.equal(records[0].path, `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-shot.png`);
+});
+
+test('resolveImageAssetFile resolves plain filenames inside the assets dir', () => {
+  const resolved = resolveImageAssetFile('123-shot.png');
+  assert.equal(resolved, path.join(path.resolve(ASSETS_DIR), '123-shot.png'));
+});
+
+test('resolveImageAssetFile rejects traversal and separator attempts', () => {
+  assert.equal(resolveImageAssetFile(''), null);
+  assert.equal(resolveImageAssetFile('   '), null);
+  assert.equal(resolveImageAssetFile('../auth.db'), null);
+  assert.equal(resolveImageAssetFile('..'), null);
+  assert.equal(resolveImageAssetFile('sub/dir.png'), null);
+  assert.equal(resolveImageAssetFile('sub\\dir.png'), null);
+  assert.equal(resolveImageAssetFile('a..b/../c.png'), null);
+});

package/server/modules/browser-use/browser-use.service.ts

@@ -1,10 +1,12 @@
 import { createRequire } from 'node:module';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
+import spawn from 'cross-spawn';
+
 import { appConfigDb } from '@/modules/database/index.js';
 import { providerMcpService } from '@/modules/providers/index.js';
 import { getModuleDir } from '@/utils/runtime-paths.js';
@@ -270,8 +272,10 @@ function runCommand(command: string, args: string[]): Promise<void> {
     }, INSTALL_COMMAND_TIMEOUT_MS);
     timer.unref?.();
 
-    child.stdout.on('data', (chunk) => output.push(String(chunk)));
-    child.stderr.on('data', (chunk) => output.push(String(chunk)));
+    // stdio config above guarantees the pipes exist; cross-spawn's types
+    // just don't narrow them the way node's spawn overloads do.
+    child.stdout?.on('data', (chunk) => output.push(String(chunk)));
+    child.stderr?.on('data', (chunk) => output.push(String(chunk)));
     child.on('error', (error) => finish(() => reject(error)));
     child.on('close', (code) => finish(() => {
       if (code === 0) {

package/server/modules/database/tests/sessions-provider-mapping.test.ts

@@ -100,9 +100,9 @@ test('assignProviderSessionId merges a watcher-created duplicate into the app ro
 
 test('legacy provider-keyed rows stay resolvable through both lookups', async () => {
   await withIsolatedDatabase(() => {
-    sessionsDb.createSession('legacy-1', 'gemini', '/workspace/demo');
+    sessionsDb.createSession('legacy-1', 'opencode', '/workspace/demo');
 
-    assert.equal(sessionsDb.getSessionById('legacy-1')?.provider, 'gemini');
+    assert.equal(sessionsDb.getSessionById('legacy-1')?.provider, 'opencode');
     assert.equal(sessionsDb.getSessionByProviderSessionId('legacy-1')?.session_id, 'legacy-1');
   });
 });

package/server/modules/notifications/services/notification-orchestrator.service.js

@@ -13,7 +13,6 @@ const PROVIDER_LABELS = {
   claude: 'Claude',
   cursor: 'Cursor',
   codex: 'Codex',
-  gemini: 'Gemini',
   system: 'System'
 };
 

package/server/modules/projects/services/project-clone.service.ts

@@ -1,7 +1,9 @@
-import { spawn } from 'node:child_process';
 import { access, mkdir, rm } from 'node:fs/promises';
 import path from 'node:path';
 
+// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
+import spawn from 'cross-spawn';
+
 import { githubTokensDb } from '@/modules/database/index.js';
 import { createProject } from '@/modules/projects/services/project-management.service.js';
 import type { WorkspacePathValidationResult } from '@/shared/types.js';

package/server/modules/providers/README.md

@@ -36,7 +36,6 @@ Current provider ids in this repo are:
 - `claude`
 - `codex`
 - `cursor`
-- `gemini`
 - `opencode`
 
 Those ids are mirrored in backend unions and frontend provider constants. If
@@ -56,8 +55,7 @@ server/modules/providers/list/<provider>/
   <provider>-session-synchronizer.provider.ts
 ```
 
-The existing provider folders are `claude`, `codex`, `cursor`, `gemini`, and
-`opencode`.
+The existing provider folders are `claude`, `codex`, `cursor`, and `opencode`.
 
 ## What Each Facet Does
 
@@ -123,7 +121,6 @@ Current MCP formats in this repo are:
 | Claude | `.mcp.json` in user / local / project locations | `user`, `local`, `project` | `stdio`, `http`, `sse` |
 | Codex | `.codex/config.toml` | `user`, `project` | `stdio`, `http` |
 | Cursor | `.cursor/mcp.json` | `user`, `project` | `stdio`, `http` |
-| Gemini | `.gemini/settings.json` | `user`, `project` | `stdio`, `http` |
 | OpenCode | `~/.config/opencode/opencode.json` or `<workspace>/opencode.json` (`.jsonc` is read when present) | `user`, `project` | `stdio`, `http` |
 
 5. Implement skills.
@@ -144,7 +141,6 @@ Current skill discovery roots are:
 | Claude | `~/.claude/skills` | `<workspace>/.claude/skills` | `/` | Also discovers Claude plugin skills from enabled plugin installs. Command skills live under `commands/`; markdown skills live under `skills/` and are scanned recursively. |
 | Codex | `~/.agents/skills`, `~/.codex/skills/.system`, `/etc/codex/skills` | `<workspace>/.agents/skills`, `path.dirname(workspacePath)/.agents/skills`, topmost git root `.agents/skills` | `$` | Overlapping roots are deduplicated before scanning. |
 | Cursor | `~/.cursor/skills` | `<workspace>/.cursor/skills`, `<workspace>/.agents/skills` | `/` | Uses slash-style commands. |
-| Gemini | `~/.gemini/skills`, `~/.agents/skills` | `<workspace>/.gemini/skills`, `<workspace>/.agents/skills` | `/` | Uses slash-style commands. |
 | OpenCode | `~/.config/opencode/skills`, `~/.claude/skills`, `~/.agents/skills` | Cwd-to-topmost-git-root `.opencode/skills`, `.claude/skills`, and `.agents/skills` | `/` | Reuses OpenCode, Claude, and Agents skill locations. Overlapping roots are deduplicated before scanning. |
 
 Command forms currently used by the providers are:
@@ -153,7 +149,6 @@ Command forms currently used by the providers are:
 - Claude plugin skills: `/plugin-name:skill-name`
 - Codex skills: `$skill-name`
 - Cursor skills: `/skill-name`
-- Gemini skills: `/skill-name`
 - OpenCode skills: `/skill-name`
 
 6. Implement sessions.
@@ -191,7 +186,6 @@ Current session sync roots are:
 | Claude | `~/.claude/projects/**/*.jsonl` | Uses `~/.claude/history.jsonl` for name lookup and the trailing `ai-title`, `last-prompt`, or `custom-title` entries for title recovery. |
 | Codex | `~/.codex/sessions/**/*.jsonl` | Uses `~/.codex/session_index.jsonl` for title lookup and the last `task_complete` message for a fallback title. |
 | Cursor | `~/.cursor/projects/**/*.jsonl` | Uses sibling `worker.log` to recover `workspacePath`, then derives the session title from the first user prompt. |
-| Gemini | `~/.gemini/tmp/**/*.jsonl` | Current full scans only index temp JSONL chat artifacts. Single-file sync also accepts legacy `.json` files. |
 | OpenCode | `~/.local/share/opencode/opencode.db` | Reads active sessions/messages/parts from OpenCode's shared SQLite database and stores `jsonl_path` as `null` so deleting one app session cannot remove the shared DB. |
 
 8. Register the provider.

package/server/modules/providers/list/claude/claude-sessions.provider.ts

@@ -313,6 +313,18 @@ export class ClaudeSessionsProvider implements IProviderSessions {
 
     if (raw.message?.role === 'user' && raw.message?.content && raw.isMeta !== true) {
       if (Array.isArray(raw.message.content)) {
+        // Image attachments sent through the SDK are persisted as base64
+        // `image` blocks next to the prompt text. Collect them so the UI can
+        // render them on the user bubble.
+        const imageAttachments: Array<{ data: string }> = [];
+        for (const part of raw.message.content) {
+          if (part?.type === 'image' && part.source?.type === 'base64' && typeof part.source.data === 'string') {
+            const mediaType = typeof part.source.media_type === 'string' ? part.source.media_type : 'image/png';
+            imageAttachments.push({ data: `data:${mediaType};base64,${part.source.data}` });
+          }
+        }
+        let imagesAttached = false;
+
         for (let partIndex = 0; partIndex < raw.message.content.length; partIndex++) {
           const part = raw.message.content[partIndex];
           if (part.type === 'tool_result') {
@@ -339,7 +351,9 @@ export class ClaudeSessionsProvider implements IProviderSessions {
                 kind: 'text',
                 role: 'user',
                 content: text,
+                images: !imagesAttached && imageAttachments.length > 0 ? imageAttachments : undefined,
               }));
+              imagesAttached = true;
             }
           }
         }
@@ -359,9 +373,25 @@ export class ClaudeSessionsProvider implements IProviderSessions {
               kind: 'text',
               role: 'user',
               content: textParts,
+              images: imageAttachments.length > 0 ? imageAttachments : undefined,
             }));
+            imagesAttached = true;
           }
         }
+
+        // Image-only turns still deserve a user bubble even without text.
+        if (!imagesAttached && imageAttachments.length > 0) {
+          messages.push(createNormalizedMessage({
+            id: `${baseId}_images`,
+            sessionId,
+            timestamp: ts,
+            provider: PROVIDER,
+            kind: 'text',
+            role: 'user',
+            content: '',
+            images: imageAttachments,
+          }));
+        }
       } else if (typeof raw.message.content === 'string') {
         const text = raw.message.content;
 

package/server/modules/providers/list/codex/codex-session-synchronizer.provider.ts

@@ -133,7 +133,23 @@ export class CodexSessionSynchronizer implements IProviderSessionSynchronizer {
       };
     }
 
-    let sessionName = nameMap.get(parsed.sessionId);
+    // Sessions started by sending a message from cloudcli carry a distinct
+    // app-allocated session_id mapped to the provider id. For these we title the
+    // conversation from the first user message the user typed, instead of the
+    // generic "Untitled Codex Session" placeholder. Sessions discovered purely
+    // by indexing (session_id === provider_session_id) keep the existing
+    // thread_name/last-agent-message setup below.
+    const isAppCreated =
+      existingSession != null &&
+      existingSession.provider_session_id != null &&
+      existingSession.session_id !== existingSession.provider_session_id;
+
+    let sessionName = isAppCreated
+      ? await this.extractFirstUserMessageFromStart(filePath)
+      : undefined;
+    if (!sessionName) {
+      sessionName = nameMap.get(parsed.sessionId);
+    }
     if (!sessionName) {
       sessionName = await this.extractLastAgentMessageFromEnd(filePath);
     }
@@ -144,6 +160,49 @@ export class CodexSessionSynchronizer implements IProviderSessionSynchronizer {
     };
   }
 
+  /**
+   * Returns the first user message text in a Codex transcript, used to title
+   * app-created sessions from the prompt the user sent from cloudcli.
+   *
+   * Reads the `event_msg`/`user_message` payload rather than the raw
+   * `response_item` user turn so injected `<environment_context>` boilerplate is
+   * never mistaken for the user's prompt.
+   */
+  private async extractFirstUserMessageFromStart(filePath: string): Promise<string | undefined> {
+    try {
+      const content = await readFile(filePath, 'utf8');
+      const lines = content.split(/\r?\n/);
+
+      for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line) {
+          continue;
+        }
+
+        let parsed: unknown;
+        try {
+          parsed = JSON.parse(line);
+        } catch {
+          continue;
+        }
+
+        const data = parsed as Record<string, unknown>;
+        const eventType = typeof data.type === 'string' ? data.type : undefined;
+        const payload = data.payload as Record<string, unknown> | undefined;
+        const payloadType = typeof payload?.type === 'string' ? payload.type : undefined;
+        const message = typeof payload?.message === 'string' ? payload.message : undefined;
+
+        if (eventType === 'event_msg' && payloadType === 'user_message' && message?.trim()) {
+          return message;
+        }
+      }
+    } catch {
+      // Ignore missing/unreadable files so sync can continue.
+    }
+
+    return undefined;
+  }
+
   private async extractLastAgentMessageFromEnd(filePath: string): Promise<string | undefined> {
     try {
       const content = await readFile(filePath, 'utf8');

package/server/modules/providers/list/codex/codex-sessions.provider.ts

@@ -2,6 +2,7 @@ import fsSync from 'node:fs';
 import readline from 'node:readline';
 
 import { sessionsDb } from '@/modules/database/index.js';
+import { toImageAttachments } from '@/shared/image-attachments.js';
 import type { IProviderSessions } from '@/shared/interfaces.js';
 import type { AnyRecord, FetchHistoryOptions, FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
 import { createNormalizedMessage, generateMessageId, readObjectRecord, sliceTailPage } from '@/shared/utils.js';
@@ -31,6 +32,42 @@ function isVisibleCodexUserMessage(payload: AnyRecord | null | undefined): boole
   return typeof payload.message === 'string' && payload.message.trim().length > 0;
 }
 
+/**
+ * Reads the image attachments Codex records on `user_message` events.
+ * Turns sent with `local_image` input items land in `local_images` as file
+ * paths (verified against real rollout JSONL); the `images` array can carry
+ * base64 data URLs, which are passed through as inline `data` attachments so
+ * the UI can preview them without a file lookup.
+ *
+ * Exported for tests.
+ */
+export function extractCodexUserImages(
+  payload: AnyRecord | null | undefined,
+): Array<{ path?: string; data?: string }> | undefined {
+  if (!payload) {
+    return undefined;
+  }
+
+  const candidates = [
+    ...(Array.isArray(payload.local_images) ? payload.local_images : []),
+    ...(Array.isArray(payload.images) ? payload.images : []),
+  ];
+
+  const attachments: Array<{ path?: string; data?: string }> = [];
+  for (const entry of candidates) {
+    if (typeof entry !== 'string' || !entry.trim()) {
+      continue;
+    }
+    if (entry.startsWith('data:')) {
+      attachments.push({ data: entry });
+    } else {
+      attachments.push(...toImageAttachments([entry]));
+    }
+  }
+
+  return attachments.length > 0 ? attachments : undefined;
+}
+
 function extractCodexTextContent(content: unknown): string {
   if (!Array.isArray(content)) {
     return typeof content === 'string' ? content : '';
@@ -104,6 +141,7 @@ async function getCodexSessionMessages(
               role: 'user',
               content: entry.payload.message,
             },
+            images: extractCodexUserImages(entry.payload as AnyRecord),
           });
         }
 
@@ -296,7 +334,8 @@ export class CodexSessionsProvider implements IProviderSessions {
               .filter(Boolean)
               .join('\n')
           : String(raw.message.content || '');
-      if (!content.trim()) {
+      const rawImages = Array.isArray(raw.images) && raw.images.length > 0 ? raw.images : undefined;
+      if (!content.trim() && !rawImages) {
         return [];
       }
       return [createNormalizedMessage({
@@ -307,6 +346,7 @@ export class CodexSessionsProvider implements IProviderSessions {
         kind: 'text',
         role: 'user',
         content,
+        images: rawImages,
       })];
     }
 

package/server/modules/providers/list/cursor/cursor-models.provider.ts

@@ -1,7 +1,6 @@
 import { access, readdir } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
 
 import crossSpawn from 'cross-spawn';
 
@@ -446,11 +445,6 @@ export const CURSOR_FALLBACK_MODELS: ProviderModelsDefinition = {
       label: "gpt-5.2-xhigh-fast",
       description: "GPT-5.2 Extra High Fast",
     },
-    {
-      value: "gemini-3.1-pro",
-      label: "gemini-3.1-pro",
-      description: "Gemini 3.1 Pro",
-    },
     {
       value: "gpt-5.4-mini-none",
       label: "gpt-5.4-mini-none",
@@ -531,16 +525,6 @@ export const CURSOR_FALLBACK_MODELS: ProviderModelsDefinition = {
       label: "gpt-5.1-high",
       description: "GPT-5.1 High",
     },
-    {
-      value: "gemini-3-flash",
-      label: "gemini-3-flash",
-      description: "Gemini 3 Flash",
-    },
-    {
-      value: "gemini-3.5-flash",
-      label: "gemini-3.5-flash",
-      description: "Gemini 3.5 Flash",
-    },
     {
       value: "gpt-5.1-codex-mini-low",
       label: "gpt-5.1-codex-mini-low",
@@ -589,7 +573,9 @@ type CursorModelRow = {
 
 const CURSOR_MODELS_TIMEOUT_MS = 10_000;
 const CURSOR_CHATS_ROOT = path.join(os.homedir(), '.cursor', 'chats');
-const spawnFunction = process.platform === 'win32' ? crossSpawn : spawn;
+// cross-spawn resolves .cmd shims/PATHEXT on Windows and delegates to
+// child_process.spawn everywhere else.
+const spawnFunction = crossSpawn;
 const ANSI_PATTERN = new RegExp(
   // eslint-disable-next-line no-control-regex
   '[\\u001B\\u009B][[\\]()#;?]*(?:'

package/server/modules/providers/list/cursor/cursor-session-synchronizer.provider.ts

@@ -141,7 +141,13 @@ export class CursorSessionSynchronizer implements IProviderSessionSynchronizer {
       }
 
       const text = typeof data.message?.content?.[0]?.text === 'string' ? data.message.content[0].text : '';
-      const firstLine = text.replace(/<\/?user_query>/g, '').trim().split('\n')[0];
+      // Drop Cursor's `<timestamp>…</timestamp>` prefix and `<user_query>` tags
+      // so the session name comes from the actual first line the user typed.
+      const firstLine = text
+        .replace(/<timestamp>[\s\S]*?<\/timestamp>/g, '')
+        .replace(/<\/?user_query>/g, '')
+        .trim()
+        .split('\n')[0];
 
       return {
         sessionId,

package/server/modules/providers/list/cursor/cursor-sessions.provider.ts

@@ -2,6 +2,7 @@ import crypto from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 
+import { parseImagesInputTag } from '@/shared/image-attachments.js';
 import type { IProviderSessions } from '@/shared/interfaces.js';
 import type { AnyRecord, FetchHistoryOptions, FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
 import {
@@ -24,7 +25,7 @@ type CursorJsonBlob = CursorDbBlob & {
   parsed: AnyRecord;
 };
 
-type CursorMessageBlob = {
+export type CursorMessageBlob = {
   id: string;
   sequence: number;
   rowid: number;
@@ -59,17 +60,42 @@ function unwrapUserQueryText(value: string, role: 'user' | 'assistant'): string
     return value;
   }
 
-  const normalized = value.trimStart();
+  // Cursor wraps user turns as `<timestamp>…</timestamp>\n<user_query>…</user_query>`.
+  // Show only the `<user_query>` content, trimmed so there are no blank lines
+  // at the top/bottom and the `<timestamp>` prefix is dropped entirely.
   const openTag = '<user_query>';
   const closeTag = '</user_query>';
-  if (!normalized.startsWith(openTag)) {
-    return value;
+  const openIndex = value.indexOf(openTag);
+  if (openIndex >= 0) {
+    const afterOpen = value.slice(openIndex + openTag.length);
+    const closeIndex = afterOpen.lastIndexOf(closeTag);
+    const inner = closeIndex >= 0 ? afterOpen.slice(0, closeIndex) : afterOpen;
+    return inner.trim();
   }
 
-  const afterOpen = normalized.slice(openTag.length);
-  const closeIndex = afterOpen.lastIndexOf(closeTag);
-  const inner = closeIndex >= 0 ? afterOpen.slice(0, closeIndex) : afterOpen;
-  return inner.trim();
+  // No `<user_query>` wrapper: still strip a leading `<timestamp>…</timestamp>`.
+  return value.replace(/^\s*<timestamp>[\s\S]*?<\/timestamp>\s*/, '').trim();
+}
+
+/**
+ * Unwraps one user-authored text payload and splits off the `<images_input>`
+ * attachment block appended by the chat composer. Assistant text passes
+ * through untouched.
+ */
+function extractUserTextAndImages(
+  value: string,
+  role: 'user' | 'assistant',
+): { text: string; images?: Array<{ path: string; name?: string }> } {
+  const unwrapped = unwrapUserQueryText(value, role);
+  if (role !== 'user') {
+    return { text: unwrapped };
+  }
+
+  const { text, attachments } = parseImagesInputTag(unwrapped);
+  return {
+    text,
+    images: attachments.length > 0 ? attachments : undefined,
+  };
 }
 
 function normalizeToolId(value: unknown): string | null {
@@ -401,8 +427,11 @@ export class CursorSessionsProvider implements IProviderSessions {
   /**
    * Converts Cursor SQLite message blobs into normalized messages and attaches
    * matching tool results to their tool_use entries.
+   *
+   * Public so tests can drive history normalization with synthetic blobs
+   * without needing a real Cursor store.db.
    */
-  private normalizeCursorBlobs(blobs: CursorMessageBlob[], sessionId: string | null): NormalizedMessage[] {
+  normalizeCursorBlobs(blobs: CursorMessageBlob[], sessionId: string | null): NormalizedMessage[] {
     const messages: NormalizedMessage[] = [];
     const toolUseMap = new Map<string, NormalizedMessage>();
     const baseTime = Date.now();
@@ -442,7 +471,16 @@ export class CursorSessionsProvider implements IProviderSessions {
                 text = unwrapUserQueryText(content.message.content, role);
               }
             }
-            if (text?.trim()) {
+            const { text: cleanText, images } = role === 'user'
+              ? (() => {
+                const parsed = parseImagesInputTag(text);
+                return {
+                  text: parsed.text,
+                  images: parsed.attachments.length > 0 ? parsed.attachments : undefined,
+                };
+              })()
+              : { text, images: undefined };
+            if (cleanText?.trim() || images) {
               messages.push(createNormalizedMessage({
                 id: baseId,
                 sessionId,
@@ -450,7 +488,8 @@ export class CursorSessionsProvider implements IProviderSessions {
                 provider: PROVIDER,
                 kind: 'text',
                 role,
-                content: text,
+                content: cleanText,
+                images,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -502,8 +541,8 @@ export class CursorSessionsProvider implements IProviderSessions {
             }
 
             if (part?.type === 'text' && part?.text) {
-              const normalizedPartText = unwrapUserQueryText(part.text, role);
-              if (!normalizedPartText) {
+              const { text: normalizedPartText, images } = extractUserTextAndImages(part.text, role);
+              if (!normalizedPartText && !images) {
                 continue;
               }
               messages.push(createNormalizedMessage({
@@ -514,6 +553,7 @@ export class CursorSessionsProvider implements IProviderSessions {
                 kind: 'text',
                 role,
                 content: normalizedPartText,
+                images,
                 sequence: blob.sequence,
                 rowid: blob.rowid,
               }));
@@ -553,8 +593,8 @@ export class CursorSessionsProvider implements IProviderSessions {
           && content.content.trim()
           && !isInternalCursorText(content.content)
         ) {
-          const normalizedText = unwrapUserQueryText(content.content, role);
-          if (!normalizedText) {
+          const { text: normalizedText, images } = extractUserTextAndImages(content.content, role);
+          if (!normalizedText && !images) {
             continue;
           }
           messages.push(createNormalizedMessage({
@@ -565,6 +605,7 @@ export class CursorSessionsProvider implements IProviderSessions {
             kind: 'text',
             role,
             content: normalizedText,
+            images,
             sequence: blob.sequence,
             rowid: blob.rowid,
           }));

package/server/modules/providers/list/opencode/opencode-auth.provider.ts

@@ -19,7 +19,6 @@ const OPENCODE_ENV_CREDENTIAL_KEYS = [
   'ANTHROPIC_API_KEY',
   'OPENAI_API_KEY',
   'GOOGLE_GENERATIVE_AI_API_KEY',
-  'GEMINI_API_KEY',
   'GROQ_API_KEY',
   'OPENROUTER_API_KEY',
 ];