feat(cursor): discover filesystem skills

[djfbryant]

Cursor threads can now discover local SKILL.md skills from the supported skill folders.

T3 keeps $skill in the composer. Before it sends a known selected skill to Cursor, it changes the token to Cursor’s /skill form.

Tests:

• ./node_modules/.bin/vp test run apps/server/src/provider/Drivers/CursorSkills.test.ts apps/server/src/provider/Layers/CursorProvider.test.ts apps/server/src/provider/Layers/CursorAdapter.test.ts (47 passed)

Built with GPT-5.6 Terra in T3 Code.

Note

Add filesystem skill discovery for CursorDriver and translate $skill to /skill

• Adds discoverCursorSkills in CursorSkills.ts which recursively reads SKILL.md files from user roots (~/.agents|.cursor|.claude|.codex/skills) and project roots (cwd/.agents|.cursor|.claude|.codex/skills), parses YAML frontmatter, and returns de-duplicated ServerProviderSkill entries with user or project scope.
• Adds parseSkillFrontmatter which validates name (kebab-case) and non-empty description; files failing validation are silently skipped.
• Adds renderCursorSkillInvocations which rewrites $name tokens to /name only for known skill names, preserving unknown tokens.
• Threads cwd through CursorDriver.create, checkCursorProviderStatus, and CursorAdapter.makeCursorAdapter so skills are discovered at session start and prompts are rewritten before sending to Cursor.
• Behavioral Change: session/prompt requests now send skill-translated input instead of raw text; skill discovery is best-effort and unreadable or malformed entries are skipped without failing.

^{Macroscope summarized 2d8b64c.}

---

Note

Medium Risk
Reads user/project skill files and rewrites prompt text before ACP send. Discovery is best-effort and only known skill names are rewritten, but prompt mutation and filesystem scanning still warrant review.

Overview
Cursor threads can now surface on-disk skills in the shared $ composer picker. T3 scans the same user and project skill folders Cursor documents (.agents, .cursor, .claude, .codex) because ACP does not expose a catalogue.

Valid SKILL.md files (YAML name/description, name matching the parent directory) are published on the provider snapshot. Before a prompt is sent, known $skill tokens are rewritten to Cursor’s /skill form; unknown $ tokens are left alone. Built-in, marketplace, and plugin skills stay hidden.

Malformed or unreadable files are skipped so discovery cannot fail the provider check.

^{Reviewed by Cursor Bugbot for commit 2d8b64c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 82cc9eb1-8749-4f9f-ae53-73cffdbe0796

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 2d8b64c. Configure here.}

[cursor]

Skill picker cwd mismatches session

Medium Severity

The composer $ picker publishes skills discovered from ServerConfig.cwd, while sendTurn rewrites $skill tokens using ctx.skillNames discovered from the thread workspace cwd (worktreePath or project workspaceRoot). When those roots differ—worktrees or another project than the process cwd—a skill chosen from the picker can be missing from the session set, so the $ token is left unchanged and Cursor never receives /skill.

Additional Locations (2)

• apps/server/src/provider/Layers/CursorAdapter.ts#L499-L535
• apps/server/src/provider/Layers/CursorProvider.ts#L1063-L1064

 

^{Reviewed by Cursor Bugbot for commit 2d8b64c. Configure here.}

[cursor]

Session skill set goes stale

Low Severity

skillNames is captured once in startSession and reused for every sendTurn. Provider status can rediscover skills and refresh the composer picker without restarting the session, so a skill added on disk can appear in $ search while still being absent from ctx.skillNames, leaving the token untranslated until the session is recreated.

Additional Locations (2)

• apps/server/src/provider/Layers/CursorAdapter.ts#L783-L784
• apps/server/src/provider/Layers/CursorAdapter.ts#L974-L978

 

^{Reviewed by Cursor Bugbot for commit 2d8b64c. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a new feature (filesystem skill discovery and skill picker integration) with new user-facing behavior and runtime text transformation. New capabilities warrant human review. A Medium severity finding about potential cwd mismatch between the skill picker and session also requires attention.

^{You can add or adjust custom eligibility rules. Learn more.}