fix(provider-cursor): Cursor text generation no longer leaks SQLite file handles on every call

[bompus]

Every Cursor title, commit-message or PR-text generation leaked 8 SQLite file handles until the server exited. Now 0 stay open after a call.

Problem

Every Cursor text-generation call (thread titles, commit messages, PR text) leaves 8 SQLite file descriptors open until the server exits. Each call runs in a fresh temp directory, and in @cursor/sdk 1.0.35 Agent.close() and asyncDispose() do not close the default store the agent opened for it. A server that had been up about four hours held 120 of these descriptors from the 15 calls it had served. Details are in #18151.

Change

makeCursorTextGeneration now opens a SqliteLocalAgentStore for each call, with its state in a second scoped temp directory, passes it as local.store, and disposes it after the agent. The store is released from the outer scope, so it closes after the agent on success, failure, timeout and interruption. SqliteLocalAgentStore is exported through sdk.ts and the CursorSdk service so tests can stub it.

The agent-transcripts/ directories each call also leaves under ~/.cursor/projects are a separate problem and are not touched here, as noted in the issue.

Scope and approval

Fixes #18151, a triaged bug. A maintainer asked for this PR and this approach: #18151 (comment)

Verification

• vp test run on textGeneration.test.ts, CursorSdk.test.ts, CursorAgentSdk.test.ts and driver.test.ts: 27 passed. The new test fails without the change: it checks the store is opened for the call's workspace, disposed after the agent, and still disposed when the run ends in an error.
• tsc --noEmit on packages/provider-cursor reports no errors, and vp fmt --check passes on the touched directory.
• Real Cursor run, outside T3 Code, using the SDK's ESM entry in an isolated HOME with the unsandboxed fallback (this host's sandbox is unavailable): today's pattern held 8 descriptors after one call and 16 after two, none released by asyncDispose(). With a per-call store, 8 were open during the run and 0 after store.dispose(), and nothing opened under the SDK's default sdk-agent-store.
• The CommonJS entry that T3 loads: checked against a local stub of Cursor's auth and model endpoints (no model call). A store from @cursor/sdk/sqlite works with Agent from @cursor/sdk, going from 5 descriptors open to 0 after disposal. Requiring the sqlite entry added about 10 ms.

Not checked: the change running inside a full T3 server against Cursor, and the sandboxed (non-fallback) path. If a cancelled run writes to the store after it is disposed, the SDK catches and logs that write; I did not exercise it.

Model and harness: Claude Sonnet 5.5, via Claude Code in T3 Code.

[macroscopeapp]

Approvability

Verdict: Approved at 61ddd98

Macroscope's review found this PR approvable — This is a contained fix to dispose of the Cursor SDK's per-call SQLite store, with tests covering normal and error cleanup and no change to generated text behavior. The remaining changes are limited to SDK wiring and test support.

Notes:

• Diff unchanged. Approvability was decided on eligibility alone.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate 61ddd98

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1374273e-91d8-4644-a23d-c501d8386f6b

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 8d199b4 and 61ddd98.

---

---

📒 Files selected for processing (6)

• packages/provider-cursor/src/server/CursorAgentSdk.test.ts
• packages/provider-cursor/src/server/CursorSdk.test.ts
• packages/provider-cursor/src/server/CursorSdk.ts
• packages/provider-cursor/src/server/sdk.ts
• packages/provider-cursor/src/server/textGeneration.test.ts
• packages/provider-cursor/src/server/textGeneration.ts

---

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

Cursor text generation now opens a SQLite agent store for each run, passes it to the agent, and disposes it during cleanup. The Cursor SDK layer exposes the store. Tests cover cleanup after successful and failed runs.

Changes

Cursor store lifecycle

Layer / File(s)	Summary
Expose the SQLite agent store packages/provider-cursor/src/server/sdk.ts, packages/provider-cursor/src/server/CursorSdk.ts, packages/provider-cursor/src/server/CursorSdk.test.ts, packages/provider-cursor/src/server/CursorAgentSdk.test.ts	The SDK module exports SqliteLocalAgentStore, and the CursorSdk instance provides it to consumers. SDK test stubs now include the export.
Scope store to each generation run packages/provider-cursor/src/server/textGeneration.ts, packages/provider-cursor/src/server/textGeneration.test.ts	Each generation run opens a store for its temporary workspace and passes it to the agent. Scoped cleanup disposes the store. Tests check disposal after successful and failed runs.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: juliusmarminge

---

---

Merge Risk: ⚪ Minimal · up to 61ddd

This change closes the SQLite files that Cursor text generation opens on each call, fixing the file-descriptor leak. No concrete merge-blocking risk was found. One edge case, store disposal after a timed-out agent close, is unconfirmed.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 61ddd

The change gives each generation request explicit ownership of its temporary database and cleanup. Existing credential and workspace controls remain intact. No new attack path was established, but cleanup during interruption or database-disposal failure remains incompletely verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly affected assets are provider-process SQLite handles and per-request temporary state. Production code creates invocation-owned stores rather than introducing a shared application database. Actual directory uniqueness and SDK storage semantics remain unverified.

Trust Boundaries and Controls

• observed — The production driver supplies instance-owned credential resolution and access scopes to text generation. Access admission rejects new work while credentials are changing, and sign-out closes tracked scopes before clearing stored browser credentials.

Resilience and Maintainability Implications

• inferred — Credential-scope drainage now depends on the added store lifecycle. Store opening is outside the 180-second request timeout, and disposal errors are logged and ignored without an explicit deadline. Whether these operations can stall sign-out or leave resources open is unresolved; the available evidence does not demonstrate either outcome.

Hardening Proposals

• proposed — Validate pending store acquisition, interrupted generation, delayed or failed disposal, concurrent calls, and sign-out drainage against the actual SDK. If cleanup can outlive its scope, define recovery and ownership explicitly rather than merely timing out a promise and assuming the resource was released.

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Issue #18151 requires each Cursor text-generation call to close its SQLite file descriptors. textGeneration.ts opens SqliteLocalAgentStore with a per-call workspaceRef and separate scoped `state…
Out of Scope Changes check		The changes stay within issue #18151. The SDK export and service injection support the per-call store and test stubbing. The test updates verify the required resource lifecycle and sandbox fallback. N…
Description check		The description includes all required sections. It explains the SQLite handle leak, the implementation, scope and approval, focused verification, limitations, and the agent model and harness.
Title check		The title clearly and concisely describes the primary fix: preventing SQLite file-handle leaks during Cursor text generation.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[t3dotgg]

Note

🤖 Claude Opus 5.5 responding on behalf of Theo

Your fix landed in #19310 (squash acb90279e2), with your commit kept and you credited as co-author.

One follow-up was needed. withAccess forks the call into a child scope, and the store finalizer was registered there after the fork's interrupt finalizer. On sign-out the store was disposed before the run was cancelled and the agent closed, so a cancelled run could write to a disposed store. #19310 adds an Effect.scoped inside withAccess, so the agent always closes first. A new test signs out mid-run with the real makeCursorAuth and checks that order. It fails without the change.

Leaving this PR open for you to close. Thanks for the clear issue and repro.

[juliusmarminge]

Note

Grok responding on behalf of Julius.

Thanks @bompus! This landed as a takeover in #19310 (with you as co-author), which fixes #18151, so I'm closing this one as superseded.