fix(provider): guard file notes against raw base64 data

describeSource returned any non-data: string verbatim, so a raw base64
file part with no filename inlined the whole blob into the note text.
Now only URL-shaped strings are used as names; everything else falls
back to "file". file:// sources are emitted as filesystem paths (via
fileURLToPath, href fallback on invalid URLs) since the local agent's
workspace tools act on paths.

Author: justin-carper

src/provider/message-map.ts

@@ -1,3 +1,4 @@
+import { fileURLToPath } from "node:url";
 import type {
 	LanguageModelV3FilePart,
 	LanguageModelV3Prompt,
@@ -119,12 +120,32 @@ function fileNote(part: LanguageModelV3FilePart): string {
 	return `[attached file: ${name} (${part.mediaType}) — not forwarded to Cursor]`;
 }
 
+/** Matches strings with a URL scheme followed by `://` (http, https, file, …). */
+const URL_SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+
 function describeSource(data: string | Uint8Array | URL): string | undefined {
-	if (data instanceof URL) return data.href;
-	if (typeof data === "string" && !data.startsWith("data:")) return data;
+	// file:// sources become filesystem paths: the agent runs locally with
+	// workspace tools that operate on paths, so a path is actionable where a
+	// file:// href is not.
+	if (data instanceof URL)
+		return data.protocol === "file:" ? fileUrlToPath(data) : data.href;
+	// Only accept strings that look like a URL. AI-SDK file parts may carry
+	// raw base64 in `data` (no `data:` prefix); returning that verbatim would
+	// inline the entire blob into the note text.
+	if (typeof data === "string" && URL_SCHEME.test(data))
+		return data.startsWith("file://") ? fileUrlToPath(data) : data;
 	return undefined;
 }
 
+/** Convert a file:// URL to a filesystem path, falling back to the href when invalid. */
+function fileUrlToPath(url: string | URL): string {
+	try {
+		return fileURLToPath(url);
+	} catch {
+		return typeof url === "string" ? url : url.href;
+	}
+}
+
 /**
  * Extract only the final user turn as a Cursor message. Used when resuming a
  * pooled agent that already remembers the prior conversation, so we send just

test/message-map.test.ts

@@ -220,8 +220,8 @@ describe("promptToCursorMessage", () => {
 		expect(msg.text).toContain("application/x-directory");
 	});
 
-	it("falls back to the file URL when a file part has no filename", () => {
-		const { url } = tempFile("noname.bin", Buffer.from([0, 1, 2]));
+	it("falls back to the filesystem path when a file:// part has no filename", () => {
+		const { path, url } = tempFile("noname.bin", Buffer.from([0, 1, 2]));
 		const prompt: LanguageModelV3Prompt = [
 			{
 				role: "user",
@@ -236,10 +236,53 @@ describe("promptToCursorMessage", () => {
 		];
 		const msg = promptToCursorMessage(prompt);
 		expect(msg.images).toBeUndefined();
-		// No filename → the note identifies the file by its source URL.
-		expect(msg.text).toContain(url);
+		// No filename → the note identifies the file by its filesystem path
+		// (not the file:// href) so the local agent's workspace tools can act
+		// on it directly.
+		expect(msg.text).toContain(path);
+		expect(msg.text).not.toContain("file://");
 		expect(msg.text).toContain("application/octet-stream");
 	});
+
+	it("uses an http URL string as the name when a file part has no filename", () => {
+		const prompt: LanguageModelV3Prompt = [
+			{
+				role: "user",
+				content: [
+					{
+						type: "file",
+						data: "https://example.com/pic.png",
+						mediaType: "image/png",
+					},
+				],
+			},
+		];
+		const msg = promptToCursorMessage(prompt);
+		expect(msg.images).toBeUndefined();
+		expect(msg.text).toContain("https://example.com/pic.png");
+	});
+
+	it("never inlines raw base64 string data; falls back to a generic name", () => {
+		const b64 = PNG_BYTES.toString("base64");
+		const prompt: LanguageModelV3Prompt = [
+			{
+				role: "user",
+				content: [
+					{
+						type: "file",
+						// Raw base64 with no data: prefix and no filename — must NOT
+						// end up verbatim in the note text.
+						data: b64,
+						mediaType: "image/png",
+					},
+				],
+			},
+		];
+		const msg = promptToCursorMessage(prompt);
+		expect(msg.images).toBeUndefined();
+		expect(msg.text).not.toContain(b64);
+		expect(msg.text).toContain("[attached file: file (image/png)");
+	});
 });
 
 describe("latestUserMessage", () => {