fix(cursor): SelectedImage blobIdWithData + JPEG soft-cap prep

[yansigit]

Summary

• Encode Cursor SelectedImage with blob_id_with_data (field 9) + path, and store image bytes in the existing session blobStore (sha256 hex) so getBlob can hydrate vision the same way system-prompt roots already do. Legacy inline field 8 is no longer written.
• Add JPEG soft-cap prep via sharp (quality ladder + edge shrink), split inbound decode ceiling (16 MiB) from the 1 MiB wire cap, and fail closed on decode bombs / mislabeled JPEG / invalid base64.
• Proven on the OpenCodex Cursor path (live Grumpy attach / view_image captions); this ports the wire-format + soft-cap pieces only (no Codex-only promote / multi-agent / MCP omit work).

Related Issues

• Related to Cursor SelectedImage hydration reliability (no upstream issue filed yet for blobIdWithData).

Validation

Choose the change type and focused loop from the
Contribution Golden Path. The full unit suite,
Vitest, the 60% coverage gate, and the production build all run in CI on this PR (#8329):

• Change type: other (open-sse Cursor executor / vision encode)
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube PR analysis is green or any remaining issues are explicitly documented below

Focused loop run locally:

node --import tsx/esm --test tests/unit/cursor-image-input.test.ts
npm run check:open-sse-typecheck
npm run lint

All 28 tests in cursor-image-input.test.ts passed. check:open-sse-typecheck OK (pre-existing baseline only). Lint green (pre-commit lint-staged + full npm run lint).

Tests Added Or Updated

• tests/unit/cursor-image-input.test.ts — field 9 / blobStore assertions; JPEG soft-cap + mislabeled PNG-as-JPEG + strict base64 + large-PNG resolve regressions.

Coverage Notes

• Covers open-sse/utils/cursorAgentProtobuf.ts (encodeSelectedImageBody / encodeAgentRunRequest) and open-sse/utils/cursorImages.ts (resolve + prep + sniff). Executor still passes the same blobStore into encode; getBlob now also serves vision blobs stored during encode.

Reviewer Notes

• Adds a direct sharp dependency (^0.35.3; already present transitively / in overrides).
• Behavior change: oversized-but-decodable PNGs under 16 MiB are re-encoded instead of hard-failing at 1 MiB inbound; undecodable / SSRF / decode-ceiling failures still return sanitized 400 via CursorImageError.
• No OmniRoute live Cursor smoke in this PR; wire format matches the OpenCodex path that passed live Grumpy attach + forced view_image.

[diegosouzapw]

Thanks for the PR. Please address the mandatory items (tests and/or merge blockers) in this branch, then rerun checks before /merge-prs.

[diegosouzapw]

Thanks for the PR. Please address the mandatory items (tests and/or merge blockers) in this branch, then rerun checks before /merge-prs.

[diegosouzapw]

Thanks for the PR. Please address the mandatory items (tests and/or merge blockers) in this branch, then rerun checks before /merge-prs.

[diegosouzapw]

Obrigado pelo PR. Mantive a revisão de fix-in-place e não foi possível concluir o ajuste completo aqui:

• Para os PRs em fork: não consigo aplicar push de correção diretamente na sua branch.
  Por favor, faça um rebase/sync com release/v3.8.50, resolva conflitos se houver, e rode os checks dessa branch.
  Se preferir, posso aplicar a correção na próxima rodada assim que você mandar o branch atualizado ou confirmar que o PR está limpo pra esse merge.

[yansigit]

@diegosouzapw Thanks. already done on our side:

• Branch is rebased/synced onto current release/v3.8.50 (e0ce95c59)
• Changelog fragment added (changelog.d/fixes/9834-cursor-selected-image-blobid.md)
• Checks on this head are green
  PR is clean for the next /merge-prs / queue pass. Happy to rebase again if the tip moves.

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #8875. Mergify cannot evaluate rules on this PR. Once #8875 is merged or closed, Mergify will resume processing this PR. ⚠️