Where does the bug appear (feature/product)?
Cursor IDE
Describe the Bug
When referencing a folder cursor locks up every time.
I have a directory with two yaml files in it. They both contain about 200 lines of code. They are not referenced by anything in my codebase.
Task manager reports that Cursor has a process for one of the files that is using 4GB of ram.
I do not have any other files open.
I have completely uninstalled Cursor, deleted every file I could find associated with Cursor. Then reinstalled from a newly downloaded install file.
This happens to me with various folders about 1-2 times a week.
This is the file that’s overloading Cursor (today):
# Alphaglow Backend Standards (Rust)
project:
scope: "All Alphaglow backend services"
language: "Rust"
primary_runtime: "Async HTTP APIs and background workers"
database: "PostgreSQL (with optional Redis, MongoDB, etc.)"
core_principles:
- "Type- and memory-safety first (idiomatic Rust)"
- "Explicit, well-modeled domain types"
- "Async-by-default I/O"
- "Secure-by-default APIs and data handling"
- "Consistency across services (naming, error model, logging)"
- "Observability: logs, metrics, and tracing on all critical paths"
crud_standards:
general:
- "All CRUD operations are async and non-blocking"
- "Use explicit types for all parameters and return values"
- "Return domain-specific result types (e.g. Result<T, DomainError>)"
- "Implement comprehensive error handling with structured error types"
- "Log operations with appropriate levels and contextual fields"
- "Use parameterized queries / query builders (e.g. SQLx, SeaORM, Diesel)"
- "Never expose database internals directly in API responses"
create:
- "Validate input data before insertion (domain + database constraints)"
- "Check for uniqueness/duplicates where applicable"
- "Wrap multi-table operations in explicit transactions"
- "Return created record or identifier on success"
- "Handle unique constraint violations with typed errors"
read:
- "Return an Option<T> for not-found cases at the repository layer"
- "Use targeted SELECTs, avoid SELECT * in production code"
- "Implement pagination for multi-row reads (page/limit or cursor)"
- "Consider caching for hot paths; clearly document eviction strategy"
update:
- "Support partial updates via typed input structs (e.g. Option fields)"
- "Validate all incoming data prior to persistence"
- "Return updated record or success indicator"
- "Use optimistic locking/version fields where concurrent updates matter"
- "Record old vs. new values in audit logs on sensitive entities"
delete:
- "Prefer soft deletes (is_deleted, deleted_at) for user/content entities"
- "Implement cascading behavior explicitly and document it"
- "Return a boolean/Result indicating success vs. not-found"
- "Clean up related resources (e.g. cache entries, background jobs)"
schema_standards:
primary_keys:
type: "UUID or database-generated integer; prefer UUID for public entities"
name: "id"
constraints:
- "PRIMARY KEY"
- "NOT NULL"
foreign_keys:
naming_pattern: "{referenced_table}_id"
constraints:
- "NOT NULL unless truly optional relationship"
- "REFERENCES {parent_table}(id) ON DELETE RESTRICT or CASCADE (explicit)"
timestamps:
fields:
created_at:
type: "TIMESTAMP WITH TIME ZONE"
default: "CURRENT_TIMESTAMP"
updated_at:
type: "TIMESTAMP WITH TIME ZONE"
default: "CURRENT_TIMESTAMP"
conventions:
- "Use *_at suffix for temporal fields"
- "Always update updated_at on mutations"
naming:
tables:
convention: "snake_case plural (e.g. users, user_languages)"
columns:
convention: "snake_case (e.g. created_at, is_active)"
performance:
indexes:
guidelines:
- "Index foreign keys"
- "Index frequently queried columns and unique constraints"
- "Name indexes idx_{table}_{column}"
partitioning:
recommended_for:
- "Large append-only or time-series tables"
- "High-volume audit/event tables"
documentation:
rules:
- "Document table purpose and relationships"
- "Document non-obvious columns and constraints"
- "Keep schema docs in migration files and/or schema reference docs"
token_and_auth_standards:
architecture:
principles:
- "Auth/token logic lives in dedicated modules/crates (no ad-hoc JWT usage)"
- "HTTP handlers delegate to auth services; they do not implement auth rules inline"
- "Use typed auth context (e.g. AuthenticatedUser) extracted from requests"
token_types:
access_token:
purpose: "Short-lived API access"
storage: "Bearer token in Authorization header"
refresh_token:
purpose: "Long-lived token for obtaining new access tokens"
storage: "Secure storage on client; optionally tracked server-side (e.g. Redis)"
id_token:
purpose: "Identity / profile claims when needed"
operations:
login:
- "Validate credentials and issue new access + refresh (and id token if used)"
- "Optionally persist refresh token identifiers for revocation"
refresh:
- "Validate refresh token and its revocation status"
- "Rotate refresh tokens (issue new, revoke old)"
logout:
- "Invalidate refresh tokens (e.g. remove from store or mark revoked)"
security:
jwt:
- "Use strong secrets or asymmetric keys"
- "Set explicit expirations per token type"
- "Validate issuer, audience, and other critical claims"
storage:
- "Never log raw tokens"
- "Use secure channels (HTTPS) for all auth operations"
error_handling:
design:
- "Use a central error type per service or domain (enum + thiserror/anyhow)"
- "Map domain errors to HTTP responses in one place (e.g. middleware/layer)"
- "Never leak internal error details to clients"
logging_and_observability:
logging:
rules:
- "Use structured logging (key-value fields)"
- "Include request identifiers, user ID (when available), and key entity IDs"
- "Mask sensitive fields (passwords, secrets, tokens)"
- "Log security-sensitive events (auth, permission failures, data exports)"
metrics:
guidelines:
- "Record latency and error-rate metrics per endpoint"
- "Expose health and readiness endpoints"
tracing:
guidelines:
- "Propagate trace IDs across services where possible"
- "Annotate spans with domain-relevant information (e.g. lesson_id, user_id)"
testing_and_quality:
tests:
- "Unit test domain logic and repositories (database with test harness or mocks)"
- "Integration test API endpoints (happy path + error scenarios)"
- "Test authentication/authorization flows and permission boundaries"
- "Test concurrency and transaction boundaries where relevant"
code_quality:
- "Use clippy and rustfmt in CI"
- "Avoid unwrap/expect in production code paths"
- "Prefer small, well-named functions and modules"
security_and_compliance:
input_validation:
- "Validate all external inputs at the boundary layer"
- "Use typed requests and central validation helpers"
data_protection:
- "Hash passwords with modern KDFs (e.g. Argon2, scrypt, bcrypt)"
- "Encrypt sensitive fields at rest when required"
rate_limiting:
- "Apply rate limiting on authentication and other sensitive endpoints"
auditing:
- "Maintain audit log for admin and security-sensitive operations"
Steps to Reproduce
using @ in an agent window locks up Cursor on certain directories every time. I have no idea what causes certain directories to do this.
Expected Behavior
I can link folders without having to kill Cursor.
Screenshots / Screen Recordings
Operating System
Windows 10/11
Version Information
Version: 3.2.21 (user setup)
VSCode Version: 1.105.1
Commit: 806df57ed3b6f1ee0175140d38039a38574ec720
Date: 2026-05-03T01:46:14.413Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 39.8.1
Chromium: 142.0.7444.265
Node.js: 22.22.1
V8: 14.2.231.22-electron.0
OS: Windows_NT x64 10.0.19045
Does this stop you from using Cursor
Yes - Cursor is unusable


