@cursor/bdk 0.2.2 → 0.2.3

package/dist/internal/hosted-delivery.js

@@ -26,6 +26,29 @@ import { endActiveHttpSpan } from "./otel/http.js";
 import { ReminderValidationError, UnknownReminderError } from "./reminder-runner.js";
 import { mapThrownRequestError, statusForThrownRequestError } from "./request-error-status.js";
 import { HostedEnqueueNotActiveError } from "./session-engine.js";
+function responseToReply(response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const value = (yield response.json());
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            throw new Error("Hosted delivery produced a non-object JSON response.");
+        }
+        return {
+            status: response.status,
+            body: value,
+            serverTiming: (_a = response.headers.get("server-timing")) !== null && _a !== void 0 ? _a : undefined,
+        };
+    });
+}
+function responseFromReply(reply) {
+    return Response.json(reply.body, {
+        status: reply.status,
+        headers: reply.serverTiming === undefined ? undefined : { "server-timing": reply.serverTiming },
+    });
+}
+function isTransientRetryReply(reply) {
+    return reply.body.retry === HOSTED_GUEST_RETRY_TRANSIENT;
+}
 /**
  * A second `send()` in one delivery is a deterministic authored bug — the
  * wire protocol carries exactly one pending send per delivery — so it must
@@ -49,6 +72,23 @@ function boundedMessage(text) {
         ? `${text.slice(0, MAX_ERROR_MESSAGE_LENGTH)}…`
         : text;
 }
+/**
+ * A channel's non-OK dispatch response body is the only record of why the
+ * delivery was refused (e.g. an authored 400 with a validation message).
+ * Carry it, bounded, into the terminal channel_dispatch_failed so the
+ * control plane's failure log is diagnosable.
+ */
+function channelDispatchDetail(response) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const text = (yield response.text()).trim();
+            return text === "" ? undefined : boundedMessage(text);
+        }
+        catch (_a) {
+            return undefined;
+        }
+    });
+}
 function terminalHostedError(status, error, message) {
     return hostedGuestErrorResponse({
         status,
@@ -231,7 +271,7 @@ function runAdmission(input, adapter) {
         }
         if (!dispatched.ok) {
             return {
-                response: terminalHostedError(dispatched.status >= 400 ? dispatched.status : 502, "channel_dispatch_failed"),
+                response: terminalHostedError(dispatched.status >= 400 ? dispatched.status : 502, "channel_dispatch_failed", yield channelDispatchDetail(dispatched)),
             };
         }
         try {
@@ -333,8 +373,11 @@ function logGuestNetworkWait(phase, stats) {
 export function registerHostedDeliveryRoute(input) {
     var _a, _b;
     const pending = new Map();
+    const admissions = new Map();
     const activeOwners = new Map();
     const pendingTtlMs = 10 * 60000;
+    /** Keep an in-flight owner turn addressable for status polls. */
+    const ownerTurnPendingTtlMs = 12 * 60 * 60000;
     const waitForNetwork = (_a = input.waitForGuestNetwork) !== null && _a !== void 0 ? _a : (() => waitForGuestNetworkReady());
     const consumeBoundSecrets = (_b = input.consumeBoundSecrets) !== null && _b !== void 0 ? _b : (() => consumeHostedBoundSecrets());
     /**
@@ -375,7 +418,57 @@ export function registerHostedDeliveryRoute(input) {
                 pending.delete(token);
             }
         }
+        for (const [deliveryId, operation] of admissions) {
+            if (operation.expiresAt <= now) {
+                admissions.delete(deliveryId);
+            }
+        }
     };
+    const runAdmissionOperation = (delivery, definition) => __awaiter(this, void 0, void 0, function* () {
+        return afterHostedWork(input.flushOtel, () => __awaiter(this, void 0, void 0, function* () {
+            const startedAt = performance.now();
+            let guestNetwork;
+            const finish = (response) => withServerTiming(response, performance.now() - startedAt, guestNetwork);
+            try {
+                const network = yield finishNetworkWait("admission");
+                guestNetwork = network.timing;
+                if (network.response !== undefined) {
+                    return yield responseToReply(finish(network.response));
+                }
+                if (isHostedReminderAdmission(delivery)) {
+                    return yield responseToReply(finish(yield dispatchHostedReminderAdmission(input, delivery)));
+                }
+                if (definition === undefined) {
+                    return yield responseToReply(finish(terminalHostedError(404, "channel_not_found", `No channel named "${delivery.channelId}" is mounted.`)));
+                }
+                const admitted = yield dispatchHostedAdmission({
+                    delivery,
+                    definition,
+                    args: input.buildHandlerArgs(delivery.channelId),
+                });
+                if (admitted.pendingSend === undefined) {
+                    return yield responseToReply(finish(admitted.response));
+                }
+                pruneExpired();
+                const admissionToken = randomBytes(24).toString("hex");
+                pending.set(admissionToken, {
+                    send: admitted.pendingSend,
+                    channelKind: delivery.channelKind,
+                    expiresAt: Date.now() + pendingTtlMs,
+                    deliveryId: delivery.deliveryId,
+                });
+                return yield responseToReply(finish(Response.json({
+                    ok: true,
+                    v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                    outcome: "send",
+                    admissionToken,
+                })));
+            }
+            catch (error) {
+                return yield responseToReply(finish(terminalHostedError(503, "internal_error", boundedMessage(error instanceof Error ? error.message : String(error)))));
+            }
+        }));
+    });
     // Hosted callers reach this only through Anyrun's signed pod-port URL.
     // The marker is a second, route-specific fence distinct from channel auth.
     const auth = request => {
@@ -394,9 +487,9 @@ export function registerHostedDeliveryRoute(input) {
         auth: [auth],
         handler: (request) => __awaiter(this, void 0, void 0, function* () {
             return afterHostedWork(input.flushOtel, () => __awaiter(this, void 0, void 0, function* () {
+                var _a;
                 const startedAt = performance.now();
-                let guestNetwork;
-                const finish = (response) => withServerTiming(response, performance.now() - startedAt, guestNetwork);
+                const finish = (response) => withServerTiming(response, performance.now() - startedAt);
                 const unconsumed = finishBoundSecrets();
                 if (unconsumed !== undefined) {
                     return finish(unconsumed);
@@ -412,46 +505,65 @@ export function registerHostedDeliveryRoute(input) {
                     console.info(`[agent-sdk] hosted admission rejected: envelope failed to parse keys=${JSON.stringify(rawKeys)} hasManagedAutomation=${String(rawKeys.includes("managedAutomation"))}`);
                     return finish(terminalHostedError(400, "invalid_hosted_admission", "Expected a supported Agent SDK hosted-admission envelope."));
                 }
-                console.info(`[agent-sdk] hosted admission received deliveryId=${delivery.deliveryId} channelId=${delivery.channelId} channelKind=${delivery.channelKind} eventType=${delivery.eventType} sessionMode=${delivery.sessionMode} managedAutomation=${delivery.managedAutomation === undefined ? "<absent>" : `automationUuid=${delivery.managedAutomation.automationUuid} mcpServerNames=${String(delivery.managedAutomation.mcpServerNames.length)} slackChannels=${delivery.managedAutomation.slackChannels === undefined ? "<absent>" : JSON.stringify(delivery.managedAutomation.slackChannels)}`}`);
-                recordHostedManagedAutomation(delivery);
-                if (isHostedReminderAdmission(delivery)) {
-                    const network = yield finishNetworkWait("admission");
-                    guestNetwork = network.timing;
-                    if (network.response !== undefined) {
-                        return finish(network.response);
+                pruneExpired();
+                const existing = admissions.get(delivery.deliveryId);
+                if (delivery.mode === "status") {
+                    if (existing === undefined) {
+                        return finish(transientHostedError(409, "hosted_admission_unavailable", "No hosted admission is in flight for this delivery."));
                     }
-                    return finish(yield dispatchHostedReminderAdmission(input, delivery));
+                    return existing.settledReply === undefined
+                        ? finish(Response.json({
+                            ok: true,
+                            v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                            outcome: "running",
+                        }))
+                        : responseFromReply(existing.settledReply);
                 }
-                const channel = input.channels.find(candidate => candidate.id === delivery.channelId);
-                if (channel === undefined) {
-                    return finish(terminalHostedError(404, "channel_not_found", `No channel named "${delivery.channelId}" is mounted.`));
+                if (existing !== undefined) {
+                    if (existing.settledReply !== undefined && isTransientRetryReply(existing.settledReply)) {
+                        admissions.delete(delivery.deliveryId);
+                    }
+                    else {
+                        return existing.settledReply === undefined
+                            ? finish(Response.json({
+                                ok: true,
+                                v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                                outcome: "started",
+                            }))
+                            : responseFromReply(existing.settledReply);
+                    }
                 }
-                const network = yield finishNetworkWait("admission");
-                guestNetwork = network.timing;
-                if (network.response !== undefined) {
-                    return finish(network.response);
+                console.info(`[agent-sdk] hosted admission received deliveryId=${delivery.deliveryId} channelId=${delivery.channelId} channelKind=${delivery.channelKind} eventType=${delivery.eventType} sessionMode=${delivery.sessionMode} managedAutomation=${delivery.managedAutomation === undefined ? "<absent>" : `automationUuid=${delivery.managedAutomation.automationUuid} mcpServerNames=${String(delivery.managedAutomation.mcpServerNames.length)} slackChannels=${delivery.managedAutomation.slackChannels === undefined ? "<absent>" : JSON.stringify(delivery.managedAutomation.slackChannels)}`}`);
+                recordHostedManagedAutomation(delivery);
+                const reminder = isHostedReminderAdmission(delivery);
+                const definition = reminder
+                    ? undefined
+                    : (_a = input.channels.find(candidate => candidate.id === delivery.channelId)) === null || _a === void 0 ? void 0 : _a.definition;
+                if (!reminder && definition === undefined) {
+                    return finish(terminalHostedError(404, "channel_not_found", `No channel named "${delivery.channelId}" is mounted.`));
                 }
-                const admitted = yield dispatchHostedAdmission({
-                    delivery,
-                    definition: channel.definition,
-                    args: input.buildHandlerArgs(delivery.channelId),
+                let operation;
+                const execution = runAdmissionOperation(delivery, definition).then(reply => {
+                    operation.settledReply = reply;
+                    operation.expiresAt = Date.now() + pendingTtlMs;
+                    return reply;
                 });
-                if (admitted.pendingSend === undefined) {
-                    return finish(admitted.response);
+                operation = {
+                    execution,
+                    expiresAt: Date.now() + ownerTurnPendingTtlMs,
+                };
+                admissions.set(delivery.deliveryId, operation);
+                const quickReply = yield Promise.race([
+                    execution,
+                    new Promise(resolve => setImmediate(() => resolve(undefined))),
+                ]);
+                if (quickReply !== undefined) {
+                    return responseFromReply(quickReply);
                 }
-                pruneExpired();
-                const admissionToken = randomBytes(24).toString("hex");
-                pending.set(admissionToken, {
-                    send: admitted.pendingSend,
-                    channelKind: delivery.channelKind,
-                    expiresAt: Date.now() + pendingTtlMs,
-                    deliveryId: delivery.deliveryId,
-                });
                 return finish(Response.json({
                     ok: true,
                     v: HOSTED_DELIVERY_PROTOCOL_VERSION,
-                    outcome: "send",
-                    admissionToken,
+                    outcome: "started",
                 }));
             }));
         }),
@@ -484,13 +596,40 @@ export function registerHostedDeliveryRoute(input) {
                     admitted.sessionPublicId !== execution.sessionPublicId) {
                     return finish(transientHostedError(409, "hosted_admission_session_mismatch", "The hosted admission token is already bound to another session."));
                 }
-                const network = yield finishNetworkWait("execution");
-                guestNetwork = network.timing;
-                if (network.response !== undefined) {
-                    return finish(network.response);
+                if (execution.mode === "start" &&
+                    admitted.settledReply !== undefined &&
+                    isTransientRetryReply(admitted.settledReply)) {
+                    delete admitted.settledReply;
+                    delete admitted.execution;
+                }
+                if (execution.mode === "status" ||
+                    (execution.mode === "start" && admitted.execution !== undefined)) {
+                    if (admitted.settledReply !== undefined) {
+                        return responseFromReply(admitted.settledReply);
+                    }
+                    if (admitted.execution === undefined) {
+                        return finish(transientHostedError(409, "hosted_admission_unavailable", "The hosted admission token has no owner turn in flight."));
+                    }
+                    if (execution.mode === "start") {
+                        return finish(Response.json({
+                            ok: true,
+                            v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                            outcome: "started",
+                        }));
+                    }
+                    return finish(Response.json({
+                        ok: true,
+                        v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                        outcome: "running",
+                    }));
                 }
                 admitted.sessionPublicId = execution.sessionPublicId;
                 if (execution.mode === "enqueue") {
+                    const network = yield finishNetworkWait("execution");
+                    guestNetwork = network.timing;
+                    if (network.response !== undefined) {
+                        return finish(network.response);
+                    }
                     const enqueueOutcome = yield enqueueIntoActiveOwner({
                         activeOwners,
                         sessionPublicId: execution.sessionPublicId,
@@ -500,7 +639,15 @@ export function registerHostedDeliveryRoute(input) {
                     });
                     return finish(Response.json(Object.assign({ ok: true, v: HOSTED_DELIVERY_PROTOCOL_VERSION }, enqueueOutcome)));
                 }
-                (_a = admitted.execution) !== null && _a !== void 0 ? _a : (admitted.execution = (() => __awaiter(this, void 0, void 0, function* () {
+                if (admitted.execution === undefined) {
+                    admitted.expiresAt = Date.now() + ownerTurnPendingTtlMs;
+                }
+                (_a = admitted.execution) !== null && _a !== void 0 ? _a : (admitted.execution = afterHostedWork(input.flushOtel, () => __awaiter(this, void 0, void 0, function* () {
+                    const network = yield finishNetworkWait("execution");
+                    guestNetwork = network.timing;
+                    if (network.response !== undefined) {
+                        return yield responseToReply(finish(network.response));
+                    }
                     const startedAt = performance.now();
                     const executionId = hostedExecutionDiagId(execution.admissionToken);
                     const sinks = Object.assign(Object.assign(Object.assign(Object.assign({}, (input.stateRoot === undefined ? {} : { stateRoot: input.stateRoot })), (input.persistSessionRun === undefined
@@ -512,10 +659,10 @@ export function registerHostedDeliveryRoute(input) {
                             : hostedFailureClassification(fields.failureCode);
                         yield flushHostedExecutionRecord(sinks, Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ executionId, sessionPublicId: execution.sessionPublicId, sessionId: fields.sessionId, turnStatus: fields.turnStatus, durationMs: Math.max(0, Math.round(performance.now() - startedAt)) }, (fields.message === undefined ? {} : { message: fields.message })), (fields.abortReason === undefined ? {} : { abortReason: fields.abortReason })), { failureCode: fields.failureCode }), (fields.errorCode === undefined ? {} : { errorCode: fields.errorCode })), { classification }), (fields.error === undefined ? {} : { error: fields.error })));
                     });
-                    // Claim the file before the turn runs. The host reads it after its
-                    // own POST returns, which for a 9-minute timeout is while this turn
-                    // is still going; without this marker that read would surface the
-                    // PREVIOUS delivery's terminal record as if it were this one's.
+                    // Claim the file before the turn runs. If a later status request
+                    // fails, the host reads this record while the turn may still be
+                    // running; the marker prevents it from surfacing the previous
+                    // delivery's terminal record.
                     yield writeDiag({
                         sessionId: "",
                         turnStatus: HOSTED_EXECUTION_DIAG_RUNNING_STATUS,
@@ -562,7 +709,10 @@ export function registerHostedDeliveryRoute(input) {
                             // survive the park just like a finished turn's.
                             yield (_a = input.drainSessionDurability) === null || _a === void 0 ? void 0 : _a.call(input, session.id);
                             drainAt = hostedExecutionNow();
-                            const consumedDeliveryIds = [owner.primaryDeliveryId, ...owner.acceptedDeliveryIds];
+                            const consumedDeliveryIds = [
+                                owner.primaryDeliveryId,
+                                ...owner.acceptedDeliveryIds,
+                            ];
                             if (consumedDeliveryIds.length > HOSTED_MAX_CONSUMED_DELIVERY_IDS) {
                                 throw new Error(`hosted execute consumedDeliveryIds length ${String(consumedDeliveryIds.length)} exceeds cap ${String(HOSTED_MAX_CONSUMED_DELIVERY_IDS)}`);
                             }
@@ -597,7 +747,7 @@ export function registerHostedDeliveryRoute(input) {
                                 drainAt,
                                 endedAt: hostedExecutionNow(),
                             });
-                            return reply;
+                            return yield responseToReply(finish(Response.json(reply.body, { status: reply.status })));
                         }
                         catch (error) {
                             owner.accepting = false;
@@ -623,9 +773,39 @@ export function registerHostedDeliveryRoute(input) {
                             }
                         }
                     }));
-                }))());
-                const reply = yield admitted.execution;
-                return finish(Response.json(reply.body, { status: reply.status }));
+                })).then(reply => {
+                    admitted.settledReply = reply;
+                    admitted.expiresAt = Date.now() + pendingTtlMs;
+                    return reply;
+                }, error => {
+                    admitted.settledReply = {
+                        status: 503,
+                        body: {
+                            ok: false,
+                            error: "internal_error",
+                            retry: HOSTED_GUEST_RETRY_TERMINAL,
+                            classification: hostedFailureClassification("internal_error"),
+                            message: error instanceof Error ? error.message : String(error),
+                        },
+                    };
+                    admitted.expiresAt = Date.now() + pendingTtlMs;
+                    return admitted.settledReply;
+                }));
+                if (execution.mode === "start") {
+                    const quickReply = yield Promise.race([
+                        admitted.execution,
+                        new Promise(resolve => setImmediate(() => resolve(undefined))),
+                    ]);
+                    if (quickReply !== undefined) {
+                        return responseFromReply(quickReply);
+                    }
+                    return finish(Response.json({
+                        ok: true,
+                        v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                        outcome: "started",
+                    }));
+                }
+                return finish(terminalHostedError(400, "invalid_hosted_execution", "Owner execution requires start or status mode."));
             }));
         }),
     });

package/dist/internal/hosting.d.ts

@@ -6,8 +6,8 @@
  * backend stays authoritative — these exist so mistakes fail fast and
  * locally with the same grammar the server enforces.
  */
-/** `hosting.egressDomains` cap (backend caps the deploy body at 20). */
-export declare const MAX_EGRESS_DOMAINS = 20;
+/** `hosting.egressDomains` cap (the manifest schema and deploy body agree). */
+export declare const MAX_EGRESS_DOMAINS = 64;
 /** Max secrets per deployment. */
 export declare const MAX_SECRETS = 32;
 /** Max secret value size in bytes. */

package/dist/internal/hosting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../../src/internal/hosting.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,kCAAkC;AAClC,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,sCAAsC;AACtC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,8BAA8B;AAC9B,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,YAAY,CAAC;AACrD,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,sDAAsD;AACtD,eAAO,MAAM,yBAAyB,EAAE,MAA+B,CAAC;AAIxE,gFAAgF;AAChF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,YAAI,2BAA2B,CAAU,CAAC;AAQ3F,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKvE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQnE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS3E;AAID,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}
+{"version":3,"file":"hosting.d.ts","sourceRoot":"","sources":["../../src/internal/hosting.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,kCAAkC;AAClC,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,sCAAsC;AACtC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,8BAA8B;AAC9B,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,YAAY,CAAC;AACrD,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,MAAM,CAAC;AACxC,sDAAsD;AACtD,eAAO,MAAM,yBAAyB,EAAE,MAA+B,CAAC;AAIxE,gFAAgF;AAChF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,YAAI,2BAA2B,CAAU,CAAC;AAW3F,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQnE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS3E;AAID,sEAAsE;AACtE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/internal/hosting.js

@@ -6,8 +6,8 @@
  * backend stays authoritative — these exist so mistakes fail fast and
  * locally with the same grammar the server enforces.
  */
-/** `hosting.egressDomains` cap (backend caps the deploy body at 20). */
-export const MAX_EGRESS_DOMAINS = 20;
+/** `hosting.egressDomains` cap (the manifest schema and deploy body agree). */
+export const MAX_EGRESS_DOMAINS = 64;
 /** Max secrets per deployment. */
 export const MAX_SECRETS = 32;
 /** Max secret value size in bytes. */
@@ -39,12 +39,18 @@ const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
 // Lowercase hostname with >=2 labels, an alphabetic TLD, and at most one
 // leading `*.` wildcard. Labels: alphanumeric with interior hyphens.
 const EGRESS_DOMAIN_PATTERN = /^(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]+$/;
+/** `host:port` asks for raw TCP egress; a wildcard host has no address to open. */
+const EGRESS_TCP_PATTERN = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]+:([1-9]\d{0,4})$/;
 /** Returns a human error message, or undefined when the domain is valid. */
 export function validateEgressDomain(domain) {
     if (EGRESS_DOMAIN_PATTERN.test(domain)) {
         return undefined;
     }
-    return `Invalid egress domain ${JSON.stringify(domain)}: use a lowercase hostname with at least two labels and an alphabetic TLD (e.g. "api.example.com"), optionally with a single leading "*." wildcard.`;
+    const tcp = EGRESS_TCP_PATTERN.exec(domain);
+    if (tcp !== null && Number(tcp[3]) <= 65535) {
+        return undefined;
+    }
+    return `Invalid egress domain ${JSON.stringify(domain)}: use a lowercase hostname with at least two labels and an alphabetic TLD (e.g. "api.example.com"), optionally with a single leading "*." wildcard or a trailing ":port" for raw TCP.`;
 }
 /**
  * Returns a human error message, or undefined when the name is a valid

package/dist/internal/install-cursor-skills.d.ts

@@ -1,8 +1,8 @@
 /**
  * Offer to install the package's coding-agent skills into the user's
- * personal Cursor skills dir under `~/.cursor/skills/agentsdk/<skill>/`.
+ * personal Cursor skills dir under `~/.cursor/skills/bdk/<skill>/`.
  *
- * Cursor walks `~/.cursor/skills` recursively, so the `agentsdk/` folder is
+ * Cursor walks `~/.cursor/skills` recursively, so the `bdk/` folder is
  * only organizational — identity comes from the leaf folder that holds
  * SKILL.md. Installed copies get `alwaysApply: true` so Cursor injects the
  * skill body as a global rule instead of leaving it as an on-demand catalog
@@ -14,9 +14,7 @@
  * install, so `pnpm install` in everysphere does not overwrite `~/.cursor`.
  */
 /** Category folder under ~/.cursor/skills (Cursor discovers nested skills). */
-export declare const CURSOR_SKILLS_NAMESPACE = "agentsdk";
-/** Pre-rename install folder. Install deletes this so `/agentkit-*` rows disappear. */
-export declare const LEGACY_CURSOR_SKILLS_NAMESPACE = "agentkit";
+export declare const CURSOR_SKILLS_NAMESPACE = "bdk";
 /** How long the `init` offer waits for an answer before skipping the install. */
 export declare const SKILL_PROMPT_TIMEOUT_MS = 45000;
 /**
@@ -27,9 +25,9 @@ export declare const CURSOR_JULY_SKILLS_HOME_ENV = "CURSOR_JULY_SKILLS_HOME";
 /** Set to `1` to skip the postinstall skill copy. */
 export declare const CURSOR_JULY_SKIP_SKILL_INSTALL_ENV = "CURSOR_JULY_SKIP_SKILL_INSTALL";
 export interface PackageSkill {
-    /** Frontmatter `name` (e.g. agentsdk-create-agent). */
+    /** Frontmatter `name` (e.g. bdk-create-agent). */
     name: string;
-    /** Leaf install directory under agentsdk/ (e.g. create-agent). */
+    /** Leaf install directory under bdk/ (e.g. create-agent). */
     leafDir: string;
     /** Absolute path to the source skill directory in the package. */
     sourceDir: string;
@@ -42,19 +40,17 @@ export declare function cursorSkillsHome(home?: string): string;
  * (npm, pnpm, yarn, npx, global), not the everysphere source checkout.
  */
 export declare function isConsumerPackageInstall(packageRoot: string): boolean;
-/** `~/.cursor/skills/agentsdk` — where package skills are installed. */
-export declare function agentsdkCursorSkillsDir(skillsHome?: string): string;
-/** Pre-rename `~/.cursor/skills/agentkit`. */
-export declare function legacyAgentkitCursorSkillsDir(skillsHome?: string): string;
-/** Absolute install path for one skill: `…/agentsdk/<leafDir>`. */
+/** `~/.cursor/skills/bdk` — where package skills are installed. */
+export declare function bdkCursorSkillsDir(skillsHome?: string): string;
+/** Absolute install path for one skill: `…/bdk/<leafDir>`. */
 export declare function skillInstallPath(skill: Pick<PackageSkill, "leafDir">, skillsHome?: string): string;
 /**
  * Skills shipped next to the running package. Uses the frontmatter `name`
- * when present, otherwise `agentsdk-<dir>`.
+ * when present, otherwise `bdk-<dir>`.
  */
 export declare function listShippedPackageSkills(packageRoot?: string): Promise<PackageSkill[]>;
 /**
- * Skills that do not yet have a SKILL.md under ~/.cursor/skills/agentsdk/.
+ * Skills that do not yet have a SKILL.md under ~/.cursor/skills/bdk/.
  * Install still overwrites every shipped skill when the user confirms — this
  * helper is for messaging (fresh install vs update).
  */
@@ -67,15 +63,15 @@ export interface SkillInstallResult {
     installed: string[];
     /** Leaf dirs deleted because the package no longer ships them. */
     removed: string[];
-    /** True when leftover `~/.cursor/skills/agentkit` was deleted. */
-    removedLegacyNamespace: boolean;
+    /** Leftover namespace dirs deleted (`…/agentsdk`, `…/agentkit`). */
+    removedLegacyDirs: string[];
 }
 /**
- * Copy each skill directory into `skillsHome/agentsdk/<leafDir>/`.
+ * Copy each skill directory into `skillsHome/bdk/<leafDir>/`.
  * Always overwrites so a package upgrade refreshes local Cursor skills.
  * Strips monorepo-only frontmatter, sets `alwaysApply: true` so Cursor
  * loads the body into context, and removes leaf dirs no longer shipped.
- * Also deletes leftover `skillsHome/agentkit/` from the previous namespace.
+ * Also deletes leftover `skillsHome/agentsdk/` and `skillsHome/agentkit/`.
  */
 export declare function installCursorSkills(skills: readonly PackageSkill[], skillsHome?: string): Promise<SkillInstallResult>;
 /**
@@ -88,7 +84,7 @@ export interface SkillInstallPlan {
     shipped: PackageSkill[];
     /** Resolved `~/.cursor/skills`, to install into. */
     skillsHome: string;
-    /** Install target: `<skillsHome>/agentsdk`. */
+    /** Install target: `<skillsHome>/bdk`. */
     directory: string;
     /** Leaf dirs the package ships. */
     leaves: string[];
@@ -96,15 +92,15 @@ export interface SkillInstallPlan {
     firstInstall: boolean;
     /** Installed leaf dirs the package dropped; installing deletes them. */
     orphans: string[];
-    /** True when leftover `skillsHome/agentkit` still exists. */
-    hasLegacyNamespace: boolean;
+    /** Leftover namespace dirs that still exist. Installing deletes them. */
+    legacyDirs: string[];
 }
 /** What an install would do, for the offer and for `install-skills`. */
 export declare function planSkillInstall(options?: {
     packageRoot?: string;
     skillsHome?: string;
 }): Promise<SkillInstallPlan>;
-/** `Installed 9 Agent SDK skills`, what it dropped, and where it went. */
+/** `Installed 9 BDK skills`, what it dropped, and where it went. */
 export declare function formatSkillInstall(plan: SkillInstallPlan, result: SkillInstallResult): string;
 export type PackageInstallSkillSyncResult = {
     status: "installed";
@@ -123,7 +119,7 @@ export interface SyncCursorSkillsOnPackageInstallOptions {
     out?: (text: string) => void;
 }
 /**
- * Copy shipped coding-agent skills into ~/.cursor/skills/agentsdk during a
+ * Copy shipped coding-agent skills into ~/.cursor/skills/bdk during a
  * consumer `npm install` / `npx`. Never throws: a failed copy must not fail
  * the package install. No-op in the monorepo source tree and when
  * `CURSOR_JULY_SKIP_SKILL_INSTALL=1`.
@@ -140,7 +136,7 @@ export interface OfferInstallCursorSkillsOptions {
 }
 /**
  * On a TTY, offer to install/update every shipped package skill into
- * ~/.cursor/skills/agentsdk (always overwriting). No-op when non-interactive
+ * ~/.cursor/skills/bdk (always overwriting). No-op when non-interactive
  * or the package ships no skills. An unanswered prompt skips the install
  * rather than blocking the caller — see `SKILL_PROMPT_TIMEOUT_MS`.
  */

package/dist/internal/install-cursor-skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-cursor-skills.d.ts","sourceRoot":"","sources":["../../src/internal/install-cursor-skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,qDAAqD;AACrD,eAAO,MAAM,kCAAkC,mCAAmC,CAAC;AAEnF,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,UAAU,GAAE,MAA2B,GAAG,MAAM,CAEvF;AAED,8CAA8C;AAC9C,wBAAgB,6BAA6B,CAAC,UAAU,GAAE,MAA2B,GAAG,MAAM,CAE7F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACpC,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,GAAE,MAAyB,GACrC,OAAO,CAAC,YAAY,EAAE,CAAC,CA4BzB;AAaD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAY1B;AAED,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kEAAkE;IAClE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kEAAkE;IAClE,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,UAAU,GAAE,MAA2B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AA6DD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,CAsBR;AAiCD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,wEAAwE;AACxE,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAY7F;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEN,MAAM,WAAW,uCAAuC;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,GAAE,uCAA4C,GACpD,OAAO,CAAC,6BAA6B,CAAC,CAgCxC;AAED,MAAM,WAAW,+BAA+B;IAC9C,4CAA4C;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqDpD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAsB9B"}
+{"version":3,"file":"install-cursor-skills.d.ts","sourceRoot":"","sources":["../../src/internal/install-cursor-skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAQ7C,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,qDAAqD;AACrD,eAAO,MAAM,kCAAkC,mCAAmC,CAAC;AAEnF,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,UAAU,GAAE,MAA2B,GAAG,MAAM,CAElF;AAMD,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACpC,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,GAAE,MAAyB,GACrC,OAAO,CAAC,YAAY,EAAE,CAAC,CA4BzB;AAaD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAY1B;AAED,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kEAAkE;IAClE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,UAAU,GAAE,MAA2B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AA8DD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,CAsBR;AAiCD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,wEAAwE;AACxE,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAY7F;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEN,MAAM,WAAW,uCAAuC;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,GAAE,uCAA4C,GACpD,OAAO,CAAC,6BAA6B,CAAC,CAgCxC;AAED,MAAM,WAAW,+BAA+B;IAC9C,4CAA4C;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqDpD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAsB9B"}