@cursor/bdk 0.2.3 → 0.2.4

package/src/internal/cli-manifest.ts

@@ -1,56 +0,0 @@
-/**
- * `july manifest` — print the offline deploy manifest (Wd-1 of
- * `docs/agent-serve/agent-sdk-event-ingress-plan.md`).
- *
- * Loads the agent project from disk and emits the statically-derived
- * metadata the control plane stores at deploy time: declared GitHub webhook
- * events, egress domains, public routes, and the full `/v1/info` payload.
- * Runs entirely offline — no VM, no engine, no network.
- */
-
-import { buildAgentDeployManifest, parseAgentDeployManifest } from "./deploy-manifest.js";
-import { isAgentProjectDir, loadAgentProject } from "./discovery.js";
-
-export interface CmdManifestOptions {
-  dir: string;
-  /** Compact single-line JSON (machine consumption); default pretty. */
-  json?: boolean;
-  /** Test seams. */
-  out?: (line: string) => void;
-  err?: (line: string) => void;
-}
-
-export async function cmdManifest(options: CmdManifestOptions): Promise<number> {
-  const out = options.out ?? ((line: string) => process.stdout.write(line));
-  const err = options.err ?? ((line: string) => process.stderr.write(line));
-
-  if (!(await isAgentProjectDir(options.dir))) {
-    err(
-      `No agent project found at ${options.dir} (expected an agent.ts default-exporting defineAgent({ ... })).\n`,
-    );
-    return 1;
-  }
-
-  const project = await loadAgentProject(options.dir);
-  for (const diagnostic of project.diagnostics) {
-    err(`${diagnostic.severity}: ${diagnostic.message}\n`);
-  }
-  if (project.diagnostics.some(d => d.severity === "error")) {
-    return 1;
-  }
-
-  const manifest = buildAgentDeployManifest(project);
-  // Round-trip through the wire schema so `july manifest` can never emit
-  // something the control plane contract would reject.
-  if (parseAgentDeployManifest(JSON.parse(JSON.stringify(manifest))) === undefined) {
-    err("internal error: generated manifest failed schema validation\n");
-    return 1;
-  }
-
-  out(
-    options.json === true
-      ? `${JSON.stringify(manifest)}\n`
-      : `${JSON.stringify(manifest, null, 2)}\n`,
-  );
-  return 0;
-}

package/src/internal/cli-mcp-oauth.ts

@@ -1,396 +0,0 @@
-/**
- * `agent-sdk mcp oauth <connection> [--store]`.
- *
- * Host MCP OAuth for `defineConnection({ url, oauth: true })` (local tokens,
- * optionally stored as deployment secrets), and service-account connector
- * authorization for `defineConnection({ cursorAccount: true })` (tokens
- * stored backend-side against the hosted deployment's service account — see
- * `cursor-account-mcp-auth.ts`).
- */
-
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
-import { isCursorAccountTransport } from "../types.js";
-import { resolveDeployAuth } from "./cli-deploy.js";
-import { resolveConnectionEnvTemplates } from "./connection-env.js";
-import { CursorBackendClient } from "./cursor/backend-client.js";
-import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
-import { deploymentServiceAccountId } from "./deploy-client.js";
-import { loadAgentProject } from "./discovery.js";
-import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
-import {
-  isUnsupportedV2LegacyCommandError,
-  rejectV2ForLegacyCommand,
-} from "./legacy-command-guard.js";
-import {
-  createHostMcpOAuthProvider,
-  MCP_OAUTH_CALLBACK_URL,
-  openBrowser,
-  waitForMcpOAuthCallback,
-} from "./mcp-oauth.js";
-import { upsertHostMcpOauthSecrets } from "./mcp-oauth-persist.js";
-import { resolveProdSlug } from "./resolve-prod-target.js";
-
-export type McpOauthCliOptions = {
-  dir: string;
-  connection: string;
-  /** Upsert MCP_OAUTH_* on the hosted deployment (host-OAuth connections only). */
-  store?: boolean;
-  slug?: string;
-  team?: string;
-  apiKey?: string;
-  err?: (text: string) => void;
-  out?: (text: string) => void;
-  /** Test seams. */
-  fetchImpl?: typeof fetch;
-  openBrowserImpl?: (url: string) => void;
-  sleep?: (ms: number) => Promise<void>;
-  pollIntervalMs?: number;
-  pollTimeoutMs?: number;
-};
-
-function describe(error: unknown): string {
-  if (!(error instanceof Error)) {
-    return String(error);
-  }
-  const cause = error.cause;
-  if (!(cause instanceof Error)) {
-    return error.message;
-  }
-  const code = "code" in cause && typeof cause.code === "string" ? cause.code : undefined;
-  const detail = code === undefined ? cause.message : `${cause.message} (${code})`;
-  return `${error.message}: ${detail}`;
-}
-
-export async function cmdMcpOauth(options: McpOauthCliOptions): Promise<number> {
-  const err = options.err ?? (text => process.stderr.write(text));
-  const out = options.out ?? (text => process.stdout.write(text));
-  const project = await loadAgentProject(options.dir);
-  const authored = [...project.agent.connections, ...(project.agent.hostConnections ?? [])];
-  const connection = authored.find(entry => entry.name === options.connection);
-  if (connection === undefined) {
-    const known = authored.map(entry => entry.name).join(", ") || "(none)";
-    err(`${LOG_PREFIX} Unknown MCP connection "${options.connection}". Authored: ${known}.\n`);
-    return 1;
-  }
-
-  const transport = resolveConnectionEnvTemplates(connection.transport);
-  if (isCursorAccountTransport(transport)) {
-    return cmdMcpOauthCursorAccount(options, {
-      servers: transport.servers,
-      out,
-      err,
-    });
-  }
-  if (!("url" in transport) || transport.oauth !== true) {
-    err(
-      `${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }) or defineConnection({ cursorAccount: true }).\n`,
-    );
-    return 1;
-  }
-
-  const flow = await authorizeHostMcpOauth({
-    connection: options.connection,
-    url: transport.url,
-    type: transport.type === "sse" ? "sse" : "http",
-    headers: transport.headers,
-    out,
-    err,
-  });
-  if (!flow.ok) {
-    return 1;
-  }
-
-  if (options.store !== true) {
-    return 0;
-  }
-  return storeOauthSecrets({
-    connection: options.connection,
-    dir: options.dir,
-    slug: options.slug,
-    team: options.team,
-    apiKey: options.apiKey,
-    tokens: flow.tokens,
-    clientId: flow.clientId,
-    err,
-    out,
-  });
-}
-
-export interface HostMcpOauthArgs {
-  /** Connection name — the local token-store identifier. */
-  connection: string;
-  url: string;
-  type?: "http" | "sse";
-  headers?: Record<string, string>;
-  out: (text: string) => void;
-  err: (text: string) => void;
-}
-
-export type HostMcpOauthResult =
-  | { ok: true; tokens: OAuthTokens | undefined; clientId: string | undefined }
-  | { ok: false };
-
-/**
- * The interactive host-OAuth browser flow against an MCP server URL. Takes
- * the transport metadata directly so callers that already hold it never have
- * to load the authored project to authorize.
- */
-export async function authorizeHostMcpOauth(args: HostMcpOauthArgs): Promise<HostMcpOauthResult> {
-  const { connection, out, err } = args;
-  out(`${LOG_PREFIX} Authorizing "${connection}" (${args.url})…\n`);
-
-  let authorizationUrl: URL | undefined;
-  const provider = await createHostMcpOAuthProvider({
-    identifier: connection,
-    resourceUrl: args.url,
-    onRedirect: url => {
-      authorizationUrl = url;
-    },
-  });
-
-  const client = new Client({ name: "agent-sdk-mcp-oauth", version: "0.1.0" });
-  const url = new URL(args.url);
-  const requestInit = args.headers === undefined ? undefined : { headers: args.headers };
-
-  const makeTransport = (): StreamableHTTPClientTransport | SSEClientTransport => {
-    if (args.type === "sse") {
-      return new SSEClientTransport(url, {
-        authProvider: provider,
-        requestInit,
-      });
-    }
-    return new StreamableHTTPClientTransport(url, {
-      authProvider: provider,
-      requestInit,
-    });
-  };
-
-  let mcpTransport = makeTransport();
-  let authorized = false;
-  try {
-    await client.connect(mcpTransport);
-    out(`${LOG_PREFIX} "${connection}" already authorized.\n`);
-    await client.close().catch(() => undefined);
-    authorized = true;
-  } catch (error) {
-    if (!(error instanceof UnauthorizedError)) {
-      err(`${LOG_PREFIX} Failed to connect to "${connection}": ${describe(error)}\n`);
-      return { ok: false };
-    }
-  }
-
-  if (!authorized) {
-    const redirect = authorizationUrl ?? provider.lastRedirectUrl;
-    if (redirect === undefined) {
-      err(`${LOG_PREFIX} Auth required but no authorization URL was provided.\n`);
-      return { ok: false };
-    }
-
-    out(`${LOG_PREFIX} Open if needed:\n  ${redirect.toString()}\n`);
-    out(`${LOG_PREFIX} Waiting on ${MCP_OAUTH_CALLBACK_URL}…\n`);
-    openBrowser(redirect.toString());
-
-    let callback: Awaited<ReturnType<typeof waitForMcpOAuthCallback>>;
-    try {
-      callback = await waitForMcpOAuthCallback({
-        authorizationUrl: redirect.toString(),
-      });
-    } catch (error) {
-      err(`${LOG_PREFIX} OAuth callback failed: ${describe(error)}\n`);
-      return { ok: false };
-    }
-
-    try {
-      await mcpTransport.finishAuth(callback.code);
-    } catch (error) {
-      err(`${LOG_PREFIX} Token exchange failed: ${describe(error)}\n`);
-      return { ok: false };
-    }
-
-    mcpTransport = makeTransport();
-    try {
-      await client.connect(mcpTransport);
-      const tools = await client.listTools();
-      out(
-        `${LOG_PREFIX} Authorized "${connection}" (${tools.tools.length} tools). Local tokens in the agent-serve config dir.\n`,
-      );
-      await client.close().catch(() => undefined);
-    } catch (error) {
-      err(
-        `${LOG_PREFIX} Reconnect failed: ${describe(error)}. Re-run \`${CLI} mcp oauth ${connection}\`.\n`,
-      );
-      return { ok: false };
-    }
-  }
-
-  return {
-    ok: true,
-    tokens: provider.tokens(),
-    clientId: provider.clientInformation()?.client_id,
-  };
-}
-
-/**
- * `mcp oauth` for a `cursorAccount` connection: authorize the hosted
- * deployment's service account for the connection's connectors. Tokens are
- * stored backend-side by the cursor.com OAuth callback, so `--store` (a
- * deployment-secrets concept) is a no-op here.
- */
-async function cmdMcpOauthCursorAccount(
-  options: McpOauthCliOptions,
-  args: {
-    servers: string[] | undefined;
-    out: (text: string) => void;
-    err: (text: string) => void;
-  },
-): Promise<number> {
-  const { out, err } = args;
-
-  let slug: string;
-  try {
-    slug = resolveProdSlug({ dir: options.dir, slug: options.slug });
-  } catch (error) {
-    err(`${LOG_PREFIX} ${describe(error)}\n`);
-    return 1;
-  }
-
-  const auth = await resolveDeployAuth({
-    team: options.team,
-    apiKey: options.apiKey,
-    fetchImpl: options.fetchImpl,
-    err,
-  });
-  if (typeof auth === "number") {
-    return auth;
-  }
-  const backendClient = new CursorBackendClient({
-    backendUrl: auth.backendUrl,
-    apiKey: auth.apiKey,
-    fetchImpl: options.fetchImpl,
-  });
-
-  let serviceAccountId: string | undefined;
-  try {
-    await rejectV2ForLegacyCommand({
-      client: auth.client,
-      teamId: auth.teamId,
-      slug,
-    });
-    const detail = await auth.client.getDeployment({
-      teamId: auth.teamId,
-      slug,
-    });
-    serviceAccountId = deploymentServiceAccountId(detail);
-  } catch (error) {
-    if (isUnsupportedV2LegacyCommandError(error)) {
-      err(`${LOG_PREFIX} ${error.message}\n`);
-      return 1;
-    }
-    err(
-      `${LOG_PREFIX} Could not load deployment "${slug}" (team ${auth.teamId}): ${describe(error)}\n` +
-        `${LOG_PREFIX} Deploy first with \`${CLI} deploy\`.\n`,
-    );
-    return 1;
-  }
-  if (serviceAccountId === undefined) {
-    err(
-      `${LOG_PREFIX} Deployment "${slug}" has no service account yet (it predates service-account-backed deploys). Redeploy with \`${CLI} deploy\` and rerun.\n`,
-    );
-    return 1;
-  }
-
-  if (options.store === true) {
-    out(
-      `${LOG_PREFIX} Note: --store is not needed for cursorAccount connections — tokens are stored on the Cursor backend against the deployment's service account.\n`,
-    );
-  }
-
-  out(
-    `${LOG_PREFIX} Authorizing connection "${options.connection}" for ${slug}'s service account…\n`,
-  );
-  const result = await authorizeCursorAccountConnectors({
-    backendClient,
-    teamId: auth.teamId,
-    slug,
-    serviceAccountId,
-    connectionName: options.connection,
-    servers: args.servers,
-    interactive: true,
-    out,
-    err,
-    openBrowserImpl: options.openBrowserImpl,
-    sleep: options.sleep,
-    pollIntervalMs: options.pollIntervalMs,
-    pollTimeoutMs: options.pollTimeoutMs,
-  });
-
-  if (result.pending.length > 0 || result.errored.length > 0) {
-    err(
-      `${LOG_PREFIX} You can authorize connectors any time from the playground page ` +
-        `(cursor.com dashboard → Deployed Agents → ${slug}) or by rerunning ` +
-        `\`${CLI} mcp oauth ${options.connection}\`.\n`,
-    );
-    return 1;
-  }
-  return 0;
-}
-
-async function storeOauthSecrets(args: {
-  connection: string;
-  dir: string;
-  slug?: string;
-  team?: string;
-  apiKey?: string;
-  tokens: OAuthTokens | undefined;
-  clientId: string | undefined;
-  err: (text: string) => void;
-  out: (text: string) => void;
-}): Promise<number> {
-  const tokens = args.tokens;
-  if (tokens === undefined || tokens.access_token.trim() === "") {
-    args.err(`${LOG_PREFIX} No access token to store for "${args.connection}".\n`);
-    return 1;
-  }
-
-  let slug: string;
-  try {
-    slug = resolveProdSlug({ dir: args.dir, slug: args.slug });
-  } catch (error) {
-    args.err(`${LOG_PREFIX} ${describe(error)}\n`);
-    return 1;
-  }
-
-  const auth = await resolveDeployAuth({
-    team: args.team,
-    apiKey: args.apiKey,
-    err: args.err,
-  });
-  if (typeof auth === "number") {
-    return auth;
-  }
-
-  try {
-    await rejectV2ForLegacyCommand({
-      client: auth.client,
-      teamId: auth.teamId,
-      slug,
-    });
-    const secretNames = await upsertHostMcpOauthSecrets({
-      connection: args.connection,
-      tokens,
-      clientId: args.clientId,
-      target: { client: auth.client, teamId: auth.teamId, slug },
-    });
-    args.out(
-      `${LOG_PREFIX} Stored on ${slug}. Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`,
-    );
-    return 0;
-  } catch (error) {
-    args.err(`${LOG_PREFIX} Failed to store secrets on ${slug}: ${describe(error)}\n`);
-    return 1;
-  }
-}