@cursor/bdk 0.2.9 → 0.2.11

package/dist/internal/deploy-manifest.d.ts

@@ -127,6 +127,23 @@ export declare function buildAgentDeployManifest(project: AgentProject, options?
  * through the catch API.
  */
 export declare function channelCatchDeclaration(definition: AgentProject["channels"][number]["definition"]): AgentDeployManifestCatchDeclaration | undefined;
+/**
+ * Deployment secrets the control plane decrypts to admit this channel's
+ * caught requests — the names behind its `sharedSecretAuth` /
+ * `hmacSignatureAuth` policies (a named GitHub webhook secret included).
+ * Empty for a `publicEndpoint()` channel: that chain admits everything, so
+ * the control plane checks nothing. `deploy` folds these into the declared
+ * secret names so an unset one is flagged before the first delivery 401s.
+ */
+export declare function channelCatchSecretNames(definition: AgentProject["channels"][number]["definition"]): string[];
+/**
+ * Deployment secrets a channel's API credentials name (today the
+ * `githubChannel` `{ secretName }` credentials). Nothing on the control
+ * plane reads them — the guest does — but `deploy` folds them into the
+ * declared secret names so an unset one is flagged at deploy time rather
+ * than as a failed API call inside the guest.
+ */
+export declare function channelCredentialSecretNames(definition: AgentProject["channels"][number]["definition"]): string[];
 /**
  * Parse an untrusted manifest (round-trip check for the CLI's own output;
  * the CP re-validates server-side with its own copy of the contract).

package/dist/internal/deploy-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/internal/deploy-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOlE,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAI/F,eAAO,MAAM,uBAAuB,EAAE,CAAK,CAAC;AAqF5C,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;IACtD;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,EAAE,oBAAoB,CAAC;QACnC;;;WAGG;QACH,UAAU,CAAC,EAAE,wCAAwC,CAAC;QACtD;;;;;;WAMG;QACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B;;;;;WAKG;QACH,KAAK,CAAC,EAAE,mCAAmC,CAAC;KAC7C,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,KAAK,CAAC;QACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,IAAI,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,SAAS,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,CAAC,CAAC;IACnB,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,+BAA+B,CAAC;IAC9C;;;OAGG;IACH,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE,qBAAqB,CAsEvB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GACzD,mCAAmC,GAAG,SAAS,CA6CjD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAKxF"}
+{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/internal/deploy-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQlE,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAI/F,eAAO,MAAM,uBAAuB,EAAE,CAAK,CAAC;AAqF5C,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;IACtD;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,EAAE,oBAAoB,CAAC;QACnC;;;WAGG;QACH,UAAU,CAAC,EAAE,wCAAwC,CAAC;QACtD;;;;;;WAMG;QACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B;;;;;WAKG;QACH,KAAK,CAAC,EAAE,mCAAmC,CAAC;KAC7C,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,KAAK,CAAC;QACZ,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;IACH,IAAI,EAAE,oBAAoB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,SAAS,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,CAAC,CAAC;IACnB,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,+BAA+B,CAAC;IAC9C;;;OAGG;IACH,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE,qBAAqB,CA6EvB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GACzD,mCAAmC,GAAG,SAAS,CAoDjD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GACzD,MAAM,EAAE,CAUV;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GACzD,MAAM,EAAE,CAEV;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAKxF"}

package/dist/internal/deploy-manifest.js

@@ -30,7 +30,9 @@
  */
 import { z } from "zod";
 import { catchAuthDeclaration, isPublicEndpointPolicy, } from "../channels.js";
+import { githubChannelCredentialSecretNames, isCursorAccountGitHubChannel, } from "../channels/github/github-channel.js";
 import { isCursorHostedStorage } from "../storage-backends/cursor-hosted.js";
+import { channelArchitectureError } from "./channel-architecture.js";
 import { applyAgentContinuationDefaults, channelContinuationIdentity, channelDeclaredEventTypes, handshakeChannelContinuation, } from "./continuation-channel.js";
 import { CONTINUATION_SELECTORS } from "./continuation-identity.js";
 import { projectInfo, runtimeArchitectureCompatibilityError } from "./discovery.js";
@@ -113,41 +115,51 @@ const agentDeployManifestV1Schema = z.object({
  * network, no filesystem beyond what `loadAgentProject` already read.
  */
 export function buildAgentDeployManifest(project, options) {
-    var _a, _b;
-    var _c, _d, _e, _f;
     const runtimeArchitectureError = runtimeArchitectureCompatibilityError(project.agent);
     if (runtimeArchitectureError !== undefined) {
         throw new Error(runtimeArchitectureError);
     }
     applyAgentContinuationDefaults(project);
     const channels = project.channels.map(channel => {
-        var _a;
+        const architectureError = channelArchitectureError(project.agent.architecture, channel.definition);
+        if (architectureError !== undefined) {
+            throw new Error(`channels/${channel.id}: ${architectureError}`);
+        }
         const handshake = handshakeChannelContinuation(channel);
         if (!handshake.ok) {
             throw new Error(handshake.error);
         }
-        const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
+        const kind = channel.definition.meta?.kind;
         const meta = channel.definition.meta;
         const declaredEvents = channelDeclaredEventTypes(channel.definition.meta);
         const eventTypes = declaredEvents === undefined ? undefined : [...declaredEvents].sort();
-        return Object.assign(Object.assign({ id: channel.id, kind,
-            eventTypes, continuation: channelContinuationIdentity(channel.definition), catch: channelCatchDeclaration(channel.definition) }, (kind === "slack" && (meta === null || meta === void 0 ? void 0 : meta.slackReply) !== undefined
-            ? { slackReply: meta.slackReply }
-            : {})), (kind === "slack" && (meta === null || meta === void 0 ? void 0 : meta.slackChannelPosts) !== undefined
-            ? { slackChannelPosts: [...meta.slackChannelPosts] }
-            : {}));
+        return {
+            id: channel.id,
+            kind,
+            eventTypes,
+            continuation: channelContinuationIdentity(channel.definition),
+            catch: channelCatchDeclaration(channel.definition),
+            ...(kind === "slack" && meta?.slackReply !== undefined
+                ? { slackReply: meta.slackReply }
+                : {}),
+            ...(kind === "slack" && meta?.slackChannelPosts !== undefined
+                ? { slackChannelPosts: [...meta.slackChannelPosts] }
+                : {}),
+        };
     });
     // Same mapping as `july deploy` (cli-deploy.ts): channels declared public
     // via `publicEndpoint()` become alias-token-free route prefixes.
     const publicRoutePaths = project.channels
-        .filter(channel => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
+        .filter(channel => (channel.definition.auth ?? []).some(isPublicEndpointPolicy))
         .map(channel => `/v1/channels/${channel.id}`);
     const manifest = {
         manifestVersion: DEPLOY_MANIFEST_VERSION,
-        generatedAtMs: (_c = options === null || options === void 0 ? void 0 : options.nowMs) !== null && _c !== void 0 ? _c : Date.now(),
-        cliVersion: (_d = options === null || options === void 0 ? void 0 : options.cliVersion) !== null && _d !== void 0 ? _d : packageVersion(),
-        cliGitSha: (_e = options === null || options === void 0 ? void 0 : options.cliGitSha) !== null && _e !== void 0 ? _e : packageGitSha(),
-        declarations: Object.assign(Object.assign(Object.assign(Object.assign({ egressDomains: [...((_f = (_a = project.agent.hosting) === null || _a === void 0 ? void 0 : _a.egressDomains) !== null && _f !== void 0 ? _f : [])], publicRoutePaths, 
+        generatedAtMs: options?.nowMs ?? Date.now(),
+        cliVersion: options?.cliVersion ?? packageVersion(),
+        cliGitSha: options?.cliGitSha ?? packageGitSha(),
+        declarations: {
+            egressDomains: [...(project.agent.hosting?.egressDomains ?? [])],
+            publicRoutePaths,
             // Deploy manifests describe Cursor-hosted deployments. When the agent
             // authors no storage, framework-storage-selection.ts injects the
             // platform Cursor-hosted mirror for both v1 and v2.
@@ -155,9 +167,14 @@ export function buildAgentDeployManifest(project, options) {
                 ? "cursor-hosted"
                 : isCursorHostedStorage(project.storage)
                     ? "cursor-hosted"
-                    : "other" }, (project.agent.architecture === undefined
-            ? {}
-            : { architecture: project.agent.architecture })), { persistent: project.agent.persistent }), (((_b = project.agent.hosting) === null || _b === void 0 ? void 0 : _b.image) === undefined ? {} : { image: project.agent.hosting.image })), { channels }),
+                    : "other",
+            ...(project.agent.architecture === undefined
+                ? {}
+                : { architecture: project.agent.architecture }),
+            persistent: project.agent.persistent,
+            ...(project.agent.hosting?.image === undefined ? {} : { image: project.agent.hosting.image }),
+            channels,
+        },
         info: projectInfo(project),
     };
     const validation = agentDeployManifestV1Schema.safeParse(manifest);
@@ -177,12 +194,18 @@ export function buildAgentDeployManifest(project, options) {
  * through the catch API.
  */
 export function channelCatchDeclaration(definition) {
-    var _a, _b;
-    const routes = (_a = definition.routes) !== null && _a !== void 0 ? _a : [];
+    const routes = definition.routes ?? [];
     if (routes.length === 0) {
         return undefined;
     }
-    const declared = ((_b = definition.auth) !== null && _b !== void 0 ? _b : [])
+    // A cursorAccount channel receives its deliveries through Cursor's own
+    // GitHub App on the webhook fleets, never through a direct catch. The
+    // `GITHUB_WEBHOOK_SECRET` fallback still shapes its local route policy,
+    // but that must not open a second, direct door on the control plane.
+    if (isCursorAccountGitHubChannel(definition)) {
+        return undefined;
+    }
+    const declared = (definition.auth ?? [])
         .map(catchAuthDeclaration)
         .filter(declaration => declaration !== undefined);
     if (declared.length === 0) {
@@ -219,6 +242,33 @@ export function channelCatchDeclaration(definition) {
         auth,
     };
 }
+/**
+ * Deployment secrets the control plane decrypts to admit this channel's
+ * caught requests — the names behind its `sharedSecretAuth` /
+ * `hmacSignatureAuth` policies (a named GitHub webhook secret included).
+ * Empty for a `publicEndpoint()` channel: that chain admits everything, so
+ * the control plane checks nothing. `deploy` folds these into the declared
+ * secret names so an unset one is flagged before the first delivery 401s.
+ */
+export function channelCatchSecretNames(definition) {
+    const declaration = channelCatchDeclaration(definition);
+    if (declaration === undefined || declaration.auth.some(policy => policy.kind === "public")) {
+        return [];
+    }
+    return [
+        ...new Set(declaration.auth.flatMap(policy => (policy.kind === "public" ? [] : [policy.secret]))),
+    ];
+}
+/**
+ * Deployment secrets a channel's API credentials name (today the
+ * `githubChannel` `{ secretName }` credentials). Nothing on the control
+ * plane reads them — the guest does — but `deploy` folds them into the
+ * declared secret names so an unset one is flagged at deploy time rather
+ * than as a failed API call inside the guest.
+ */
+export function channelCredentialSecretNames(definition) {
+    return githubChannelCredentialSecretNames(definition);
+}
 /**
  * Parse an untrusted manifest (round-trip check for the CLI's own output;
  * the CP re-validates server-side with its own copy of the contract).

package/dist/internal/deploy-source.js

@@ -5,29 +5,20 @@
  * CLI can fill `--repo` / `--ref` / `--path` so `agent-sdk deploy` (no
  * flags) is enough. Explicit flags always win.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { execFile } from "node:child_process";
 import { relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
-const defaultGitRunner = (args, cwd) => __awaiter(void 0, void 0, void 0, function* () {
+const defaultGitRunner = async (args, cwd) => {
     try {
-        const { stdout } = yield execFileAsync("git", [...args], { cwd });
+        const { stdout } = await execFileAsync("git", [...args], { cwd });
         const trimmed = stdout.trim();
         return trimmed === "" ? undefined : trimmed;
     }
-    catch (_a) {
+    catch {
         return undefined;
     }
-});
+};
 /**
  * Normalize a git remote URL to the https form the control plane accepts
  * (`https://host/owner/repo`, no `.git` suffix). Returns undefined for
@@ -59,7 +50,7 @@ export function httpsGitRepoUrlFromRemote(remote) {
             }
             url = `https://${ssh.hostname}/${path}`;
         }
-        catch (_a) {
+        catch {
             return undefined;
         }
     }
@@ -70,7 +61,7 @@ export function httpsGitRepoUrlFromRemote(remote) {
     try {
         parsed = new URL(url);
     }
-    catch (_b) {
+    catch {
         return undefined;
     }
     const path = parsed.pathname
@@ -105,32 +96,29 @@ export function agentPathRelativeToGitRoot(dir, gitRoot) {
  * Probe the git checkout containing `dir` for deploy source fields.
  * Missing pieces stay undefined.
  */
-export function inferDeployGitSource(dir, options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const git = (_a = options === null || options === void 0 ? void 0 : options.git) !== null && _a !== void 0 ? _a : defaultGitRunner;
-        const absDir = resolve(dir);
-        const gitRoot = yield git(["rev-parse", "--show-toplevel"], absDir);
-        if (gitRoot === undefined) {
-            return {};
-        }
-        const remote = yield git(["remote", "get-url", "origin"], gitRoot);
-        const gitRepoUrl = remote === undefined ? undefined : httpsGitRepoUrlFromRemote(remote);
-        const branch = yield git(["rev-parse", "--abbrev-ref", "HEAD"], gitRoot);
-        let gitRef;
-        if (branch !== undefined && branch !== "HEAD") {
-            gitRef = branch;
-        }
-        else {
-            // Detached HEAD — pin the exact commit so the control plane still
-            // has something concrete to build.
-            gitRef = yield git(["rev-parse", "HEAD"], gitRoot);
-        }
-        const agentPath = agentPathRelativeToGitRoot(absDir, gitRoot);
-        return {
-            gitRepoUrl,
-            gitRef,
-            agentPath,
-        };
-    });
+export async function inferDeployGitSource(dir, options) {
+    const git = options?.git ?? defaultGitRunner;
+    const absDir = resolve(dir);
+    const gitRoot = await git(["rev-parse", "--show-toplevel"], absDir);
+    if (gitRoot === undefined) {
+        return {};
+    }
+    const remote = await git(["remote", "get-url", "origin"], gitRoot);
+    const gitRepoUrl = remote === undefined ? undefined : httpsGitRepoUrlFromRemote(remote);
+    const branch = await git(["rev-parse", "--abbrev-ref", "HEAD"], gitRoot);
+    let gitRef;
+    if (branch !== undefined && branch !== "HEAD") {
+        gitRef = branch;
+    }
+    else {
+        // Detached HEAD — pin the exact commit so the control plane still
+        // has something concrete to build.
+        gitRef = await git(["rev-parse", "HEAD"], gitRoot);
+    }
+    const agentPath = agentPathRelativeToGitRoot(absDir, gitRoot);
+    return {
+        gitRepoUrl,
+        gitRef,
+        agentPath,
+    };
 }

package/dist/internal/discovery/agent-config.js

@@ -1,15 +1,6 @@
 /**
  * `agent/agent.ts`: model, runtime architecture, working directory, hosting, and concurrency.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { basename, isAbsolute, join, resolve } from "node:path";
 import { MAX_RUNNING_TURNS_LIMIT, } from "../../types.js";
 import { normalizePositiveInt } from "../bounded-int.js";
@@ -82,20 +73,18 @@ export function resolveAgentCwd(ctx, authored) {
  * Point those harnesses at ~/.cache/agent-serve/<dir> unless the agent
  * already set cwd or workspaceDir.
  */
-export function resolveLocalCwd(ctx, authoredCwd, authoredWorkspaceDir) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const cwd = resolveAgentCwd(ctx, authoredCwd);
-        if (cwd !== undefined) {
-            return cwd;
-        }
-        if (resolveAgentCwd(ctx, authoredWorkspaceDir) !== undefined) {
-            return undefined;
-        }
-        if (!(yield isNestedInGitRepo(ctx.rootDir))) {
-            return undefined;
-        }
-        return defaultLocalHarnessCwd(basename(ctx.rootDir));
-    });
+export async function resolveLocalCwd(ctx, authoredCwd, authoredWorkspaceDir) {
+    const cwd = resolveAgentCwd(ctx, authoredCwd);
+    if (cwd !== undefined) {
+        return cwd;
+    }
+    if (resolveAgentCwd(ctx, authoredWorkspaceDir) !== undefined) {
+        return undefined;
+    }
+    if (!(await isNestedInGitRepo(ctx.rootDir))) {
+        return undefined;
+    }
+    return defaultLocalHarnessCwd(basename(ctx.rootDir));
 }
 /**
  * Validate the authored `hosting` block against the same grammar the
@@ -105,39 +94,38 @@ export function resolveLocalCwd(ctx, authoredCwd, authoredWorkspaceDir) {
  * hard failures: the backend stays authoritative.
  */
 export function resolveHosting(ctx, agentDir, hosting, extensions) {
-    var _a, _b;
     const agentPath = displayPath(ctx, join(agentDir, "agent.ts"));
     const warn = (message) => {
         ctx.diagnostics.push({ severity: "warning", path: agentPath, message });
     };
-    for (const error of hostingEntryErrors(hosting !== null && hosting !== void 0 ? hosting : {})) {
+    for (const error of hostingEntryErrors(hosting ?? {})) {
         warn(`hosting.${error}`);
     }
-    if ((hosting === null || hosting === void 0 ? void 0 : hosting.image) !== undefined) {
+    if (hosting?.image !== undefined) {
         const imageError = validateContainerImageName(hosting.image);
         if (imageError !== undefined) {
             warn(`hosting.image: ${imageError}`);
         }
     }
-    const mountedEgress = extensions.flatMap(extension => { var _a; var _b; return (_b = (_a = extension.hosting) === null || _a === void 0 ? void 0 : _a.egressDomains) !== null && _b !== void 0 ? _b : []; });
-    const egressDomains = [...new Set([...((_a = hosting === null || hosting === void 0 ? void 0 : hosting.egressDomains) !== null && _a !== void 0 ? _a : []), ...mountedEgress])];
+    const mountedEgress = extensions.flatMap(extension => extension.hosting?.egressDomains ?? []);
+    const egressDomains = [...new Set([...(hosting?.egressDomains ?? []), ...mountedEgress])];
     if (egressDomains.length > MAX_EGRESS_DOMAINS) {
         const withMounts = mountedEgress.length > 0 ? " with mounted extensions" : "";
         warn(`hosting.egressDomains lists ${egressDomains.length} domains${withMounts}; deploys are capped at ${MAX_EGRESS_DOMAINS}.`);
     }
     const secretNames = [
         ...new Set([
-            ...((_b = hosting === null || hosting === void 0 ? void 0 : hosting.secretNames) !== null && _b !== void 0 ? _b : []),
-            ...extensions.flatMap(extension => { var _a; var _b; return (_b = (_a = extension.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; }),
+            ...(hosting?.secretNames ?? []),
+            ...extensions.flatMap(extension => extension.hosting?.secretNames ?? []),
         ]),
     ];
-    if (egressDomains.length === 0 && secretNames.length === 0 && (hosting === null || hosting === void 0 ? void 0 : hosting.image) === undefined) {
+    if (egressDomains.length === 0 && secretNames.length === 0 && hosting?.image === undefined) {
         return undefined;
     }
     return {
         egressDomains: egressDomains.length === 0 ? undefined : egressDomains,
         secretNames: secretNames.length === 0 ? undefined : secretNames,
-        image: hosting === null || hosting === void 0 ? void 0 : hosting.image,
+        image: hosting?.image,
     };
 }
 /**
@@ -167,33 +155,31 @@ export function resolveConcurrency(ctx, agentDir, concurrency) {
         return undefined;
     }
 }
-export function loadAgentConfig(ctx, agentDir, isRoot) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const configPath = yield findModuleFile(agentDir, "agent");
-        if (configPath === undefined) {
-            ctx.diagnostics.push({
-                severity: "error",
-                path: displayPath(ctx, join(agentDir, "agent.ts")),
-                message: isRoot
-                    ? "agent.ts is required on the root agent: default-export defineAgent({ ... })"
-                    : "agent.ts is required on a subagent: default-export defineAgent({ description: ... })",
-            });
-            return undefined;
-        }
-        const definition = yield importDefault(ctx, configPath, "agent");
-        if (definition === undefined) {
-            return undefined;
-        }
-        const config = definition;
-        if (!isRoot && isBlank(config.description)) {
-            ctx.diagnostics.push({
-                severity: "error",
-                path: displayPath(ctx, configPath),
-                message: "Subagents require a description; the parent model reads it to decide when to delegate.",
-            });
-        }
-        return config;
-    });
+export async function loadAgentConfig(ctx, agentDir, isRoot) {
+    const configPath = await findModuleFile(agentDir, "agent");
+    if (configPath === undefined) {
+        ctx.diagnostics.push({
+            severity: "error",
+            path: displayPath(ctx, join(agentDir, "agent.ts")),
+            message: isRoot
+                ? "agent.ts is required on the root agent: default-export defineAgent({ ... })"
+                : "agent.ts is required on a subagent: default-export defineAgent({ description: ... })",
+        });
+        return undefined;
+    }
+    const definition = await importDefault(ctx, configPath, "agent");
+    if (definition === undefined) {
+        return undefined;
+    }
+    const config = definition;
+    if (!isRoot && isBlank(config.description)) {
+        ctx.diagnostics.push({
+            severity: "error",
+            path: displayPath(ctx, configPath),
+            message: "Subagents require a description; the parent model reads it to decide when to delegate.",
+        });
+    }
+    return config;
 }
 export function isValidModelSetting(model) {
     if (typeof model === "string") {