@cursor/july 0.1.1

package/dist/internal/reminder-schedule.js

@@ -0,0 +1,82 @@
+/**
+ * Schedule resolution for reminders (`every` / `cron` / `delay` / `at`).
+ */
+import { parseCron } from "./cron.js";
+import { parseDuration } from "./duration.js";
+export class ReminderValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ReminderValidationError";
+    }
+}
+/** Node setTimeout overflows past ~2^31-1 ms (~24.8d); chunk long waits. */
+export const MAX_TIMER_MS = 2147483647;
+/** Resolve create-input schedule fields into a concrete next-fire plan. */
+export function resolveSchedule(input) {
+    const shapes = [
+        input.every !== undefined,
+        input.cron !== undefined,
+        input.delay !== undefined,
+        input.at !== undefined,
+    ].filter(Boolean);
+    if (shapes.length !== 1) {
+        throw new ReminderValidationError("reminders.create requires exactly one of every, cron, delay, or at");
+    }
+    const now = Date.now();
+    if (input.every !== undefined) {
+        const intervalMs = parseDuration(input.every);
+        if (intervalMs <= 0) {
+            throw new ReminderValidationError(`every must be > 0 (got ${input.every})`);
+        }
+        return {
+            kind: "every",
+            value: String(input.every),
+            intervalMs,
+            nextFireAtMs: now + intervalMs,
+        };
+    }
+    if (input.cron !== undefined) {
+        parseCron(input.cron); // validate
+        return {
+            kind: "cron",
+            value: input.cron,
+            nextFireAtMs: nextCronFireMs(input.cron, now),
+        };
+    }
+    if (input.delay !== undefined) {
+        const delayMs = parseDuration(input.delay);
+        return {
+            kind: "delay",
+            value: String(input.delay),
+            nextFireAtMs: now + delayMs,
+        };
+    }
+    const atMs = typeof input.at === "number"
+        ? input.at
+        : input.at instanceof Date
+            ? input.at.getTime()
+            : Date.parse(String(input.at));
+    if (!Number.isFinite(atMs)) {
+        throw new ReminderValidationError(`Invalid at time: ${String(input.at)}`);
+    }
+    return {
+        kind: "at",
+        value: typeof input.at === "string" ? input.at : new Date(atMs).toISOString(),
+        nextFireAtMs: atMs,
+    };
+}
+/** Next UTC fire strictly after `afterMs` for a 5-field cron. */
+export function nextCronFireMs(cronSource, afterMs) {
+    try {
+        return parseCron(cronSource).nextFire(new Date(afterMs)).getTime();
+    }
+    catch (error) {
+        throw new ReminderValidationError(error instanceof Error
+            ? error.message
+            : `Could not find next fire for cron "${cronSource}"`);
+    }
+}
+/** Default busy policy: recurring may skip; one-shots queue behind the turn. */
+export function defaultBusyPolicy(kind) {
+    return kind === "every" || kind === "cron" ? "skipIfBusy" : "queueBehindTurn";
+}

package/dist/internal/reminder-store.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Durable reminder instance store under `<stateRoot>/reminders/`.
+ *
+ * Handlers (`run` / function `until`) are not serializable — they live only
+ * in the in-memory {@link ReminderRunner} registry. Disk holds schedule,
+ * prompt, target, and status so one-shots / recurring ticks survive restart
+ * for prompt-form reminders.
+ */
+import type { ReminderBusyPolicy, ReminderScheduleKind, ReminderStatus } from "../types.js";
+export declare const REMINDER_SNAPSHOT_VERSION: 1;
+export type { ReminderBusyPolicy, ReminderScheduleKind, ReminderStatus, } from "../types.js";
+/** Serializable reminder record (no function bodies). */
+export interface ReminderRecord {
+    version: typeof REMINDER_SNAPSHOT_VERSION;
+    id: string;
+    purpose: string;
+    /** Channel that owns the target session (e.g. `drive`, `http`). */
+    channelId: string;
+    /** Channel-local continuation key (not the wire `channel:key` token). */
+    continuationToken: string;
+    /** Optional opaque target metadata (e.g. `{ prUrl }`). */
+    target?: Record<string, unknown>;
+    scheduleKind: ReminderScheduleKind;
+    /** Raw schedule value: every/delay string, cron expression, or ISO `at`. */
+    scheduleValue: string;
+    intervalMs?: number;
+    /** Prompt form — mutually exclusive with in-memory `run`. */
+    prompt?: string;
+    /**
+     * True when create() registered a `run` handler. Handlers are not
+     * serializable; after restart, armed records with this flag and no live
+     * handler are disarmed instead of falling back to a generic prompt.
+     */
+    hasRunHandler: boolean;
+    /** True when create() registered a function `until` (in-memory only). */
+    hasUntilFn: boolean;
+    /** Natural-language until (agent-facing); function until is in-memory only. */
+    untilPrompt?: string;
+    busyPolicy: ReminderBusyPolicy;
+    status: ReminderStatus;
+    disarmReason?: string;
+    fireCount: number;
+    nextFireAtMs: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare class ReminderStore {
+    private readonly rootDir;
+    constructor(rootDir: string);
+    private filePath;
+    ensureRoot(): Promise<void>;
+    list(): Promise<ReminderRecord[]>;
+    listArmed(): Promise<ReminderRecord[]>;
+    get(id: string): Promise<ReminderRecord | undefined>;
+    save(record: ReminderRecord): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+//# sourceMappingURL=reminder-store.d.ts.map

package/dist/internal/reminder-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reminder-store.d.ts","sourceRoot":"","sources":["../../src/internal/reminder-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,yBAAyB,EAAG,CAAU,CAAC;AAEpD,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,yBAAyB,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,oBAAoB,CAAC;IACnC,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,MAAM,EAAI;IAEhD,OAAO,CAAC,QAAQ;IAIV,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhC;IAEK,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBtC;IAEK,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3C;IAEK,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAsBzD;IAEK,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhD;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtC;CACF"}

package/dist/internal/reminder-store.js

@@ -0,0 +1,106 @@
+/**
+ * Durable reminder instance store under `<stateRoot>/reminders/`.
+ *
+ * Handlers (`run` / function `until`) are not serializable — they live only
+ * in the in-memory {@link ReminderRunner} registry. Disk holds schedule,
+ * prompt, target, and status so one-shots / recurring ticks survive restart
+ * for prompt-form reminders.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { mkdir, readdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import { join } from "node:path";
+export const REMINDER_SNAPSHOT_VERSION = 1;
+export class ReminderStore {
+    constructor(rootDir) {
+        this.rootDir = rootDir;
+    }
+    filePath(id) {
+        return join(this.rootDir, `${id}.json`);
+    }
+    ensureRoot() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield mkdir(this.rootDir, { recursive: true });
+        });
+    }
+    list() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.ensureRoot();
+            let names;
+            try {
+                names = yield readdir(this.rootDir);
+            }
+            catch (_a) {
+                return [];
+            }
+            const records = [];
+            for (const name of names) {
+                if (!name.endsWith(".json"))
+                    continue;
+                const record = yield this.get(name.slice(0, -".json".length));
+                if (record !== undefined) {
+                    records.push(record);
+                }
+            }
+            return records;
+        });
+    }
+    listArmed() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const all = yield this.list();
+            return all.filter((r) => r.status === "armed");
+        });
+    }
+    get(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const raw = yield readFile(this.filePath(id), "utf8");
+                const parsed = JSON.parse(raw);
+                if (parsed.version !== REMINDER_SNAPSHOT_VERSION) {
+                    return undefined;
+                }
+                if (typeof parsed.id !== "string" || parsed.id !== id) {
+                    return undefined;
+                }
+                return parsed;
+            }
+            catch (error) {
+                if (error !== null &&
+                    typeof error === "object" &&
+                    "code" in error &&
+                    error.code === "ENOENT") {
+                    return undefined;
+                }
+                return undefined;
+            }
+        });
+    }
+    save(record) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.ensureRoot();
+            const path = this.filePath(record.id);
+            const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+            const body = `${JSON.stringify(record, null, 2)}\n`;
+            try {
+                yield writeFile(tmp, body, "utf8");
+                yield rename(tmp, path);
+            }
+            catch (error) {
+                yield rm(tmp, { force: true }).catch(() => { });
+                throw error;
+            }
+        });
+    }
+    delete(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield rm(this.filePath(id), { force: true });
+        });
+    }
+}

package/dist/internal/resolved-connections.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Serve-time connection resolution for one mounted agent: once the host is
+ * listening (port known), symbolic transports — peers and the Cursor
+ * account bridge — resolve to concrete URLs and join the engine's
+ * resolved-connection set. Local turns call both over loopback; cloud
+ * turns use the serve `publicUrl` for peers and the account's native
+ * connectors instead of the bridge.
+ */
+import type { AgentProject } from "../types.js";
+import { type CursorAccountConnectionRef, type CursorAccountMcpBridge } from "./cursor/account-mcp.js";
+import { type PeerConnectionRef } from "./peer-connections.js";
+import type { EngineResolvedConnection } from "./session-engine.js";
+/** Fail fast before listen when static cloud config cannot honor `servers`. */
+export declare function validateMountConnectionsConfig(args: {
+    slug: string;
+    project: AgentProject;
+    accountRefs?: CursorAccountConnectionRef[];
+    publicUrl?: string;
+}): void;
+/** Fail closed when a cloud turn cannot honor a `servers` filter. */
+export declare function assertCloudCanHonorAccountServersFilters(args: {
+    runtime: "local" | "cloud";
+    resolvedConnections: readonly EngineResolvedConnection[];
+}): void;
+/** Fail closed when anonymous HTTP admission would expose account connectors. */
+export declare function assertAccountConnectionsNotAnonymous(args: {
+    allowAnonymous?: boolean;
+    hasAccountConnections: boolean;
+}): void;
+export declare function resolveMountConnections(args: {
+    slug: string;
+    project: AgentProject;
+    serverUrl: string;
+    peerRefs?: PeerConnectionRef[];
+    accountRefs?: CursorAccountConnectionRef[];
+    accountBridge?: CursorAccountMcpBridge;
+    publicUrl?: string;
+    authToken?: string;
+    logger: (line: string) => void;
+}): EngineResolvedConnection[];
+//# sourceMappingURL=resolved-connections.d.ts.map

package/dist/internal/resolved-connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-connections.d.ts","sourceRoot":"","sources":["../../src/internal/resolved-connections.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAE5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAuBP;AAED,qEAAqE;AACrE,wBAAgB,wCAAwC,CAAC,IAAI,EAAE;IAC7D,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,mBAAmB,EAAE,SAAS,wBAAwB,EAAE,CAAC;CAC1D,GAAG,IAAI,CAmBP;AAED,iFAAiF;AACjF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,EAAE,OAAO,CAAC;CAChC,GAAG,IAAI,CAMP;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC3C,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,wBAAwB,EAAE,CA6C7B"}

package/dist/internal/resolved-connections.js

@@ -0,0 +1,73 @@
+/**
+ * Serve-time connection resolution for one mounted agent: once the host is
+ * listening (port known), symbolic transports — peers and the Cursor
+ * account bridge — resolve to concrete URLs and join the engine's
+ * resolved-connection set. Local turns call both over loopback; cloud
+ * turns use the serve `publicUrl` for peers and the account's native
+ * connectors instead of the bridge.
+ */
+import { resolveCursorAccountConnections, } from "./cursor/account-mcp.js";
+import { resolvePeerConnections, } from "./peer-connections.js";
+/** Fail fast before listen when static cloud config cannot honor `servers`. */
+export function validateMountConnectionsConfig(args) {
+    if (args.accountRefs === undefined || args.accountRefs.length === 0) {
+        return;
+    }
+    const agent = args.project.agent;
+    const cloudCapable = agent.runtime === "cloud" || agent.cloud !== undefined;
+    if (!cloudCapable || args.publicUrl !== undefined) {
+        return;
+    }
+    const label = args.slug === "" ? args.project.name : args.slug;
+    const filteredRefs = args.accountRefs.filter((ref) => ref.servers !== undefined);
+    if (filteredRefs.length === 0) {
+        return;
+    }
+    throw new Error(`[agent-serve] agent "${label}" has Cursor account MCP connections with \`servers\` filters (${filteredRefs
+        .map((ref) => ref.name)
+        .join(", ")}) but no --public-url; cloud-runtime turns cannot honor those filters without a public bridge URL. Set --public-url or remove the \`servers\` filter.`);
+}
+/** Fail closed when a cloud turn cannot honor a `servers` filter. */
+export function assertCloudCanHonorAccountServersFilters(args) {
+    if (args.runtime !== "cloud") {
+        return;
+    }
+    const blocked = args.resolvedConnections.filter((connection) => connection.accountServersFilter !== undefined &&
+        connection.cloudUrl === undefined);
+    if (blocked.length === 0) {
+        return;
+    }
+    throw new Error(`[agent-serve] cloud turn cannot honor Cursor account \`servers\` filters (${blocked
+        .map((connection) => connection.name)
+        .join(", ")}) without --public-url; set --public-url so cloud turns reach the filtered account bridge instead of falling back to native connectors.`);
+}
+/** Fail closed when anonymous HTTP admission would expose account connectors. */
+export function assertAccountConnectionsNotAnonymous(args) {
+    if (args.allowAnonymous === true && args.hasAccountConnections) {
+        throw new Error("[agent-serve] --allow-anonymous cannot be used with Cursor account MCP connections (defineConnection({ cursorAccount: true })); use --bearer-token or remove the account MCP connections.");
+    }
+}
+export function resolveMountConnections(args) {
+    const agent = args.project.agent;
+    const cloudCapable = agent.runtime === "cloud" || agent.cloud !== undefined;
+    const label = args.slug === "" ? args.project.name : args.slug;
+    const resolved = [];
+    if (args.peerRefs !== undefined && args.peerRefs.length > 0) {
+        const peers = resolvePeerConnections(Object.assign(Object.assign({ refs: args.peerRefs, serverUrl: args.serverUrl }, (args.publicUrl === undefined ? {} : { publicUrl: args.publicUrl })), (args.authToken === undefined ? {} : { authToken: args.authToken })));
+        resolved.push(...peers);
+        if (cloudCapable && args.publicUrl === undefined) {
+            args.logger(`[agent-serve] warning: agent "${label}" has peer MCP connections (${peers
+                .map((peer) => peer.name)
+                .join(", ")}) but no --public-url; cloud-runtime turns cannot reach this host's loopback address, so peers are omitted from cloud turns.`);
+        }
+    }
+    if (args.accountRefs !== undefined && args.accountBridge !== undefined) {
+        resolved.push(...resolveCursorAccountConnections(Object.assign({ refs: args.accountRefs, serverUrl: args.serverUrl, basePath: args.slug === "" ? "" : `/${args.slug}`, bridgeSecret: args.accountBridge.secret }, (args.publicUrl === undefined ? {} : { publicUrl: args.publicUrl }))));
+        // Non-blocking startup DX: connector statuses land in the serve log.
+        args.accountBridge.logPreflight(args.accountRefs);
+        if (cloudCapable && args.publicUrl === undefined) {
+            args.logger(`[agent-serve] agent "${label}": cloud-runtime turns omit the account bridge without --public-url (cloud agents fall back to the account's native connectors).`);
+        }
+    }
+    return resolved;
+}

package/dist/internal/review-comments.d.ts

@@ -0,0 +1,50 @@
+export type ReviewCommentPublisher = "local_gh";
+export type ReviewCommentPostResult = {
+    posted: boolean;
+    publisher: ReviewCommentPublisher;
+    mode: "review_with_inline_comments" | "review_body_only" | "skipped";
+    inlineCommentCount: number;
+    detail: string;
+};
+export type ReviewInlineComment = {
+    file: string;
+    line: number;
+    start_line?: number;
+    body: string;
+};
+export type ReviewCommentPostArgs = {
+    prUrl: string;
+    reviewedHeadSha: string;
+    message: string;
+    comments: ReviewInlineComment[];
+    cleanupPrevious?: boolean;
+    signal?: AbortSignal;
+};
+export type ReviewCommentsRequest = {
+    provider: "github";
+    repo: string;
+    prNumber: number;
+    headSha: string;
+    message: string;
+    comments: ReviewInlineComment[];
+    cleanupPrevious: boolean;
+};
+export type ReviewCommentPublisherImplementation = {
+    postReview: (args: ReviewCommentPostArgs) => Promise<ReviewCommentPostResult>;
+};
+/**
+ * Prepares the provider-neutral review payload used by local `gh` posting.
+ */
+export declare function prepareReviewCommentsRequest(args: ReviewCommentPostArgs): {
+    kind: "prepared";
+    request: ReviewCommentsRequest;
+} | {
+    kind: "skipped";
+    result: ReviewCommentPostResult;
+};
+/**
+ * Posts a PR review with the local `gh` credentials (`gh auth` / GITHUB_TOKEN /
+ * GH_TOKEN). Does not use the security-bugbot comments service.
+ */
+export declare function createLocalGhReviewPublisher(): ReviewCommentPublisherImplementation;
+//# sourceMappingURL=review-comments.d.ts.map

package/dist/internal/review-comments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEhD,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAOF;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF"}

package/dist/internal/review-comments.js

@@ -0,0 +1,194 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { spawn } from "node:child_process";
+/**
+ * Prepares the provider-neutral review payload used by local `gh` posting.
+ */
+export function prepareReviewCommentsRequest(args) {
+    var _a;
+    const target = parseGithubPrUrl(args.prUrl);
+    if (target.kind === "invalid") {
+        return { kind: "skipped", result: skipped(target.detail) };
+    }
+    return {
+        kind: "prepared",
+        request: {
+            provider: "github",
+            repo: target.value.repo,
+            prNumber: target.value.prNumber,
+            headSha: args.reviewedHeadSha,
+            message: args.message,
+            comments: args.comments,
+            cleanupPrevious: (_a = args.cleanupPrevious) !== null && _a !== void 0 ? _a : true,
+        },
+    };
+}
+/**
+ * Posts a PR review with the local `gh` credentials (`gh auth` / GITHUB_TOKEN /
+ * GH_TOKEN). Does not use the security-bugbot comments service.
+ */
+export function createLocalGhReviewPublisher() {
+    return {
+        postReview(args) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return postReviewViaLocalGh(args);
+            });
+        },
+    };
+}
+function postReviewViaLocalGh(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const prepared = prepareReviewCommentsRequest(args);
+        if (prepared.kind === "skipped") {
+            return prepared.result;
+        }
+        const { request } = prepared;
+        const path = `repos/${request.repo}/pulls/${request.prNumber}/reviews`;
+        const payload = {
+            commit_id: request.headSha,
+            body: request.message,
+            event: "COMMENT",
+            comments: request.comments.map(toGithubReviewComment),
+        };
+        try {
+            (_a = args.signal) === null || _a === void 0 ? void 0 : _a.throwIfAborted();
+            const response = yield ghApiPostJson(path, payload, args.signal);
+            const htmlUrl = typeof response.html_url === "string" ? response.html_url : undefined;
+            const inlineCommentCount = request.comments.length;
+            return {
+                posted: true,
+                publisher: "local_gh",
+                mode: inlineCommentCount > 0
+                    ? "review_with_inline_comments"
+                    : "review_body_only",
+                inlineCommentCount,
+                detail: htmlUrl
+                    ? `posted via local gh: ${htmlUrl}`
+                    : `posted via local gh with ${inlineCommentCount} inline comment(s)`,
+            };
+        }
+        catch (error) {
+            if ((_b = args.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                throw error;
+            }
+            return skipped(`local gh review post failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+function toGithubReviewComment(comment) {
+    const body = {
+        path: comment.file,
+        body: comment.body,
+        line: comment.line,
+        side: "RIGHT",
+    };
+    if (comment.start_line !== undefined &&
+        comment.start_line > 0 &&
+        comment.start_line !== comment.line) {
+        body.start_line = comment.start_line;
+        body.start_side = "RIGHT";
+    }
+    return body;
+}
+function skipped(detail) {
+    return {
+        posted: false,
+        publisher: "local_gh",
+        mode: "skipped",
+        inlineCommentCount: 0,
+        detail,
+    };
+}
+function parseGithubPrUrl(prUrl) {
+    let url;
+    try {
+        url = new URL(prUrl);
+    }
+    catch (error) {
+        return {
+            kind: "invalid",
+            detail: `unparseable PR URL: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (url.hostname !== "github.com") {
+        return {
+            kind: "invalid",
+            detail: "local gh publisher only supports github.com PRs",
+        };
+    }
+    const parts = url.pathname.split("/").filter(Boolean);
+    if (parts.length !== 4 || parts[2] !== "pull") {
+        return {
+            kind: "invalid",
+            detail: "unparseable PR URL: expected https://github.com/{owner}/{repo}/pull/{number}",
+        };
+    }
+    const prNumber = Number(parts[3]);
+    if (!Number.isInteger(prNumber) || prNumber <= 0) {
+        return {
+            kind: "invalid",
+            detail: "unparseable PR URL: pull request number must be a positive integer",
+        };
+    }
+    return {
+        kind: "valid",
+        value: {
+            repo: `${parts[0]}/${parts[1]}`,
+            prNumber,
+        },
+    };
+}
+function ghApiPostJson(path, payload, signal) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new Promise((resolvePromise, rejectPromise) => {
+            const child = spawn("gh", ["api", path, "--method", "POST", "--input", "-"], {
+                env: Object.assign(Object.assign({}, process.env), { GH_PROMPT_DISABLED: "1" }),
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            let stdout = "";
+            let stderr = "";
+            const onAbort = () => {
+                var _a;
+                child.kill("SIGTERM");
+                rejectPromise((_a = signal === null || signal === void 0 ? void 0 : signal.reason) !== null && _a !== void 0 ? _a : new Error("aborted"));
+            };
+            signal === null || signal === void 0 ? void 0 : signal.addEventListener("abort", onAbort, { once: true });
+            child.stdout.on("data", (chunk) => {
+                stdout += String(chunk);
+            });
+            child.stderr.on("data", (chunk) => {
+                stderr += String(chunk);
+            });
+            child.on("error", (error) => {
+                signal === null || signal === void 0 ? void 0 : signal.removeEventListener("abort", onAbort);
+                rejectPromise(error);
+            });
+            child.on("close", (code) => {
+                signal === null || signal === void 0 ? void 0 : signal.removeEventListener("abort", onAbort);
+                if (code !== 0) {
+                    rejectPromise(new Error(`gh api ${path} exited with ${code}: ${stderr.trim().slice(0, 2000)}`));
+                    return;
+                }
+                if (!stdout.trim()) {
+                    resolvePromise({});
+                    return;
+                }
+                try {
+                    resolvePromise(JSON.parse(stdout));
+                }
+                catch (error) {
+                    rejectPromise(new Error(`gh api ${path} returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`));
+                }
+            });
+            child.stdin.end(JSON.stringify(payload));
+        });
+    });
+}

package/dist/internal/router.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Tiny path router: literal segments, `:param` captures, and a trailing
+ * `*param` catch-all, compiled once at server startup.
+ */
+import type { AuthContext, AuthPolicy, RouteMethod } from "../types.js";
+export interface ServerRouteContext {
+    params: Record<string, string>;
+    requestIp: string | null;
+    /** Resolved by the route's auth chain ("none" routes see null). */
+    auth: AuthContext | null;
+}
+export type ServerRouteHandler = (request: Request, ctx: ServerRouteContext) => Response | Promise<Response>;
+export interface ServerRoute {
+    method: RouteMethod;
+    /** Path pattern, e.g. `/v1/session/:sessionId/stream`. */
+    pattern: string;
+    /** Auth chain for the route; "none" mounts the route unauthenticated. */
+    auth: AuthPolicy[] | "none";
+    handler: ServerRouteHandler;
+}
+export interface RouteMatch {
+    route: ServerRoute;
+    params: Record<string, string>;
+}
+export declare class Router {
+    private readonly routes;
+    add(route: ServerRoute): void;
+    match(method: string, pathname: string): RouteMatch | undefined;
+    private matchExact;
+    /** True when the path matches some route with a different method. */
+    hasPath(pathname: string): boolean;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/internal/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/internal/router.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mEAAmE;IACnE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,kBAAkB,KACpB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC5B,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAaD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAE9C,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAE5B;IAED,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAW9D;IAED,OAAO,CAAC,UAAU;IAclB,qEAAqE;IACrE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKjC;CACF"}