@cursor/july 0.1.100 → 0.1.101

package/dist/internal/advertise-tools.js

@@ -27,6 +27,9 @@
  * `defineConnection({ effects })` filters the listing before names are
  * assigned: only tools whose MCP annotations classify as an intended
  * effect are advertised. Unclassified tools are omitted, not guessed.
+ * `defineConnection({ tools: [...] })` keeps only the named tools.
+ * `disallowedTools` drops names. A name filter that matches nothing on
+ * the server fails the turn.
  * Tools whose `annotations.title` is `do-not-call` are dropped as well
  * (vendor host-UI / MCP Apps helpers that still carry `readOnlyHint`).
  */
@@ -39,6 +42,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { connectionAllowsTool, } from "../types.js";
 import { brandDefinition } from "./brand.js";
 import { sanitizeMcpToolName, suffixMcpToolName, } from "./sanitize-mcp-tool-name.js";
 import { classifyAnnotationsEffect } from "./tool-policy.js";
@@ -70,7 +74,12 @@ export function resolveAdvertisedTools(args) {
             try {
                 const source = yield sourceFor(connection, args.session, args.hostMcp);
                 const listed = yield source.listTools();
-                return { connection, ok: true, source, listed };
+                return {
+                    connection,
+                    ok: true,
+                    source,
+                    listed: listed.filter((info) => connectionAllowsTool(connection, info.name)),
+                };
             }
             catch (error) {
                 return { connection, ok: false, error };
@@ -88,6 +97,16 @@ export function resolveAdvertisedTools(args) {
                 throw new Error(`Failed to list tools on advertised connection "${connection.name}": ${describeError(listing.error)}`, { cause: listing.error });
             }
             const { source, listed } = listing;
+            if ((connection.tools !== undefined ||
+                connection.disallowedTools !== undefined) &&
+                listed.length === 0) {
+                const error = new Error(`Advertised connection "${connection.name}" tool filter matched no tools on the server.`);
+                if (args.onConnectionError !== undefined) {
+                    args.onConnectionError(connection.name, error);
+                    continue;
+                }
+                throw error;
+            }
             const intended = listed.filter((info) => !isDoNotCallTool(info.annotations) &&
                 matchesIntendedEffects(info.annotations, connection.effects));
             const exposed = exposeListedTools(intended, claimed);

package/dist/internal/as-of.d.ts

@@ -16,4 +16,22 @@ export declare function assertTimeArgs(tools: readonly {
     };
 }[], asOf: string | undefined): void;
 export declare function timeArgViolation(input: unknown, timeArgs: readonly string[], asOf: string): string | undefined;
+/** Relative expressions or instants after `asOf`. Numeric epochs need `timeArgs`. */
+export declare function forwardTimeArgument(input: unknown, asOf: string): string | undefined;
+/**
+ * The string-typed time-window properties a tool's input schema declares.
+ * String-typed only: a numeric `from` is a pagination offset more often than
+ * an instant, and requiring an ISO value there would break the call.
+ */
+export declare function schemaTimeWindowKeys(inputSchema: {
+    properties?: Record<string, unknown>;
+} | undefined): string[];
+/**
+ * An omitted time window on a vendor tool is not "no window" — the vendor
+ * fills it with a live default (Datadog: `now-1h`..`now`), which the walker
+ * cannot see because the value is never present. In a frozen session a call
+ * that omits a schema-declared window key is refused so the model supplies
+ * the bound explicitly, where {@link forwardTimeArgument} then checks it.
+ */
+export declare function missingTimeWindow(input: unknown, windowKeys: readonly string[], asOf: string): string | undefined;
 //# sourceMappingURL=as-of.d.ts.map

package/dist/internal/as-of.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"as-of.d.ts","sourceRoot":"","sources":["../../src/internal/as-of.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAK,EAAE,MAAM,EAMxB;CACF;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,IAAI,CAMjE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAQvD;CACF;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACxD,EAAE,EACH,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,CAeN;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CA0BpB"}
+{"version":3,"file":"as-of.d.ts","sourceRoot":"","sources":["../../src/internal/as-of.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAK,EAAE,MAAM,EAMxB;CACF;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,IAAI,CAMjE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAQvD;CACF;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACxD,EAAE,EACH,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,CAeN;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CA0BpB;AA6CD,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAmCpB;AAqBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GAChE,MAAM,EAAE,CAoBV;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAkBpB"}

package/dist/internal/as-of.js

@@ -80,3 +80,134 @@ export function timeArgViolation(input, timeArgs, asOf) {
     }
     return undefined;
 }
+// Whole-string only: a query that merely contains "now" is not a bound.
+// Duration-only strings (`30m`, `2h`) and last/this plus a non-window word
+// (`last modified`) are not time bounds. Calendar-aligned `now/d` is.
+const TIME_UNIT = "(?:s|sec|secs|second|seconds|m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days|w|week|weeks|mo|month|months|y|yr|yrs|year|years)";
+const WINDOW_WORD = "(?:second|seconds|minute|minutes|hour|hours|day|days|week|weeks|month|months|year|years|quarter|quarters|weekend|monday|tuesday|wednesday|thursday|friday|saturday|sunday|morning|afternoon|evening|night)";
+const RELATIVE_TIME_EXPRESSION = new RegExp(`^(?:now(?:\\s*[+-]\\s*\\d+\\s*${TIME_UNIT}\\b.*|/[a-zA-Z]+.*)?|[+-]\\d+\\s*${TIME_UNIT}|today|yesterday|tomorrow|(?:last|this)\\s+${WINDOW_WORD})$`, "i");
+function forwardTimeReason(value, asOf, frozenMs) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (trimmed === "") {
+        return undefined;
+    }
+    if (RELATIVE_TIME_EXPRESSION.test(trimmed)) {
+        return (`Argument ${JSON.stringify(value)} is a relative time expression, ` +
+            `which reads against the real present. This session reads the world ` +
+            `as of ${asOf}; supply an absolute ISO-8601 instant with a timezone ` +
+            `at or before that instant and retry.`);
+    }
+    const instant = parseInstant(trimmed);
+    if (instant !== undefined && instant.getTime() > frozenMs) {
+        return (`Argument ${JSON.stringify(value)} is later than the instant this ` +
+            `session reads the world as of (${asOf}). Supply a bound at or before ` +
+            `that instant and retry.`);
+    }
+    return undefined;
+}
+/** Relative expressions or instants after `asOf`. Numeric epochs need `timeArgs`. */
+export function forwardTimeArgument(input, asOf) {
+    const frozenMs = new Date(asOf).getTime();
+    const seen = new Set();
+    const walk = (value, depth) => {
+        if (depth > 8) {
+            return undefined;
+        }
+        const reason = forwardTimeReason(value, asOf, frozenMs);
+        if (reason !== undefined) {
+            return reason;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                const found = walk(item, depth + 1);
+                if (found !== undefined) {
+                    return found;
+                }
+            }
+            return undefined;
+        }
+        if (typeof value === "object" && value !== null) {
+            if (seen.has(value)) {
+                return undefined;
+            }
+            seen.add(value);
+            for (const item of Object.values(value)) {
+                const found = walk(item, depth + 1);
+                if (found !== undefined) {
+                    return found;
+                }
+            }
+        }
+        return undefined;
+    };
+    return walk(input, 0);
+}
+/**
+ * Property names that carry a query's time window when a vendor schema
+ * declares them. Deliberately narrower than the embedded-filter key list:
+ * these must be safe to *require*, so only unambiguous window names — never
+ * `timestamp`/`date`, which name data fields more often than bounds.
+ */
+const TIME_WINDOW_KEYS = new Set([
+    "from",
+    "to",
+    "since",
+    "until",
+    "start",
+    "end",
+    "start_time",
+    "end_time",
+    "starttime",
+    "endtime",
+]);
+/**
+ * The string-typed time-window properties a tool's input schema declares.
+ * String-typed only: a numeric `from` is a pagination offset more often than
+ * an instant, and requiring an ISO value there would break the call.
+ */
+export function schemaTimeWindowKeys(inputSchema) {
+    const properties = inputSchema === null || inputSchema === void 0 ? void 0 : inputSchema.properties;
+    if (properties === undefined) {
+        return [];
+    }
+    const keys = [];
+    for (const [name, spec] of Object.entries(properties)) {
+        if (!TIME_WINDOW_KEYS.has(name.toLowerCase())) {
+            continue;
+        }
+        const type = typeof spec === "object" && spec !== null
+            ? spec.type
+            : undefined;
+        const types = Array.isArray(type) ? type : [type];
+        if (types.includes("string")) {
+            keys.push(name);
+        }
+    }
+    return keys;
+}
+/**
+ * An omitted time window on a vendor tool is not "no window" — the vendor
+ * fills it with a live default (Datadog: `now-1h`..`now`), which the walker
+ * cannot see because the value is never present. In a frozen session a call
+ * that omits a schema-declared window key is refused so the model supplies
+ * the bound explicitly, where {@link forwardTimeArgument} then checks it.
+ */
+export function missingTimeWindow(input, windowKeys, asOf) {
+    if (windowKeys.length === 0) {
+        return undefined;
+    }
+    const record = typeof input === "object" && input !== null
+        ? input
+        : {};
+    const missing = windowKeys.filter((key) => record[key] === undefined);
+    if (missing.length === 0) {
+        return undefined;
+    }
+    return (`This tool fills omitted time bounds (${missing.join(", ")}) with a ` +
+        `live default window, which reads the real present. This session reads ` +
+        `the world as of ${asOf}; supply each bound explicitly as an absolute ` +
+        `ISO-8601 instant with a timezone at or before that instant and retry.`);
+}

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAexB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsF1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmnBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AAwCD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAexB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmoBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAqBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -161,6 +161,10 @@ export function cmdDeploy(options) {
         if (manifests.every((manifest) => manifest.architecture === "v2")) {
             return deployAgentsdkApplication(ctx, options, targets, {
                 hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+                declaredSecretNames: [
+                    ...new Set(manifests.flatMap((manifest) => { var _a; var _b; return (_b = (_a = manifest.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; })),
+                ],
+                hasDeploymentsChannels: manifests.some((manifest) => manifest.hasDeploymentsChannels),
             });
         }
         if (!ctx.json &&
@@ -498,6 +502,8 @@ function deployOne(ctx, options, target, extras) {
                 agentPath,
                 repositories: options.cursorEventsRepos,
                 hasScmChannels: manifest.hasScmChannels,
+                declaredSecretNames: hosting === null || hosting === void 0 ? void 0 : hosting.secretNames,
+                hasDeploymentsChannels: manifest.hasDeploymentsChannels,
                 multiTenant: options.multiTenant === true,
             });
         }
@@ -639,13 +645,7 @@ function deployAgentsdkApplication(ctx, options, targets, declarations) {
                     .map((component) => { var _a; return `  component: ${component.componentKey} (${(_a = component.agentPath) !== null && _a !== void 0 ? _a : "."})\n`; })
                     .join(""));
         }
-        // Components bake sequentially on the control plane, so the default wait
-        // budget is per component; otherwise a 2+ component deploy routinely hits
-        // the client-side timeout while the server-side deploy is still fine. An
-        // explicitly passed timeout always wins.
-        const waitCtx = options.timeoutMs === undefined
-            ? Object.assign(Object.assign({}, ctx), { timeoutMs: ctx.timeoutMs * targets.length }) : ctx;
-        return deployOneAgentsdk(waitCtx, undefined, {
+        return deployOneAgentsdk(ctx, undefined, {
             slug,
             gitRepoUrl,
             gitRef,
@@ -653,6 +653,8 @@ function deployAgentsdkApplication(ctx, options, targets, declarations) {
             components,
             repositories: options.cursorEventsRepos,
             hasScmChannels: declarations.hasScmChannels,
+            declaredSecretNames: declarations.declaredSecretNames,
+            hasDeploymentsChannels: declarations.hasDeploymentsChannels,
             multiTenant: options.multiTenant === true,
         });
     });
@@ -718,6 +720,8 @@ function deployOneAgentsdk(ctx, extras, args) {
             ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
+        warnMissingSecrets(ctx, slug, args.declaredSecretNames, detail.secretNames);
+        const watchesRepositories = args.hasScmChannels || args.hasDeploymentsChannels === true;
         ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
             `  status:       running\n` +
             `  architecture: v2\n` +
@@ -728,13 +732,14 @@ function deployOneAgentsdk(ctx, extras, args) {
                 : `  components:   ${args.components
                     .map((component) => component.componentKey)
                     .join(", ")}\n`) +
-            (detail.repositories === undefined || !args.hasScmChannels
+            (detail.repositories === undefined || !watchesRepositories
                 ? ""
                 : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`));
-        // An agent with GitHub/Origin channels bound to no repository scope gets
-        // no deliveries at all, which is otherwise invisible in this output.
-        if (args.hasScmChannels && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
-            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin channels receive no events.\n` +
+        // An agent with GitHub/Origin/deployments channels bound to no repository
+        // scope gets no deliveries at all (deployments channels receive the
+        // watched repos' deployment events), which is otherwise invisible here.
+        if (watchesRepositories && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
+            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin/deployments channels receive no events.\n` +
                 `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
         }
         return 0;
@@ -833,6 +838,7 @@ function readDeployManifest(dir) {
                 const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
                 return kind === "github" || kind === "origin";
             }),
+            hasDeploymentsChannels: project.channels.some((channel) => { var _a; return ((_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind) === "deployments"; }),
         };
     });
 }
@@ -1013,6 +1019,9 @@ function renderAgentkitDeploymentStatus(ctx, detail) {
             ? "(nothing)"
             : detail.repositories.join(", ")}`);
     }
+    if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
+        lines.push(`  secrets:      ${detail.secretNames.join(", ")}`);
+    }
     if (detail.lastError !== null && detail.lastError !== undefined) {
         lines.push(`  last error:   ${sanitizeCustomerError(detail.lastError)}`);
     }
@@ -1198,6 +1207,20 @@ export function cmdRotatePodCredential(slug, options) {
 // ============================================================================
 // secrets set|list|unset
 // ============================================================================
+function secretDeploymentArchitecture(ctx, slug) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug });
+            return "v2";
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                return "v1";
+            }
+            throw error;
+        }
+    });
+}
 export function cmdSecretsSet(slug, specs, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
@@ -1248,11 +1271,19 @@ export function cmdSecretsSet(slug, specs, options) {
         }
         let secretNames;
         try {
-            secretNames = yield ctx.client.setSecrets({
-                teamId: ctx.teamId,
-                slug,
-                secrets,
-            });
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            secretNames =
+                architecture === "v2"
+                    ? yield ctx.client.setAgentkitSecrets({
+                        teamId: ctx.teamId,
+                        slug,
+                        secrets,
+                    })
+                    : yield ctx.client.setSecrets({
+                        teamId: ctx.teamId,
+                        slug,
+                        secrets,
+                    });
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -1280,7 +1311,11 @@ export function cmdSecretsList(slug, options) {
         }
         let secrets;
         try {
-            secrets = yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            secrets =
+                architecture === "v2"
+                    ? yield ctx.client.listAgentkitSecrets({ teamId: ctx.teamId, slug })
+                    : yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -1309,7 +1344,17 @@ export function cmdSecretsUnset(slug, name, options) {
             return ctx;
         }
         try {
-            yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            if (architecture === "v2") {
+                yield ctx.client.deleteAgentkitSecret({
+                    teamId: ctx.teamId,
+                    slug,
+                    name,
+                });
+            }
+            else {
+                yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
+            }
         }
         catch (error) {
             if (error instanceof DeployApiError && error.status === 404) {

package/dist/internal/continuation-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continuation-identity.d.ts","sourceRoot":"","sources":["../../src/internal/continuation-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,OAAO,GACP,QAAQ,GACR,WAAW,GACX,YAAY,CAAC;AAEjB,eAAO,MAAM,sBAAsB,YACjC,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,SAAS,EACT,SAAS,CACD,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACxD,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAChC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EACJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACvC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACpC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAC;IACpD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,SAAS,mBAAmB,EA+CzC,CAAC;AAEX,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AA2BD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,oBAAoB,CAE/B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,2BAAkC,EAC3C,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,oBAAoB,CA2BtB;AAmCD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAKhC;AAED,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,kBAAkB,CASpB;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,oBAAoB,CAEtB;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE,oBAAoB,EAC/B,IAAI,CAAC,EAAE,MAAM,GACZ,QAAQ,GAAG,eAAe,CAI5B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,gBAAgB,GACrB,mBAAmB,GAAG,SAAS,CAEjC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,MAAM,CAaR;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAwC1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyC9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,SAAS,CAmBpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,mBAAmB,CAarB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,EACD,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CA8BR;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EACR,QAAQ,SAAS;IAAE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAE9D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChE,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACvC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAS5D"}
+{"version":3,"file":"continuation-identity.d.ts","sourceRoot":"","sources":["../../src/internal/continuation-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,OAAO,GACP,QAAQ,GACR,WAAW,GACX,YAAY,CAAC;AAEjB,eAAO,MAAM,sBAAsB,YACjC,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,SAAS,EACT,SAAS,CACD,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACxD,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAChC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EACJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACvC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACpC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAC;IACpD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,SAAS,mBAAmB,EAiDzC,CAAC;AAEX,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AA2BD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,oBAAoB,CAE/B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,2BAAkC,EAC3C,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,oBAAoB,CA2BtB;AAmCD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAKhC;AAED,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,kBAAkB,CASpB;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,oBAAoB,CAEtB;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE,oBAAoB,EAC/B,IAAI,CAAC,EAAE,MAAM,GACZ,QAAQ,GAAG,eAAe,CAI5B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,gBAAgB,GACrB,mBAAmB,GAAG,SAAS,CAEjC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,MAAM,CAaR;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAwC1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyC9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,SAAS,CAmBpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,mBAAmB,CAarB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,EACD,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CA8BR;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EACR,QAAQ,SAAS;IAAE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAE9D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChE,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACvC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAS5D"}

package/dist/internal/continuation-identity.js

@@ -77,7 +77,9 @@ export const BUILTINS = [
     {
         type: "deployment",
         kind: "deployments",
-        events: ["deployment.created", "deployment.succeeded"],
+        // All three factory stream events carry `deploymentId`; keep in
+        // lockstep with the control plane's `conversation/deployments.ts`.
+        events: ["deployment.created", "deployment.succeeded", "deployment.failed"],
         format: "deployments:{deploymentId}",
     },
 ];

package/dist/internal/cursor/hosted-deployment-secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Task-time application secrets for hosted v2 freeze restores.
+ *
+ * The deployment host rewrites this tmpfs document before each admission and
+ * execution request. July reloads it synchronously because the process was
+ * already running in the frozen snapshot when the task-specific values
+ * arrived.
+ */
+export declare const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+/**
+ * Refresh `process.env` from the latest bound document. A missing or malformed
+ * file is a no-op; an empty valid document removes values loaded by an earlier
+ * bind after the deployment secret was unset.
+ */
+export declare function refreshBoundDeploymentSecrets(path?: string): void;
+//# sourceMappingURL=hosted-deployment-secrets.d.ts.map

package/dist/internal/cursor/hosted-deployment-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAqC5D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,IAAI,CAeN"}

package/dist/internal/cursor/hosted-deployment-secrets.js

@@ -0,0 +1,61 @@
+/**
+ * Task-time application secrets for hosted v2 freeze restores.
+ *
+ * The deployment host rewrites this tmpfs document before each admission and
+ * execution request. July reloads it synchronously because the process was
+ * already running in the frozen snapshot when the task-specific values
+ * arrived.
+ */
+import { readFileSync } from "node:fs";
+export const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+const appliedSecretNames = new Set();
+function parseBoundSecrets(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (_a) {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        return undefined;
+    }
+    const envelope = parsed;
+    if (envelope.v !== 1 ||
+        envelope.secrets === null ||
+        typeof envelope.secrets !== "object" ||
+        Array.isArray(envelope.secrets)) {
+        return undefined;
+    }
+    const secrets = {};
+    for (const [name, value] of Object.entries(envelope.secrets)) {
+        if (SECRET_NAME_PATTERN.test(name) &&
+            !name.startsWith("CURSOR_") &&
+            typeof value === "string") {
+            secrets[name] = value;
+        }
+    }
+    return secrets;
+}
+/**
+ * Refresh `process.env` from the latest bound document. A missing or malformed
+ * file is a no-op; an empty valid document removes values loaded by an earlier
+ * bind after the deployment secret was unset.
+ */
+export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
+    const secrets = parseBoundSecrets(path);
+    if (secrets === undefined) {
+        return;
+    }
+    for (const name of appliedSecretNames) {
+        if (!(name in secrets)) {
+            delete process.env[name];
+        }
+    }
+    appliedSecretNames.clear();
+    for (const [name, value] of Object.entries(secrets)) {
+        process.env[name] = value;
+        appliedSecretNames.add(name);
+    }
+}

package/dist/internal/cursor-deployment-relay.d.ts

@@ -18,22 +18,36 @@ export interface ResolvedSubscription {
     environments: string[];
     events: Set<DeploymentEventType>;
 }
+export type DeploymentSubscriptionSource = readonly ResolvedSubscription[] | (() => readonly ResolvedSubscription[]);
 export interface DeploymentEventRelayOptions {
     baseUrl: string;
     apiKey: string;
     stateDir: string;
-    subscriptions: readonly ResolvedSubscription[];
+    /**
+     * Snapshot or a getter. A getter is re-read on every registration
+     * heartbeat so a channel that refreshes `deploySourceUris` after start
+     * can add sources without restarting the relay.
+     */
+    subscriptions: DeploymentSubscriptionSource;
     dispatch: (event: DeploymentEvent) => Promise<void>;
     logger: (line: string) => void;
     fetchImpl?: typeof fetch;
     pollWaitMs?: number;
 }
+/** Current subscriptions: a live getter, otherwise the snapshot. */
+export declare function currentDeploymentSubscriptions(subscriptions: DeploymentSubscriptionSource): readonly ResolvedSubscription[];
 /** Normalize the channel's `deploySourceUris` option into concrete subscriptions. */
 export declare function resolveDeploymentSubscriptions(options: {
     deploySourceUris: readonly (string | DeploymentSubscription)[];
     environments?: readonly string[];
     events?: readonly DeploymentEventType[];
 }): ResolvedSubscription[];
+/**
+ * Union per-channel subscriptions, widening events and environments when
+ * the same deploy source appears more than once. An empty environment
+ * list means every environment and absorbs a narrower list.
+ */
+export declare function mergeResolvedSubscriptions(groups: readonly (readonly ResolvedSubscription[])[]): ResolvedSubscription[];
 /** Whether one confirmed subscription wants this event. */
 export declare function deploymentEventMatches(subscription: ResolvedSubscription, envelope: DeploymentEvent): boolean;
 /** One channel the host can deliver a deployment event to. */

package/dist/internal/cursor-deployment-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA8CzB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAkEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}
+{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,MAAM,4BAA4B,GACpC,SAAS,oBAAoB,EAAE,GAC/B,CAAC,MAAM,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,4BAA4B,GAC1C,SAAS,oBAAoB,EAAE,CAEjC;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA8CzB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,CAAC,SAAS,oBAAoB,EAAE,CAAC,EAAE,GACnD,oBAAoB,EAAE,CA2BxB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAuEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}