@cursor/july 0.1.100 → 0.1.102

package/src/channels/origin/defaults.ts

@@ -0,0 +1,143 @@
+/**
+ * Default stream-event handlers for the Origin channel: reply delivery.
+ *
+ * The GitHub channel posts completed assistant messages back to the PR via
+ * `buildDefaultGitHubEvents`; this is the Origin analogue. Outbound
+ * credentials resolve exactly like `ctx.origin` in hooks (see
+ * ./binding.ts): channel app credentials / `ORIGIN_APP_*` env when
+ * configured, otherwise — for `cursorAccount` channels — the Cursor-account
+ * session exchange, which on hosted v2 acts as the deployment
+ * service-account principal. The `agent-serve` SA scope allowlist includes
+ * `repository:pull_requests:reviews:write`, the scope
+ * `CreatePullRequestComment` checks, so no extra grant is needed.
+ */
+
+import type { ChannelEventHandlers } from "../../types.js";
+import { buildOriginBinding, type OriginHandle } from "./binding.js";
+import type { OriginChannelState } from "./state.js";
+import type { OriginAppOptions } from "./types.js";
+
+/** Hidden marker on outbound Origin comments so consumers can spot them. */
+export const ORIGIN_OUTBOUND_MARKER = "<!-- agent-serve-origin -->";
+
+export function formatOriginOutboundComment(body: string): string {
+  if (body.includes(ORIGIN_OUTBOUND_MARKER)) {
+    return body;
+  }
+  return `${body.trimEnd()}\n\n${ORIGIN_OUTBOUND_MARKER}`;
+}
+
+export interface BuildDefaultOriginEventsOptions {
+  /** Force the signed-in Cursor account / deployment SA credential path. */
+  cursorAccount?: boolean | { repos: readonly string[] };
+  /** Channel-authored outbound app credentials / API base. */
+  app?: OriginAppOptions;
+  /**
+   * When false, skip posting completed assistant messages (and failure
+   * notices) back to the Origin pull request. Defaults to true.
+   */
+  deliverReplies?: boolean;
+  /** Injectable binding builder for tests. */
+  buildBinding?: typeof buildOriginBinding;
+}
+
+function bindingForState(
+  options: BuildDefaultOriginEventsOptions,
+  state: OriginChannelState
+): OriginHandle {
+  const build = options.buildBinding ?? buildOriginBinding;
+  return build({
+    repository: {
+      owner: state.owner,
+      name: state.repo,
+      fullName: `${state.owner}/${state.repo}`,
+    },
+    ...(state.installationId === null
+      ? {}
+      : { installationId: state.installationId }),
+    cursorAccount:
+      options.cursorAccount !== undefined && options.cursorAccount !== false,
+    app: options.app,
+  });
+}
+
+async function postPullRequestComment(
+  options: BuildDefaultOriginEventsOptions,
+  state: OriginChannelState,
+  body: string
+): Promise<void> {
+  if (
+    state.owner === "" ||
+    state.repo === "" ||
+    state.pullRequestNumber === null
+  ) {
+    return;
+  }
+  const origin = bindingForState(options, state);
+  await origin.request({
+    method: "POST",
+    path: `/v1/origin/repos/${encodeURIComponent(state.owner)}/${encodeURIComponent(
+      state.repo
+    )}/pulls/${state.pullRequestNumber}/comments`,
+    body: { body: formatOriginOutboundComment(body) },
+  });
+}
+
+/**
+ * Built-in delivery: post assistant text on `message.completed`, and a
+ * short error comment on turn/session failure. Every post soft-fails so a
+ * missing outbound credential (or an Origin refusal) never crashes the
+ * session — the GitHub defaults' posture.
+ */
+export function buildDefaultOriginEvents(
+  options: BuildDefaultOriginEventsOptions = {}
+): ChannelEventHandlers<OriginChannelState> {
+  const deliverReplies = options.deliverReplies !== false;
+
+  return {
+    async "message.completed"(event, channel) {
+      if (!deliverReplies) {
+        return;
+      }
+      if (event.data.finishReason === "tool_call" || event.data.text === "") {
+        return;
+      }
+      try {
+        await postPullRequestComment(options, channel.state, event.data.text);
+      } catch {
+        // Soft-fail delivery so a missing credential does not crash the session.
+      }
+    },
+
+    async "turn.failed"(_event, channel) {
+      await postFailure(options, channel, deliverReplies);
+    },
+
+    async "session.failed"(_event, channel) {
+      await postFailure(options, channel, deliverReplies);
+    },
+  };
+}
+
+async function postFailure(
+  options: BuildDefaultOriginEventsOptions,
+  channel: { state: OriginChannelState },
+  deliverReplies: boolean
+): Promise<void> {
+  if (!deliverReplies) {
+    return;
+  }
+  try {
+    await postPullRequestComment(
+      options,
+      channel.state,
+      [
+        "I hit an error while handling your request.",
+        "",
+        "Please try again, or reach out if it keeps failing.",
+      ].join("\n")
+    );
+  } catch {
+    // Soft-fail.
+  }
+}

package/src/channels/origin/index.ts

@@ -26,8 +26,10 @@ export * from "./api.js";
 export * from "./binding.js";
 export * from "./checks.js";
 export * from "./cursor-account.js";
+export * from "./defaults.js";
 export * from "./events.js";
 export * from "./origin-channel.js";
 export * from "./origin-webhook.js";
 export * from "./reactions.js";
+export * from "./state.js";
 export * from "./types.js";

package/src/channels/origin/origin-channel.ts

@@ -18,13 +18,16 @@ import type {
   AgentCloudOptions,
   AuthContext,
   ChannelDefinition,
+  ChannelEventHandlers,
   ChannelHandlerArgs,
+  JsonValue,
 } from "../../types.js";
 import { buildOriginBinding } from "./binding.js";
 import {
   parseCursorOriginRepoScope,
   registerOriginCursorAccountRuntime,
 } from "./cursor-account.js";
+import { buildDefaultOriginEvents } from "./defaults.js";
 import { deriveOriginWebhookEvents, ORIGIN_CHANNEL_KIND } from "./events.js";
 import {
   DEFAULT_ORIGIN_API_BASE_URL,
@@ -32,6 +35,11 @@ import {
   type OriginWebhookHeaders,
   verifyOriginWebhook,
 } from "./origin-webhook.js";
+import {
+  emptyOriginChannelState,
+  type OriginChannelState,
+  originChannelStateForEvent,
+} from "./state.js";
 import type {
   OriginActor,
   OriginChannelOptions,
@@ -432,6 +440,7 @@ function enrichEventContext(input: {
     ...input.ctx,
     host: input.args.host,
     artifacts: input.args.artifacts,
+    send: input.args.send,
     origin: buildOriginBinding({
       repository: input.ctx.repository,
       installationId: input.ctx.installationId,
@@ -504,6 +513,7 @@ async function startTurn(input: {
   message: string;
   dispatch: OriginTurnDispatch;
   cloud?: AgentCloudOptions;
+  state: OriginChannelState;
 }): Promise<Response> {
   const source = continuationSource(input.options.continuation, "origin");
   const session = await input.args.send(input.message, {
@@ -513,6 +523,10 @@ async function startTurn(input: {
       : {}),
     title: input.dispatch.title ?? defaultOriginTitle(input.ctx),
     ...(input.cloud === undefined ? {} : { cloud: input.cloud }),
+    state: input.state as unknown as JsonValue,
+    // Resume must refresh the triggering comment / delivery identifiers so
+    // reply delivery targets the latest wake, not the session's first.
+    refreshState: input.state as unknown as JsonValue,
   });
   if (isDeferredChannelSession(session)) {
     // Hosted admission captured the send; the control plane allocates the
@@ -569,6 +583,8 @@ async function applyDispatch(input: {
   extra: Record<string, unknown>;
   message: string;
   cloud?: AgentCloudOptions;
+  /** Comment id that woke this dispatch (comment events only). */
+  triggeringCommentId?: string;
 }): Promise<Response> {
   if (input.dispatch === null) {
     return skipped("not_dispatched", input.extra);
@@ -587,6 +603,14 @@ async function applyDispatch(input: {
     message,
     dispatch: input.dispatch,
     cloud: input.cloud,
+    state: originChannelStateForEvent({
+      repository: input.ctx.repository,
+      pullRequestNumber: input.ctx.pullRequestNumber,
+      installationId: input.ctx.installationId,
+      deliveryId: input.ctx.deliveryId,
+      eventType: input.ctx.eventType,
+      triggeringCommentId: input.triggeringCommentId,
+    }),
   });
 }
 
@@ -654,6 +678,7 @@ export async function dispatchOriginWebhook(input: {
       dispatch,
       extra: { event: eventType },
       message: `Origin comment on ${ctx.repository.fullName}#${ctx.pullRequestNumber}`,
+      triggeringCommentId: commentId,
     });
   }
 
@@ -798,7 +823,7 @@ export function getOriginChannelOptions(
 
 export function originChannel(
   options: OriginChannelOptions = {}
-): ChannelDefinition {
+): ChannelDefinition<OriginChannelState> {
   const usesCursorAccount =
     options.cursorAccount === true || typeof options.cursorAccount === "object";
   const cursorScope =
@@ -833,8 +858,19 @@ export function originChannel(
     );
   }
 
+  const events: ChannelEventHandlers<OriginChannelState> = {
+    ...buildDefaultOriginEvents({
+      cursorAccount: channelOptions.cursorAccount,
+      app: channelOptions.app,
+      deliverReplies: channelOptions.deliverReplies,
+    }),
+    ...options.events,
+  };
+
   const definition = defineChannel({
     auth,
+    state: emptyOriginChannelState(),
+    events,
     onStart: options.onStart,
     onStop: options.onStop,
     meta: {

package/src/channels/origin/state.ts

@@ -0,0 +1,54 @@
+/**
+ * Durable per-session Origin channel state.
+ *
+ * Persisted with the turn (same mechanism as `GitHubChannelState`) so
+ * channel stream-event handlers — reply delivery in ./defaults.ts — can
+ * rebuild a repo-bound Origin handle without re-parsing the webhook.
+ */
+
+export interface OriginChannelState {
+  owner: string;
+  repo: string;
+  pullRequestNumber: number | null;
+  /** Origin app installation id from the delivery envelope, when present. */
+  installationId: string | null;
+  /** Comment id that woke the turn (comment events only). */
+  triggeringCommentId: string | null;
+  deliveryId: string | null;
+  eventType: string | null;
+}
+
+export function emptyOriginChannelState(
+  overrides: Partial<OriginChannelState> = {}
+): OriginChannelState {
+  return {
+    owner: "",
+    repo: "",
+    pullRequestNumber: null,
+    installationId: null,
+    triggeringCommentId: null,
+    deliveryId: null,
+    eventType: null,
+    ...overrides,
+  };
+}
+
+/** Build the per-turn channel state from a dispatched event's context. */
+export function originChannelStateForEvent(input: {
+  repository: { owner: string; name: string };
+  pullRequestNumber: number;
+  installationId?: string;
+  deliveryId?: string;
+  eventType: string;
+  triggeringCommentId?: string;
+}): OriginChannelState {
+  return emptyOriginChannelState({
+    owner: input.repository.owner,
+    repo: input.repository.name,
+    pullRequestNumber: input.pullRequestNumber,
+    installationId: input.installationId ?? null,
+    triggeringCommentId: input.triggeringCommentId ?? null,
+    deliveryId: input.deliveryId ?? null,
+    eventType: input.eventType,
+  });
+}

package/src/channels/origin/types.ts

@@ -4,11 +4,14 @@ import type {
   ArtifactsApi,
   AuthContext,
   AuthPolicy,
+  ChannelEventHandlers,
   ChannelStartArgs,
   HostContext,
+  SendMessageFn,
 } from "../../types.js";
 import type { OriginTokenProvider } from "./api.js";
 import type { OriginHandle } from "./binding.js";
+import type { OriginChannelState } from "./state.js";
 
 export interface OriginActor {
   id: string;
@@ -70,6 +73,12 @@ export interface OriginEventContext {
    */
   payload: Record<string, unknown>;
   sender?: OriginActor;
+  /**
+   * Channel `send`. Set on every delivery path (HTTP webhook, hosted
+   * admission, SCM events) so a hook can start a turn itself instead of
+   * returning `{ auth, message }` or a deferred `{ task }`.
+   */
+  send?: SendMessageFn;
   host: HostContext;
   artifacts: ArtifactsApi;
   /**
@@ -242,6 +251,21 @@ export interface OriginChannelOptions {
    * pull request URL, or a resolver for custom cloud options.
    */
   cloud?: boolean | AgentCloudOptions | OriginCloudOptionsResolver;
+  /**
+   * When false, skip posting completed assistant messages (and failure
+   * notices) back to the Origin pull request. Defaults to true — the GitHub
+   * channel's reply-delivery posture. Outbound credentials resolve like
+   * `ctx.origin`: {@link app} / `ORIGIN_APP_*` env when configured,
+   * otherwise the Cursor-account session exchange (hosted v2 deployments
+   * post as the deployment service-account principal).
+   */
+  deliverReplies?: boolean;
+  /**
+   * Channel stream-event handlers, merged over the built-in reply-delivery
+   * defaults (`buildDefaultOriginEvents`) — same override contract as the
+   * GitHub channel's `events`.
+   */
+  events?: ChannelEventHandlers<OriginChannelState>;
   /** Called once when the server mounts this channel. */
   onStart?: (args: ChannelStartArgs) => void | Promise<void>;
   /** Called when the server shuts down. */

package/src/channels/slack/api.ts

@@ -5,6 +5,7 @@
 import { ErrorCode, type WebAPIPlatformError, WebClient } from "@slack/web-api";
 import { slackifyMarkdown } from "slackify-markdown";
 import type { ArtifactsApi, HostContext } from "../../types.js";
+import { highlightCodeFences } from "./code-fences.js";
 import {
   SLACK_DEFAULT_LOADING_MESSAGES,
   SLACK_LOADING_MESSAGE_MAX_LEN,
@@ -287,18 +288,20 @@ export async function setThreadTitle(args: {
 export async function setSuggestedPrompts(args: {
   botToken: SlackBotToken | undefined;
   channelId: string;
-  threadTs: string;
+  threadTs?: string;
   prompts: SlackSuggestedPrompt[];
   title?: string;
 }): Promise<SoftSlackResult> {
   const body: Record<string, unknown> = {
     channel_id: args.channelId,
-    thread_ts: args.threadTs,
     prompts: args.prompts.map((p) => ({
       title: p.title,
       message: p.message,
     })),
   };
+  if (args.threadTs !== undefined && args.threadTs !== "") {
+    body.thread_ts = args.threadTs;
+  }
   if (args.title !== undefined && args.title !== "") {
     body.title = args.title;
   }
@@ -495,7 +498,7 @@ export async function postMessage(args: {
       operation: "chat.postMessage",
       body: {
         ...base,
-        markdown_text: args.text,
+        markdown_text: highlightCodeFences(args.text),
       },
     });
     // Older workspaces / scopes may not accept markdown_text — retry with text.

package/src/channels/slack/assistant.ts

@@ -48,7 +48,7 @@ export async function maybeSetThreadTitle(args: {
 export async function maybeSetSuggestedPrompts(args: {
   botToken: SlackBotToken | undefined;
   channelId: string;
-  threadTs: string;
+  threadTs?: string;
   prompts: SlackSuggestedPrompt[];
   title?: string;
   log?: SlackLog;

package/src/channels/slack/code-fences.ts

@@ -0,0 +1,183 @@
+/**
+ * Slack highlights a fenced code block only when its info string is a
+ * language it knows (`ts`, `python`, …). Models on this harness cite code
+ * with Cursor's `startLine:endLine:path` form, or a bare path, which Slack
+ * shows verbatim as the block's header with no highlighting. The header is
+ * the only slot Slack offers, so a block gets colors by moving the reference
+ * to a comment on its first line. Files whose language has no comment
+ * syntax, or that Slack cannot color anyway, keep the reference as header.
+ */
+
+const FENCE = /^(\s*)(`{3,}|~{3,})(.*)$/;
+/** A line that may still grow into a fence. */
+const FENCE_START = /^\s*(`{1,2}|~{1,2})$/;
+const CITATION = /^(\d+):(\d+):(\S+)$/;
+
+const LANGUAGE_BY_EXTENSION: Readonly<Record<string, string>> = {
+  ts: "ts",
+  mts: "ts",
+  cts: "ts",
+  tsx: "tsx",
+  js: "js",
+  mjs: "js",
+  cjs: "js",
+  jsx: "jsx",
+  py: "python",
+  go: "go",
+  rs: "rust",
+  java: "java",
+  kt: "kotlin",
+  swift: "swift",
+  rb: "ruby",
+  php: "php",
+  c: "c",
+  h: "c",
+  cc: "cpp",
+  cpp: "cpp",
+  hpp: "cpp",
+  cs: "csharp",
+  json: "json",
+  jsonc: "jsonc",
+  yaml: "yaml",
+  yml: "yaml",
+  toml: "toml",
+  xml: "xml",
+  html: "html",
+  css: "css",
+  scss: "scss",
+  md: "markdown",
+  mdx: "mdx",
+  sh: "bash",
+  bash: "bash",
+  zsh: "bash",
+  sql: "sql",
+  proto: "protobuf",
+  tf: "hcl",
+  graphql: "graphql",
+  dockerfile: "dockerfile",
+  ini: "ini",
+};
+
+/** `[open, close]` comment delimiters; languages without one (JSON) are absent. */
+const COMMENT_BY_LANGUAGE: Readonly<Record<string, readonly [string, string]>> =
+  {
+    ts: ["//", ""],
+    tsx: ["//", ""],
+    js: ["//", ""],
+    jsx: ["//", ""],
+    go: ["//", ""],
+    rust: ["//", ""],
+    java: ["//", ""],
+    kotlin: ["//", ""],
+    swift: ["//", ""],
+    php: ["//", ""],
+    c: ["//", ""],
+    cpp: ["//", ""],
+    csharp: ["//", ""],
+    jsonc: ["//", ""],
+    protobuf: ["//", ""],
+    python: ["#", ""],
+    ruby: ["#", ""],
+    yaml: ["#", ""],
+    toml: ["#", ""],
+    bash: ["#", ""],
+    dockerfile: ["#", ""],
+    ini: ["#", ""],
+    hcl: ["#", ""],
+    graphql: ["#", ""],
+    sql: ["--", ""],
+    css: ["/*", "*/"],
+    scss: ["/*", "*/"],
+    html: ["<!--", "-->"],
+    xml: ["<!--", "-->"],
+    markdown: ["<!--", "-->"],
+    mdx: ["<!--", "-->"],
+  };
+
+function languageForPath(path: string): string | undefined {
+  const base = path.slice(path.lastIndexOf("/") + 1).toLowerCase();
+  const ext = base.includes(".") ? base.slice(base.lastIndexOf(".") + 1) : base;
+  return LANGUAGE_BY_EXTENSION[ext];
+}
+
+function looksLikePath(info: string): boolean {
+  return info.includes("/") || languageForPath(info) !== undefined;
+}
+
+/**
+ * Replacement lines for an opening fence whose info string is a citation or
+ * a path: the fence tagged with the language, then the reference as a
+ * comment. Falls back to the reference as the header when the block cannot
+ * carry a comment. `null` when the info string is neither.
+ */
+function rewriteOpening(
+  indent: string,
+  marks: string,
+  info: string
+): string[] | null {
+  const token = info.trim().split(/\s+/)[0] ?? "";
+  const cited = CITATION.exec(token);
+  const path = cited?.[3] ?? (looksLikePath(token) ? token : undefined);
+  if (path === undefined) {
+    return null;
+  }
+  const reference = cited === null ? path : `${path}:${cited[1]}-${cited[2]}`;
+  const language = languageForPath(path);
+  const comment =
+    language === undefined ? undefined : COMMENT_BY_LANGUAGE[language];
+  if (comment === undefined) {
+    return [`${indent}${marks}${reference}`];
+  }
+  const [open, close] = comment;
+  const commented =
+    close === "" ? `${open} ${reference}` : `${open} ${reference} ${close}`;
+  return [`${indent}${marks}${language}`, `${indent}${commented}`];
+}
+
+/**
+ * Rewrite fence info strings so Slack highlights the block. Safe to run on
+ * a growing stream: the output for a prefix is a prefix of the output for
+ * the full text, because an opening fence whose line has not ended yet is
+ * held back rather than emitted half-formed.
+ */
+export function highlightCodeFences(markdown: string): string {
+  const complete = markdown.endsWith("\n");
+  const lines = markdown.split("\n");
+  if (complete) {
+    lines.pop();
+  }
+  const out: string[] = [];
+  let open: { marks: string } | null = null;
+  const heldBack = (): string =>
+    `${out.join("\n")}${out.length > 0 ? "\n" : ""}`;
+  for (const [index, line] of lines.entries()) {
+    const last = index === lines.length - 1 && !complete;
+    const fence = FENCE.exec(line);
+    if (fence === null) {
+      if (last && open === null && FENCE_START.test(line)) {
+        return heldBack();
+      }
+      out.push(line);
+      continue;
+    }
+    const [, indent = "", marks = "", info = ""] = fence;
+    if (open !== null) {
+      if (
+        marks[0] === open.marks[0] &&
+        marks.length >= open.marks.length &&
+        info.trim() === ""
+      ) {
+        open = null;
+      }
+      out.push(line);
+      continue;
+    }
+    if (last) {
+      // Opening fence still being written: wait for the whole line.
+      return heldBack();
+    }
+    open = { marks };
+    out.push(...(rewriteOpening(indent, marks, info) ?? [line]));
+  }
+  return complete ? `${out.join("\n")}\n` : out.join("\n");
+}

package/src/channels/slack/dispatch.ts

@@ -38,6 +38,7 @@ import { isExternalSlackSender } from "./external-policy.js";
 import {
   describeSlackEventShape,
   formatSlackContextBlock,
+  parseAppHomeOpened,
   parseAppMentionEvent,
   parseAssistantThreadStarted,
   parseChannelMessageEvent,
@@ -181,8 +182,9 @@ export interface SlackInboundDispatchDeps extends SlackContinuationProbes {
    */
   blockExternals?: boolean;
   /**
-   * Suggested prompts written on `assistant_thread_started` so the
-   * assistant pane is not blank before the first user message.
+   * Suggested prompts pinned when a user opens the agent Messages tab
+   * (`app_home_opened`). Older apps still seed them on
+   * `assistant_thread_started`.
    */
   suggestedPrompts?: SlackSuggestedPrompt[];
   suggestedPromptsTitle?: string;
@@ -766,6 +768,29 @@ export function dispatchInboundFromEventBody(
     return true;
   }
 
+  const home = parseAppHomeOpened(body);
+  if (home !== null) {
+    const prompts = deps.suggestedPrompts ?? [];
+    log.info("app home opened", {
+      channel: home.channelId,
+      tab: home.tab,
+      user: home.userId,
+      event_id: eventId,
+    });
+    if (home.tab === "messages" && prompts.length > 0) {
+      deps.waitUntil(
+        maybeSetSuggestedPrompts({
+          botToken: deps.credentials?.botToken,
+          channelId: home.channelId,
+          prompts,
+          title: deps.suggestedPromptsTitle,
+          log,
+        })
+      );
+    }
+    return true;
+  }
+
   const assistantThread = parseAssistantThreadStarted(body);
   if (assistantThread !== null) {
     const prompts = deps.suggestedPrompts ?? [];