@cursor/july 0.1.100 → 0.1.102

package/src/internal/mcp-host.ts

@@ -15,16 +15,22 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import type {
-  DiscoveredConnection,
-  HostMcpCallResult,
-  HostMcpRegistry,
-  HostMcpToolInfo,
-  JsonObject,
-  McpToolAnnotations,
+import {
+  connectionAllowsTool,
+  type DiscoveredConnection,
+  type HostMcpCallResult,
+  type HostMcpRegistry,
+  type HostMcpToolInfo,
+  type JsonObject,
+  type McpToolAnnotations,
 } from "../types.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
 import { createHostMcpOAuthProvider } from "./mcp-oauth.js";
+import {
+  instrumentedMcpFetch,
+  mcpTraceMeta,
+  runMcpClientSpan,
+} from "./otel/mcp.js";
 
 export class McpNeedsAuthError extends Error {
   readonly connection: string;
@@ -113,10 +119,17 @@ export class McpHost implements HostMcpRegistry {
   }
 
   async listTools(connectionName: string): Promise<HostMcpToolInfo[]> {
-    return this.withClient(connectionName, async (client) => {
-      const listed = await client.listTools();
-      return listed.tools.map(toToolInfo);
-    });
+    const connection = this.requireConnection(connectionName);
+    return runMcpClientSpan(
+      { method: "tools/list", connection: connectionName },
+      () =>
+        this.withClient(connectionName, async (client) => {
+          const listed = await client.listTools(mcpListParams());
+          return listed.tools
+            .map(toToolInfo)
+            .filter((tool) => connectionAllowsTool(connection, tool.name));
+        })
+    );
   }
 
   /**
@@ -142,21 +155,38 @@ export class McpHost implements HostMcpRegistry {
     };
     return {
       listTools: () =>
-        withFreshClient(async (client) => {
-          const listed = await client.listTools();
-          return listed.tools.map(toToolInfo);
-        }),
-      callTool: (toolName, args = {}) =>
-        withFreshClient(async (client) => {
-          const result = await client.callTool({
-            name: toolName,
-            arguments: args,
-          });
-          return throwIfCallNeedsAuth(
-            connection.name,
-            normalizeCallResult(result)
-          );
-        }),
+        runMcpClientSpan(
+          { method: "tools/list", connection: connection.name },
+          () =>
+            withFreshClient(async (client) => {
+              const listed = await client.listTools(mcpListParams());
+              return listed.tools
+                .map(toToolInfo)
+                .filter((tool) => connectionAllowsTool(connection, tool.name));
+            })
+        ),
+      callTool: (toolName, args = {}) => {
+        assertConnectionAllowsTool(connection, toolName);
+        return runMcpClientSpan(
+          {
+            method: "tools/call",
+            connection: connection.name,
+            toolName,
+          },
+          () =>
+            withFreshClient(async (client) => {
+              const result = await client.callTool({
+                name: toolName,
+                arguments: args,
+                ...mcpCallMeta(),
+              });
+              return throwIfCallNeedsAuth(
+                connection.name,
+                normalizeCallResult(result)
+              );
+            })
+        );
+      },
     };
   }
 
@@ -165,13 +195,23 @@ export class McpHost implements HostMcpRegistry {
     toolName: string,
     args: Record<string, unknown> = {}
   ): Promise<HostMcpCallResult> {
-    return this.withClient(connectionName, async (client) => {
-      const result = await client.callTool({
-        name: toolName,
-        arguments: args,
-      });
-      return throwIfCallNeedsAuth(connectionName, normalizeCallResult(result));
-    });
+    const connection = this.requireConnection(connectionName);
+    assertConnectionAllowsTool(connection, toolName);
+    return runMcpClientSpan(
+      { method: "tools/call", connection: connectionName, toolName },
+      () =>
+        this.withClient(connectionName, async (client) => {
+          const result = await client.callTool({
+            name: toolName,
+            arguments: args,
+            ...mcpCallMeta(),
+          });
+          return throwIfCallNeedsAuth(
+            connectionName,
+            normalizeCallResult(result)
+          );
+        })
+    );
   }
 
   async dropClient(name: string): Promise<void> {
@@ -254,7 +294,7 @@ export class McpHost implements HostMcpRegistry {
     await opened.close();
   }
 
-  private async connect(name: string): Promise<OpenedConnection> {
+  private requireConnection(name: string): DiscoveredConnection {
     const connection = this.byName.get(name);
     if (connection === undefined) {
       const known = this.names().join(", ") || "(none)";
@@ -262,8 +302,24 @@ export class McpHost implements HostMcpRegistry {
         `Unknown MCP connection "${name}". Authored MCP connections: ${known}.`
       );
     }
-    return openConnection(connection, this.oauthRedirectUrl);
+    return connection;
+  }
+
+  private async connect(name: string): Promise<OpenedConnection> {
+    return openConnection(this.requireConnection(name), this.oauthRedirectUrl);
+  }
+}
+
+function assertConnectionAllowsTool(
+  connection: DiscoveredConnection,
+  toolName: string
+): void {
+  if (connectionAllowsTool(connection, toolName)) {
+    return;
   }
+  throw new Error(
+    `MCP connection "${connection.name}" does not allow tool "${toolName}".`
+  );
 }
 
 /** Exported for unit tests. */
@@ -434,10 +490,33 @@ async function createTransport(
         })
       : undefined;
 
+  const fetchImpl = instrumentedMcpFetch();
+  const fetchLike = (url: string | URL, init?: RequestInit) =>
+    fetchImpl(url, init);
   if (transport.type === "sse") {
-    return new SSEClientTransport(url, { requestInit, authProvider });
+    return new SSEClientTransport(url, {
+      requestInit,
+      authProvider,
+      fetch: fetchLike,
+    });
   }
-  return new StreamableHTTPClientTransport(url, { requestInit, authProvider });
+  return new StreamableHTTPClientTransport(url, {
+    requestInit,
+    authProvider,
+    fetch: fetchLike,
+  });
+}
+
+function mcpListParams(): { _meta: { traceparent: string } } | undefined {
+  const meta = mcpTraceMeta();
+  return meta === undefined ? undefined : { _meta: meta };
+}
+
+function mcpCallMeta():
+  | { _meta: { traceparent: string } }
+  | Record<string, never> {
+  const meta = mcpTraceMeta();
+  return meta === undefined ? {} : { _meta: meta };
 }
 
 function isOauthHttpTransport(

package/src/internal/otel/collector.ts

@@ -24,9 +24,23 @@ import type { OtelRuntime } from "./runtime.js";
 
 const CONTENT_MAX = 2_048;
 
+export interface OtelCallContext {
+  sessionId: string;
+  session: SessionInfo;
+  turnId: string;
+  callId: string;
+  toolName: string;
+}
+
 export interface OtelCollector {
   onEvent(event: SessionEvent, session: SessionInfo): void;
   close(): void;
+  /**
+   * Run `fn` under the tool span so outbound inject sees that context.
+   * Opens the session / turn / tool span if the event stream has not
+   * reached `actions.requested` yet (dispatch is async).
+   */
+  runInCall<T>(args: OtelCallContext, fn: () => T | Promise<T>): Promise<T>;
   /** Merge author tags onto the session; paints open spans immediately. */
   setSessionAttributes(
     sessionId: string,
@@ -93,6 +107,12 @@ export function createOtelCollector(
       const bag = extraBySession.get(sessionId);
       return bag === undefined ? undefined : { ...bag };
     },
+    runInCall(args, fn) {
+      const span = ensureCallSpan(args);
+      return context.with(trace.setSpan(context.active(), span), () =>
+        Promise.resolve(fn())
+      );
+    },
   };
 
   function handle(event: SessionEvent, session: SessionInfo): void {
@@ -101,6 +121,9 @@ export function createOtelCollector(
 
     switch (event.type) {
       case "session.started": {
+        if (sessions.get(event.sessionId) !== undefined) {
+          return;
+        }
         openSession({
           sessionId: event.sessionId,
           session,
@@ -174,6 +197,15 @@ export function createOtelCollector(
         if (state === undefined) {
           return;
         }
+        // `runInCall` can open a synthetic turn before this event is
+        // applied. Keep that entry (and its in-flight tool spans) and
+        // just mark it real so `action.result` will not auto-close it.
+        const existing = state.turns.get(event.turnId);
+        if (existing !== undefined) {
+          existing.synthetic = false;
+          existing.span.setAttribute("agent_sdk.turn_synthetic", false);
+          return;
+        }
         openTurn({
           state,
           sessionId: event.sessionId,
@@ -227,32 +259,14 @@ export function createOtelCollector(
           return;
         }
         for (const call of event.data.calls) {
-          const parentCtx = parentCtxFor(
+          openToolSpan({
             turn,
-            event.data.parentCallId ?? call.parentCallId
-          );
-          const span = runtime.tracer.startSpan(
-            "agent_sdk.tool",
-            {
-              kind: SpanKind.INTERNAL,
-              startTime,
-              attributes: join(event.sessionId, {
-                "cursor.conversation.id": event.sessionId,
-                "cursor.tool.name": call.toolName,
-                "cursor.tool.kind": "builtin",
-                "agent_sdk.agent": agentName,
-                "agent_sdk.turn_id": event.turnId,
-                "agent_sdk.call_id": call.callId,
-                "agent_sdk.parent_call_id": call.parentCallId,
-                "agent_sdk.tool_args":
-                  logOpts?.toolContent === true && call.args !== undefined
-                    ? truncate(json(call.args))
-                    : undefined,
-              }),
-            },
-            parentCtx
-          );
-          turn.tools.set(call.callId, span);
+            sessionId: event.sessionId,
+            turnId: event.turnId,
+            call,
+            parentCallId: event.data.parentCallId ?? call.parentCallId,
+            startTime,
+          });
         }
         return;
       }
@@ -702,6 +716,92 @@ export function createOtelCollector(
     return trace.setSpan(context.active(), turn.span);
   }
 
+  function openToolSpan(args: {
+    turn: TurnState;
+    sessionId: string;
+    turnId: string | undefined;
+    call: {
+      callId: string;
+      toolName: string;
+      args?: unknown;
+      parentCallId?: string;
+    };
+    parentCallId?: string;
+    startTime: number | undefined;
+  }): Span {
+    const existing = args.turn.tools.get(args.call.callId);
+    if (existing !== undefined) {
+      // Early `runInCall` opens with callId/toolName only. Fill in
+      // parent linkage and opt-in args when `actions.requested` arrives.
+      // The OTel parent is fixed at start; `parent_call_id` still records
+      // the event-stream hierarchy for nested/subagent calls.
+      existing.setAttributes(
+        join(args.sessionId, {
+          "agent_sdk.parent_call_id":
+            args.parentCallId ?? args.call.parentCallId,
+          "agent_sdk.tool_args":
+            logOpts?.toolContent === true && args.call.args !== undefined
+              ? truncate(json(args.call.args))
+              : undefined,
+        })
+      );
+      return existing;
+    }
+    const span = runtime.tracer.startSpan(
+      "agent_sdk.tool",
+      {
+        kind: SpanKind.INTERNAL,
+        startTime: args.startTime,
+        attributes: join(args.sessionId, {
+          "cursor.conversation.id": args.sessionId,
+          "cursor.tool.name": args.call.toolName,
+          "cursor.tool.kind": "builtin",
+          "agent_sdk.agent": agentName,
+          "agent_sdk.turn_id": args.turnId,
+          "agent_sdk.call_id": args.call.callId,
+          "agent_sdk.parent_call_id": args.call.parentCallId,
+          "agent_sdk.tool_args":
+            logOpts?.toolContent === true && args.call.args !== undefined
+              ? truncate(json(args.call.args))
+              : undefined,
+        }),
+      },
+      parentCtxFor(args.turn, args.parentCallId ?? args.call.parentCallId)
+    );
+    args.turn.tools.set(args.call.callId, span);
+    return span;
+  }
+
+  function ensureCallSpan(args: OtelCallContext): Span {
+    const startTime = Date.now();
+    const state =
+      sessions.get(args.sessionId) ??
+      openSession({
+        sessionId: args.sessionId,
+        session: args.session,
+        channelId: args.session.channelId,
+        startTime,
+        restored: true,
+      });
+    const turn =
+      state.turns.get(args.turnId) ??
+      openTurn({
+        state,
+        sessionId: args.sessionId,
+        turnId: args.turnId,
+        session: args.session,
+        startTime,
+        synthetic: true,
+      });
+    return openToolSpan({
+      turn,
+      sessionId: args.sessionId,
+      turnId: args.turnId,
+      call: { callId: args.callId, toolName: args.toolName },
+      startTime,
+    });
+  }
+
   function endOpenChildren(turn: TurnState, endTime: number | undefined): void {
     for (const span of turn.tools.values()) {
       span.end(endTime);

package/src/internal/otel/http.ts

@@ -11,19 +11,9 @@ import {
   SpanStatusCode,
   trace,
 } from "@opentelemetry/api";
-import { W3CTraceContextPropagator } from "@opentelemetry/core";
+import { ensureW3cPropagator } from "./propagation.js";
 import type { OtelRuntime } from "./runtime.js";
 
-let propagatorInstalled = false;
-
-function ensurePropagator(): void {
-  if (propagatorInstalled) {
-    return;
-  }
-  propagation.setGlobalPropagator(new W3CTraceContextPropagator());
-  propagatorInstalled = true;
-}
-
 interface HttpSpanHandle {
   context: Context;
   end(statusCode: number, error?: unknown): void;
@@ -61,7 +51,7 @@ function startHttpSpan(
   if (runtime === undefined || runtime.config.traces === false) {
     return undefined;
   }
-  ensurePropagator();
+  ensureW3cPropagator();
   const headers: Record<string, string> = {};
   for (const [key, value] of Object.entries(req.headers)) {
     if (typeof value === "string") {

package/src/internal/otel/mcp.ts

@@ -0,0 +1,69 @@
+/**
+ * Client-side MCP instrumentation: W3C / Cursor HTTP inject on Streamable
+ * HTTP + SSE fetches, SEP-414 `_meta.traceparent` on JSON-RPC params, and
+ * CLIENT spans for `tools/list` / `tools/call`.
+ */
+
+import { context, SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+import { formatTraceparent, injectActiveTraceContext } from "../../otel.js";
+import { attrs } from "./attrs.js";
+
+const TRACER = "agent_sdk";
+
+export function instrumentedMcpFetch(base: typeof fetch = fetch): typeof fetch {
+  return (input, init) => {
+    if (input instanceof Request && init === undefined) {
+      const headers = new Headers(input.headers);
+      injectActiveTraceContext(headers);
+      return base(new Request(input, { headers }));
+    }
+    const headers = new Headers(init?.headers);
+    injectActiveTraceContext(headers);
+    return base(input, { ...init, headers });
+  };
+}
+
+/** SEP-414 / OTel MCP carrier for `params._meta`. */
+export function mcpTraceMeta(): { traceparent: string } | undefined {
+  const span = trace.getSpan(context.active());
+  if (span === undefined) {
+    return undefined;
+  }
+  const traceparent = formatTraceparent(span.spanContext());
+  if (traceparent === undefined) {
+    return undefined;
+  }
+  return { traceparent };
+}
+
+export function runMcpClientSpan<T>(
+  args: {
+    method: string;
+    connection: string;
+    toolName?: string;
+  },
+  fn: () => Promise<T>
+): Promise<T> {
+  const span = trace.getTracer(TRACER).startSpan(args.method, {
+    kind: SpanKind.CLIENT,
+    attributes: attrs({
+      "rpc.system": "mcp",
+      "mcp.method.name": args.method,
+      "mcp.tool.name": args.toolName,
+      "agent_sdk.mcp.connection": args.connection,
+    }),
+  });
+  return context.with(trace.setSpan(context.active(), span), async () => {
+    try {
+      return await fn();
+    } catch (error) {
+      span.setStatus({
+        code: SpanStatusCode.ERROR,
+        message: error instanceof Error ? error.message : String(error),
+      });
+      throw error;
+    } finally {
+      span.end();
+    }
+  });
+}

package/src/internal/otel/propagation.ts

@@ -0,0 +1,17 @@
+/**
+ * Process-global W3C `traceparent` propagator. Inbound HTTP extracts;
+ * outbound Factory / Cursor API calls inject.
+ */
+
+import { propagation } from "@opentelemetry/api";
+import { W3CTraceContextPropagator } from "@opentelemetry/core";
+
+let installed = false;
+
+export function ensureW3cPropagator(): void {
+  if (installed) {
+    return;
+  }
+  propagation.setGlobalPropagator(new W3CTraceContextPropagator());
+  installed = true;
+}

package/src/internal/otel/runtime.ts

@@ -41,6 +41,7 @@ import {
 } from "@opentelemetry/semantic-conventions";
 import type { OtelExporterConfig, OtelSignal } from "../../otel.js";
 import { exportersForSignal, type ResolvedOtelConfig } from "./config.js";
+import { ensureW3cPropagator } from "./propagation.js";
 
 const INSTRUMENTATION = "agent_sdk";
 
@@ -66,6 +67,7 @@ export function createOtelRuntime(
       "[agent-sdk:otel] OTEL_EXPORTER_OTLP_PROTOCOL=grpc is unsupported; using http/protobuf"
     );
   }
+  ensureW3cPropagator();
   const sdk = startOtelSdk(config, log);
   const meter =
     config.metrics === false

package/src/internal/review-comments.ts

@@ -639,7 +639,9 @@ type OriginThreadJson = {
  */
 type OriginActorJson = {
   user?: { id?: string; email?: string };
-  app?: { id?: string; slug?: string };
+  // Apps have no slug (they are id + display name); `slug` is being retired
+  // from the public actor and is never read here.
+  app?: { id?: string; displayName?: string };
   serviceAccount?: { id?: string };
 };
 
@@ -685,7 +687,8 @@ export function listedCommentFromOriginComment(
       : startLine;
   const commitSha = thread.version?.headSha;
   const author = comment.author;
-  const authorLogin = author?.app?.slug ?? author?.user?.email;
+  const authorLogin =
+    author?.app?.displayName ?? author?.app?.id ?? author?.user?.email;
   // App and service-account actors are machine identities; only a `user`
   // actor is a human PR participant.
   const authorIsBot =