@cursor/july 0.1.101 → 0.1.102

package/dist/internal/cursor/backend-client.js

@@ -2,7 +2,8 @@
  * Minimal Connect-JSON client for the handful of `aiserver.v1.DashboardService`
  * RPCs agent-serve needs — `GetMe`, `ListSandMcpTools`, `ExecuteSandMcpTool`,
  * and the login-time key lifecycle (`CreateUserApiKey`, `ListUserApiKeys`,
- * `RevokeUserApiKey`).
+ * `RevokeUserApiKey`) — plus {@link CursorBackendClient.serviceRpc} for the
+ * odd unary call on another `aiserver.v1` service under the same token.
  *
  * Plain `fetch` POSTs with proto-JSON bodies and zod-validated responses:
  * agent-serve is a published package and should not pull the generated
@@ -26,7 +27,7 @@ import { z } from "zod";
 import { boundedToolAnnotations } from "../mcp-host.js";
 import { CURSOR_SESSION_EXCHANGE_PATH, CursorSessionExchangeError, exchangeCursorApiKeyForSession, SESSION_TOKEN_EXPIRY_LEEWAY_MS, } from "./session-token.js";
 const CLIENT_VERSION = "agent-serve-0.1.0";
-const SERVICE_PREFIX = "/aiserver.v1.DashboardService";
+const DASHBOARD_SERVICE = "DashboardService";
 const LIST_TIMEOUT_MS = 60000;
 /** Backend-executed tools call out to third-party servers; be generous. */
 const EXECUTE_TIMEOUT_MS = 120000;
@@ -144,11 +145,11 @@ const executeResponseSchema = z.object({
 // Shared request machinery (used by the client and the login-time mint)
 // ============================================================================
 /** One DashboardService Connect-JSON POST; auth is the caller's bearer. */
-function dashboardRpc(args) {
+function connectRpc(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         try {
-            return yield args.fetchImpl(`${args.backendUrl}${SERVICE_PREFIX}/${args.method}`, {
+            return yield args.fetchImpl(`${args.backendUrl}/aiserver.v1.${args.service}/${args.method}`, {
                 method: "POST",
                 headers: Object.assign({ "content-type": "application/json", authorization: `Bearer ${args.bearer}`, "x-ghost-mode": "true", "x-cursor-client-version": CLIENT_VERSION, "x-cursor-client-type": "agent-serve", "x-request-id": randomUUID() }, args.extraHeaders),
                 body: JSON.stringify((_a = args.body) !== null && _a !== void 0 ? _a : {}),
@@ -313,16 +314,27 @@ export class CursorBackendClient {
             return githubTokenResponseSchema.parse(parsed);
         });
     }
+    /**
+     * One unary Connect-JSON call on `aiserver.v1.<service>` with the same
+     * token exchange and 401 retry as the dashboard RPCs. Callers parse the
+     * proto-JSON response themselves.
+     */
+    serviceRpc(service, method, body, timeoutMs = LIST_TIMEOUT_MS) {
+        return this.rpc(method, body, timeoutMs, { service });
+    }
     rpc(method_1, body_1) {
         return __awaiter(this, arguments, void 0, function* (method, body, timeoutMs = LIST_TIMEOUT_MS, options) {
             var _a, _b;
+            var _c;
+            const service = (_c = options === null || options === void 0 ? void 0 : options.service) !== null && _c !== void 0 ? _c : DASHBOARD_SERVICE;
             const extraHeaders = (options === null || options === void 0 ? void 0 : options.teamId) === undefined
                 ? undefined
                 : { "x-cursor-team-id": String(options.teamId) };
             const bearer = yield this.getAccessToken();
-            const first = yield dashboardRpc({
+            const first = yield connectRpc({
                 fetchImpl: this.fetchImpl,
                 backendUrl: this.backendUrl,
+                service,
                 method,
                 bearer,
                 body,
@@ -340,9 +352,10 @@ export class CursorBackendClient {
                 this.token = undefined;
             }
             const retryBearer = yield this.getAccessToken();
-            const second = yield dashboardRpc({
+            const second = yield connectRpc({
                 fetchImpl: this.fetchImpl,
                 backendUrl: this.backendUrl,
+                service,
                 method,
                 bearer: retryBearer,
                 body,
@@ -421,11 +434,12 @@ export class CursorBackendClient {
 export function createUserApiKeyWithSessionToken(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
-        const response = yield dashboardRpc({
+        const response = yield connectRpc({
             fetchImpl: (_a = args.fetchImpl) !== null && _a !== void 0 ? _a : fetch,
             backendUrl: args.backendUrl.endsWith("/")
                 ? args.backendUrl.slice(0, -1)
                 : args.backendUrl,
+            service: DASHBOARD_SERVICE,
             method: "CreateUserApiKey",
             bearer: args.sessionToken,
             body: { name: args.keyName },
@@ -463,9 +477,10 @@ export function revokeMintedUserApiKey(args) {
         const backendUrl = args.backendUrl.endsWith("/")
             ? args.backendUrl.slice(0, -1)
             : args.backendUrl;
-        const listResponse = yield dashboardRpc({
+        const listResponse = yield connectRpc({
             fetchImpl,
             backendUrl,
+            service: DASHBOARD_SERVICE,
             method: "ListUserApiKeys",
             bearer: args.sessionToken,
             body: {},
@@ -479,9 +494,10 @@ export function revokeMintedUserApiKey(args) {
             // lagging replica — skip rather than touch any other key.
             return;
         }
-        const revokeResponse = yield dashboardRpc({
+        const revokeResponse = yield connectRpc({
             fetchImpl,
             backendUrl,
+            service: DASHBOARD_SERVICE,
             method: "RevokeUserApiKey",
             bearer: args.sessionToken,
             body: { id: match.id },

package/dist/internal/cursor/hosted-store-secrets.d.ts

@@ -12,4 +12,15 @@ export declare const DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE = "/run/
 export declare function resolveDeploymentStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
 /** Engine framework store: env, then task-bind file. */
 export declare function resolveFrameworkStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
+export type CursorManagedV2StoreIds = {
+    deploymentStoreSourceId: string;
+    frameworkStoreSourceId: string;
+};
+/**
+ * Resolve the complete managed-v2 store identity at the process boundary.
+ *
+ * Freeze snapshots construct storage before task bind, so callers keep this
+ * resolver lazy. Once an operation needs storage, both ids are mandatory.
+ */
+export declare function requireCursorManagedV2StoreIdsSync(env?: NodeJS.ProcessEnv): CursorManagedV2StoreIds;
 //# sourceMappingURL=hosted-store-secrets.d.ts.map

package/dist/internal/cursor/hosted-store-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AA4B9D,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB"}
+{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AA4B9D,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,CAYzB"}

package/dist/internal/cursor/hosted-store-secrets.js

@@ -46,3 +46,18 @@ export function resolveFrameworkStoreSourceIdSync(env = process.env) {
     }
     return readBoundSecretFile(FRAMEWORK_STORE_SOURCE_ID_FILE_ENV, DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE, env);
 }
+/**
+ * Resolve the complete managed-v2 store identity at the process boundary.
+ *
+ * Freeze snapshots construct storage before task bind, so callers keep this
+ * resolver lazy. Once an operation needs storage, both ids are mandatory.
+ */
+export function requireCursorManagedV2StoreIdsSync(env = process.env) {
+    const deploymentStoreSourceId = resolveDeploymentStoreSourceIdSync(env);
+    const frameworkStoreSourceId = resolveFrameworkStoreSourceIdSync(env);
+    if (deploymentStoreSourceId === undefined ||
+        frameworkStoreSourceId === undefined) {
+        throw new Error("Cursor-managed AgentSDK v2 requires AGENT_SERVE_STORE_SOURCE_ID and AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID");
+    }
+    return { deploymentStoreSourceId, frameworkStoreSourceId };
+}

package/dist/internal/discovery/ab.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `agent/ab.ts` or `agent/ab/*.ts` plus `agent/ab.config.ts`: live A/B experiments.
+ */
+import type { ABConfigFile } from "../../ab.js";
+import type { DiscoveredAB } from "../../types.js";
+import { type DiscoveryContext } from "./context.js";
+export declare function loadABs(ctx: DiscoveryContext, agentDir: string): Promise<DiscoveredAB[]>;
+export declare function loadABConfig(ctx: DiscoveryContext, agentDir: string): Promise<ABConfigFile | undefined>;
+//# sourceMappingURL=ab.d.ts.map

package/dist/internal/discovery/ab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ab.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/ab.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAUlE,wBAAsB,OAAO,CAC3B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CA+CzB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAyBnC"}

package/dist/internal/discovery/ab.js

@@ -0,0 +1,101 @@
+/**
+ * `agent/ab.ts` or `agent/ab/*.ts` plus `agent/ab.config.ts`: live A/B experiments.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { basename, extname, join, relative } from "node:path";
+import { displayPath } from "./context.js";
+import { findModuleFile, isDirectory, isModuleFile, toPosix, walkFiles, } from "./fs.js";
+import { importDefault } from "./modules.js";
+export function loadABs(ctx, agentDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const abs = [];
+        const seen = new Set();
+        const single = yield findModuleFile(agentDir, "ab");
+        if (single !== undefined) {
+            const definition = yield importDefault(ctx, single, "ab");
+            if (definition !== undefined) {
+                const name = resolveABName(definition, "ab");
+                seen.add(name);
+                abs.push({
+                    name,
+                    definition: definition,
+                });
+            }
+        }
+        const absDir = join(agentDir, "ab");
+        if (yield isDirectory(absDir)) {
+            for (const filePath of yield walkFiles(absDir)) {
+                if (!isModuleFile(basename(filePath))) {
+                    continue;
+                }
+                const rel = toPosix(relative(absDir, filePath));
+                const stem = rel.slice(0, -extname(rel).length);
+                const definition = yield importDefault(ctx, filePath, "ab");
+                if (definition === undefined) {
+                    continue;
+                }
+                const name = resolveABName(definition, stem);
+                if (seen.has(name)) {
+                    ctx.diagnostics.push({
+                        severity: "error",
+                        path: displayPath(ctx, filePath),
+                        message: `Duplicate A/B experiment name ${JSON.stringify(name)}.`,
+                    });
+                    continue;
+                }
+                seen.add(name);
+                abs.push({
+                    name,
+                    definition: definition,
+                });
+            }
+        }
+        return abs;
+    });
+}
+export function loadABConfig(ctx, agentDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const path = yield findModuleFile(agentDir, "ab.config");
+        if (path === undefined) {
+            return undefined;
+        }
+        try {
+            const mod = yield ctx.importModule(path);
+            if (mod.default === null || typeof mod.default !== "object") {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, path),
+                    message: "ab.config.ts must default-export defineABConfig({ ... }) from @cursor/july/ab.",
+                });
+                return undefined;
+            }
+            return mod.default;
+        }
+        catch (error) {
+            ctx.diagnostics.push({
+                severity: "error",
+                path: displayPath(ctx, path),
+                message: `Failed to load ab.config: ${error instanceof Error ? error.message : String(error)}`,
+            });
+            return undefined;
+        }
+    });
+}
+function resolveABName(definition, fallback) {
+    if (typeof definition === "object" &&
+        definition !== null &&
+        "name" in definition &&
+        typeof definition.name === "string" &&
+        definition.name.length > 0) {
+        return definition.name;
+    }
+    return fallback;
+}

package/dist/internal/discovery/agent-config.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `agent/agent.ts`: model, runtime architecture, working directory, hosting, and concurrency.
+ */
+import { type AgentArchitecture, type AgentConcurrencyOptions, type AgentConfigDefinition, type AgentHostingOptions, type AgentRuntime, type ModelSetting } from "../../types.js";
+import { type DiscoveryContext } from "./context.js";
+export declare function runtimeArchitectureCompatibilityError(agent: {
+    runtime: AgentRuntime;
+    architecture?: AgentArchitecture;
+}): string | undefined;
+export declare function resolveArchitecture(ctx: DiscoveryContext, agentDir: string, architecture: AgentArchitecture | undefined): AgentArchitecture | undefined;
+/** Absolute harness cwd parent, or undefined when unset / blank. */
+export declare function resolveAgentCwd(ctx: DiscoveryContext, authored: string | undefined): string | undefined;
+/**
+ * Nested git checkouts inherit ancestor AGENTS.md / .cursor rules and MCP.
+ * Point those harnesses at ~/.cache/agent-serve/<dir> unless the agent
+ * already set cwd or workspaceDir.
+ */
+export declare function resolveLocalCwd(ctx: DiscoveryContext, authoredCwd: string | undefined, authoredWorkspaceDir: string | undefined): Promise<string | undefined>;
+/**
+ * Validate the authored `hosting` block against the same grammar the
+ * backend enforces on deploy. Violations are warning diagnostics (reported
+ * by `agent-sdk validate`), not hard failures: the backend stays
+ * authoritative and `agent-sdk deploy` re-checks before any network call.
+ */
+export declare function resolveHosting(ctx: DiscoveryContext, agentDir: string, hosting: AgentHostingOptions | undefined): AgentHostingOptions | undefined;
+/**
+ * Validate the authored `concurrency` block. Invalid values are **error**
+ * diagnostics (serve refuses to start): silently dropping a turn ceiling
+ * would fail open to unlimited parallelism, the opposite of what the
+ * author asked for.
+ */
+export declare function resolveConcurrency(ctx: DiscoveryContext, agentDir: string, concurrency: AgentConcurrencyOptions | undefined): AgentConcurrencyOptions | undefined;
+export declare function loadAgentConfig(ctx: DiscoveryContext, agentDir: string, isRoot: boolean): Promise<AgentConfigDefinition | undefined>;
+export declare function isValidModelSetting(model: unknown): model is ModelSetting;
+//# sourceMappingURL=agent-config.d.ts.map

package/dist/internal/discovery/agent-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-config.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/agent-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EAEjB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,cAAc,CAAC;AAI3E,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC,GAAG,MAAM,GAAG,SAAS,CAIrB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,iBAAiB,GAAG,SAAS,GAC1C,iBAAiB,GAAG,SAAS,CAc/B;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,GAAG,SAAS,CASpB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAY7B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACvC,mBAAmB,GAAG,SAAS,CAyCjC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,uBAAuB,GAAG,SAAS,GAC/C,uBAAuB,GAAG,SAAS,CAmBrC;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CA4B5C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAUzE"}

package/dist/internal/discovery/agent-config.js

@@ -0,0 +1,173 @@
+/**
+ * `agent/agent.ts`: model, runtime architecture, working directory, hosting, and concurrency.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { basename, isAbsolute, join, resolve } from "node:path";
+import { MAX_RUNNING_TURNS_LIMIT, } from "../../types.js";
+import { normalizePositiveInt } from "../bounded-int.js";
+import { isReservedSecretName, MAX_EGRESS_DOMAINS, validateEgressDomain, validateSecretName, } from "../hosting.js";
+import { defaultLocalHarnessCwd, isNestedInGitRepo } from "../workspace.js";
+import { displayPath, isBlank } from "./context.js";
+import { findModuleFile } from "./fs.js";
+import { importDefault } from "./modules.js";
+export function runtimeArchitectureCompatibilityError(agent) {
+    return agent.architecture === "v2" && agent.runtime === "grokbot"
+        ? 'architecture: "v2" cannot use runtime: "grokbot": the grokbot runtime executes through the signed-in account\'s hosted /v0/grokbot box, not a deployment-scoped v2 runtime.'
+        : undefined;
+}
+export function resolveArchitecture(ctx, agentDir, architecture) {
+    if (architecture === undefined ||
+        architecture === "v1" ||
+        architecture === "v2") {
+        return architecture;
+    }
+    ctx.diagnostics.push({
+        severity: "error",
+        path: displayPath(ctx, join(agentDir, "agent.ts")),
+        message: `architecture must be "v1" or "v2"; got ${JSON.stringify(architecture)}.`,
+    });
+    return undefined;
+}
+/** Absolute harness cwd parent, or undefined when unset / blank. */
+export function resolveAgentCwd(ctx, authored) {
+    if (authored === undefined) {
+        return undefined;
+    }
+    const trimmed = authored.trim();
+    if (trimmed === "") {
+        return undefined;
+    }
+    return isAbsolute(trimmed) ? trimmed : resolve(ctx.rootDir, trimmed);
+}
+/**
+ * Nested git checkouts inherit ancestor AGENTS.md / .cursor rules and MCP.
+ * Point those harnesses at ~/.cache/agent-serve/<dir> unless the agent
+ * already set cwd or workspaceDir.
+ */
+export function resolveLocalCwd(ctx, authoredCwd, authoredWorkspaceDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const cwd = resolveAgentCwd(ctx, authoredCwd);
+        if (cwd !== undefined) {
+            return cwd;
+        }
+        if (resolveAgentCwd(ctx, authoredWorkspaceDir) !== undefined) {
+            return undefined;
+        }
+        if (!(yield isNestedInGitRepo(ctx.rootDir))) {
+            return undefined;
+        }
+        return defaultLocalHarnessCwd(basename(ctx.rootDir));
+    });
+}
+/**
+ * Validate the authored `hosting` block against the same grammar the
+ * backend enforces on deploy. Violations are warning diagnostics (reported
+ * by `agent-sdk validate`), not hard failures: the backend stays
+ * authoritative and `agent-sdk deploy` re-checks before any network call.
+ */
+export function resolveHosting(ctx, agentDir, hosting) {
+    var _a, _b;
+    if (hosting === undefined) {
+        return undefined;
+    }
+    const agentPath = displayPath(ctx, join(agentDir, "agent.ts"));
+    const warn = (message) => {
+        ctx.diagnostics.push({ severity: "warning", path: agentPath, message });
+    };
+    const egressDomains = (_a = hosting.egressDomains) !== null && _a !== void 0 ? _a : [];
+    for (const domain of egressDomains) {
+        const domainError = validateEgressDomain(domain);
+        if (domainError !== undefined) {
+            warn(`hosting.egressDomains: ${domainError}`);
+        }
+    }
+    if (egressDomains.length > MAX_EGRESS_DOMAINS) {
+        warn(`hosting.egressDomains lists ${egressDomains.length} domains; deploys are capped at ${MAX_EGRESS_DOMAINS}.`);
+    }
+    for (const name of (_b = hosting.secretNames) !== null && _b !== void 0 ? _b : []) {
+        const nameError = validateSecretName(name);
+        if (nameError !== undefined) {
+            warn(`hosting.secretNames: ${nameError}`);
+        }
+        else if (isReservedSecretName(name)) {
+            warn(`hosting.secretNames: ${JSON.stringify(name)} is platform-managed (CURSOR_* / reserved hosted-storage names); omit it from secretNames.`);
+        }
+    }
+    return Object.assign(Object.assign({}, (hosting.egressDomains === undefined
+        ? {}
+        : { egressDomains: [...hosting.egressDomains] })), (hosting.secretNames === undefined
+        ? {}
+        : { secretNames: [...hosting.secretNames] }));
+}
+/**
+ * Validate the authored `concurrency` block. Invalid values are **error**
+ * diagnostics (serve refuses to start): silently dropping a turn ceiling
+ * would fail open to unlimited parallelism, the opposite of what the
+ * author asked for.
+ */
+export function resolveConcurrency(ctx, agentDir, concurrency) {
+    if (concurrency === undefined || concurrency.maxRunningTurns === undefined) {
+        return undefined;
+    }
+    try {
+        return {
+            maxRunningTurns: normalizePositiveInt(concurrency.maxRunningTurns, {
+                label: "concurrency.maxRunningTurns",
+                max: MAX_RUNNING_TURNS_LIMIT,
+            }),
+        };
+    }
+    catch (error) {
+        ctx.diagnostics.push({
+            severity: "error",
+            path: displayPath(ctx, join(agentDir, "agent.ts")),
+            message: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+}
+export function loadAgentConfig(ctx, agentDir, isRoot) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const configPath = yield findModuleFile(agentDir, "agent");
+        if (configPath === undefined) {
+            ctx.diagnostics.push({
+                severity: "error",
+                path: displayPath(ctx, join(agentDir, "agent.ts")),
+                message: isRoot
+                    ? "agent.ts is required on the root agent: default-export defineAgent({ ... })"
+                    : "agent.ts is required on a subagent: default-export defineAgent({ description: ... })",
+            });
+            return undefined;
+        }
+        const definition = yield importDefault(ctx, configPath, "agent");
+        if (definition === undefined) {
+            return undefined;
+        }
+        const config = definition;
+        if (!isRoot && isBlank(config.description)) {
+            ctx.diagnostics.push({
+                severity: "error",
+                path: displayPath(ctx, configPath),
+                message: "Subagents require a description; the parent model reads it to decide when to delegate.",
+            });
+        }
+        return config;
+    });
+}
+export function isValidModelSetting(model) {
+    if (typeof model === "string") {
+        return model.trim() !== "";
+    }
+    return (typeof model === "object" &&
+        model !== null &&
+        typeof model.id === "string" &&
+        model.id.trim() !== "");
+}

package/dist/internal/discovery/agent.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Compile one `agent/` directory (and its subagents) into a {@link ResolvedAgent}.
+ */
+import { type ResolvedAgent } from "../../types.js";
+import { type DiscoveryContext } from "./context.js";
+export declare function loadAgent(ctx: DiscoveryContext, agentDir: string, options: {
+    name: string;
+    isRoot: boolean;
+}): Promise<ResolvedAgent>;
+export declare function warnUnknownSlots(ctx: DiscoveryContext, agentDir: string): Promise<void>;
+//# sourceMappingURL=agent.d.ts.map

package/dist/internal/discovery/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/agent.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAkBnE,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAelE,wBAAsB,SAAS,CAC7B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,aAAa,CAAC,CAyNxB;AAqDD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf"}