@cursor/july 0.1.101 → 0.1.103

package/dist/internal/cursor/bound-secret-file.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Destroying a hosted v2 task-bind secret file after its value is in
+ * `process.env`.
+ *
+ * The bind files under `/run/cursor/secrets/` are an IPC channel, not a
+ * credential store: the control plane cannot set another process's
+ * environment, so it drops the value on tmpfs and July copies it into
+ * `process.env` before anything authored runs. Once that copy succeeds the
+ * on-disk value is pure liability — authored agent code runs in this pod and
+ * can read any world-readable path.
+ *
+ * Unlink is preferred. It is not always available: pod-daemon writes the
+ * files as root, and removing a directory entry needs write permission on
+ * `/run/cursor/secrets`, which is root-owned. Making that directory writable
+ * by the guest is not the fix — untrusted guest code could then plant a
+ * symlink that the next root-side bind write would follow. The binder instead
+ * relaxes the two secret files themselves so the guest can truncate them, and
+ * this module falls back to a zero-length overwrite. Both readers treat an
+ * empty bind file as unsigned.
+ */
+/**
+ * What happened to a bind file. Only `readable` is a failure: the secret
+ * survived the consume and callers must not run authored code.
+ */
+export type BoundSecretFileDisposal = 
+/** Nothing recoverable was there — missing, empty, or unreadable already. */
+{
+    state: "absent";
+}
+/** Directory entry removed. */
+ | {
+    state: "unlinked";
+}
+/** Truncated to zero length and fsynced; an empty file remains. */
+ | {
+    state: "wiped";
+}
+/** Still recoverable by a later `readFile`. */
+ | {
+    state: "readable";
+    reason: string;
+};
+/**
+ * Whether a later `readFile` of this path could still recover a secret.
+ * A read failure counts as unrecoverable: this process just read the file
+ * during hydrate, so losing access to it means the content is gone.
+ */
+export declare function boundSecretFileIsReadable(path: string): boolean;
+/**
+ * Remove a bind file's contents from disk, preferring unlink over an empty
+ * leftover. Callers must have already copied the value into `process.env`:
+ * this is destructive and there is no second bind until the control plane
+ * rewrites the file before the next hosted request.
+ */
+export declare function destroyBoundSecretFile(path: string): BoundSecretFileDisposal;
+//# sourceMappingURL=bound-secret-file.d.ts.map

package/dist/internal/cursor/bound-secret-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-secret-file.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/bound-secret-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH;;;GAGG;AACH,MAAM,MAAM,uBAAuB;AACjC,6EAA6E;AAC3E;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE;AACrB,+BAA+B;GAC7B;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE;AACvB,mEAAmE;GACjE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE;AACpB,+CAA+C;GAC7C;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM/D;AAOD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAuC5E"}

package/dist/internal/cursor/bound-secret-file.js

@@ -0,0 +1,88 @@
+/**
+ * Destroying a hosted v2 task-bind secret file after its value is in
+ * `process.env`.
+ *
+ * The bind files under `/run/cursor/secrets/` are an IPC channel, not a
+ * credential store: the control plane cannot set another process's
+ * environment, so it drops the value on tmpfs and July copies it into
+ * `process.env` before anything authored runs. Once that copy succeeds the
+ * on-disk value is pure liability — authored agent code runs in this pod and
+ * can read any world-readable path.
+ *
+ * Unlink is preferred. It is not always available: pod-daemon writes the
+ * files as root, and removing a directory entry needs write permission on
+ * `/run/cursor/secrets`, which is root-owned. Making that directory writable
+ * by the guest is not the fix — untrusted guest code could then plant a
+ * symlink that the next root-side bind write would follow. The binder instead
+ * relaxes the two secret files themselves so the guest can truncate them, and
+ * this module falls back to a zero-length overwrite. Both readers treat an
+ * empty bind file as unsigned.
+ */
+import { closeSync, fsyncSync, ftruncateSync, openSync, readFileSync, unlinkSync, } from "node:fs";
+/**
+ * Whether a later `readFile` of this path could still recover a secret.
+ * A read failure counts as unrecoverable: this process just read the file
+ * during hydrate, so losing access to it means the content is gone.
+ */
+export function boundSecretFileIsReadable(path) {
+    try {
+        return readFileSync(path, "utf8").trim() !== "";
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function errorReason(error) {
+    const code = error === null || error === void 0 ? void 0 : error.code;
+    return typeof code === "string" ? code : "unknown";
+}
+/**
+ * Remove a bind file's contents from disk, preferring unlink over an empty
+ * leftover. Callers must have already copied the value into `process.env`:
+ * this is destructive and there is no second bind until the control plane
+ * rewrites the file before the next hosted request.
+ */
+export function destroyBoundSecretFile(path) {
+    if (!boundSecretFileIsReadable(path)) {
+        // Nothing recoverable, so nothing to fail over. Still try to clear the
+        // empty leftover: whether that succeeds does not change the disposal,
+        // because there is no secret here either way.
+        try {
+            unlinkSync(path);
+        }
+        catch (_a) {
+            // Already gone, or a directory the guest cannot write. Both are fine.
+        }
+        return { state: "absent" };
+    }
+    let unlinkReason;
+    try {
+        unlinkSync(path);
+        if (!boundSecretFileIsReadable(path)) {
+            return { state: "unlinked" };
+        }
+        unlinkReason = "recreated";
+    }
+    catch (error) {
+        unlinkReason = errorReason(error);
+    }
+    try {
+        const fd = openSync(path, "r+");
+        try {
+            ftruncateSync(fd, 0);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch (error) {
+        return {
+            state: "readable",
+            reason: `unlink ${unlinkReason}, truncate ${errorReason(error)}`,
+        };
+    }
+    return boundSecretFileIsReadable(path)
+        ? { state: "readable", reason: `unlink ${unlinkReason}, truncate no-op` }
+        : { state: "wiped" };
+}

package/dist/internal/cursor/credentials.d.ts

@@ -4,13 +4,16 @@
  * Exactly one kind of secret exists at runtime: a **personal Cursor user API
  * key**. Two ways to obtain it, one code path after that:
  *
- * - `agent-serve login` runs the same PKCE browser flow as `cursor-agent`
+ * - `agent-sdk login` runs the same PKCE browser flow as `cursor-agent`
  *   and Sand, then uses the short-lived session once to mint a named,
  *   dashboard-revocable user API key — only the key is stored.
  * - `CURSOR_API_KEY` (or `serve({ apiKey })`) wins over the stored key, so
  *   CI and hosted deployments stay env-driven.
  * - `CURSOR_API_KEY_FILE` (or the hosted default path) is next: freeze bind
- *   drops the key at task time without restarting July.
+ *   drops the key at task time without restarting July. On the hosted path
+ *   that file is consumed into `CURSOR_API_KEY` and destroyed before
+ *   anything authored runs, so this fallback is there for local,
+ *   self-hosted, and the unsigned window before the first bind.
  * - Stored `july login` is last. Same order for hosted and self-hosted:
  *   option → env → file → login.
  *
@@ -19,6 +22,7 @@
  * on demand from the API key (see `backend-client.ts`).
  */
 import { z } from "zod";
+import { type BoundSecretFileDisposal } from "./bound-secret-file.js";
 export declare const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
 export declare const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
 /**
@@ -65,9 +69,11 @@ export interface ResolvedApiKey {
 }
 /**
  * Hosted task-bind path. Not a secret: the snapshot may name this path.
- * The binder writes the key here after restore; July re-reads on each use.
- * Override with `CURSOR_API_KEY_FILE`. A missing file is unsigned — self-hosted
- * then uses `CURSOR_API_KEY` or stored login.
+ * The binder writes the key here after restore, and hosted admission /
+ * execution consume it into `process.env.CURSOR_API_KEY` and destroy the
+ * file before authored work — this is an IPC handoff, not a credential
+ * source July keeps reading. Override with `CURSOR_API_KEY_FILE`. A missing
+ * file is unsigned — self-hosted then uses `CURSOR_API_KEY` or stored login.
  */
 export declare const DEFAULT_CURSOR_API_KEY_FILE: string;
 /**
@@ -76,7 +82,35 @@ export declare const DEFAULT_CURSOR_API_KEY_FILE: string;
  * listens before the binder drops the key; self-hosted falls through to
  * env or login.
  */
+export declare function resolveCursorApiKeyFilePath(filePath?: string, env?: NodeJS.ProcessEnv): string;
 export declare function readApiKeyFromFile(filePath?: string): string | undefined;
+export type BoundCursorApiKeyConsumeResult = {
+    /** The file supplied `CURSOR_API_KEY` on this call. */
+    applied: boolean;
+    disposal: BoundSecretFileDisposal;
+};
+/**
+ * Copy the task-bind key file into `process.env.CURSOR_API_KEY`, then destroy
+ * the file.
+ *
+ * Hosted v2 cannot set another process's environment from the binder, so it
+ * drops a tmpfs file. Teaching every reader to open that file misses authored
+ * `process.env.CURSOR_API_KEY` and leaves a secret on disk. Hosted admission /
+ * execution call this once per request, next to the deployment-secrets
+ * consume: after it returns, env-only readers work and the key is no longer
+ * recoverable from disk. The control plane re-binds before the next request.
+ *
+ * The env write always happens before the destroy, never the other way round.
+ * An already-set `CURSOR_API_KEY` is not overwritten, but the file is still
+ * destroyed — env is the source, the file is only the handoff.
+ *
+ * A `readable` disposal means the secret survived; callers on the hosted path
+ * must fail the request rather than run authored code.
+ */
+export declare function consumeBoundCursorApiKey(options?: {
+    filePath?: string;
+    env?: NodeJS.ProcessEnv;
+}): BoundCursorApiKeyConsumeResult;
 /**
  * First present source wins. We define the order; operators do not.
  * `--api-key` / `serve({ apiKey })` → `CURSOR_API_KEY` → `CURSOR_API_KEY_FILE`

package/dist/internal/cursor/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAGxE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAqBD,wBAAgB,yBAAyB,IAAI,iBAAiB,GAAG,SAAS,CAQzE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAQA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MACJ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYxE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,cAAc,GAAG,SAAS,CAkB7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEtC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAAoH,CAAC;AAQhJ,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAGxE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAqBD,wBAAgB,yBAAyB,IAAI,iBAAiB,GAAG,SAAS,CAQzE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAQA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,MACJ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAKR;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxE;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,uBAAuB,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,8BAA8B,CAqBjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,cAAc,GAAG,SAAS,CAkB7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEtC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAAoH,CAAC;AAQhJ,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}

package/dist/internal/cursor/credentials.js

@@ -4,13 +4,16 @@
  * Exactly one kind of secret exists at runtime: a **personal Cursor user API
  * key**. Two ways to obtain it, one code path after that:
  *
- * - `agent-serve login` runs the same PKCE browser flow as `cursor-agent`
+ * - `agent-sdk login` runs the same PKCE browser flow as `cursor-agent`
  *   and Sand, then uses the short-lived session once to mint a named,
  *   dashboard-revocable user API key — only the key is stored.
  * - `CURSOR_API_KEY` (or `serve({ apiKey })`) wins over the stored key, so
  *   CI and hosted deployments stay env-driven.
  * - `CURSOR_API_KEY_FILE` (or the hosted default path) is next: freeze bind
- *   drops the key at task time without restarting July.
+ *   drops the key at task time without restarting July. On the hosted path
+ *   that file is consumed into `CURSOR_API_KEY` and destroyed before
+ *   anything authored runs, so this fallback is there for local,
+ *   self-hosted, and the unsigned window before the first bind.
  * - Stored `july login` is last. Same order for hosted and self-hosted:
  *   option → env → file → login.
  *
@@ -34,6 +37,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { z } from "zod";
 import { CLI_COMMAND_NAME } from "../distribution.js";
+import { destroyBoundSecretFile, } from "./bound-secret-file.js";
 export const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
 export const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
 const DEFAULT_CURSOR_WEBSITE_URL = "https://cursor.com";
@@ -152,9 +156,11 @@ export function clearStoredCredentials() {
 }
 /**
  * Hosted task-bind path. Not a secret: the snapshot may name this path.
- * The binder writes the key here after restore; July re-reads on each use.
- * Override with `CURSOR_API_KEY_FILE`. A missing file is unsigned — self-hosted
- * then uses `CURSOR_API_KEY` or stored login.
+ * The binder writes the key here after restore, and hosted admission /
+ * execution consume it into `process.env.CURSOR_API_KEY` and destroy the
+ * file before authored work — this is an IPC handoff, not a credential
+ * source July keeps reading. Override with `CURSOR_API_KEY_FILE`. A missing
+ * file is unsigned — self-hosted then uses `CURSOR_API_KEY` or stored login.
  */
 export const DEFAULT_CURSOR_API_KEY_FILE = "/run/cursor/secrets/CURSOR_API_KEY";
 /**
@@ -163,11 +169,14 @@ export const DEFAULT_CURSOR_API_KEY_FILE = "/run/cursor/secrets/CURSOR_API_KEY";
  * listens before the binder drops the key; self-hosted falls through to
  * env or login.
  */
-export function readApiKeyFromFile(filePath) {
-    const configured = filePath !== null && filePath !== void 0 ? filePath : process.env.CURSOR_API_KEY_FILE;
-    const path = configured !== undefined && configured.trim() !== ""
+export function resolveCursorApiKeyFilePath(filePath, env = process.env) {
+    const configured = filePath !== null && filePath !== void 0 ? filePath : env.CURSOR_API_KEY_FILE;
+    return configured !== undefined && configured.trim() !== ""
         ? configured.trim()
         : DEFAULT_CURSOR_API_KEY_FILE;
+}
+export function readApiKeyFromFile(filePath) {
+    const path = resolveCursorApiKeyFilePath(filePath);
     try {
         const raw = readFileSync(path, "utf8").trim();
         return raw === "" ? undefined : raw;
@@ -176,6 +185,47 @@ export function readApiKeyFromFile(filePath) {
         return undefined;
     }
 }
+/**
+ * Copy the task-bind key file into `process.env.CURSOR_API_KEY`, then destroy
+ * the file.
+ *
+ * Hosted v2 cannot set another process's environment from the binder, so it
+ * drops a tmpfs file. Teaching every reader to open that file misses authored
+ * `process.env.CURSOR_API_KEY` and leaves a secret on disk. Hosted admission /
+ * execution call this once per request, next to the deployment-secrets
+ * consume: after it returns, env-only readers work and the key is no longer
+ * recoverable from disk. The control plane re-binds before the next request.
+ *
+ * The env write always happens before the destroy, never the other way round.
+ * An already-set `CURSOR_API_KEY` is not overwritten, but the file is still
+ * destroyed — env is the source, the file is only the handoff.
+ *
+ * A `readable` disposal means the secret survived; callers on the hosted path
+ * must fail the request rather than run authored code.
+ */
+export function consumeBoundCursorApiKey(options) {
+    var _a;
+    const env = (_a = options === null || options === void 0 ? void 0 : options.env) !== null && _a !== void 0 ? _a : process.env;
+    const path = resolveCursorApiKeyFilePath(options === null || options === void 0 ? void 0 : options.filePath, env);
+    const envKeyAlreadySet = env.CURSOR_API_KEY !== undefined && env.CURSOR_API_KEY.trim() !== "";
+    let raw = "";
+    try {
+        raw = readFileSync(path, "utf8").trim();
+    }
+    catch (_b) {
+        return { applied: false, disposal: { state: "absent" } };
+    }
+    if (raw === "") {
+        return { applied: false, disposal: destroyBoundSecretFile(path) };
+    }
+    if (!envKeyAlreadySet) {
+        env.CURSOR_API_KEY = raw;
+    }
+    return {
+        applied: !envKeyAlreadySet,
+        disposal: destroyBoundSecretFile(path),
+    };
+}
 /**
  * First present source wins. We define the order; operators do not.
  * `--api-key` / `serve({ apiKey })` → `CURSOR_API_KEY` → `CURSOR_API_KEY_FILE`

package/dist/internal/cursor/hosted-bound-secrets.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The hosted v2 per-request secret handoff: bind files in, `process.env` out,
+ * nothing recoverable left on disk.
+ *
+ * The control plane rewrites `/run/cursor/secrets/` before every hosted
+ * admission and execution because it cannot set the already-running July
+ * process's environment. This module closes that handoff at the top of each
+ * request: copy both documents into `process.env`, then destroy them. Hosted
+ * request code and authored agents read env from there on — nothing on the
+ * hosted path should open these paths again.
+ *
+ * It fails closed. A secret that survives the consume would sit world-readable
+ * next to authored agent code for the length of a turn, so the caller returns
+ * a retryable error instead of dispatching. The next request re-binds and
+ * consumes again.
+ */
+/** Wire error code for a bind file that outlived its consume. */
+export declare const BOUND_SECRETS_NOT_CONSUMED = "bound_secrets_not_consumed";
+export type HostedBoundSecretsResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: typeof BOUND_SECRETS_NOT_CONSUMED;
+    message: string;
+};
+/**
+ * Hydrate `process.env` from both bind files and remove them from disk.
+ * Returns a failure when either secret is still readable afterwards.
+ *
+ * Both paths are platform constants, deliberately not the `CURSOR_API_KEY_FILE`
+ * override that {@link resolveApiKeySync} honors. That override is a read
+ * chain; this is a destructive consume. Following it here would let authored
+ * code redirect the destroy at a decoy path — reporting success while the real
+ * bind file stays live — and would delete an operator's own long-lived key
+ * file on a surface that points the variable at one.
+ */
+export declare function consumeHostedBoundSecrets(options?: {
+    apiKeyFilePath?: string;
+    deploymentSecretsFilePath?: string;
+}): HostedBoundSecretsResult;
+//# sourceMappingURL=hosted-bound-secrets.d.ts.map

package/dist/internal/cursor/hosted-bound-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-bound-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-bound-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,0BAA0B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,GAAG,wBAAwB,CA2B3B"}

package/dist/internal/cursor/hosted-bound-secrets.js

@@ -0,0 +1,54 @@
+/**
+ * The hosted v2 per-request secret handoff: bind files in, `process.env` out,
+ * nothing recoverable left on disk.
+ *
+ * The control plane rewrites `/run/cursor/secrets/` before every hosted
+ * admission and execution because it cannot set the already-running July
+ * process's environment. This module closes that handoff at the top of each
+ * request: copy both documents into `process.env`, then destroy them. Hosted
+ * request code and authored agents read env from there on — nothing on the
+ * hosted path should open these paths again.
+ *
+ * It fails closed. A secret that survives the consume would sit world-readable
+ * next to authored agent code for the length of a turn, so the caller returns
+ * a retryable error instead of dispatching. The next request re-binds and
+ * consumes again.
+ */
+import { consumeBoundCursorApiKey, DEFAULT_CURSOR_API_KEY_FILE, } from "./credentials.js";
+import { consumeBoundDeploymentSecrets, DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE, } from "./hosted-deployment-secrets.js";
+/** Wire error code for a bind file that outlived its consume. */
+export const BOUND_SECRETS_NOT_CONSUMED = "bound_secrets_not_consumed";
+/**
+ * Hydrate `process.env` from both bind files and remove them from disk.
+ * Returns a failure when either secret is still readable afterwards.
+ *
+ * Both paths are platform constants, deliberately not the `CURSOR_API_KEY_FILE`
+ * override that {@link resolveApiKeySync} honors. That override is a read
+ * chain; this is a destructive consume. Following it here would let authored
+ * code redirect the destroy at a decoy path — reporting success while the real
+ * bind file stays live — and would delete an operator's own long-lived key
+ * file on a surface that points the variable at one.
+ */
+export function consumeHostedBoundSecrets(options) {
+    var _a, _b;
+    const survivors = [];
+    const secretsPath = (_a = options === null || options === void 0 ? void 0 : options.deploymentSecretsFilePath) !== null && _a !== void 0 ? _a : DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE;
+    const secrets = consumeBoundDeploymentSecrets(secretsPath);
+    if (secrets.disposal.state === "readable") {
+        survivors.push(`${secretsPath} (${secrets.disposal.reason})`);
+    }
+    const apiKeyPath = (_b = options === null || options === void 0 ? void 0 : options.apiKeyFilePath) !== null && _b !== void 0 ? _b : DEFAULT_CURSOR_API_KEY_FILE;
+    const apiKey = consumeBoundCursorApiKey({ filePath: apiKeyPath });
+    if (apiKey.disposal.state === "readable") {
+        survivors.push(`${apiKeyPath} (${apiKey.disposal.reason})`);
+    }
+    if (survivors.length === 0) {
+        return { ok: true };
+    }
+    return {
+        ok: false,
+        code: BOUND_SECRETS_NOT_CONSUMED,
+        message: `Task-bind secrets are still readable after being hydrated into the ` +
+            `environment, so authored work did not run: ${survivors.join(", ")}.`,
+    };
+}

package/dist/internal/cursor/hosted-deployment-secrets.d.ts

@@ -4,13 +4,27 @@
  * The deployment host rewrites this tmpfs document before each admission and
  * execution request. July reloads it synchronously because the process was
  * already running in the frozen snapshot when the task-specific values
- * arrived.
+ * arrived, then destroys the document: `process.env` is the source authored
+ * code reads, and the file is only how the value crossed the process
+ * boundary.
  */
+import { type BoundSecretFileDisposal } from "./bound-secret-file.js";
 export declare const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+export type BoundDeploymentSecretsConsumeResult = {
+    /** The document supplied values on this call. */
+    applied: boolean;
+    disposal: BoundSecretFileDisposal;
+};
 /**
- * Refresh `process.env` from the latest bound document. A missing or malformed
- * file is a no-op; an empty valid document removes values loaded by an earlier
- * bind after the deployment secret was unset.
+ * Apply the bound document to `process.env`, then destroy it.
+ *
+ * The env refresh always runs first, so a failed destroy never costs the
+ * request its secrets. A malformed document is destroyed too: it carries no
+ * values this process can use, and leaving it on disk only leaves whatever
+ * the control plane did manage to write.
+ *
+ * A `readable` disposal means the document survived; hosted callers must fail
+ * the request rather than run authored code next to a live secrets file.
  */
-export declare function refreshBoundDeploymentSecrets(path?: string): void;
+export declare function consumeBoundDeploymentSecrets(path?: string): BoundDeploymentSecretsConsumeResult;
 //# sourceMappingURL=hosted-deployment-secrets.d.ts.map

package/dist/internal/cursor/hosted-deployment-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAqC5D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,IAAI,CAeN"}
+{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAuD5D,MAAM,MAAM,mCAAmC,GAAG;IAChD,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,uBAAuB,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,mCAAmC,CASrC"}

package/dist/internal/cursor/hosted-deployment-secrets.js

@@ -4,9 +4,12 @@
  * The deployment host rewrites this tmpfs document before each admission and
  * execution request. July reloads it synchronously because the process was
  * already running in the frozen snapshot when the task-specific values
- * arrived.
+ * arrived, then destroys the document: `process.env` is the source authored
+ * code reads, and the file is only how the value crossed the process
+ * boundary.
  */
 import { readFileSync } from "node:fs";
+import { destroyBoundSecretFile, } from "./bound-secret-file.js";
 export const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
 const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 const appliedSecretNames = new Set();
@@ -39,15 +42,11 @@ function parseBoundSecrets(path) {
     return secrets;
 }
 /**
- * Refresh `process.env` from the latest bound document. A missing or malformed
- * file is a no-op; an empty valid document removes values loaded by an earlier
- * bind after the deployment secret was unset.
+ * Apply the latest bound document to `process.env`. An empty valid document
+ * removes values loaded by an earlier bind after the deployment secret was
+ * unset, which is why the applied names are tracked across calls.
  */
-export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
-    const secrets = parseBoundSecrets(path);
-    if (secrets === undefined) {
-        return;
-    }
+function applyBoundSecrets(secrets) {
     for (const name of appliedSecretNames) {
         if (!(name in secrets)) {
             delete process.env[name];
@@ -59,3 +58,24 @@ export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYM
         appliedSecretNames.add(name);
     }
 }
+/**
+ * Apply the bound document to `process.env`, then destroy it.
+ *
+ * The env refresh always runs first, so a failed destroy never costs the
+ * request its secrets. A malformed document is destroyed too: it carries no
+ * values this process can use, and leaving it on disk only leaves whatever
+ * the control plane did manage to write.
+ *
+ * A `readable` disposal means the document survived; hosted callers must fail
+ * the request rather than run authored code next to a live secrets file.
+ */
+export function consumeBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
+    const secrets = parseBoundSecrets(path);
+    if (secrets !== undefined) {
+        applyBoundSecrets(secrets);
+    }
+    return {
+        applied: secrets !== undefined,
+        disposal: destroyBoundSecretFile(path),
+    };
+}

package/dist/internal/cursor/hosted-store-secrets.d.ts

@@ -1,7 +1,7 @@
 /**
  * Task-time bind paths for hosted deployment file-store source ids.
  *
- * Freeze v2 snapshots start `agent-serve serve` at bake time without a service
+ * Freeze v2 snapshots start `agent-sdk serve` at bake time without a service
  * account, so neither store id is in process env. Execute-from-freeze binds
  * the deployment credential and store ids into `/run/cursor/secrets/` without
  * restarting July — the same pattern as {@link DEFAULT_CURSOR_API_KEY_FILE}.
@@ -12,4 +12,15 @@ export declare const DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE = "/run/
 export declare function resolveDeploymentStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
 /** Engine framework store: env, then task-bind file. */
 export declare function resolveFrameworkStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
+export type CursorManagedV2StoreIds = {
+    deploymentStoreSourceId: string;
+    frameworkStoreSourceId: string;
+};
+/**
+ * Resolve the complete managed-v2 store identity at the process boundary.
+ *
+ * Freeze snapshots construct storage before task bind, so callers keep this
+ * resolver lazy. Once an operation needs storage, both ids are mandatory.
+ */
+export declare function requireCursorManagedV2StoreIdsSync(env?: NodeJS.ProcessEnv): CursorManagedV2StoreIds;
 //# sourceMappingURL=hosted-store-secrets.d.ts.map

package/dist/internal/cursor/hosted-store-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AA4B9D,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB"}
+{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AA4B9D,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,CAYzB"}

package/dist/internal/cursor/hosted-store-secrets.js

@@ -1,7 +1,7 @@
 /**
  * Task-time bind paths for hosted deployment file-store source ids.
  *
- * Freeze v2 snapshots start `agent-serve serve` at bake time without a service
+ * Freeze v2 snapshots start `agent-sdk serve` at bake time without a service
  * account, so neither store id is in process env. Execute-from-freeze binds
  * the deployment credential and store ids into `/run/cursor/secrets/` without
  * restarting July — the same pattern as {@link DEFAULT_CURSOR_API_KEY_FILE}.
@@ -46,3 +46,18 @@ export function resolveFrameworkStoreSourceIdSync(env = process.env) {
     }
     return readBoundSecretFile(FRAMEWORK_STORE_SOURCE_ID_FILE_ENV, DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE, env);
 }
+/**
+ * Resolve the complete managed-v2 store identity at the process boundary.
+ *
+ * Freeze snapshots construct storage before task bind, so callers keep this
+ * resolver lazy. Once an operation needs storage, both ids are mandatory.
+ */
+export function requireCursorManagedV2StoreIdsSync(env = process.env) {
+    const deploymentStoreSourceId = resolveDeploymentStoreSourceIdSync(env);
+    const frameworkStoreSourceId = resolveFrameworkStoreSourceIdSync(env);
+    if (deploymentStoreSourceId === undefined ||
+        frameworkStoreSourceId === undefined) {
+        throw new Error("Cursor-managed AgentSDK v2 requires AGENT_SERVE_STORE_SOURCE_ID and AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID");
+    }
+    return { deploymentStoreSourceId, frameworkStoreSourceId };
+}

package/dist/internal/cursor-account-mcp-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-account-mcp-auth.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-account-mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,4BAA4B,CAAC;AAOpC,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,MAAM,WAAW,oCAAoC;IACnD,aAAa,EAAE,IAAI,CACjB,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kBAAkB;IAClB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sCAAsC;IACrD,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAMD;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,oCAAoC,GACzC,OAAO,CAAC,sCAAsC,CAAC,CA8FjD;AA2DD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0C/B"}
+{"version":3,"file":"cursor-account-mcp-auth.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-account-mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,4BAA4B,CAAC;AAQpC,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,MAAM,WAAW,oCAAoC;IACnD,aAAa,EAAE,IAAI,CACjB,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kBAAkB;IAClB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sCAAsC;IACrD,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,oCAAoC,GACzC,OAAO,CAAC,sCAAsC,CAAC,CA8FjD;AA2DD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0C/B"}

package/dist/internal/cursor-account-mcp-auth.js

@@ -23,6 +23,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { LOG_PREFIX } from "./distribution.js";
 import { openBrowser } from "./mcp-oauth.js";
+import { sleep as defaultSleep } from "./sleep.js";
 const DEFAULT_POLL_INTERVAL_MS = 3000;
 const DEFAULT_POLL_TIMEOUT_MS = 5 * 60 * 1000;
 /** Same default the dashboard uses; MCP_OAUTH_REDIRECT_URI overrides for dev. */
@@ -33,9 +34,6 @@ export function mcpOauthRedirectUri() {
     }
     return "https://www.cursor.com/agents/mcp/oauth/callback";
 }
-function sleepMs(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 /**
  * Authorize the deployment service account for the connection's connectors.
  * Already-authorized connectors are skipped; the rest get a browser OAuth
@@ -46,7 +44,7 @@ export function authorizeCursorAccountConnectors(args) {
         var _a, _b, _c, _d, _e, _f;
         const { backendClient, teamId, serviceAccountId, connectionName, out, err } = args;
         const open = (_a = args.openBrowserImpl) !== null && _a !== void 0 ? _a : openBrowser;
-        const sleep = (_b = args.sleep) !== null && _b !== void 0 ? _b : sleepMs;
+        const sleep = (_b = args.sleep) !== null && _b !== void 0 ? _b : defaultSleep;
         const pollIntervalMs = (_c = args.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS;
         const pollTimeoutMs = (_d = args.pollTimeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_POLL_TIMEOUT_MS;
         const redirectUri = mcpOauthRedirectUri();