@cursor/july 0.1.102 → 0.1.103

package/dist/internal/cursor/credentials.d.ts

@@ -4,13 +4,16 @@
  * Exactly one kind of secret exists at runtime: a **personal Cursor user API
  * key**. Two ways to obtain it, one code path after that:
  *
- * - `agent-serve login` runs the same PKCE browser flow as `cursor-agent`
+ * - `agent-sdk login` runs the same PKCE browser flow as `cursor-agent`
  *   and Sand, then uses the short-lived session once to mint a named,
  *   dashboard-revocable user API key — only the key is stored.
  * - `CURSOR_API_KEY` (or `serve({ apiKey })`) wins over the stored key, so
  *   CI and hosted deployments stay env-driven.
  * - `CURSOR_API_KEY_FILE` (or the hosted default path) is next: freeze bind
- *   drops the key at task time without restarting July.
+ *   drops the key at task time without restarting July. On the hosted path
+ *   that file is consumed into `CURSOR_API_KEY` and destroyed before
+ *   anything authored runs, so this fallback is there for local,
+ *   self-hosted, and the unsigned window before the first bind.
  * - Stored `july login` is last. Same order for hosted and self-hosted:
  *   option → env → file → login.
  *
@@ -19,6 +22,7 @@
  * on demand from the API key (see `backend-client.ts`).
  */
 import { z } from "zod";
+import { type BoundSecretFileDisposal } from "./bound-secret-file.js";
 export declare const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
 export declare const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
 /**
@@ -65,9 +69,11 @@ export interface ResolvedApiKey {
 }
 /**
  * Hosted task-bind path. Not a secret: the snapshot may name this path.
- * The binder writes the key here after restore; July re-reads on each use.
- * Override with `CURSOR_API_KEY_FILE`. A missing file is unsigned — self-hosted
- * then uses `CURSOR_API_KEY` or stored login.
+ * The binder writes the key here after restore, and hosted admission /
+ * execution consume it into `process.env.CURSOR_API_KEY` and destroy the
+ * file before authored work — this is an IPC handoff, not a credential
+ * source July keeps reading. Override with `CURSOR_API_KEY_FILE`. A missing
+ * file is unsigned — self-hosted then uses `CURSOR_API_KEY` or stored login.
  */
 export declare const DEFAULT_CURSOR_API_KEY_FILE: string;
 /**
@@ -76,7 +82,35 @@ export declare const DEFAULT_CURSOR_API_KEY_FILE: string;
  * listens before the binder drops the key; self-hosted falls through to
  * env or login.
  */
+export declare function resolveCursorApiKeyFilePath(filePath?: string, env?: NodeJS.ProcessEnv): string;
 export declare function readApiKeyFromFile(filePath?: string): string | undefined;
+export type BoundCursorApiKeyConsumeResult = {
+    /** The file supplied `CURSOR_API_KEY` on this call. */
+    applied: boolean;
+    disposal: BoundSecretFileDisposal;
+};
+/**
+ * Copy the task-bind key file into `process.env.CURSOR_API_KEY`, then destroy
+ * the file.
+ *
+ * Hosted v2 cannot set another process's environment from the binder, so it
+ * drops a tmpfs file. Teaching every reader to open that file misses authored
+ * `process.env.CURSOR_API_KEY` and leaves a secret on disk. Hosted admission /
+ * execution call this once per request, next to the deployment-secrets
+ * consume: after it returns, env-only readers work and the key is no longer
+ * recoverable from disk. The control plane re-binds before the next request.
+ *
+ * The env write always happens before the destroy, never the other way round.
+ * An already-set `CURSOR_API_KEY` is not overwritten, but the file is still
+ * destroyed — env is the source, the file is only the handoff.
+ *
+ * A `readable` disposal means the secret survived; callers on the hosted path
+ * must fail the request rather than run authored code.
+ */
+export declare function consumeBoundCursorApiKey(options?: {
+    filePath?: string;
+    env?: NodeJS.ProcessEnv;
+}): BoundCursorApiKeyConsumeResult;
 /**
  * First present source wins. We define the order; operators do not.
  * `--api-key` / `serve({ apiKey })` → `CURSOR_API_KEY` → `CURSOR_API_KEY_FILE`

package/dist/internal/cursor/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAGxE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAqBD,wBAAgB,yBAAyB,IAAI,iBAAiB,GAAG,SAAS,CAQzE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAQA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MACJ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYxE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,cAAc,GAAG,SAAS,CAkB7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEtC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAAoH,CAAC;AAQhJ,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAGxE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAqBD,wBAAgB,yBAAyB,IAAI,iBAAiB,GAAG,SAAS,CAQzE;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAQA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,MACJ,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAKR;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxE;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,uBAAuB,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,8BAA8B,CAqBjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,cAAc,GAAG,SAAS,CAkB7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEtC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAAoH,CAAC;AAQhJ,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}

package/dist/internal/cursor/credentials.js

@@ -4,13 +4,16 @@
  * Exactly one kind of secret exists at runtime: a **personal Cursor user API
  * key**. Two ways to obtain it, one code path after that:
  *
- * - `agent-serve login` runs the same PKCE browser flow as `cursor-agent`
+ * - `agent-sdk login` runs the same PKCE browser flow as `cursor-agent`
  *   and Sand, then uses the short-lived session once to mint a named,
  *   dashboard-revocable user API key — only the key is stored.
  * - `CURSOR_API_KEY` (or `serve({ apiKey })`) wins over the stored key, so
  *   CI and hosted deployments stay env-driven.
  * - `CURSOR_API_KEY_FILE` (or the hosted default path) is next: freeze bind
- *   drops the key at task time without restarting July.
+ *   drops the key at task time without restarting July. On the hosted path
+ *   that file is consumed into `CURSOR_API_KEY` and destroyed before
+ *   anything authored runs, so this fallback is there for local,
+ *   self-hosted, and the unsigned window before the first bind.
  * - Stored `july login` is last. Same order for hosted and self-hosted:
  *   option → env → file → login.
  *
@@ -34,6 +37,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { z } from "zod";
 import { CLI_COMMAND_NAME } from "../distribution.js";
+import { destroyBoundSecretFile, } from "./bound-secret-file.js";
 export const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
 export const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
 const DEFAULT_CURSOR_WEBSITE_URL = "https://cursor.com";
@@ -152,9 +156,11 @@ export function clearStoredCredentials() {
 }
 /**
  * Hosted task-bind path. Not a secret: the snapshot may name this path.
- * The binder writes the key here after restore; July re-reads on each use.
- * Override with `CURSOR_API_KEY_FILE`. A missing file is unsigned — self-hosted
- * then uses `CURSOR_API_KEY` or stored login.
+ * The binder writes the key here after restore, and hosted admission /
+ * execution consume it into `process.env.CURSOR_API_KEY` and destroy the
+ * file before authored work — this is an IPC handoff, not a credential
+ * source July keeps reading. Override with `CURSOR_API_KEY_FILE`. A missing
+ * file is unsigned — self-hosted then uses `CURSOR_API_KEY` or stored login.
  */
 export const DEFAULT_CURSOR_API_KEY_FILE = "/run/cursor/secrets/CURSOR_API_KEY";
 /**
@@ -163,11 +169,14 @@ export const DEFAULT_CURSOR_API_KEY_FILE = "/run/cursor/secrets/CURSOR_API_KEY";
  * listens before the binder drops the key; self-hosted falls through to
  * env or login.
  */
-export function readApiKeyFromFile(filePath) {
-    const configured = filePath !== null && filePath !== void 0 ? filePath : process.env.CURSOR_API_KEY_FILE;
-    const path = configured !== undefined && configured.trim() !== ""
+export function resolveCursorApiKeyFilePath(filePath, env = process.env) {
+    const configured = filePath !== null && filePath !== void 0 ? filePath : env.CURSOR_API_KEY_FILE;
+    return configured !== undefined && configured.trim() !== ""
         ? configured.trim()
         : DEFAULT_CURSOR_API_KEY_FILE;
+}
+export function readApiKeyFromFile(filePath) {
+    const path = resolveCursorApiKeyFilePath(filePath);
     try {
         const raw = readFileSync(path, "utf8").trim();
         return raw === "" ? undefined : raw;
@@ -176,6 +185,47 @@ export function readApiKeyFromFile(filePath) {
         return undefined;
     }
 }
+/**
+ * Copy the task-bind key file into `process.env.CURSOR_API_KEY`, then destroy
+ * the file.
+ *
+ * Hosted v2 cannot set another process's environment from the binder, so it
+ * drops a tmpfs file. Teaching every reader to open that file misses authored
+ * `process.env.CURSOR_API_KEY` and leaves a secret on disk. Hosted admission /
+ * execution call this once per request, next to the deployment-secrets
+ * consume: after it returns, env-only readers work and the key is no longer
+ * recoverable from disk. The control plane re-binds before the next request.
+ *
+ * The env write always happens before the destroy, never the other way round.
+ * An already-set `CURSOR_API_KEY` is not overwritten, but the file is still
+ * destroyed — env is the source, the file is only the handoff.
+ *
+ * A `readable` disposal means the secret survived; callers on the hosted path
+ * must fail the request rather than run authored code.
+ */
+export function consumeBoundCursorApiKey(options) {
+    var _a;
+    const env = (_a = options === null || options === void 0 ? void 0 : options.env) !== null && _a !== void 0 ? _a : process.env;
+    const path = resolveCursorApiKeyFilePath(options === null || options === void 0 ? void 0 : options.filePath, env);
+    const envKeyAlreadySet = env.CURSOR_API_KEY !== undefined && env.CURSOR_API_KEY.trim() !== "";
+    let raw = "";
+    try {
+        raw = readFileSync(path, "utf8").trim();
+    }
+    catch (_b) {
+        return { applied: false, disposal: { state: "absent" } };
+    }
+    if (raw === "") {
+        return { applied: false, disposal: destroyBoundSecretFile(path) };
+    }
+    if (!envKeyAlreadySet) {
+        env.CURSOR_API_KEY = raw;
+    }
+    return {
+        applied: !envKeyAlreadySet,
+        disposal: destroyBoundSecretFile(path),
+    };
+}
 /**
  * First present source wins. We define the order; operators do not.
  * `--api-key` / `serve({ apiKey })` → `CURSOR_API_KEY` → `CURSOR_API_KEY_FILE`

package/dist/internal/cursor/hosted-bound-secrets.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The hosted v2 per-request secret handoff: bind files in, `process.env` out,
+ * nothing recoverable left on disk.
+ *
+ * The control plane rewrites `/run/cursor/secrets/` before every hosted
+ * admission and execution because it cannot set the already-running July
+ * process's environment. This module closes that handoff at the top of each
+ * request: copy both documents into `process.env`, then destroy them. Hosted
+ * request code and authored agents read env from there on — nothing on the
+ * hosted path should open these paths again.
+ *
+ * It fails closed. A secret that survives the consume would sit world-readable
+ * next to authored agent code for the length of a turn, so the caller returns
+ * a retryable error instead of dispatching. The next request re-binds and
+ * consumes again.
+ */
+/** Wire error code for a bind file that outlived its consume. */
+export declare const BOUND_SECRETS_NOT_CONSUMED = "bound_secrets_not_consumed";
+export type HostedBoundSecretsResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: typeof BOUND_SECRETS_NOT_CONSUMED;
+    message: string;
+};
+/**
+ * Hydrate `process.env` from both bind files and remove them from disk.
+ * Returns a failure when either secret is still readable afterwards.
+ *
+ * Both paths are platform constants, deliberately not the `CURSOR_API_KEY_FILE`
+ * override that {@link resolveApiKeySync} honors. That override is a read
+ * chain; this is a destructive consume. Following it here would let authored
+ * code redirect the destroy at a decoy path — reporting success while the real
+ * bind file stays live — and would delete an operator's own long-lived key
+ * file on a surface that points the variable at one.
+ */
+export declare function consumeHostedBoundSecrets(options?: {
+    apiKeyFilePath?: string;
+    deploymentSecretsFilePath?: string;
+}): HostedBoundSecretsResult;
+//# sourceMappingURL=hosted-bound-secrets.d.ts.map

package/dist/internal/cursor/hosted-bound-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-bound-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-bound-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,0BAA0B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,GAAG,wBAAwB,CA2B3B"}

package/dist/internal/cursor/hosted-bound-secrets.js

@@ -0,0 +1,54 @@
+/**
+ * The hosted v2 per-request secret handoff: bind files in, `process.env` out,
+ * nothing recoverable left on disk.
+ *
+ * The control plane rewrites `/run/cursor/secrets/` before every hosted
+ * admission and execution because it cannot set the already-running July
+ * process's environment. This module closes that handoff at the top of each
+ * request: copy both documents into `process.env`, then destroy them. Hosted
+ * request code and authored agents read env from there on — nothing on the
+ * hosted path should open these paths again.
+ *
+ * It fails closed. A secret that survives the consume would sit world-readable
+ * next to authored agent code for the length of a turn, so the caller returns
+ * a retryable error instead of dispatching. The next request re-binds and
+ * consumes again.
+ */
+import { consumeBoundCursorApiKey, DEFAULT_CURSOR_API_KEY_FILE, } from "./credentials.js";
+import { consumeBoundDeploymentSecrets, DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE, } from "./hosted-deployment-secrets.js";
+/** Wire error code for a bind file that outlived its consume. */
+export const BOUND_SECRETS_NOT_CONSUMED = "bound_secrets_not_consumed";
+/**
+ * Hydrate `process.env` from both bind files and remove them from disk.
+ * Returns a failure when either secret is still readable afterwards.
+ *
+ * Both paths are platform constants, deliberately not the `CURSOR_API_KEY_FILE`
+ * override that {@link resolveApiKeySync} honors. That override is a read
+ * chain; this is a destructive consume. Following it here would let authored
+ * code redirect the destroy at a decoy path — reporting success while the real
+ * bind file stays live — and would delete an operator's own long-lived key
+ * file on a surface that points the variable at one.
+ */
+export function consumeHostedBoundSecrets(options) {
+    var _a, _b;
+    const survivors = [];
+    const secretsPath = (_a = options === null || options === void 0 ? void 0 : options.deploymentSecretsFilePath) !== null && _a !== void 0 ? _a : DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE;
+    const secrets = consumeBoundDeploymentSecrets(secretsPath);
+    if (secrets.disposal.state === "readable") {
+        survivors.push(`${secretsPath} (${secrets.disposal.reason})`);
+    }
+    const apiKeyPath = (_b = options === null || options === void 0 ? void 0 : options.apiKeyFilePath) !== null && _b !== void 0 ? _b : DEFAULT_CURSOR_API_KEY_FILE;
+    const apiKey = consumeBoundCursorApiKey({ filePath: apiKeyPath });
+    if (apiKey.disposal.state === "readable") {
+        survivors.push(`${apiKeyPath} (${apiKey.disposal.reason})`);
+    }
+    if (survivors.length === 0) {
+        return { ok: true };
+    }
+    return {
+        ok: false,
+        code: BOUND_SECRETS_NOT_CONSUMED,
+        message: `Task-bind secrets are still readable after being hydrated into the ` +
+            `environment, so authored work did not run: ${survivors.join(", ")}.`,
+    };
+}

package/dist/internal/cursor/hosted-deployment-secrets.d.ts

@@ -4,13 +4,27 @@
  * The deployment host rewrites this tmpfs document before each admission and
  * execution request. July reloads it synchronously because the process was
  * already running in the frozen snapshot when the task-specific values
- * arrived.
+ * arrived, then destroys the document: `process.env` is the source authored
+ * code reads, and the file is only how the value crossed the process
+ * boundary.
  */
+import { type BoundSecretFileDisposal } from "./bound-secret-file.js";
 export declare const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+export type BoundDeploymentSecretsConsumeResult = {
+    /** The document supplied values on this call. */
+    applied: boolean;
+    disposal: BoundSecretFileDisposal;
+};
 /**
- * Refresh `process.env` from the latest bound document. A missing or malformed
- * file is a no-op; an empty valid document removes values loaded by an earlier
- * bind after the deployment secret was unset.
+ * Apply the bound document to `process.env`, then destroy it.
+ *
+ * The env refresh always runs first, so a failed destroy never costs the
+ * request its secrets. A malformed document is destroyed too: it carries no
+ * values this process can use, and leaving it on disk only leaves whatever
+ * the control plane did manage to write.
+ *
+ * A `readable` disposal means the document survived; hosted callers must fail
+ * the request rather than run authored code next to a live secrets file.
  */
-export declare function refreshBoundDeploymentSecrets(path?: string): void;
+export declare function consumeBoundDeploymentSecrets(path?: string): BoundDeploymentSecretsConsumeResult;
 //# sourceMappingURL=hosted-deployment-secrets.d.ts.map

package/dist/internal/cursor/hosted-deployment-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAqC5D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,IAAI,CAeN"}
+{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAuD5D,MAAM,MAAM,mCAAmC,GAAG;IAChD,iDAAiD;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,uBAAuB,CAAC;CACnC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,mCAAmC,CASrC"}

package/dist/internal/cursor/hosted-deployment-secrets.js

@@ -4,9 +4,12 @@
  * The deployment host rewrites this tmpfs document before each admission and
  * execution request. July reloads it synchronously because the process was
  * already running in the frozen snapshot when the task-specific values
- * arrived.
+ * arrived, then destroys the document: `process.env` is the source authored
+ * code reads, and the file is only how the value crossed the process
+ * boundary.
  */
 import { readFileSync } from "node:fs";
+import { destroyBoundSecretFile, } from "./bound-secret-file.js";
 export const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
 const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 const appliedSecretNames = new Set();
@@ -39,15 +42,11 @@ function parseBoundSecrets(path) {
     return secrets;
 }
 /**
- * Refresh `process.env` from the latest bound document. A missing or malformed
- * file is a no-op; an empty valid document removes values loaded by an earlier
- * bind after the deployment secret was unset.
+ * Apply the latest bound document to `process.env`. An empty valid document
+ * removes values loaded by an earlier bind after the deployment secret was
+ * unset, which is why the applied names are tracked across calls.
  */
-export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
-    const secrets = parseBoundSecrets(path);
-    if (secrets === undefined) {
-        return;
-    }
+function applyBoundSecrets(secrets) {
     for (const name of appliedSecretNames) {
         if (!(name in secrets)) {
             delete process.env[name];
@@ -59,3 +58,24 @@ export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYM
         appliedSecretNames.add(name);
     }
 }
+/**
+ * Apply the bound document to `process.env`, then destroy it.
+ *
+ * The env refresh always runs first, so a failed destroy never costs the
+ * request its secrets. A malformed document is destroyed too: it carries no
+ * values this process can use, and leaving it on disk only leaves whatever
+ * the control plane did manage to write.
+ *
+ * A `readable` disposal means the document survived; hosted callers must fail
+ * the request rather than run authored code next to a live secrets file.
+ */
+export function consumeBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
+    const secrets = parseBoundSecrets(path);
+    if (secrets !== undefined) {
+        applyBoundSecrets(secrets);
+    }
+    return {
+        applied: secrets !== undefined,
+        disposal: destroyBoundSecretFile(path),
+    };
+}

package/dist/internal/cursor/hosted-store-secrets.d.ts

@@ -1,7 +1,7 @@
 /**
  * Task-time bind paths for hosted deployment file-store source ids.
  *
- * Freeze v2 snapshots start `agent-serve serve` at bake time without a service
+ * Freeze v2 snapshots start `agent-sdk serve` at bake time without a service
  * account, so neither store id is in process env. Execute-from-freeze binds
  * the deployment credential and store ids into `/run/cursor/secrets/` without
  * restarting July — the same pattern as {@link DEFAULT_CURSOR_API_KEY_FILE}.

package/dist/internal/cursor/hosted-store-secrets.js

@@ -1,7 +1,7 @@
 /**
  * Task-time bind paths for hosted deployment file-store source ids.
  *
- * Freeze v2 snapshots start `agent-serve serve` at bake time without a service
+ * Freeze v2 snapshots start `agent-sdk serve` at bake time without a service
  * account, so neither store id is in process env. Execute-from-freeze binds
  * the deployment credential and store ids into `/run/cursor/secrets/` without
  * restarting July — the same pattern as {@link DEFAULT_CURSOR_API_KEY_FILE}.

package/dist/internal/cursor-account-mcp-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-account-mcp-auth.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-account-mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,4BAA4B,CAAC;AAOpC,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,MAAM,WAAW,oCAAoC;IACnD,aAAa,EAAE,IAAI,CACjB,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kBAAkB;IAClB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sCAAsC;IACrD,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAMD;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,oCAAoC,GACzC,OAAO,CAAC,sCAAsC,CAAC,CA8FjD;AA2DD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0C/B"}
+{"version":3,"file":"cursor-account-mcp-auth.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-account-mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,4BAA4B,CAAC;AAQpC,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,MAAM,WAAW,oCAAoC;IACnD,aAAa,EAAE,IAAI,CACjB,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kBAAkB;IAClB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sCAAsC;IACrD,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,oCAAoC,GACzC,OAAO,CAAC,sCAAsC,CAAC,CA8FjD;AA2DD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0C/B"}

package/dist/internal/cursor-account-mcp-auth.js

@@ -23,6 +23,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { LOG_PREFIX } from "./distribution.js";
 import { openBrowser } from "./mcp-oauth.js";
+import { sleep as defaultSleep } from "./sleep.js";
 const DEFAULT_POLL_INTERVAL_MS = 3000;
 const DEFAULT_POLL_TIMEOUT_MS = 5 * 60 * 1000;
 /** Same default the dashboard uses; MCP_OAUTH_REDIRECT_URI overrides for dev. */
@@ -33,9 +34,6 @@ export function mcpOauthRedirectUri() {
     }
     return "https://www.cursor.com/agents/mcp/oauth/callback";
 }
-function sleepMs(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 /**
  * Authorize the deployment service account for the connection's connectors.
  * Already-authorized connectors are skipped; the rest get a browser OAuth
@@ -46,7 +44,7 @@ export function authorizeCursorAccountConnectors(args) {
         var _a, _b, _c, _d, _e, _f;
         const { backendClient, teamId, serviceAccountId, connectionName, out, err } = args;
         const open = (_a = args.openBrowserImpl) !== null && _a !== void 0 ? _a : openBrowser;
-        const sleep = (_b = args.sleep) !== null && _b !== void 0 ? _b : sleepMs;
+        const sleep = (_b = args.sleep) !== null && _b !== void 0 ? _b : defaultSleep;
         const pollIntervalMs = (_c = args.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS;
         const pollTimeoutMs = (_d = args.pollTimeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_POLL_TIMEOUT_MS;
         const redirectUri = mcpOauthRedirectUri();

package/dist/internal/cursor-deployment-relay.d.ts

@@ -36,9 +36,13 @@ export interface DeploymentEventRelayOptions {
 }
 /** Current subscriptions: a live getter, otherwise the snapshot. */
 export declare function currentDeploymentSubscriptions(subscriptions: DeploymentSubscriptionSource): readonly ResolvedSubscription[];
-/** Normalize the channel's `deploySourceUris` option into concrete subscriptions. */
+/**
+ * Normalize the channel's `deploySourceUris` option into concrete
+ * subscriptions. An omitted or empty option resolves to none, which callers
+ * read as "defer to the deploy scope".
+ */
 export declare function resolveDeploymentSubscriptions(options: {
-    deploySourceUris: readonly (string | DeploymentSubscription)[];
+    deploySourceUris?: readonly (string | DeploymentSubscription)[];
     environments?: readonly string[];
     events?: readonly DeploymentEventType[];
 }): ResolvedSubscription[];

package/dist/internal/cursor-deployment-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,MAAM,4BAA4B,GACpC,SAAS,oBAAoB,EAAE,GAC/B,CAAC,MAAM,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,4BAA4B,GAC1C,SAAS,oBAAoB,EAAE,CAEjC;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA8CzB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,CAAC,SAAS,oBAAoB,EAAE,CAAC,EAAE,GACnD,oBAAoB,EAAE,CA2BxB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAuEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}
+{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,MAAM,4BAA4B,GACpC,SAAS,oBAAoB,EAAE,GAC/B,CAAC,MAAM,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,4BAA4B,GAC1C,SAAS,oBAAoB,EAAE,CAEjC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAChE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA8CzB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,CAAC,SAAS,oBAAoB,EAAE,CAAC,EAAE,GACnD,oBAAoB,EAAE,CA2BxB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAuEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}

package/dist/internal/cursor-deployment-relay.js

@@ -33,11 +33,15 @@ const DEFAULT_EVENTS = ["deployment.succeeded"];
 export function currentDeploymentSubscriptions(subscriptions) {
     return typeof subscriptions === "function" ? subscriptions() : subscriptions;
 }
-/** Normalize the channel's `deploySourceUris` option into concrete subscriptions. */
+/**
+ * Normalize the channel's `deploySourceUris` option into concrete
+ * subscriptions. An omitted or empty option resolves to none, which callers
+ * read as "defer to the deploy scope".
+ */
 export function resolveDeploymentSubscriptions(options) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e;
     const bySource = new Map();
-    for (const entry of options.deploySourceUris) {
+    for (const entry of (_a = options.deploySourceUris) !== null && _a !== void 0 ? _a : []) {
         const subscription = typeof entry === "string" ? { deploySourceUri: entry } : entry;
         // Case-folded only: `Deployment.deploy_source_uri` has no documented
         // format, and the server keys subscriptions the same way.
@@ -46,11 +50,11 @@ export function resolveDeploymentSubscriptions(options) {
             throw new Error(`deploymentsChannel: invalid deploy source "${subscription.deploySourceUri}".`);
         }
         const environments = [
-            ...new Set(((_b = (_a = subscription.environments) !== null && _a !== void 0 ? _a : options.environments) !== null && _b !== void 0 ? _b : [])
+            ...new Set(((_c = (_b = subscription.environments) !== null && _b !== void 0 ? _b : options.environments) !== null && _c !== void 0 ? _c : [])
                 .map((value) => value.trim())
                 .filter(Boolean)),
         ];
-        const events = new Set((_d = (_c = subscription.events) !== null && _c !== void 0 ? _c : options.events) !== null && _d !== void 0 ? _d : DEFAULT_EVENTS);
+        const events = new Set((_e = (_d = subscription.events) !== null && _d !== void 0 ? _d : options.events) !== null && _e !== void 0 ? _e : DEFAULT_EVENTS);
         if (events.size === 0) {
             throw new Error(`deploymentsChannel: deploy source "${deploySourceUri}" subscribes to no events.`);
         }
@@ -68,10 +72,10 @@ export function resolveDeploymentSubscriptions(options) {
                 ? []
                 : [...new Set([...existing.environments, ...environments])];
     }
-    // Empty is legal here and means "this channel wants nothing". The
-    // wire-level empty list means deregister. The host re-resolves on each
-    // heartbeat, so a channel that later fills `deploySourceUris` can
-    // register without a restart.
+    // Empty means "this channel names nothing". The relay wire reads that as
+    // deregistration, hosted admission reads it as "defer to the deploy
+    // scope". The host re-resolves on each heartbeat, so a channel that later
+    // fills `deploySourceUris` registers without a restart.
     return [...bySource.values()];
 }
 /**

package/dist/internal/deploy-manifest.d.ts

@@ -28,8 +28,8 @@
  * Keep that capability per-channel: do not reintroduce a provider-wide event
  * union for control-plane consumers.
  */
-import type { ContinuationIdentity } from "../continuation.js";
 import type { AgentProject, AgentProjectInfo } from "../types.js";
+import { type ContinuationIdentity } from "./continuation-identity.js";
 export declare const DEPLOY_MANIFEST_VERSION: 1;
 export interface AgentDeployManifestDeclarations {
     egressDomains: string[];

package/dist/internal/deploy-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/internal/deploy-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAclE,eAAO,MAAM,uBAAuB,EAAE,CAAK,CAAC;AAiC5C,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;IACtD;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,EAAE,oBAAoB,CAAC;KACpC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,CAAC,CAAC;IACnB,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,+BAA+B,CAAC;IAC9C;;;OAGG;IACH,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,qBAAqB,CA0DvB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,SAAS,CAOnC"}
+{"version":3,"file":"deploy-manifest.d.ts","sourceRoot":"","sources":["../../src/internal/deploy-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOlE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,4BAA4B,CAAC;AAOpC,eAAO,MAAM,uBAAuB,EAAE,CAAK,CAAC;AAiC5C,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;IACtD;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,YAAY,EAAE,oBAAoB,CAAC;KACpC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,CAAC,CAAC;IACnB,6BAA6B;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,+BAA+B,CAAC;IAC9C;;;OAGG;IACH,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,qBAAqB,CA0DvB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,GACX,qBAAqB,GAAG,SAAS,CAOnC"}

package/dist/internal/deploy-manifest.js

@@ -32,7 +32,7 @@ import { z } from "zod";
 import { isPublicEndpointPolicy } from "../channels.js";
 import { isCursorHostedStorage } from "../storage-backends/cursor-hosted.js";
 import { applyAgentContinuationDefaults, channelContinuationIdentity, channelDeclaredEventTypes, handshakeChannelContinuation, } from "./continuation-channel.js";
-import { CONTINUATION_SELECTORS } from "./continuation-identity.js";
+import { CONTINUATION_SELECTORS, } from "./continuation-identity.js";
 import { projectInfo, runtimeArchitectureCompatibilityError, } from "./discovery.js";
 import { packageVersion } from "./distribution.js";
 export const DEPLOY_MANIFEST_VERSION = 1;

package/dist/internal/discovery/ab.d.ts

@@ -4,6 +4,6 @@
 import type { ABConfigFile } from "../../ab.js";
 import type { DiscoveredAB } from "../../types.js";
 import { type DiscoveryContext } from "./context.js";
-export declare function loadABs(ctx: DiscoveryContext, agentDir: string): Promise<DiscoveredAB[]>;
+export declare function loadABs(ctx: DiscoveryContext, agentDir: string, onDisable?: (source: string, path: string) => void): Promise<DiscoveredAB[]>;
 export declare function loadABConfig(ctx: DiscoveryContext, agentDir: string): Promise<ABConfigFile | undefined>;
 //# sourceMappingURL=ab.d.ts.map

package/dist/internal/discovery/ab.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ab.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/ab.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAUlE,wBAAsB,OAAO,CAC3B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CA+CzB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAyBnC"}
+{"version":3,"file":"ab.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/ab.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAUlE,wBAAsB,OAAO,CAC3B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GACjD,OAAO,CAAC,YAAY,EAAE,CAAC,CAiEzB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAyBnC"}