@cursor/july 0.1.105 → 0.1.108

package/dist/index.js

@@ -49,12 +49,13 @@ export { InvalidAsOfError, VacuousTimeArgsError, } from "./internal/as-of.js";
 export { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, loadAgentProject, loadAgentProjects, projectInfo, resolveAgentMounts, } from "./internal/discovery.js";
 export { collectGitHubTriggerTargets, collectOriginTriggerTargets, handleAgentServeTrigger, } from "./internal/handleAgentServeTrigger.js";
 export { MCP_CHANNEL_ID, MCP_ENDPOINT_PATH, mcpEndpointToolNames, TOOL_MCP_ENDPOINT_PATH, } from "./internal/mcp-endpoint.js";
-export { ReminderValidationError, UnknownReminderError, } from "./internal/reminder-runner.js";
+export { REMINDER_ARGS_MAX_BYTES, ReminderValidationError, rejectAnonymousReminderHandlers, UnknownReminderError, } from "./internal/reminder-runner.js";
 export { SessionBusyError, ToolInputError, ToolNotDirectlyCallableError, UnknownChannelError, UnknownSessionError, UnknownToolError, } from "./internal/session-engine.js";
 export { createMemoryKv, memoryCasTable } from "./kv/memory-kv.js";
 export { agentStoreMemoryBackend, fileMemoryBackend, memoryHook, } from "./memory.js";
 export { defineOtel, resolveOtelDefinition } from "./otel.js";
 export { prompt } from "./prompt.js";
+export { defineReminder } from "./reminders.js";
 export { defineResult } from "./result.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSkill } from "./skills.js";
@@ -63,9 +64,7 @@ export { defineTool } from "./tools.js";
 export { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, DIRECT_TOOL_CALL_CHANNEL_ID, isCursorAccountTransport, isPeerConnectionTransport, isSymbolicConnectionTransport, isToolEffect, MAX_RUNNING_TURNS_LIMIT, normalizeConnectionEffects, normalizeConnectionTools, normalizeCursorAccountServers, supportsKvCas, } from "./types.js";
 /**
  * Runtime config for an agent — authored at `agent/agent.ts` (the root
- * agent) or `agent/subagents/<id>/agent.ts` (a subagent). Set
- * `architecture: "v2"` to deploy onto the v2 control plane; omitted
- * channel continuation then inherits kind `/v2` defaults.
+ * agent) or `agent/subagents/<id>/agent.ts` (a subagent).
  */
 export function defineAgent(config) {
     return brandDefinition("agent", config);

package/dist/internal/builtin-tools/artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../src/internal/builtin-tools/artifacts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEtE,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AA0BrD,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAoCvE"}
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../src/internal/builtin-tools/artifacts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEtE,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AA0BrD,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAmCvE"}

package/dist/internal/builtin-tools/artifacts.js

@@ -32,7 +32,7 @@ function kindVariant(name, schema) {
             .trim()
             .min(1)
             .optional()
-            .describe("Stable upsert key: tagging the same key again updates the existing record instead of creating a new one."),
+            .describe("Stable key, unique across kinds. Reusing it replaces that record instead of adding a new one."),
     });
 }
 export function tagArtifactTool(config) {
@@ -44,10 +44,9 @@ export function tagArtifactTool(config) {
         throw new Error("tag_artifact requires at least one declared artifact kind");
     }
     const description = [
-        "Tag a durable artifact: a record of a notable output you produced, kept across sessions and listed for the people supervising this agent. Tag one whenever you finish something worth surfacing durably.",
+        "Tag a finished output as an artifact. Artifacts persist across sessions and are listed for the people supervising this agent.",
         "Kinds:",
         ...kinds.map(([name, kind]) => `- ${name}: ${kind.description}`),
-        "Same `key` upserts: tagging it again updates that record — use a stable key when re-tagging the same underlying thing (e.g. the same PR URL).",
     ].join("\n");
     return defineTool({
         description,

package/dist/internal/channel-route-dispatch.d.ts

@@ -0,0 +1,13 @@
+import type { ChannelHandlerArgs, ChannelRoute } from "../types.js";
+/**
+ * Run one authored channel route: validate the declared Zod query / body
+ * schemas onto `handlerArgs`, then call the handler. Shared by the local
+ * router mount and hosted catch replay so a caught request meets exactly
+ * the same schema gate as a direct one.
+ */
+export declare function invokeChannelRoute(input: {
+    route: ChannelRoute;
+    request: Request;
+    handlerArgs: ChannelHandlerArgs;
+}): Promise<Response>;
+//# sourceMappingURL=channel-route-dispatch.d.ts.map

package/dist/internal/channel-route-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-route-dispatch.d.ts","sourceRoot":"","sources":["../../src/internal/channel-route-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIpE;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,kBAAkB,CAAC;CACjC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmDpB"}

package/dist/internal/channel-route-dispatch.js

@@ -0,0 +1,62 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { jsonResponse } from "./http-channel.js";
+import { validateToolInput } from "./json-schema.js";
+/**
+ * Run one authored channel route: validate the declared Zod query / body
+ * schemas onto `handlerArgs`, then call the handler. Shared by the local
+ * router mount and hosted catch replay so a caught request meets exactly
+ * the same schema gate as a direct one.
+ */
+export function invokeChannelRoute(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { route, handlerArgs } = input;
+        let request = input.request;
+        if (route.querySchema !== undefined) {
+            const rawQuery = Object.fromEntries(new URL(request.url).searchParams.entries());
+            const queryValidation = validateToolInput(route.querySchema, rawQuery);
+            if (!queryValidation.ok) {
+                return jsonResponse({ error: queryValidation.message }, { status: 400 });
+            }
+            handlerArgs.query = queryValidation.value;
+        }
+        if (route.bodySchema !== undefined) {
+            // Buffer once so handlers that need the raw body (e.g. GitHub HMAC) can
+            // still read `request.text()` / `request.json()`.
+            let bodyText;
+            try {
+                bodyText = yield request.text();
+            }
+            catch (_a) {
+                return jsonResponse({ error: "Failed to read request body" }, { status: 400 });
+            }
+            let rawBody;
+            try {
+                rawBody = bodyText === "" ? {} : JSON.parse(bodyText);
+            }
+            catch (_b) {
+                return jsonResponse({ error: "Request body must be valid JSON" }, { status: 400 });
+            }
+            const bodyValidation = validateToolInput(route.bodySchema, rawBody);
+            if (!bodyValidation.ok) {
+                return jsonResponse({ error: bodyValidation.message }, { status: 400 });
+            }
+            handlerArgs.body = bodyValidation.value;
+            request = new Request(request.url, {
+                method: request.method,
+                headers: request.headers,
+                body: bodyText === "" ? undefined : bodyText,
+                // node: undici / fetch may require duplex for streamed bodies;
+                // a string body does not.
+            });
+        }
+        return route.handler(request, handlerArgs);
+    });
+}

package/dist/internal/channel-state.d.ts

@@ -0,0 +1,17 @@
+import type { JsonValue } from "../types.js";
+/**
+ * Shallow-merge a wake patch into durable channel state. Null / undefined
+ * patch values leave the existing key alone so sticky fields survive.
+ */
+export declare function mergeChannelStateSkipNull(current: JsonValue | undefined, patch: JsonValue | undefined): JsonValue | undefined;
+/**
+ * Apply handler mutations made against a turn snapshot without reverting
+ * unchanged fields refreshed by a later delivery. At a changed path, objects
+ * merge recursively, arrays and scalars replace, and deletions win.
+ */
+export declare function mergeChannelStateMutation(args: {
+    current: JsonValue | undefined;
+    before: JsonValue;
+    after: JsonValue;
+}): JsonValue | undefined;
+//# sourceMappingURL=channel-state.d.ts.map

package/dist/internal/channel-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-state.d.ts","sourceRoot":"","sources":["../../src/internal/channel-state.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAW7C;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,GAAG,SAAS,EAC9B,KAAK,EAAE,SAAS,GAAG,SAAS,GAC3B,SAAS,GAAG,SAAS,CAgBvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC;CAClB,GAAG,SAAS,GAAG,SAAS,CAiDxB"}

package/dist/internal/channel-state.js

@@ -0,0 +1,78 @@
+import { isDeepStrictEqual } from "node:util";
+function asRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Shallow-merge a wake patch into durable channel state. Null / undefined
+ * patch values leave the existing key alone so sticky fields survive.
+ */
+export function mergeChannelStateSkipNull(current, patch) {
+    if (patch === undefined) {
+        return current;
+    }
+    const currentRecord = asRecord(current);
+    const patchRecord = asRecord(patch);
+    if (currentRecord === undefined || patchRecord === undefined) {
+        return structuredClone(patch);
+    }
+    const merged = Object.assign({}, currentRecord);
+    for (const [key, value] of Object.entries(patchRecord)) {
+        if (value !== null && value !== undefined) {
+            merged[key] = value;
+        }
+    }
+    return merged;
+}
+/**
+ * Apply handler mutations made against a turn snapshot without reverting
+ * unchanged fields refreshed by a later delivery. At a changed path, objects
+ * merge recursively, arrays and scalars replace, and deletions win.
+ */
+export function mergeChannelStateMutation(args) {
+    const { current, before, after } = args;
+    if (isDeepStrictEqual(before, after)) {
+        return current;
+    }
+    const currentRecord = asRecord(current);
+    const beforeRecord = asRecord(before);
+    const afterRecord = asRecord(after);
+    if (currentRecord === undefined ||
+        beforeRecord === undefined ||
+        afterRecord === undefined) {
+        return structuredClone(after);
+    }
+    const merged = structuredClone(currentRecord);
+    const keys = new Set([
+        ...Object.keys(beforeRecord),
+        ...Object.keys(afterRecord),
+    ]);
+    for (const key of keys) {
+        const hadBefore = Object.hasOwn(beforeRecord, key);
+        const hasAfter = Object.hasOwn(afterRecord, key);
+        if (hadBefore &&
+            hasAfter &&
+            isDeepStrictEqual(beforeRecord[key], afterRecord[key])) {
+            continue;
+        }
+        if (!hasAfter) {
+            delete merged[key];
+            continue;
+        }
+        const currentValue = merged[key];
+        const afterValue = afterRecord[key];
+        merged[key] =
+            hadBefore ||
+                (asRecord(currentValue) !== undefined &&
+                    asRecord(afterValue) !== undefined)
+                ? mergeChannelStateMutation({
+                    current: currentValue,
+                    before: hadBefore ? beforeRecord[key] : {},
+                    after: afterValue,
+                })
+                : structuredClone(afterValue);
+    }
+    return merged;
+}

package/dist/internal/cli-ax.d.ts

@@ -113,6 +113,13 @@ export interface AxCliOptions {
     resume?: boolean;
     /** Abort signal (tests / programmatic stop of `playground` proxy). */
     signal?: AbortSignal;
+    /**
+     * `run --prod` / `session --prod --message`: hosted v2 session start on
+     * the agentsdk control plane. `--dry-run` marks the turn non-mutating;
+     * `--as-of` freezes the session clock at a timezone-bearing instant.
+     */
+    dryRun?: boolean;
+    asOf?: string;
 }
 export interface ResolvedAgentTarget {
     agentUrl: string;

package/dist/internal/cli-ax.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-ax.d.ts","sourceRoot":"","sources":["../../src/internal/cli-ax.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,aAAa,CAAC;AAmErB,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAsED,wBAAsB,aAAa,CACjC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuJpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAUD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA8GpE;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA4GnE;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DpE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAe1E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAAC,GAC1C,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAepD;AAiDD,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmNpE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,GAC5D,MAAM,CAcR;AAsID;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CA8GjB;AAmGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACvC,MAAM,GAAG,SAAS,CASpB;AAoJD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,mBAAmB,GAC7B,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAgFpE;AAmCD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxE;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAKD;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAoF1E"}
+{"version":3,"file":"cli-ax.d.ts","sourceRoot":"","sources":["../../src/internal/cli-ax.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,aAAa,CAAC;AAqErB,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAsED,wBAAsB,aAAa,CACjC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuJpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAUD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA8GpE;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAqHnE;AAsED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DpE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAe1E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAAC,GAC1C,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAepD;AAiDD,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmNpE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,GAC5D,MAAM,CAcR;AAsID;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CA8GjB;AAmGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACvC,MAAM,GAAG,SAAS,CASpB;AAoJD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,mBAAmB,GAC7B,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsFpE;AAmCD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxE;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAgFjB;AAKD;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAoF1E"}

package/dist/internal/cli-ax.js

@@ -24,12 +24,14 @@ import { lookupSessionContinuation, runChat } from "./chat-client.js";
 import { ensureCursorLogin } from "./cli-cursor.js";
 import { resolveDeployAuth } from "./cli-deploy.js";
 import { resolveApiKey } from "./cursor/credentials.js";
+import { DeployApiError } from "./deploy-client.js";
 import { CLI_COMMAND_NAME, PACKAGE_NAME } from "./distribution.js";
 import { discoverEvals, filterDiscoveredEvals, runDiscoveredEvals, } from "./eval-runner.js";
 import { cancelRemoteEvalRun, getRemoteEvalRun, listRemoteEvalRuns, listRemoteEvals, pollRemoteEvalRun, RemoteEvalError, snapshotToEvalRunResults, startRemoteEvalRun, } from "./evals-client.js";
 import { runTemplateInit } from "./init-interview.js";
 import { checkInitTarget, formatInitNextSteps, formatInitScaffoldSummary, initNextCommands, initProject, installScaffoldDependencies, linkCliOntoPath, printInitGuide, resolveTemplate, } from "./init-project.js";
 import { offerInstallCursorSkills } from "./install-cursor-skills.js";
+import { rejectV2ForLegacyCommand } from "./legacy-command-guard.js";
 import { runLogsTail, sanitizeCustomerError } from "./logs-client.js";
 import { mapPool } from "./map-pool.js";
 import { openBrowser } from "./open-browser.js";
@@ -377,6 +379,15 @@ export function cmdChat(options) {
 export function cmdRun(options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
+        // Only a v2-shaped request tries the control plane; every v1 `run --prod`
+        // form (multi-turn, continuation token, local session id, --url) keeps its
+        // engine-alias path untouched.
+        if (options.prod === true && hostedSessionRejection(options) === undefined) {
+            const started = yield cmdHostedSession(options);
+            if (started !== "fallback") {
+                return started;
+            }
+        }
         const messages = (_a = options.messages) !== null && _a !== void 0 ? _a : [];
         if (messages.length === 0) {
             die("Provide --message (repeatable) or --messages-file");
@@ -472,6 +483,73 @@ export function cmdRun(options) {
         }
     });
 }
+const HOSTED_SESSION_ID_RE = /^ses_[a-f0-9]{24}$/;
+/**
+ * Hosted v2 session start: POST the agentsdk control plane, which hands the
+ * wake to Temporal (no resident engine, no `/engine/*` alias). `--session
+ * ses_…` resumes that exact session; there is no continuation token on
+ * this path. A 404 means the slug is not a v2 control-plane deployment, so
+ * `run --prod` falls back to the v1 engine alias.
+ */
+/** Why these options cannot be a hosted v2 session start, if they cannot. */
+function hostedSessionRejection(options) {
+    var _a;
+    var _b;
+    if (options.url !== undefined) {
+        return "--prod session start talks to the agentsdk control plane; do not pass --url";
+    }
+    const messages = (_b = options.messages) !== null && _b !== void 0 ? _b : [];
+    if (messages.length !== 1 || ((_a = messages[0]) === null || _a === void 0 ? void 0 : _a.trim()) === "") {
+        return "Provide exactly one --message (the wake). Multi-turn runs are local-only.";
+    }
+    if (trimNonEmpty(options.continuationToken) !== undefined) {
+        return "--continuation-token is not a hosted v2 identity; pass --session ses_… to resume a session";
+    }
+    const sessionId = trimNonEmpty(options.sessionId);
+    if (sessionId !== undefined && !HOSTED_SESSION_ID_RE.test(sessionId)) {
+        return `--session must be a hosted session id (ses_…), got ${sessionId}`;
+    }
+    return undefined;
+}
+function cmdHostedSession(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const rejection = hostedSessionRejection(options);
+        if (rejection !== undefined) {
+            die(rejection);
+        }
+        const messages = (_a = options.messages) !== null && _a !== void 0 ? _a : [];
+        const sessionId = trimNonEmpty(options.sessionId);
+        const auth = yield resolveDeployAuth({
+            team: options.team,
+            apiKey: options.apiKey,
+            fetchImpl: options.fetchImpl,
+        });
+        if (typeof auth === "number") {
+            return auth;
+        }
+        const slug = resolveProdSlug(options);
+        try {
+            const accepted = yield auth.client.startSession({
+                teamId: auth.teamId,
+                slug,
+                message: messages[0].trim(),
+                sessionId,
+                dryRun: options.dryRun,
+                asOf: options.asOf,
+            });
+            console.log(JSON.stringify(accepted, null, 2));
+            return 0;
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                return "fallback";
+            }
+            process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+            return 1;
+        }
+    });
+}
 /**
  * `agent-sdk call <tool>` — deterministic tool invocation over
  * `POST /v1/tools/:toolName` (ephemeral local server unless --url).
@@ -1301,6 +1379,11 @@ export function cmdLogs(options) {
                 if (typeof auth === "number") {
                     return auth;
                 }
+                yield rejectV2ForLegacyCommand({
+                    client: auth.client,
+                    teamId: auth.teamId,
+                    slug,
+                });
                 yield runLogsTail({
                     prod: true,
                     dir: options.dir,
@@ -1323,6 +1406,7 @@ export function cmdLogs(options) {
                             apiKey: options.apiKey,
                             fetchImpl: options.fetchImpl,
                             err: () => { },
+                            skipLegacyArchitectureCheck: true,
                         });
                         return { agentUrl: target.agentUrl, headers: target.headers };
                     }),
@@ -1428,8 +1512,22 @@ export function cmdSessions(options) {
  */
 export function cmdSession(sessionId, options) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b, _c;
+        if (options.prod === true && ((_b = (_a = options.messages) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0) {
+            // `session --prod [ses_…] --message` is the same hosted start as
+            // `run --prod`, with the positional id as the session to resume. Unlike
+            // `run`, a 404 is an error here: this form is explicitly v2.
+            const started = yield cmdHostedSession(Object.assign(Object.assign({}, options), { sessionId: (_c = trimNonEmpty(sessionId)) !== null && _c !== void 0 ? _c : options.sessionId }));
+            if (started === "fallback") {
+                process.stderr.write(`Hosted session start returned 404 for slug ${resolveProdSlug(options)}: deploy a running AgentSDK v2 agent, or use \`${CLI_COMMAND_NAME} run --prod\` (falls back to the v1 engine).\n`);
+                return 1;
+            }
+            return started;
+        }
         if (sessionId === undefined || sessionId.trim() === "") {
-            process.stderr.write(`Usage: ${CLI_COMMAND_NAME} session <sessionId> [--url | --prod] [--json | --text | --events] [--out <file.ndjson>]\n`);
+            process.stderr.write(`Usage: ${CLI_COMMAND_NAME} session <sessionId> [--url | --prod] [--json | --text | --events] [--out <file.ndjson>]\n` +
+                `   or: ${CLI_COMMAND_NAME} session --prod [<sessionId>] --slug <slug> --message "…" [--dry-run] [--as-of <instant>]\n`);
             return 2;
         }
         if (options.rawEvents === true && options.json === true) {

package/dist/internal/cli-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-cursor.d.ts","sourceRoot":"","sources":["../../src/internal/cli-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2BH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGzE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB;IACjB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAWjD;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC1E"}
+{"version":3,"file":"cli-cursor.d.ts","sourceRoot":"","sources":["../../src/internal/cli-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGzE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB;IACjB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAWjD;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC1E"}

package/dist/internal/cli-cursor.js

@@ -204,6 +204,8 @@ function describeSource(source) {
             return "CURSOR_API_KEY environment variable";
         case "file":
             return "CURSOR_API_KEY_FILE (task bind)";
+        case "service-account":
+            return "CURSOR_SERVICE_ACCOUNT_KEY environment variable";
         case "login":
             return `stored login (${credentialsFilePath()})`;
     }

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAgBxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmoBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAqBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAoBxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAiqBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAiBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -19,7 +19,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { basename, resolve } from "node:path";
-import { isPublicEndpointPolicy } from "../channels.js";
+import { catchAuthDeclaration, isPublicEndpointPolicy } from "../channels.js";
 import { isCursorAccountTransport, } from "../types.js";
 import { CursorBackendClient } from "./cursor/backend-client.js";
 import { cursorExternalApiUrl, resolveApiKey, SIGN_IN_HINT, } from "./cursor/credentials.js";
@@ -31,6 +31,7 @@ import { describeError } from "./describe-error.js";
 import { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
 import { isReservedSecretName, isValidCursorEventRepo, validateSettableSecretName, } from "./hosting.js";
+import { deploymentArchitecture, rejectV2ForLegacyCommand, } from "./legacy-command-guard.js";
 import { deployProgressLabel, sanitizeCustomerError } from "./logs-client.js";
 import { sleep } from "./sleep.js";
 import { stderrPalette } from "./terminal-style.js";
@@ -422,7 +423,7 @@ export function promptChooseDeployTargets(agents, options) {
 }
 function deployOne(ctx, options, target, extras) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         const { dir, slug } = target;
         // Fill --repo/--ref/--path from the local git checkout when omitted so
         // `agent-sdk deploy` inside an agent directory is enough. Only probe git
@@ -493,6 +494,12 @@ function deployOne(ctx, options, target, extras) {
             // without the alias token before the deploy is accepted.
             ctx.err(`  public: ${publicRoutePaths.join(", ")} (served WITHOUT the alias token — these channels authenticate requests themselves)\n`);
         }
+        const deadSecretChannels = (_h = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIdsWithDeadSecretPolicies) !== null && _h !== void 0 ? _h : [];
+        if (!ctx.json && deadSecretChannels.length > 0) {
+            ctx.err(`warning: ${deadSecretChannels
+                .map((channelId) => `/v1/channels/${channelId}`)
+                .join(", ")}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`);
+        }
         if ((manifest === null || manifest === void 0 ? void 0 : manifest.architecture) === "v2") {
             if (!ctx.json) {
                 ctx.err("  architecture: v2\n");
@@ -572,7 +579,7 @@ function deployOne(ctx, options, target, extras) {
             ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
-        const deployedPublicRoutes = (_h = detail.publicRoutePaths) !== null && _h !== void 0 ? _h : [];
+        const deployedPublicRoutes = (_j = detail.publicRoutePaths) !== null && _j !== void 0 ? _j : [];
         ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
             `  status:      running\n` +
             `  generation:  ${detail.generation}\n` +
@@ -587,7 +594,7 @@ function deployOne(ctx, options, target, extras) {
                 .join(""));
         yield runPostDeployConnectorAuth(ctx, options, {
             slug,
-            connections: (_j = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _j !== void 0 ? _j : [],
+            connections: (_k = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _k !== void 0 ? _k : [],
             serviceAccountId: deploymentServiceAccountId(detail),
         });
         return 0;
@@ -834,6 +841,18 @@ function readDeployManifest(dir) {
             publicChannelIds: project.channels
                 .filter((channel) => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
                 .map((channel) => channel.id),
+            publicChannelIdsWithDeadSecretPolicies: project.channels
+                .filter((channel) => {
+                var _a;
+                const auth = (_a = channel.definition.auth) !== null && _a !== void 0 ? _a : [];
+                return (auth.some(isPublicEndpointPolicy) &&
+                    auth.some((policy) => {
+                        var _a;
+                        const kind = (_a = catchAuthDeclaration(policy)) === null || _a === void 0 ? void 0 : _a.kind;
+                        return kind !== undefined && kind !== "public";
+                    }));
+            })
+                .map((channel) => channel.id),
             httpChannelPublicEndpoint: ((_a = project.httpChannel.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy),
             hasScmChannels: project.channels.some((channel) => {
                 var _a;
@@ -1107,15 +1126,28 @@ export function cmdDelete(slug, options) {
         if (typeof ctx === "number") {
             return ctx;
         }
+        // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+        // DELETE goes first. A v2 404 (missing slug, or an older backend)
+        // falls through to the v1 agent-serve delete.
+        let architecture = "v2";
         let accepted;
         try {
-            accepted = yield ctx.client.deleteDeployment({
-                teamId: ctx.teamId,
-                slug,
-            });
+            accepted = yield ctx.client.deleteAgentkit({ teamId: ctx.teamId, slug });
         }
         catch (error) {
-            return renderApiError(error, ctx.err);
+            if (!(error instanceof DeployApiError) || error.status !== 404) {
+                return renderApiError(error, ctx.err);
+            }
+            try {
+                accepted = yield ctx.client.deleteDeployment({
+                    teamId: ctx.teamId,
+                    slug,
+                });
+                architecture = "v1";
+            }
+            catch (v1Error) {
+                return renderApiError(v1Error, ctx.err);
+            }
         }
         if (ctx.noWait) {
             if (ctx.json) {
@@ -1127,7 +1159,9 @@ export function cmdDelete(slug, options) {
             return 0;
         }
         try {
-            yield pollUntilGone(ctx, slug);
+            yield pollUntilGone(ctx, slug, () => architecture === "v2"
+                ? ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug })
+                : ctx.client.getDeployment({ teamId: ctx.teamId, slug }));
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -1157,6 +1191,11 @@ export function cmdRotateToken(slug, options) {
         }
         let aliasToken;
         try {
+            yield rejectV2ForLegacyCommand({
+                client: ctx.client,
+                teamId: ctx.teamId,
+                slug,
+            });
             aliasToken = yield ctx.client.rotateAliasToken({
                 teamId: ctx.teamId,
                 slug,
@@ -1189,6 +1228,11 @@ export function cmdRotatePodCredential(slug, options) {
         }
         let podCredentialMaskedKey;
         try {
+            yield rejectV2ForLegacyCommand({
+                client: ctx.client,
+                teamId: ctx.teamId,
+                slug,
+            });
             podCredentialMaskedKey = yield ctx.client.rotatePodCredential({
                 teamId: ctx.teamId,
                 slug,
@@ -1211,16 +1255,11 @@ export function cmdRotatePodCredential(slug, options) {
 // ============================================================================
 function secretDeploymentArchitecture(ctx, slug) {
     return __awaiter(this, void 0, void 0, function* () {
-        try {
-            yield ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug });
-            return "v2";
-        }
-        catch (error) {
-            if (error instanceof DeployApiError && error.status === 404) {
-                return "v1";
-            }
-            throw error;
-        }
+        return deploymentArchitecture({
+            client: ctx.client,
+            teamId: ctx.teamId,
+            slug,
+        });
     });
 }
 export function cmdSecretsSet(slug, specs, options) {
@@ -1565,7 +1604,7 @@ function transientDeployStatusWaitMs(error, pollIntervalMs) {
  * Wait until GET 404s (the delete reconciler purged the record). Treats
  * other errors as failures. Throws DeployApiError on timeout.
  */
-function pollUntilGone(ctx, slug) {
+function pollUntilGone(ctx, slug, getDetail) {
     return __awaiter(this, void 0, void 0, function* () {
         const startedAt = Date.now();
         const tty = process.stderr.isTTY === true;
@@ -1587,10 +1626,7 @@ function pollUntilGone(ctx, slug) {
         };
         for (;;) {
             try {
-                const detail = yield ctx.client.getDeployment({
-                    teamId: ctx.teamId,
-                    slug,
-                });
+                const detail = yield getDetail();
                 report(deployProgressLabel(detail));
             }
             catch (error) {