@cursor/july 0.1.105 → 0.1.108

package/docs/reference/connections.md

@@ -224,7 +224,8 @@ Name the file `account.ts`. `cursor.ts` collides with the IDE `cursor`
 MCP namespace. `advertiseTools: true` puts connector tools on local
 turns by name. Without it they sit behind harness meta-tools.
 
-The host must be signed in (`agent-sdk login` or `CURSOR_API_KEY`).
+The host must be signed in (`agent-sdk login`, `CURSOR_API_KEY`, or
+`CURSOR_SERVICE_ACCOUNT_KEY`).
 `serve` fails fast at startup otherwise, and logs each connector's live
 status (`connected`, `needsAuth`, `error`) as it starts.
 

package/docs/reference/extensions.md

@@ -265,6 +265,8 @@ Continue with these pages:
   lets an agent launch and steer cloud agents
 - [Cursor Grok Bot agents](../guides/grokbot-agents.md): the extension
   that lets an agent talk to Grok Bot agents
+- [Self-improvement](../guides/improve.md): the extension that lets an
+  agent change its own source through a cloud agent and a pull request
 - [Tools](./tools.md): the tool contract extensions contribute to
 - [Skills](./skills.md): the skill forms an extension can carry
 - [Project layout](./project-layout.md): where `agent/extensions/` sits

package/docs/scaffolding-agents.md

@@ -113,7 +113,8 @@ Cursor checks the project in this order:
 
 Validation, discovery, direct server-tool calls, and server startup work
 without a Cursor credential. Model turns and evals need
-`CURSOR_API_KEY` or a saved `agent-sdk login`.
+`CURSOR_API_KEY`, then `CURSOR_API_KEY_FILE` (hosted default `/run/cursor/secrets/CURSOR_API_KEY`), then `CURSOR_SERVICE_ACCOUNT_KEY`, then a saved
+`agent-sdk login`.
 
 ## What happens after the first agent works?
 

package/docs/troubleshooting.md

@@ -30,7 +30,7 @@ not on `PATH`, use `npx @cursor/july`.
 | What you see | What to do |
 | --- | --- |
 | Built-in file reads and greps fail; the turn retries for a long time | Run under Node 22.13+ (or `tsx`), never Bun. Look for `NGHTTP2_FRAME_SIZE_ERROR` in logs. |
-| The turn fails immediately with an API-key error | Sign in with `agent-sdk login`, or set `CURSOR_API_KEY`. Discovery, `info`, `call`, and serve bring-up work without a key; model turns need one. |
+| The turn fails immediately with an API-key error | Sign in with `agent-sdk login`, or set `CURSOR_API_KEY` or `CURSOR_SERVICE_ACCOUNT_KEY`. Discovery, `info`, `call`, and serve bring-up work without a key; model turns need one. |
 | Replies quote rules or `AGENTS.md` from outside your agent project | The session workspace inherited parent-folder config. Nested git checkouts default `local.cwd` to a per-project cache directory under `~/.cache`. Point `defineAgent({ local: { cwd } })` at a checkout only when the agent should inherit that tree, or set `--state-root` to a clean directory (for example under `/tmp`). |
 | Yellow box shows Datadog/Linear tools, but the model lists `GetDynamicTools` / IDE `cursor` tools and never calls them | Attached MCP sits behind harness meta-tools, or the harness cwd is still inside another checkout. Set `advertiseTools: true` for named tools on local turns. Check `GET /v1/info` `local.cwd` and `connections[].advertiseTools`. |
 | Server tools, skills, or workspace seed files never appear | Server tools and sandbox seeds apply on the local runtime (cloud server tools need `--public-url` / `--cloud-tools-url`). Skills reach cloud through the Agent Store when hosting or a personal `CURSOR_API_KEY` is available; otherwise only skills already in the cloud repo. `validate` warns when this combination is present. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cursor/july",
-  "version": "0.1.105",
+  "version": "0.1.108",
   "description": "(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {
@@ -24,7 +24,7 @@
     "!dist/internal/tenant-mcp/**",
     "!dist/internal/grokbot/**",
     "!dist/extensions/cursor-grokbot-agents/**",
-    "!dist/internal/review-comments.*",
+    "!dist/internal/review-comments*",
     "!dist/internal/shallow-clone.*",
     "!dist/internal/managed-delivery.*",
     "src/**/*",
@@ -32,7 +32,7 @@
     "!src/internal/tenant-mcp/**",
     "!src/internal/grokbot/**",
     "!src/extensions/cursor-grokbot-agents/**",
-    "!src/internal/review-comments.ts",
+    "!src/internal/review-comments*",
     "!src/internal/shallow-clone.ts",
     "!src/internal/managed-delivery.ts",
     "skills/**/*",
@@ -146,6 +146,13 @@
       "import": "./dist/extensions/cursor-grokbot-agents/extension.js",
       "default": "./dist/extensions/cursor-grokbot-agents/extension.js"
     },
+    "./extensions/improve": {
+      "anysphere-source": "./src/extensions/improve/extension.ts",
+      "bun": "./dist/extensions/improve/extension.js",
+      "types": "./dist/extensions/improve/extension.d.ts",
+      "import": "./dist/extensions/improve/extension.js",
+      "default": "./dist/extensions/improve/extension.js"
+    },
     "./schedules": {
       "anysphere-source": "./src/schedules.ts",
       "types": "./dist/schedules.d.ts",

package/skills/create-agent/SKILL.md

@@ -133,7 +133,7 @@ npx tsc --noEmit -p ./<slug>
 tsx does not typecheck. Tool `execute` must return JSON-shaped
 values: object literals or `type` aliases, not `interface` types.
 
-Model turns need `CURSOR_API_KEY`. Without one, finish the
+Model turns need a Cursor credential (`CURSOR_API_KEY`, then `CURSOR_API_KEY_FILE`, then `CURSOR_SERVICE_ACCOUNT_KEY`, then `agent-sdk login`). Without one, finish the
 key-free checks, confirm `run` fails with only the API-key error,
 and hand these over:
 

package/skills/debug/SKILL.md

@@ -34,7 +34,7 @@ Local `agent-sdk serve`. Hosted start or health failures:
 | `403` on stream | Wrong principal. Same auth as create; beyond loopback send `--bearer-token`. |
 | Works on loopback, blocked via tunnel | `localDevStrict()` rejects forwarded headers. Use `--bearer-token`. Never `--allow-anonymous` with account MCP. |
 | Slack `channel idle … missing credentials` | Expected. `slack doctor --prefix <PREFIX>`. |
-| Immediate API-key error | Model turns need `CURSOR_API_KEY`. |
+| Immediate API-key error | Model turns need a Cursor credential (`CURSOR_API_KEY`, then `CURSOR_API_KEY_FILE`, then `CURSOR_SERVICE_ACCOUNT_KEY`, then `agent-sdk login`). |
 | Approvals or sandbox seeds missing | `runtime: "cloud"`. Those are local only. `validate` warns. |
 | `validate` clean, CI typecheck fails | tsx skipped types. JSON-shaped returns; `type` not `interface`. |
 

package/skills/evals/SKILL.md

@@ -29,7 +29,7 @@ agent-sdk eval --dir . --tag smoke
 | `evals/weather.eval.ts` + `{ id: "nyc" }` | `weather/nyc` |
 
 `eval` boots an ephemeral server and a temp state root. `--url`
-points at a running agent. Model turns need `CURSOR_API_KEY`.
+points at a running agent. Model turns need a Cursor credential (`CURSOR_API_KEY`, then `CURSOR_API_KEY_FILE`, then `CURSOR_SERVICE_ACCOUNT_KEY`, then `agent-sdk login`).
 
 ## Seeding
 

package/skills/framework-map/SKILL.md

@@ -28,8 +28,10 @@ Public docs: `node_modules/@cursor/july/dist/docs/llms.txt` or
    per-project cache directory under `~/.cache`. Point cwd at a
    checkout only when the agent must inherit that tree.
 5. **Attached MCP is nameless** until `advertiseTools: true`.
-6. **Model turns need `CURSOR_API_KEY`.** `validate`, `info`, `call`,
-   and `serve` bring-up do not.
+6. **Model turns need a Cursor credential** (`CURSOR_API_KEY`, then
+   `CURSOR_API_KEY_FILE`, then `CURSOR_SERVICE_ACCOUNT_KEY`, then
+   `agent-sdk login`). `validate`,
+   `info`, `call`, and `serve` bring-up do not.
 
 ## Folder structure
 

package/skills/github/SKILL.md

@@ -48,7 +48,7 @@ at deploy. Repos must share one GitHub owner.
 
 | Source | When |
 | --- | --- |
-| `cursorAccount` + `serve --cursor-events` | Preferred. Signed-in host (`agent-sdk login` / `CURSOR_API_KEY`). Repos from the channel and from repeatable `--repo owner/name`. Cap 20, one GitHub owner |
+| `cursorAccount` + `serve --cursor-events` | Preferred. Signed-in host (`agent-sdk login`, `CURSOR_API_KEY`, or `CURSOR_SERVICE_ACCOUNT_KEY`). Repos from the channel and from repeatable `--repo owner/name`. Cap 20, one GitHub owner |
 | HTTP `POST /<slug>/v1/channels/github` with a webhook secret | `allowAll()` + `X-Hub-Signature-256` |
 | HTTP, no secret | Loopback only. `serve --dev` also admits unsigned loopback (fixtures / forward) |
 

package/skills/otel/SKILL.md

@@ -33,9 +33,9 @@ export default defineOtel({
 3. `serve(dir, { otel: { … } })`. `otel: false` disables env and
    authored config.
 
-Hosted v2 secrets arrive after bake. Use `defineOtel(() => …)` so flush
-re-resolves exporters. Authored `agent/otel.ts` records from process
-start even when the factory returns no exporters yet.
+Hosted secrets can arrive after startup. Use `defineOtel(() => …)` so
+flush re-resolves exporters. Authored `agent/otel.ts` records from
+process start even when the factory returns no exporters yet.
 
 | Signal | Default |
 | --- | --- |

package/src/bin/agent-serve.ts

@@ -99,6 +99,7 @@ Usage:
   ${CLI} session     <sessionId> [--url <baseUrl> | --prod]
                           [--json | --text | --events] [--out <file.ndjson>]
                           [--slug <slug>] [--team <id>] [--dir <path>]
+                 or: --prod [<sessionId>] --slug <slug> --message "…" [--dry-run] [--as-of <instant>]
   ${CLI} cost        [sessionId] [--url <baseUrl> | --prod] [--json]
                           [--slug <slug>] [--team <id>] [--dir <path>]
   ${CLI} playground  [--url <baseUrl> | --prod] [--session <id>] [--print]
@@ -108,6 +109,7 @@ Usage:
                           [--session <id>] [--continuation-token <t>]
                           [--events <file.ndjson>] [--no-events] [--text]
                           [--timeout-ms <n>] [--no-stream] [--slug <slug>] [--team <id>]
+                          [--dry-run] [--as-of <instant>]
   ${CLI} trajectory  --events <file.ndjson> [--text]
   ${CLI} call        <tool> [--input <json>] [--dir <path> | --url <baseUrl> | --prod]
                           [--session <id>] [--slug <slug>] [--team <id>]
@@ -197,6 +199,10 @@ Commands:
               Writes a single events.ndjson trace (summarize with trajectory).
               Streams tool calls and reply text to stderr when stderr is a TTY.
               Pass --prod to hit the hosted deployment instead of a local server.
+              On an AgentSDK v2 slug, --prod starts a hosted session through
+              the control plane (Temporal, no resident engine); --session
+              ses_… resumes that exact session. A 404 falls back to the v1
+              engine alias.
   trajectory  Summarize an events.ndjson file into a trajectory.
   call        Call an authored server tool deterministically (no model turn)
               via POST /v1/tools/:toolName. --session runs it inside an
@@ -311,8 +317,11 @@ Options:
                      ALB/ECS checks; use single when one agent is the whole host.
   --dev              Dev mode: mounts POST /v1/dev/schedules/:scheduleId and
                      disables the cron runner (dispatch schedules by hand).
-  --api-key          Cursor API key (defaults to CURSOR_API_KEY, then the
-                     stored \`${CLI} login\` credential).
+  --api-key          Cursor API key (defaults to CURSOR_API_KEY, then
+                     CURSOR_API_KEY_FILE — hosted default
+                     /run/cursor/secrets/CURSOR_API_KEY when unset —
+                     then CURSOR_SERVICE_ACCOUNT_KEY, then the stored
+                     \`${CLI} login\` credential).
   --key-name         login: label for the minted API key (defaults to
                      "${CLI} (<hostname>)").
   --state-root       Durable state directory (default <dir>/.agent-serve). Put it
@@ -341,9 +350,6 @@ Options:
                      the Cursor backend's per-forge forwarder instead of
                      minting raw tokens into this process
                      (AGENT_SERVE_<FORGE>_PROXY_URL overrides a base URL).
-  --cursor-github-proxy
-                     serve: deprecated alias for --cursor-scm-proxy; removed
-                     one release after --cursor-scm-proxy ships.
   --public-url       serve: base URL where this host is reachable from outside
                      (e.g. https://agent-serve.example.com). Required for peer
                      connections (defineConnection({ agent })) on cloud-runtime
@@ -364,6 +370,9 @@ Options:
                      --dir basename. Mutually exclusive with --url. Requires
                      \`${CLI} login\`. For eval, this is how you opt into the
                      persisted server-side batch (default is local).
+  --dry-run          run/session --prod: mark the hosted v2 turn non-mutating.
+  --as-of            run/session --prod: freeze the session clock at this
+                     timezone-bearing ISO-8601 instant.
   --once             logs: print current progress / log buffer once and exit
                      (default is to follow).
   --print            playground/docs: print the URL only; do not open a
@@ -519,7 +528,6 @@ async function main(argv: string[]): Promise<number> {
       "allow-anonymous-cursor-account-mcp": { type: "boolean", default: false },
       "allow-anonymous-grokbot": { type: "boolean", default: false },
       "cursor-scm-proxy": { type: "boolean", default: false },
-      "cursor-github-proxy": { type: "boolean", default: false },
       "no-schedules": { type: "boolean", default: false },
       "no-control-plane": { type: "boolean", default: false },
       "no-playground": { type: "boolean", default: false },
@@ -575,6 +583,7 @@ async function main(argv: string[]): Promise<number> {
       context: { type: "string" },
       comment: { type: "string" },
       "dry-run": { type: "boolean", default: false },
+      "as-of": { type: "string" },
       out: { type: "string" },
       team: { type: "string" },
       "no-wait": { type: "boolean", default: false },
@@ -918,6 +927,8 @@ async function main(argv: string[]): Promise<number> {
           stateRoot: values["state-root"],
           timeoutMs: parseTimeoutMs(values["timeout-ms"]),
           stream: values["no-stream"] ? false : undefined,
+          dryRun: values["dry-run"],
+          asOf: values["as-of"],
         })
       );
     }
@@ -1098,6 +1109,10 @@ async function main(argv: string[]): Promise<number> {
     }
 
     case "session": {
+      const messages = await loadMessages(
+        values.message,
+        values["messages-file"]
+      );
       return cmdSession(
         positionals[0],
         axFromOptions({
@@ -1112,6 +1127,10 @@ async function main(argv: string[]): Promise<number> {
           text: values.text,
           rawEvents: values["raw-events"],
           out: values.out,
+          messages,
+          sessionId: values["session-id"] ?? values.session,
+          dryRun: values["dry-run"],
+          asOf: values["as-of"],
         })
       );
     }
@@ -1353,11 +1372,7 @@ async function main(argv: string[]): Promise<number> {
             : undefined,
         allowAnonymousGrokbot:
           values["allow-anonymous-grokbot"] === true ? true : undefined,
-        cursorScmProxy:
-          values["cursor-scm-proxy"] === true ||
-          values["cursor-github-proxy"] === true
-            ? true
-            : undefined,
+        cursorScmProxy: values["cursor-scm-proxy"] === true ? true : undefined,
         schedules: values["no-schedules"] === true ? false : undefined,
         noControlPlane: values["no-control-plane"] === true ? true : undefined,
         playground: values["no-playground"] === true ? false : undefined,
@@ -1496,6 +1511,8 @@ function axFromOptions(
     sessionId: partial.sessionId,
     resume: partial.resume,
     continuationToken: partial.continuationToken,
+    dryRun: partial.dryRun,
+    asOf: partial.asOf,
     timeoutMs: partial.timeoutMs,
     events: partial.events,
     text: partial.text,

package/src/channels/bitbucket/types.ts

@@ -229,10 +229,8 @@ export interface BitbucketChannelOptions {
    */
   webhookEvents?: readonly string[];
   /**
-   * Continuation selector. Omitted inherits {@link AgentConfig.architecture}:
-   * engine-minted per-PR continuation unless the agent set
-   * `architecture: "v2"` (then `bitbucket.pr/v2`, or `bitbucket.none/v2`
-   * when a non-PR event is declared).
+   * Continuation selector. Omit this to inherit the agent architecture's
+   * default. Set it explicitly only when migrating persisted identities.
    */
   continuation?: ContinuationIdentity;
   /**

package/src/channels/deployments/types.ts

@@ -56,10 +56,9 @@ export interface DeploymentsChannelOptions {
    * and then receives nothing. A bare string takes the default environment and
    * event filters.
    *
-   * Omit on hosted v2. The control plane then binds `deploy_source` edges
-   * from the deploy's watched `repositories` and the channel admits what it
-   * is sent. That is the multi-tenant shape: an agent cannot enumerate
-   * sources for a tenant it has never seen.
+   * Omit on Cursor-managed hosting. The control plane binds sources from the
+   * deployment's watched repositories, and the channel admits only what it
+   * receives. An agent cannot enumerate sources for an unseen tenant.
    *
    * Name sources to narrow below that scope, or to drive the self-hosted
    * relay, which has no deploy scope to inherit. On that wire `[]` means
@@ -89,10 +88,8 @@ export interface DeploymentsChannelOptions {
   onStart?: ChannelDefinition["onStart"];
   onStop?: ChannelDefinition["onStop"];
   /**
-   * Continuation selector. Omitted inherits {@link AgentConfig.architecture}:
-   * `"deployments.none/v1"` unless the agent set `architecture: "v2"` (then
-   * `"deployments.deployment/v2"`). Override with `"deployments.none/v2"`
-   * for one-shot events.
+   * Continuation selector. Omit this to inherit the agent architecture's
+   * default. Set it explicitly only when migrating persisted identities.
    */
   continuation?: ContinuationIdentity;
 }

package/src/channels/github/github-channel.ts

@@ -831,11 +831,9 @@ async function handlePullRequest(input: {
     dispatch.message ?? defaultGitHubPullRequestMessage(ctx, pullRequest),
     ...(dispatch.context ?? []),
   ].join("\n");
-  const cloud = await resolveCloudOptions(
-    input.options.cloud,
-    ctx,
-    pullRequest
-  );
+  const cloud =
+    dispatch.cloud ??
+    (await resolveCloudOptions(input.options.cloud, ctx, pullRequest));
   return startTurn({
     options: input.options,
     args: input.args,
@@ -1558,6 +1556,8 @@ async function startTurn(input: {
 }): Promise<Response> {
   const files = input.dispatch.workspaceFiles;
   const lazy = typeof files === "function";
+  const cloud = input.dispatch.cloud ?? input.cloud;
+  const state = { ...input.dispatch.state, ...input.state };
 
   const sendTurn = async () => {
     const workspaceFiles = lazy ? await files() : files;
@@ -1568,11 +1568,11 @@ async function startTurn(input: {
         ? { continuationToken: githubContinuationKey(input.ctx) }
         : {}),
       title: input.dispatch.title ?? defaultGitHubTitle(input.ctx),
-      ...(input.cloud === undefined ? {} : { cloud: input.cloud }),
+      cloud,
       ...(workspaceFiles === undefined ? {} : { workspaceFiles }),
-      state: input.state as unknown as JsonValue,
+      state: state as unknown as JsonValue,
       // Resume must refresh headSha / refs without wiping sticky banner id.
-      refreshState: input.state as unknown as JsonValue,
+      refreshState: state as unknown as JsonValue,
     });
   };
 

package/src/channels/github/types.ts

@@ -7,6 +7,7 @@ import type {
   ChannelEventHandlers,
   ChannelStartArgs,
   HostContext,
+  JsonObject,
   SendMessageFn,
   SendMessageOptions,
 } from "../../types.js";
@@ -355,6 +356,10 @@ export interface GitHubTurnDispatch {
   message?: string;
   /** Optional session title override. */
   title?: string;
+  /** Per-turn cloud options. Overrides the channel-level `cloud` resolver. */
+  cloud?: AgentCloudOptions;
+  /** Extra durable channel state. Provider-owned fields take precedence. */
+  state?: JsonObject;
   /**
    * Seeded into the session workspace before the turn (`send`'s
    * `workspaceFiles`). A function runs after the webhook is
@@ -480,10 +485,8 @@ export interface GitHubChannelOptions {
    */
   botName?: string;
   /**
-   * Continuation selector. Omitted inherits {@link AgentConfig.architecture}:
-   * `"github.pr/v1"` unless the agent set `architecture: "v2"` (then
-   * `"github.pr/v2"`). Override type with `"github.issue/v2"` or
-   * `"github.none/v2"` for events outside PR membership.
+   * Continuation selector. Omit this to inherit the agent architecture's
+   * default. Set it explicitly only when migrating persisted identities.
    */
   continuation?: ContinuationIdentity;
   /**

package/src/channels/gitlab/types.ts

@@ -219,11 +219,8 @@ export interface GitLabChannelOptions {
    */
   webhookEvents?: readonly string[];
   /**
-   * Continuation selector. Omitted inherits {@link AgentConfig.architecture}:
-   * engine-minted per-MR continuation unless the agent set
-   * `architecture: "v2"` (then `gitlab.mr/v2`, or `gitlab.none/v2` when a
-   * non-MR event is declared). Override with `"gitlab.none/v2"` for one-shot
-   * events.
+   * Continuation selector. Omit this to inherit the agent architecture's
+   * default. Set it explicitly only when migrating persisted identities.
    */
   continuation?: ContinuationIdentity;
   /**

package/src/channels/origin/origin-channel.ts

@@ -99,13 +99,20 @@ function asBoolean(value: unknown): boolean | undefined {
 function originActor(value: unknown): OriginActor | undefined {
   const record = asRecord(value);
   if (record === undefined) return undefined;
-  const nestedUser = asRecord(record.user);
-  const nestedApp = asRecord(record.app);
-  const id =
-    asNonEmptyString(nestedUser?.id) ??
-    asNonEmptyString(nestedApp?.id) ??
-    asNonEmptyString(asRecord(record.serviceAccount)?.id) ??
-    asNonEmptyString(record.id);
+
+  const nestedActors = [
+    ["user", asRecord(record.user)],
+    ["app", asRecord(record.app)],
+    ["service_account", asRecord(record.serviceAccount)],
+  ] as const;
+  for (const [kind, actor] of nestedActors) {
+    const id = asNonEmptyString(actor?.id);
+    if (id !== undefined) {
+      return { id, kind };
+    }
+  }
+
+  const id = asNonEmptyString(record.id);
   if (id === undefined) return undefined;
   const kind = asNonEmptyString(record.kind);
   return kind === undefined ? { id } : { id, kind };
@@ -361,16 +368,20 @@ export function defaultOriginAuth(
   ctx: Omit<OriginEventContext, "host" | "artifacts" | "origin">
 ): AuthContext {
   const senderId = ctx.sender?.id;
+  const senderKind = ctx.sender?.kind;
   return {
     authenticator: "origin-webhook",
     principalId: senderId ?? "origin",
-    principalType: ctx.sender?.kind === "app" ? "service" : "user",
+    principalType:
+      senderKind === "app" || senderKind === "service_account"
+        ? "service"
+        : "user",
     attributes: {
       conversation_kind: "pull_request",
       repository: ctx.repository.fullName,
       ...(ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId }),
       ...(senderId === undefined ? {} : { subject: senderId }),
-      ...(ctx.sender?.kind === undefined ? {} : { user_type: ctx.sender.kind }),
+      ...(senderKind === undefined ? {} : { user_type: senderKind }),
       issuer: `origin:${ctx.repository.owner}`,
     },
   };
@@ -461,17 +472,19 @@ async function startTurn(input: {
   state: OriginChannelState;
 }): Promise<Response> {
   const source = continuationSource(input.options.continuation, "origin");
+  const cloud = input.dispatch.cloud ?? input.cloud;
+  const state = { ...input.dispatch.state, ...input.state };
   const session = await input.args.send(input.message, {
     auth: input.dispatch.auth,
     ...(source === "engine"
       ? { continuationToken: originContinuationKey(input.ctx) }
       : {}),
     title: input.dispatch.title ?? defaultOriginTitle(input.ctx),
-    ...(input.cloud === undefined ? {} : { cloud: input.cloud }),
-    state: input.state as unknown as JsonValue,
+    cloud,
+    state: state as unknown as JsonValue,
     // Resume must refresh the triggering comment / delivery identifiers so
     // reply delivery targets the latest wake, not the session's first.
-    refreshState: input.state as unknown as JsonValue,
+    refreshState: state as unknown as JsonValue,
   });
   return turnStarted(session);
 }
@@ -605,7 +618,10 @@ export async function dispatchOriginWebhook(input: {
       ctx,
       dispatch,
       extra: { event: eventType },
-      message: `Origin comment on ${ctx.repository.fullName}#${ctx.pullRequestNumber}`,
+      message:
+        commentBody.trim() === ""
+          ? `Origin comment on ${ctx.repository.fullName}#${ctx.pullRequestNumber}`
+          : commentBody.trim(),
       triggeringCommentId: commentId,
     });
   }

package/src/channels/origin/types.ts

@@ -7,6 +7,7 @@ import type {
   ChannelEventHandlers,
   ChannelStartArgs,
   HostContext,
+  JsonObject,
   SendMessageFn,
 } from "../../types.js";
 import type { OriginTokenProvider } from "./api.js";
@@ -95,6 +96,10 @@ export type OriginTurnDispatch = {
   message?: string;
   title?: string;
   context?: readonly string[];
+  /** Per-turn cloud options. Overrides the channel-level `cloud` resolver. */
+  cloud?: AgentCloudOptions;
+  /** Extra durable channel state. Provider-owned fields take precedence. */
+  state?: JsonObject;
 };
 
 /** Bound per-delivery helpers passed to an {@link OriginTaskDispatch.task}. */
@@ -246,9 +251,8 @@ export interface OriginChannelOptions {
    */
   webhookEvents?: readonly string[];
   /**
-   * Continuation selector. Omitted inherits {@link AgentConfig.architecture}:
-   * `"origin.pr/v1"` unless the agent set `architecture: "v2"` (then
-   * `"origin.pr/v2"`). Override with `"origin.none/v2"` for one-shot events.
+   * Continuation selector. Omit this to inherit the agent architecture's
+   * default. Set it explicitly only when migrating persisted identities.
    */
   continuation?: ContinuationIdentity;
   /**

package/src/channels/slack/defaults.ts

@@ -362,6 +362,9 @@ export function buildDefaultEvents(
       channel.state.streamTs = null;
       channel.state.streamChannelId = null;
       channel.state.streamFull = false;
+      // A stream failure downgrades the rest of its own turn, not the thread.
+      channel.state.streamingUnavailable = false;
+      channel.state.streamAppendedChunks = 0;
       channel.state.lastPostedText = null;
       channel.state.streamBlockText = null;
       channel.state.reasoningCard = undefined;

package/src/channels/slack/dispatch.ts

@@ -132,6 +132,7 @@ export function emptySlackChannelState(
     lastBotMessageTs: null,
     streamingUnavailable: false,
     streamFull: false,
+    streamAppendedChunks: 0,
     progressTs: null,
     approvalMessageByCallId: {},
     reasoningCard: undefined,