@cursor/july 0.1.107 → 0.1.108

package/dist/internal/channel-route-dispatch.js

@@ -0,0 +1,62 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { jsonResponse } from "./http-channel.js";
+import { validateToolInput } from "./json-schema.js";
+/**
+ * Run one authored channel route: validate the declared Zod query / body
+ * schemas onto `handlerArgs`, then call the handler. Shared by the local
+ * router mount and hosted catch replay so a caught request meets exactly
+ * the same schema gate as a direct one.
+ */
+export function invokeChannelRoute(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { route, handlerArgs } = input;
+        let request = input.request;
+        if (route.querySchema !== undefined) {
+            const rawQuery = Object.fromEntries(new URL(request.url).searchParams.entries());
+            const queryValidation = validateToolInput(route.querySchema, rawQuery);
+            if (!queryValidation.ok) {
+                return jsonResponse({ error: queryValidation.message }, { status: 400 });
+            }
+            handlerArgs.query = queryValidation.value;
+        }
+        if (route.bodySchema !== undefined) {
+            // Buffer once so handlers that need the raw body (e.g. GitHub HMAC) can
+            // still read `request.text()` / `request.json()`.
+            let bodyText;
+            try {
+                bodyText = yield request.text();
+            }
+            catch (_a) {
+                return jsonResponse({ error: "Failed to read request body" }, { status: 400 });
+            }
+            let rawBody;
+            try {
+                rawBody = bodyText === "" ? {} : JSON.parse(bodyText);
+            }
+            catch (_b) {
+                return jsonResponse({ error: "Request body must be valid JSON" }, { status: 400 });
+            }
+            const bodyValidation = validateToolInput(route.bodySchema, rawBody);
+            if (!bodyValidation.ok) {
+                return jsonResponse({ error: bodyValidation.message }, { status: 400 });
+            }
+            handlerArgs.body = bodyValidation.value;
+            request = new Request(request.url, {
+                method: request.method,
+                headers: request.headers,
+                body: bodyText === "" ? undefined : bodyText,
+                // node: undici / fetch may require duplex for streamed bodies;
+                // a string body does not.
+            });
+        }
+        return route.handler(request, handlerArgs);
+    });
+}

package/dist/internal/channel-state.d.ts

@@ -0,0 +1,17 @@
+import type { JsonValue } from "../types.js";
+/**
+ * Shallow-merge a wake patch into durable channel state. Null / undefined
+ * patch values leave the existing key alone so sticky fields survive.
+ */
+export declare function mergeChannelStateSkipNull(current: JsonValue | undefined, patch: JsonValue | undefined): JsonValue | undefined;
+/**
+ * Apply handler mutations made against a turn snapshot without reverting
+ * unchanged fields refreshed by a later delivery. At a changed path, objects
+ * merge recursively, arrays and scalars replace, and deletions win.
+ */
+export declare function mergeChannelStateMutation(args: {
+    current: JsonValue | undefined;
+    before: JsonValue;
+    after: JsonValue;
+}): JsonValue | undefined;
+//# sourceMappingURL=channel-state.d.ts.map

package/dist/internal/channel-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-state.d.ts","sourceRoot":"","sources":["../../src/internal/channel-state.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAW7C;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,GAAG,SAAS,EAC9B,KAAK,EAAE,SAAS,GAAG,SAAS,GAC3B,SAAS,GAAG,SAAS,CAgBvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC;CAClB,GAAG,SAAS,GAAG,SAAS,CAiDxB"}

package/dist/internal/channel-state.js

@@ -0,0 +1,78 @@
+import { isDeepStrictEqual } from "node:util";
+function asRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Shallow-merge a wake patch into durable channel state. Null / undefined
+ * patch values leave the existing key alone so sticky fields survive.
+ */
+export function mergeChannelStateSkipNull(current, patch) {
+    if (patch === undefined) {
+        return current;
+    }
+    const currentRecord = asRecord(current);
+    const patchRecord = asRecord(patch);
+    if (currentRecord === undefined || patchRecord === undefined) {
+        return structuredClone(patch);
+    }
+    const merged = Object.assign({}, currentRecord);
+    for (const [key, value] of Object.entries(patchRecord)) {
+        if (value !== null && value !== undefined) {
+            merged[key] = value;
+        }
+    }
+    return merged;
+}
+/**
+ * Apply handler mutations made against a turn snapshot without reverting
+ * unchanged fields refreshed by a later delivery. At a changed path, objects
+ * merge recursively, arrays and scalars replace, and deletions win.
+ */
+export function mergeChannelStateMutation(args) {
+    const { current, before, after } = args;
+    if (isDeepStrictEqual(before, after)) {
+        return current;
+    }
+    const currentRecord = asRecord(current);
+    const beforeRecord = asRecord(before);
+    const afterRecord = asRecord(after);
+    if (currentRecord === undefined ||
+        beforeRecord === undefined ||
+        afterRecord === undefined) {
+        return structuredClone(after);
+    }
+    const merged = structuredClone(currentRecord);
+    const keys = new Set([
+        ...Object.keys(beforeRecord),
+        ...Object.keys(afterRecord),
+    ]);
+    for (const key of keys) {
+        const hadBefore = Object.hasOwn(beforeRecord, key);
+        const hasAfter = Object.hasOwn(afterRecord, key);
+        if (hadBefore &&
+            hasAfter &&
+            isDeepStrictEqual(beforeRecord[key], afterRecord[key])) {
+            continue;
+        }
+        if (!hasAfter) {
+            delete merged[key];
+            continue;
+        }
+        const currentValue = merged[key];
+        const afterValue = afterRecord[key];
+        merged[key] =
+            hadBefore ||
+                (asRecord(currentValue) !== undefined &&
+                    asRecord(afterValue) !== undefined)
+                ? mergeChannelStateMutation({
+                    current: currentValue,
+                    before: hadBefore ? beforeRecord[key] : {},
+                    after: afterValue,
+                })
+                : structuredClone(afterValue);
+    }
+    return merged;
+}

package/dist/internal/cli-ax.d.ts

@@ -113,6 +113,13 @@ export interface AxCliOptions {
     resume?: boolean;
     /** Abort signal (tests / programmatic stop of `playground` proxy). */
     signal?: AbortSignal;
+    /**
+     * `run --prod` / `session --prod --message`: hosted v2 session start on
+     * the agentsdk control plane. `--dry-run` marks the turn non-mutating;
+     * `--as-of` freezes the session clock at a timezone-bearing instant.
+     */
+    dryRun?: boolean;
+    asOf?: string;
 }
 export interface ResolvedAgentTarget {
     agentUrl: string;

package/dist/internal/cli-ax.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-ax.d.ts","sourceRoot":"","sources":["../../src/internal/cli-ax.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,aAAa,CAAC;AAmErB,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAsED,wBAAsB,aAAa,CACjC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuJpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAUD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA8GpE;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA4GnE;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DpE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAe1E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAAC,GAC1C,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAepD;AAiDD,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmNpE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,GAC5D,MAAM,CAcR;AAsID;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CA8GjB;AAmGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACvC,MAAM,GAAG,SAAS,CASpB;AAoJD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,mBAAmB,GAC7B,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAgFpE;AAmCD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxE;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAKD;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAoF1E"}
+{"version":3,"file":"cli-ax.d.ts","sourceRoot":"","sources":["../../src/internal/cli-ax.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,aAAa,CAAC;AAqErB,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAsED,wBAAsB,aAAa,CACjC,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAED,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuJpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAcjB;AAUD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA8GpE;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAqHnE;AAsED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DpE;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAe1E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAAC,GAC1C,OAAO,GAAG,KAAK,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAepD;AAiDD,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmNpE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,GAC5D,MAAM,CAcR;AAsID;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CA8GjB;AAmGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GACvC,MAAM,GAAG,SAAS,CASpB;AAoJD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,mBAAmB,GAC7B,MAAM,CAgBR;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsFpE;AAmCD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxE;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAgFjB;AAKD;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAoF1E"}

package/dist/internal/cli-ax.js

@@ -24,12 +24,14 @@ import { lookupSessionContinuation, runChat } from "./chat-client.js";
 import { ensureCursorLogin } from "./cli-cursor.js";
 import { resolveDeployAuth } from "./cli-deploy.js";
 import { resolveApiKey } from "./cursor/credentials.js";
+import { DeployApiError } from "./deploy-client.js";
 import { CLI_COMMAND_NAME, PACKAGE_NAME } from "./distribution.js";
 import { discoverEvals, filterDiscoveredEvals, runDiscoveredEvals, } from "./eval-runner.js";
 import { cancelRemoteEvalRun, getRemoteEvalRun, listRemoteEvalRuns, listRemoteEvals, pollRemoteEvalRun, RemoteEvalError, snapshotToEvalRunResults, startRemoteEvalRun, } from "./evals-client.js";
 import { runTemplateInit } from "./init-interview.js";
 import { checkInitTarget, formatInitNextSteps, formatInitScaffoldSummary, initNextCommands, initProject, installScaffoldDependencies, linkCliOntoPath, printInitGuide, resolveTemplate, } from "./init-project.js";
 import { offerInstallCursorSkills } from "./install-cursor-skills.js";
+import { rejectV2ForLegacyCommand } from "./legacy-command-guard.js";
 import { runLogsTail, sanitizeCustomerError } from "./logs-client.js";
 import { mapPool } from "./map-pool.js";
 import { openBrowser } from "./open-browser.js";
@@ -377,6 +379,15 @@ export function cmdChat(options) {
 export function cmdRun(options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
+        // Only a v2-shaped request tries the control plane; every v1 `run --prod`
+        // form (multi-turn, continuation token, local session id, --url) keeps its
+        // engine-alias path untouched.
+        if (options.prod === true && hostedSessionRejection(options) === undefined) {
+            const started = yield cmdHostedSession(options);
+            if (started !== "fallback") {
+                return started;
+            }
+        }
         const messages = (_a = options.messages) !== null && _a !== void 0 ? _a : [];
         if (messages.length === 0) {
             die("Provide --message (repeatable) or --messages-file");
@@ -472,6 +483,73 @@ export function cmdRun(options) {
         }
     });
 }
+const HOSTED_SESSION_ID_RE = /^ses_[a-f0-9]{24}$/;
+/**
+ * Hosted v2 session start: POST the agentsdk control plane, which hands the
+ * wake to Temporal (no resident engine, no `/engine/*` alias). `--session
+ * ses_…` resumes that exact session; there is no continuation token on
+ * this path. A 404 means the slug is not a v2 control-plane deployment, so
+ * `run --prod` falls back to the v1 engine alias.
+ */
+/** Why these options cannot be a hosted v2 session start, if they cannot. */
+function hostedSessionRejection(options) {
+    var _a;
+    var _b;
+    if (options.url !== undefined) {
+        return "--prod session start talks to the agentsdk control plane; do not pass --url";
+    }
+    const messages = (_b = options.messages) !== null && _b !== void 0 ? _b : [];
+    if (messages.length !== 1 || ((_a = messages[0]) === null || _a === void 0 ? void 0 : _a.trim()) === "") {
+        return "Provide exactly one --message (the wake). Multi-turn runs are local-only.";
+    }
+    if (trimNonEmpty(options.continuationToken) !== undefined) {
+        return "--continuation-token is not a hosted v2 identity; pass --session ses_… to resume a session";
+    }
+    const sessionId = trimNonEmpty(options.sessionId);
+    if (sessionId !== undefined && !HOSTED_SESSION_ID_RE.test(sessionId)) {
+        return `--session must be a hosted session id (ses_…), got ${sessionId}`;
+    }
+    return undefined;
+}
+function cmdHostedSession(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const rejection = hostedSessionRejection(options);
+        if (rejection !== undefined) {
+            die(rejection);
+        }
+        const messages = (_a = options.messages) !== null && _a !== void 0 ? _a : [];
+        const sessionId = trimNonEmpty(options.sessionId);
+        const auth = yield resolveDeployAuth({
+            team: options.team,
+            apiKey: options.apiKey,
+            fetchImpl: options.fetchImpl,
+        });
+        if (typeof auth === "number") {
+            return auth;
+        }
+        const slug = resolveProdSlug(options);
+        try {
+            const accepted = yield auth.client.startSession({
+                teamId: auth.teamId,
+                slug,
+                message: messages[0].trim(),
+                sessionId,
+                dryRun: options.dryRun,
+                asOf: options.asOf,
+            });
+            console.log(JSON.stringify(accepted, null, 2));
+            return 0;
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                return "fallback";
+            }
+            process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+            return 1;
+        }
+    });
+}
 /**
  * `agent-sdk call <tool>` — deterministic tool invocation over
  * `POST /v1/tools/:toolName` (ephemeral local server unless --url).
@@ -1301,6 +1379,11 @@ export function cmdLogs(options) {
                 if (typeof auth === "number") {
                     return auth;
                 }
+                yield rejectV2ForLegacyCommand({
+                    client: auth.client,
+                    teamId: auth.teamId,
+                    slug,
+                });
                 yield runLogsTail({
                     prod: true,
                     dir: options.dir,
@@ -1323,6 +1406,7 @@ export function cmdLogs(options) {
                             apiKey: options.apiKey,
                             fetchImpl: options.fetchImpl,
                             err: () => { },
+                            skipLegacyArchitectureCheck: true,
                         });
                         return { agentUrl: target.agentUrl, headers: target.headers };
                     }),
@@ -1428,8 +1512,22 @@ export function cmdSessions(options) {
  */
 export function cmdSession(sessionId, options) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b, _c;
+        if (options.prod === true && ((_b = (_a = options.messages) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0) {
+            // `session --prod [ses_…] --message` is the same hosted start as
+            // `run --prod`, with the positional id as the session to resume. Unlike
+            // `run`, a 404 is an error here: this form is explicitly v2.
+            const started = yield cmdHostedSession(Object.assign(Object.assign({}, options), { sessionId: (_c = trimNonEmpty(sessionId)) !== null && _c !== void 0 ? _c : options.sessionId }));
+            if (started === "fallback") {
+                process.stderr.write(`Hosted session start returned 404 for slug ${resolveProdSlug(options)}: deploy a running AgentSDK v2 agent, or use \`${CLI_COMMAND_NAME} run --prod\` (falls back to the v1 engine).\n`);
+                return 1;
+            }
+            return started;
+        }
         if (sessionId === undefined || sessionId.trim() === "") {
-            process.stderr.write(`Usage: ${CLI_COMMAND_NAME} session <sessionId> [--url | --prod] [--json | --text | --events] [--out <file.ndjson>]\n`);
+            process.stderr.write(`Usage: ${CLI_COMMAND_NAME} session <sessionId> [--url | --prod] [--json | --text | --events] [--out <file.ndjson>]\n` +
+                `   or: ${CLI_COMMAND_NAME} session --prod [<sessionId>] --slug <slug> --message "…" [--dry-run] [--as-of <instant>]\n`);
             return 2;
         }
         if (options.rawEvents === true && options.json === true) {

package/dist/internal/cli-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-cursor.d.ts","sourceRoot":"","sources":["../../src/internal/cli-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2BH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGzE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB;IACjB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAWjD;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC1E"}
+{"version":3,"file":"cli-cursor.d.ts","sourceRoot":"","sources":["../../src/internal/cli-cursor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGzE;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB;IACjB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GACL,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAWjD;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC1E"}

package/dist/internal/cli-cursor.js

@@ -204,6 +204,8 @@ function describeSource(source) {
             return "CURSOR_API_KEY environment variable";
         case "file":
             return "CURSOR_API_KEY_FILE (task bind)";
+        case "service-account":
+            return "CURSOR_SERVICE_ACCOUNT_KEY environment variable";
         case "login":
             return `stored login (${credentialsFilePath()})`;
     }

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAgBxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmoBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAqBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAoBxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAiqBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAiBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -19,7 +19,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { basename, resolve } from "node:path";
-import { isPublicEndpointPolicy } from "../channels.js";
+import { catchAuthDeclaration, isPublicEndpointPolicy } from "../channels.js";
 import { isCursorAccountTransport, } from "../types.js";
 import { CursorBackendClient } from "./cursor/backend-client.js";
 import { cursorExternalApiUrl, resolveApiKey, SIGN_IN_HINT, } from "./cursor/credentials.js";
@@ -31,6 +31,7 @@ import { describeError } from "./describe-error.js";
 import { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
 import { isReservedSecretName, isValidCursorEventRepo, validateSettableSecretName, } from "./hosting.js";
+import { deploymentArchitecture, rejectV2ForLegacyCommand, } from "./legacy-command-guard.js";
 import { deployProgressLabel, sanitizeCustomerError } from "./logs-client.js";
 import { sleep } from "./sleep.js";
 import { stderrPalette } from "./terminal-style.js";
@@ -422,7 +423,7 @@ export function promptChooseDeployTargets(agents, options) {
 }
 function deployOne(ctx, options, target, extras) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         const { dir, slug } = target;
         // Fill --repo/--ref/--path from the local git checkout when omitted so
         // `agent-sdk deploy` inside an agent directory is enough. Only probe git
@@ -493,6 +494,12 @@ function deployOne(ctx, options, target, extras) {
             // without the alias token before the deploy is accepted.
             ctx.err(`  public: ${publicRoutePaths.join(", ")} (served WITHOUT the alias token — these channels authenticate requests themselves)\n`);
         }
+        const deadSecretChannels = (_h = manifest === null || manifest === void 0 ? void 0 : manifest.publicChannelIdsWithDeadSecretPolicies) !== null && _h !== void 0 ? _h : [];
+        if (!ctx.json && deadSecretChannels.length > 0) {
+            ctx.err(`warning: ${deadSecretChannels
+                .map((channelId) => `/v1/channels/${channelId}`)
+                .join(", ")}: publicEndpoint() sits beside sharedSecretAuth()/hmacSignatureAuth() — auth chains are any-of, so every request is admitted and those secret policies never run. Drop publicEndpoint() to enforce them, or drop them to make the intent explicit.\n`);
+        }
         if ((manifest === null || manifest === void 0 ? void 0 : manifest.architecture) === "v2") {
             if (!ctx.json) {
                 ctx.err("  architecture: v2\n");
@@ -572,7 +579,7 @@ function deployOne(ctx, options, target, extras) {
             ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
-        const deployedPublicRoutes = (_h = detail.publicRoutePaths) !== null && _h !== void 0 ? _h : [];
+        const deployedPublicRoutes = (_j = detail.publicRoutePaths) !== null && _j !== void 0 ? _j : [];
         ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
             `  status:      running\n` +
             `  generation:  ${detail.generation}\n` +
@@ -587,7 +594,7 @@ function deployOne(ctx, options, target, extras) {
                 .join(""));
         yield runPostDeployConnectorAuth(ctx, options, {
             slug,
-            connections: (_j = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _j !== void 0 ? _j : [],
+            connections: (_k = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _k !== void 0 ? _k : [],
             serviceAccountId: deploymentServiceAccountId(detail),
         });
         return 0;
@@ -834,6 +841,18 @@ function readDeployManifest(dir) {
             publicChannelIds: project.channels
                 .filter((channel) => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
                 .map((channel) => channel.id),
+            publicChannelIdsWithDeadSecretPolicies: project.channels
+                .filter((channel) => {
+                var _a;
+                const auth = (_a = channel.definition.auth) !== null && _a !== void 0 ? _a : [];
+                return (auth.some(isPublicEndpointPolicy) &&
+                    auth.some((policy) => {
+                        var _a;
+                        const kind = (_a = catchAuthDeclaration(policy)) === null || _a === void 0 ? void 0 : _a.kind;
+                        return kind !== undefined && kind !== "public";
+                    }));
+            })
+                .map((channel) => channel.id),
             httpChannelPublicEndpoint: ((_a = project.httpChannel.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy),
             hasScmChannels: project.channels.some((channel) => {
                 var _a;
@@ -1172,6 +1191,11 @@ export function cmdRotateToken(slug, options) {
         }
         let aliasToken;
         try {
+            yield rejectV2ForLegacyCommand({
+                client: ctx.client,
+                teamId: ctx.teamId,
+                slug,
+            });
             aliasToken = yield ctx.client.rotateAliasToken({
                 teamId: ctx.teamId,
                 slug,
@@ -1204,6 +1228,11 @@ export function cmdRotatePodCredential(slug, options) {
         }
         let podCredentialMaskedKey;
         try {
+            yield rejectV2ForLegacyCommand({
+                client: ctx.client,
+                teamId: ctx.teamId,
+                slug,
+            });
             podCredentialMaskedKey = yield ctx.client.rotatePodCredential({
                 teamId: ctx.teamId,
                 slug,
@@ -1226,16 +1255,11 @@ export function cmdRotatePodCredential(slug, options) {
 // ============================================================================
 function secretDeploymentArchitecture(ctx, slug) {
     return __awaiter(this, void 0, void 0, function* () {
-        try {
-            yield ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug });
-            return "v2";
-        }
-        catch (error) {
-            if (error instanceof DeployApiError && error.status === 404) {
-                return "v1";
-            }
-            throw error;
-        }
+        return deploymentArchitecture({
+            client: ctx.client,
+            teamId: ctx.teamId,
+            slug,
+        });
     });
 }
 export function cmdSecretsSet(slug, specs, options) {

package/dist/internal/cli-mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/cli-mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAiB5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAiBF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA4DjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC3E;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAElB;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAoG7B"}
+{"version":3,"file":"cli-mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/cli-mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAqB5E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAiBF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA4DjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC3E;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAElB;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAoG7B"}

package/dist/internal/cli-mcp-oauth.js

@@ -27,6 +27,7 @@ import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import { deploymentServiceAccountId } from "./deploy-client.js";
 import { loadAgentProject } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
+import { isUnsupportedV2LegacyCommandError, rejectV2ForLegacyCommand, } from "./legacy-command-guard.js";
 import { createHostMcpOAuthProvider, MCP_OAUTH_CALLBACK_URL, openBrowser, waitForMcpOAuthCallback, } from "./mcp-oauth.js";
 import { upsertHostMcpOauthSecrets } from "./mcp-oauth-persist.js";
 import { resolveProdSlug } from "./resolve-prod-target.js";
@@ -222,6 +223,11 @@ function cmdMcpOauthCursorAccount(options, args) {
         });
         let serviceAccountId;
         try {
+            yield rejectV2ForLegacyCommand({
+                client: auth.client,
+                teamId: auth.teamId,
+                slug,
+            });
             const detail = yield auth.client.getDeployment({
                 teamId: auth.teamId,
                 slug,
@@ -229,6 +235,10 @@ function cmdMcpOauthCursorAccount(options, args) {
             serviceAccountId = deploymentServiceAccountId(detail);
         }
         catch (error) {
+            if (isUnsupportedV2LegacyCommandError(error)) {
+                err(`${LOG_PREFIX} ${error.message}\n`);
+                return 1;
+            }
             err(`${LOG_PREFIX} Could not load deployment "${slug}" (team ${auth.teamId}): ${describe(error)}\n` +
                 `${LOG_PREFIX} Deploy first with \`${CLI} deploy\`.\n`);
             return 1;
@@ -289,6 +299,11 @@ function storeOauthSecrets(args) {
             return auth;
         }
         try {
+            yield rejectV2ForLegacyCommand({
+                client: auth.client,
+                teamId: auth.teamId,
+                slug,
+            });
             const secretNames = yield upsertHostMcpOauthSecrets({
                 connection: args.connection,
                 tokens,

package/dist/internal/cli-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-mcp.d.ts","sourceRoot":"","sources":["../../src/internal/cli-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EAGL,iBAAiB,EAClB,MAAM,0BAA0B,CAAC;AA2BlC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACjD,qBAAqB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,aAAa,GAAG;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GACA,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAMD,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFzE;AAwRD,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA4G3E;AAoGD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE,MAAsC,GAC3C,MAAM,CAGR;AAqED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQnD"}
+{"version":3,"file":"cli-mcp.d.ts","sourceRoot":"","sources":["../../src/internal/cli-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIpD,OAAO,EAGL,iBAAiB,EAClB,MAAM,0BAA0B,CAAC;AA2BlC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACjD,qBAAqB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC3C,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,aAAa,GAAG;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GACA,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAMD,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFzE;AAwRD,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA4G3E;AA8GD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,IAAI,GAAE,MAAsC,GAC3C,MAAM,CAGR;AAqED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQnD"}

package/dist/internal/cli-mcp.js

@@ -40,6 +40,7 @@ import { dirname, join } from "node:path";
 import { resolveDeployAuth } from "./cli-deploy.js";
 import { DeployApiError } from "./deploy-client.js";
 import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
+import { rejectV2ForLegacyCommand } from "./legacy-command-guard.js";
 import { ProdTargetError, resolveProdSlug, resolveProdTarget, } from "./resolve-prod-target.js";
 import { sleep as defaultSleep } from "./sleep.js";
 /** Mount path of the MCP surface relative to an agent base URL. */
@@ -525,6 +526,17 @@ function cmdMcpInstallRemote(options) {
         if (typeof auth === "number") {
             return auth;
         }
+        try {
+            yield rejectV2ForLegacyCommand({
+                client: auth.client,
+                teamId: auth.teamId,
+                slug,
+            });
+        }
+        catch (error) {
+            err(`${describeError(error)}\n`);
+            return 1;
+        }
         // Verify the deployment resolves before writing config that cannot work.
         // A 403 here is team membership or cloud-agent entitlement, not an
         // admin-tier read. Still write the entry: calling the gateway only

package/dist/internal/cli-slack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-slack.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAIL,cAAc,EAGf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAqB/B,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,cAAc,CAAC;IACnC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAmDD,wBAAsB,QAAQ,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CA2CjB;AA6RD,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CAoLjB;AAiDD,wBAAsB,eAAe,CACnC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD5E"}
+{"version":3,"file":"cli-slack.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAIL,cAAc,EAGf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAwB/B,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,cAAc,CAAC;IACnC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAoDD,wBAAsB,QAAQ,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAsSD,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CAoLjB;AAiDD,wBAAsB,eAAe,CACnC,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD5E"}

package/dist/internal/cli-slack.js

@@ -17,7 +17,7 @@ import { basename, extname, join, resolve as resolvePath } from "node:path";
 import { envPrefixFromName, formatSlackSetupGuide, initSlackChannel, runSlackDoctor, slackEnvKeys, } from "../channels/slack/index.js";
 import { resolveDeployAuth } from "./cli-deploy.js";
 import { cmdSlackInit, runSlackManifest, } from "./cli-slack-manual.js";
-import { cursorExternalApiUrl } from "./cursor/credentials.js";
+import { cursorExternalApiUrl, resolveApiKeySync, } from "./cursor/credentials.js";
 import { slugFromDirectoryName } from "./deploy-client.js";
 import { inferDeployGitSource } from "./deploy-source.js";
 import { describeError } from "./describe-error.js";
@@ -52,7 +52,8 @@ create/destroy/icon — dedicated Socket Mode app via the Cursor dashboard:
   create   Opens the signed-in dashboard wizard. Finish name, workspace,
            and Slack consent there. The CLI writes the token pair into
            <dir>/.env.local and runs doctor. Requires \`${CLI} login\`
-           (or CURSOR_API_KEY). --prod provisions the prod app (default
+           (or CURSOR_API_KEY). A team service-account key cannot
+           provision Slack apps. --prod provisions the prod app (default
            dev). --name / --icon / --channel-posts prefill the wizard.
   destroy  Delete the provisioned Slack app for this agent (+env). Tokens
            already in .env.local are left in place (they just stop working).
@@ -274,6 +275,11 @@ function prepareProvision(options) {
         var _a, _b, _c, _d, _e;
         const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((text) => void process.stdout.write(text));
         const err = errStream(options);
+        const credential = resolveApiKeySync(options.apiKey === undefined ? undefined : { apiKey: options.apiKey });
+        if ((credential === null || credential === void 0 ? void 0 : credential.source) === "service-account") {
+            err(`A team service-account key cannot provision Slack apps. Sign in with \`${CLI} login\` or set CURSOR_API_KEY.\n`);
+            return 1;
+        }
         const auth = yield resolveDeployAuth({
             team: options.team,
             apiKey: options.apiKey,