@cursor/july 0.1.11 → 0.1.14

package/src/internal/cli-ax.ts

@@ -25,11 +25,13 @@ import {
   runDiscoveredEvals,
 } from "./eval-runner.js";
 import {
+  cancelRemoteEvalRun,
   getRemoteEvalRun,
   listRemoteEvalRuns,
   listRemoteEvals,
+  pollRemoteEvalRun,
   RemoteEvalError,
-  runRemoteEvals,
+  snapshotToEvalRunResults,
   startRemoteEvalRun,
 } from "./evals-client.js";
 import {
@@ -874,23 +876,38 @@ export async function cmdEval(options: AxCliOptions): Promise<number> {
           },
           fetchImpl: options.fetchImpl,
         });
-        return printEvalAccepted(started, options, target.agentUrl);
+        return await printEvalAccepted(started, options, target.agentUrl);
       }
 
       const progress = createRemoteEvalProgress(
         options.verbose === true || stream
       );
-      const { snapshot, results } = await runRemoteEvals({
+      // Start first so we can print the Eval ID before the (often long) wait.
+      const started = await startRemoteEvalRun({
         baseUrl: target.agentUrl,
         filterIds,
         tags,
         timeoutMs: options.timeoutMs,
         verbose: Boolean(options.verbose) || stream,
-        bearerToken: options.bearerToken,
-        headers: target.headers,
+        auth: {
+          bearerToken: options.bearerToken,
+          headers: target.headers,
+        },
+        fetchImpl: options.fetchImpl,
+      });
+      await printEvalIdBanner(started, options, target.agentUrl);
+      progress?.onSnapshot?.(started);
+      const snapshot = await pollRemoteEvalRun({
+        baseUrl: target.agentUrl,
+        runId: started.runId,
+        auth: {
+          bearerToken: options.bearerToken,
+          headers: target.headers,
+        },
         fetchImpl: options.fetchImpl,
         onSnapshot: progress === undefined ? undefined : progress.onSnapshot,
       });
+      const results = snapshotToEvalRunResults(snapshot);
       if (results.length === 0 && snapshot.status !== "failed") {
         process.stderr.write("No matching evals found.\n");
         return 2;
@@ -944,25 +961,74 @@ export function formatEvalStatusFlags(
   return parts.length === 0 ? "" : ` ${parts.join(" ")}`;
 }
 
+/** Print Eval ID + cancel/status hints after a remote batch is accepted. */
+async function printEvalIdBanner(
+  started: EvalRunSnapshot,
+  options: AxCliOptions,
+  agentUrl: string
+): Promise<void> {
+  const pollPath = `${agentUrl.replace(/\/$/, "")}/v1/dev/evals/runs/${started.runId}`;
+  const statusFlags = formatEvalStatusFlags(options);
+  const playgroundUrl = await resolveEvalPlaygroundDeepLink(
+    options,
+    started.runId,
+    agentUrl
+  );
+  if (options.json) {
+    // Waiters still want the id on stderr so progress text stays readable.
+    process.stderr.write(
+      `${JSON.stringify({
+        evalId: started.runId,
+        runId: started.runId,
+        status: started.status,
+        summary: started.summary,
+        pollUrl: pollPath,
+        ...(playgroundUrl === undefined ? {} : { playgroundUrl }),
+      })}\n`
+    );
+    return;
+  }
+  const durable = started.config.durableRuns === true ? " (persisted)" : "";
+  process.stderr.write(
+    `Eval ID: ${started.runId}${durable} — ${started.summary.total} case(s)\n`
+  );
+  process.stderr.write(
+    `Cancel:  ${CLI_COMMAND_NAME} eval cancel ${started.runId}${statusFlags}\n`
+  );
+  process.stderr.write(
+    `Status:  ${CLI_COMMAND_NAME} eval status ${started.runId}${statusFlags}\n`
+  );
+  if (playgroundUrl !== undefined) {
+    process.stderr.write(`Playground: ${playgroundUrl}\n`);
+  }
+}
+
 /** `--no-wait`: print the accepted batch id (and how to poll) then exit. */
-function printEvalAccepted(
+async function printEvalAccepted(
   started: EvalRunSnapshot,
   options: AxCliOptions,
   agentUrl: string
-): number {
+): Promise<number> {
   const pollPath = `${agentUrl.replace(/\/$/, "")}/v1/dev/evals/runs/${started.runId}`;
   const statusFlags = formatEvalStatusFlags(options);
+  const playgroundUrl = await resolveEvalPlaygroundDeepLink(
+    options,
+    started.runId,
+    agentUrl
+  );
   if (options.json) {
     console.log(
       JSON.stringify(
         {
           ok: true,
           accepted: true,
+          evalId: started.runId,
           runId: started.runId,
           status: started.status,
           summary: started.summary,
           pollUrl: pollPath,
           durableRuns: started.config.durableRuns === true,
+          ...(playgroundUrl === undefined ? {} : { playgroundUrl }),
         },
         null,
         2
@@ -971,16 +1037,126 @@ function printEvalAccepted(
   } else {
     const durable = started.config.durableRuns === true ? " (persisted)" : "";
     process.stdout.write(
-      `Accepted eval run ${started.runId}${durable} — ${started.summary.total} case(s)\n`
+      `Eval ID: ${started.runId}${durable} — ${started.summary.total} case(s)\n`
+    );
+    process.stdout.write(
+      `Cancel:  ${CLI_COMMAND_NAME} eval cancel ${started.runId}${statusFlags}\n`
     );
     process.stdout.write(
-      `Status: ${CLI_COMMAND_NAME} eval status ${started.runId}${statusFlags}\n`
+      `Status:  ${CLI_COMMAND_NAME} eval status ${started.runId}${statusFlags}\n`
     );
+    if (playgroundUrl !== undefined) {
+      process.stdout.write(`Playground: ${playgroundUrl}\n`);
+    }
     process.stdout.write(`Poll: ${pollPath}\n`);
   }
   return 0;
 }
 
+/**
+ * Hosted alias playground URL with `view=evals` + `evalRunId` so the SPA
+ * opens the batch that CLI / Slack started (not a stale sessionStorage id).
+ */
+async function resolveEvalPlaygroundDeepLink(
+  options: AxCliOptions,
+  runId: string,
+  agentUrl: string
+): Promise<string | undefined> {
+  if (options.prod !== true) {
+    const base = `${agentUrl.replace(/\/$/, "")}/playground`;
+    try {
+      const url = new URL(base);
+      url.searchParams.set("view", "evals");
+      url.searchParams.set("evalRunId", runId);
+      return url.toString();
+    } catch {
+      return undefined;
+    }
+  }
+  try {
+    const resolved = await resolveProdAliasPlaygroundUrl({
+      dir: options.dir,
+      cwd: options.cwd,
+      slug: options.slug,
+      team: options.team,
+      apiKey: options.apiKey,
+      fetchImpl: options.fetchImpl,
+      // Avoid a second "Using hosted deployment" line; banner already has context.
+      err: () => {},
+    });
+    const url = new URL(resolved.playgroundUrl);
+    url.searchParams.set("view", "evals");
+    url.searchParams.set("evalRunId", runId);
+    return url.toString();
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * `eval cancel <runId>` — cancel a running remote batch by Eval ID.
+ */
+export async function cmdEvalCancel(
+  runId: string | undefined,
+  options: AxCliOptions
+): Promise<number> {
+  const mode = resolveEvalTargetMode(options);
+  if (typeof mode === "object") {
+    process.stderr.write(`${mode.error}\n`);
+    return 2;
+  }
+  if (mode === "local") {
+    process.stderr.write(
+      "eval cancel requires --prod or --url (not the default local target)\n"
+    );
+    return 2;
+  }
+  if (runId === undefined || runId === "") {
+    process.stderr.write("usage: eval cancel <evalId> --prod|--url …\n");
+    return 2;
+  }
+  if (options.list === true || options.noWait === true) {
+    process.stderr.write("eval cancel does not accept --list or --no-wait\n");
+    return 2;
+  }
+
+  const target = await resolveEvalTarget(options);
+  if (typeof target === "number") {
+    return target;
+  }
+
+  try {
+    const snap = await cancelRemoteEvalRun({
+      baseUrl: target.agentUrl,
+      runId,
+      auth: {
+        bearerToken: options.bearerToken,
+        headers: target.headers,
+      },
+      fetchImpl: options.fetchImpl,
+    });
+    if (options.json) {
+      console.log(JSON.stringify(snap, null, 2));
+    } else {
+      process.stdout.write(
+        `Cancelled Eval ID ${snap.runId} (${snap.summary.done}/${snap.summary.total} cases finalized)\n`
+      );
+    }
+    return 0;
+  } catch (error) {
+    process.stderr.write(
+      `${sanitizeCustomerError(
+        error instanceof Error ? error.message : String(error)
+      )}\n`
+    );
+    return 1;
+  } finally {
+    if (target.close !== undefined) {
+      await target.close();
+    }
+  }
+}
+
 /**
  * `eval status [runId]` — fetch one batch (or list recent) on the deployment /
  * `--url` target. Exit `0` when the batch is completed with all cases passing,
@@ -1068,7 +1244,9 @@ export async function cmdEvalStatus(
       return 3;
     }
     const failed =
-      snap.status === "failed" || snap.cases.some((c) => c.ok !== true);
+      snap.status === "failed" ||
+      snap.status === "cancelled" ||
+      snap.cases.some((c) => c.ok !== true);
     return failed ? 1 : 0;
   } catch (error) {
     process.stderr.write(
@@ -1146,16 +1324,11 @@ function createRemoteEvalProgress(
   if (!enabled) {
     return undefined;
   }
-  let announced = false;
   let lastSummaryKey = "";
   const seenCaseKeys = new Set<string>();
   return {
     onSnapshot(snap) {
-      if (!announced) {
-        announced = true;
-        const durable = snap.config.durableRuns === true ? " (persisted)" : "";
-        process.stderr.write(`eval run: ${snap.runId}${durable}\n`);
-      }
+      // Eval ID is printed by printEvalIdBanner / printEvalAccepted.
       const summaryKey = `${snap.status}:${snap.summary.done}:${snap.summary.passed}:${snap.summary.failed}`;
       if (summaryKey !== lastSummaryKey) {
         lastSummaryKey = summaryKey;
@@ -1239,6 +1412,9 @@ function printEvalResults(
           }\n`
         );
       }
+      for (const line of r.logs ?? []) {
+        process.stdout.write(`  ${line}\n`);
+      }
       if (r.error !== undefined) {
         process.stdout.write(`  error: ${r.error}\n`);
       }

package/src/internal/cli-deploy.ts

@@ -10,13 +10,17 @@
  */
 
 import { basename, resolve } from "node:path";
-import type { AgentHostingOptions } from "../types.js";
+import {
+  type AgentHostingOptions,
+  isCursorAccountTransport,
+} from "../types.js";
 import { CursorBackendClient } from "./cursor/backend-client.js";
 import {
   cursorExternalApiUrl,
   resolveApiKey,
   SIGN_IN_HINT,
 } from "./cursor/credentials.js";
+import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import {
   AgentServeDeployClient,
   type DeployAccepted,
@@ -25,6 +29,7 @@ import {
   type DeploymentDetail,
   type DeploymentStatus,
   type DeploySource,
+  deploymentServiceAccountId,
   type SecretInfo,
   type StopAccepted,
   slugFromDirectoryName,
@@ -97,6 +102,11 @@ export interface DeployCliOptions {
   allowDomains?: string[];
   /** Test seams. */
   fetchImpl?: typeof fetch;
+  /** Inject the connector-auth browser opener (tests; also forces interactive). */
+  openBrowserImpl?: (url: string) => void;
+  sleepImpl?: (ms: number) => Promise<void>;
+  connectorPollIntervalMs?: number;
+  connectorPollTimeoutMs?: number;
   /** Inject git probing for deploy source inference (tests). */
   git?: GitRunner;
   /** Inject the multi-agent picker (tests / non-interactive hosts). */
@@ -118,6 +128,8 @@ export type SecretInputStream = NodeJS.ReadableStream & {
 interface DeployCliContext {
   client: AgentServeDeployClient;
   teamId: number;
+  apiKey: string;
+  backendUrl: string;
   json: boolean;
   noWait: boolean;
   pollIntervalMs: number;
@@ -137,6 +149,9 @@ export interface ResolveDeployAuthOptions {
 export interface ResolvedDeployAuth {
   client: AgentServeDeployClient;
   teamId: number;
+  /** The resolved account credential, for dashboard RPCs beside the deploy API. */
+  apiKey: string;
+  backendUrl: string;
 }
 
 /**
@@ -205,7 +220,12 @@ export async function resolveDeployAuth(
     );
   }
 
-  return { client, teamId };
+  return {
+    client,
+    teamId,
+    apiKey: resolved.apiKey,
+    backendUrl: resolved.backendUrl,
+  };
 }
 
 /**
@@ -233,6 +253,8 @@ async function prepare(
   return {
     client: auth.client,
     teamId: auth.teamId,
+    apiKey: auth.apiKey,
+    backendUrl: auth.backendUrl,
     json: options.json === true,
     noWait: options.noWait === true,
     pollIntervalMs: options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS,
@@ -604,8 +626,10 @@ async function deployOne(
   // The package manifest (`defineAgent({ hosting })`) is the source of
   // truth for egress domains and expected secret names; flags override or
   // augment it. Directories without an agent project (static placeholder
-  // deploys) simply have no manifest.
-  const hosting = isAgent ? await readHostingManifest(dir) : undefined;
+  // deploys) simply have no manifest. The same load supplies the
+  // cursorAccount connection refs for the post-deploy connector auth.
+  const manifest = isAgent ? await readDeployManifest(dir) : undefined;
+  const hosting = manifest?.hosting;
   const egressAllowedDomains = [
     ...new Set([
       ...(hosting?.egressDomains ?? []),
@@ -695,22 +719,125 @@ async function deployOne(
       `  playground:  ${aliasUrl}/playground (sign in with the alias token)\n` +
       `               open: ${CLI} playground --prod --slug ${slug} --team ${ctx.teamId}\n`
   );
+
+  await runPostDeployConnectorAuth(ctx, options, {
+    slug,
+    connections: manifest?.cursorAccountConnections ?? [],
+    serviceAccountId: deploymentServiceAccountId(detail),
+  });
   return 0;
 }
 
 /**
- * Read the `hosting` block from the project manifest at `dir`, or
- * undefined when the directory is not an agent project (static deploys
- * have nothing to discover).
+ * Post-deploy connector authorization for `cursorAccount` connections: the
+ * agent's connectors execute with tokens owned by the deployment's service
+ * account, which start out unauthorized. On a TTY this runs the dashboard's
+ * Authenticate flow inline (browser OAuth per connector, already-authorized
+ * ones skipped); otherwise it reports status only. Never affects the deploy
+ * outcome — anything left unauthorized just gets a playground-page pointer.
  */
-async function readHostingManifest(
-  dir: string
-): Promise<AgentHostingOptions | undefined> {
-  if (!(await isAgentProjectDir(dir))) {
-    return undefined;
+async function runPostDeployConnectorAuth(
+  ctx: DeployCliContext,
+  options: DeployCliOptions,
+  args: {
+    slug: string;
+    connections: DeployManifest["cursorAccountConnections"];
+    serviceAccountId: string | undefined;
+  }
+): Promise<void> {
+  if (args.connections.length === 0) {
+    return;
   }
+
+  const { serviceAccountId } = args;
+  if (serviceAccountId === undefined) {
+    ctx.err(
+      `warning: this agent uses Cursor account connectors, but the deployment has no service account; redeploy to mint one.\n`
+    );
+    return;
+  }
+
+  const backendClient = new CursorBackendClient({
+    backendUrl: ctx.backendUrl,
+    apiKey: ctx.apiKey,
+    fetchImpl: options.fetchImpl,
+  });
+
+  const interactive =
+    options.openBrowserImpl !== undefined ||
+    (process.stdout.isTTY === true && process.stdin.isTTY === true);
+
+  let anyUnauthorized = false;
+  for (const ref of args.connections) {
+    ctx.out(
+      `\nThis agent uses Cursor account connectors (connection "${ref.name}"${
+        ref.servers === undefined || ref.servers.length === 0
+          ? ""
+          : `: ${ref.servers.join(", ")}`
+      }).\n`
+    );
+    try {
+      const result = await authorizeCursorAccountConnectors({
+        backendClient,
+        teamId: ctx.teamId,
+        slug: args.slug,
+        serviceAccountId,
+        connectionName: ref.name,
+        servers: ref.servers,
+        interactive,
+        out: ctx.out,
+        err: ctx.err,
+        openBrowserImpl: options.openBrowserImpl,
+        sleep: options.sleepImpl,
+        pollIntervalMs: options.connectorPollIntervalMs,
+        pollTimeoutMs: options.connectorPollTimeoutMs,
+      });
+      if (result.pending.length > 0 || result.errored.length > 0) {
+        anyUnauthorized = true;
+        if (result.pending.length > 0) {
+          ctx.out(
+            `Connectors not authorized yet: ${result.pending.join(", ")}.\n`
+          );
+        }
+      }
+    } catch (error) {
+      anyUnauthorized = true;
+      ctx.err(
+        `warning: could not check connector authorization for "${ref.name}": ${describeError(error)}\n`
+      );
+    }
+  }
+
+  if (anyUnauthorized) {
+    ctx.out(
+      `You can authorize connectors at the playground page (cursor.com dashboard → Deployed Agents → ${args.slug}) or with \`${CLI} mcp oauth <connection>\`.\n`
+    );
+  }
+}
+
+interface DeployManifest {
+  hosting: AgentHostingOptions | undefined;
+  /** `cursorAccount` connections declared by the agent. */
+  cursorAccountConnections: Array<{
+    name: string;
+    servers: string[] | undefined;
+  }>;
+}
+
+/**
+ * Read the deploy-relevant bits of the project manifest at `dir` in one
+ * load: the `hosting` block plus the agent's cursorAccount connections.
+ */
+async function readDeployManifest(dir: string): Promise<DeployManifest> {
   const project = await loadAgentProject(dir);
-  return project.agent.hosting;
+  return {
+    hosting: project.agent.hosting,
+    cursorAccountConnections: project.agent.connections.flatMap((connection) =>
+      isCursorAccountTransport(connection.transport)
+        ? [{ name: connection.name, servers: connection.transport.servers }]
+        : []
+    ),
+  };
 }
 
 /**

package/src/internal/cli-mcp-oauth.ts

@@ -1,5 +1,11 @@
 /**
- * `agentkit mcp oauth <connection> [--store]` for `defineConnection({ url, oauth: true })`.
+ * `agentkit mcp oauth <connection> [--store]`.
+ *
+ * Host MCP OAuth for `defineConnection({ url, oauth: true })` (local tokens,
+ * optionally stored as deployment secrets), and service-account connector
+ * authorization for `defineConnection({ cursorAccount: true })` (tokens
+ * stored backend-side against the hosted deployment's service account — see
+ * `cursor-account-mcp-auth.ts`).
  */
 
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
@@ -7,7 +13,11 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { isCursorAccountTransport } from "../types.js";
 import { resolveDeployAuth } from "./cli-deploy.js";
+import { CursorBackendClient } from "./cursor/backend-client.js";
+import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
+import { deploymentServiceAccountId } from "./deploy-client.js";
 import { loadAgentProject } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
 import {
@@ -22,13 +32,19 @@ import { resolveProdSlug } from "./resolve-prod-target.js";
 export type McpOauthCliOptions = {
   dir: string;
   connection: string;
-  /** Upsert MCP_OAUTH_* on the hosted deployment. */
+  /** Upsert MCP_OAUTH_* on the hosted deployment (host-OAuth connections only). */
   store?: boolean;
   slug?: string;
   team?: string;
   apiKey?: string;
   err?: (text: string) => void;
   out?: (text: string) => void;
+  /** Test seams. */
+  fetchImpl?: typeof fetch;
+  openBrowserImpl?: (url: string) => void;
+  sleep?: (ms: number) => Promise<void>;
+  pollIntervalMs?: number;
+  pollTimeoutMs?: number;
 };
 
 function describe(error: unknown): string {
@@ -66,9 +82,16 @@ export async function cmdMcpOauth(
   }
 
   const transport = connection.transport;
+  if (isCursorAccountTransport(transport)) {
+    return cmdMcpOauthCursorAccount(options, {
+      servers: transport.servers,
+      out,
+      err,
+    });
+  }
   if (!("url" in transport) || transport.oauth !== true) {
     err(
-      `${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }).\n`
+      `${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }) or defineConnection({ cursorAccount: true }).\n`
     );
     return 1;
   }
@@ -184,6 +207,102 @@ export async function cmdMcpOauth(
   });
 }
 
+/**
+ * `mcp oauth` for a `cursorAccount` connection: authorize the hosted
+ * deployment's service account for the connection's connectors. Tokens are
+ * stored backend-side by the cursor.com OAuth callback, so `--store` (a
+ * deployment-secrets concept) is a no-op here.
+ */
+async function cmdMcpOauthCursorAccount(
+  options: McpOauthCliOptions,
+  args: {
+    servers: string[] | undefined;
+    out: (text: string) => void;
+    err: (text: string) => void;
+  }
+): Promise<number> {
+  const { out, err } = args;
+
+  let slug: string;
+  try {
+    slug = resolveProdSlug({ dir: options.dir, slug: options.slug });
+  } catch (error) {
+    err(`${LOG_PREFIX} ${describe(error)}\n`);
+    return 1;
+  }
+
+  const auth = await resolveDeployAuth({
+    team: options.team,
+    apiKey: options.apiKey,
+    fetchImpl: options.fetchImpl,
+    err,
+  });
+  if (typeof auth === "number") {
+    return auth;
+  }
+  const backendClient = new CursorBackendClient({
+    backendUrl: auth.backendUrl,
+    apiKey: auth.apiKey,
+    fetchImpl: options.fetchImpl,
+  });
+
+  let serviceAccountId: string | undefined;
+  try {
+    const detail = await auth.client.getDeployment({
+      teamId: auth.teamId,
+      slug,
+    });
+    serviceAccountId = deploymentServiceAccountId(detail);
+  } catch (error) {
+    err(
+      `${LOG_PREFIX} Could not load deployment "${slug}" (team ${auth.teamId}): ${describe(error)}\n` +
+        `${LOG_PREFIX} Deploy first with \`${CLI} deploy\`.\n`
+    );
+    return 1;
+  }
+  if (serviceAccountId === undefined) {
+    err(
+      `${LOG_PREFIX} Deployment "${slug}" has no service account yet (it predates service-account-backed deploys). Redeploy with \`${CLI} deploy\` and rerun.\n`
+    );
+    return 1;
+  }
+
+  if (options.store === true) {
+    out(
+      `${LOG_PREFIX} Note: --store is not needed for cursorAccount connections — tokens are stored on the Cursor backend against the deployment's service account.\n`
+    );
+  }
+
+  out(
+    `${LOG_PREFIX} Authorizing connection "${options.connection}" for ${slug}'s service account…\n`
+  );
+  const result = await authorizeCursorAccountConnectors({
+    backendClient,
+    teamId: auth.teamId,
+    slug,
+    serviceAccountId,
+    connectionName: options.connection,
+    servers: args.servers,
+    interactive: true,
+    out,
+    err,
+    openBrowserImpl: options.openBrowserImpl,
+    sleep: options.sleep,
+    pollIntervalMs: options.pollIntervalMs,
+    pollTimeoutMs: options.pollTimeoutMs,
+  });
+
+  if (result.pending.length > 0 || result.errored.length > 0) {
+    err(
+      `${LOG_PREFIX} You can authorize connectors any time from the playground page ` +
+        `(cursor.com dashboard → Deployed Agents → ${slug}) or by rerunning ` +
+        `\`${CLI} mcp oauth ${options.connection}\`.\n`
+    );
+    return 1;
+  }
+  return 0;
+}
+
 async function storeOauthSecrets(args: {
   connection: string;
   dir: string;