@cursor/july 0.1.12 → 0.1.15

package/dist/internal/cli-deploy.js

@@ -18,9 +18,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { basename, resolve } from "node:path";
+import { isCursorAccountTransport, } from "../types.js";
 import { CursorBackendClient } from "./cursor/backend-client.js";
 import { cursorExternalApiUrl, resolveApiKey, SIGN_IN_HINT, } from "./cursor/credentials.js";
-import { AgentServeDeployClient, DeployApiError, slugFromDirectoryName, TERMINAL_DEPLOY_STATUSES, validateDeploymentSlug, } from "./deploy-client.js";
+import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
+import { AgentServeDeployClient, DeployApiError, deploymentServiceAccountId, slugFromDirectoryName, TERMINAL_DEPLOY_STATUSES, validateDeploymentSlug, } from "./deploy-client.js";
 import { inferDeployGitSource } from "./deploy-source.js";
 import { isAgentProjectDir, listChildAgentDirs, loadAgentProject, } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
@@ -81,7 +83,12 @@ export function resolveDeployAuth(options) {
             const dim = stderrPalette().dim;
             err(`${dim(`Using team ${teamId}${identity.teamName === undefined ? "" : ` (${identity.teamName})`} — the account's team; pass --team to override.`)}\n`);
         }
-        return { client, teamId };
+        return {
+            client,
+            teamId,
+            apiKey: resolved.apiKey,
+            backendUrl: resolved.backendUrl,
+        };
     });
 }
 /**
@@ -105,6 +112,8 @@ function prepare(options) {
         return {
             client: auth.client,
             teamId: auth.teamId,
+            apiKey: auth.apiKey,
+            backendUrl: auth.backendUrl,
             json: options.json === true,
             noWait: options.noWait === true,
             pollIntervalMs: (_c = options.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS,
@@ -348,7 +357,7 @@ export function promptChooseDeployTargets(agents, options) {
 }
 function deployOne(ctx, options, target, extras) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e, _f;
+        var _a, _b, _c, _d, _e, _f, _g;
         const { dir, slug } = target;
         // Fill --repo/--ref/--path from the local git checkout when omitted so
         // `agentkit deploy` inside an agent directory is enough. Only probe git
@@ -409,8 +418,10 @@ function deployOne(ctx, options, target, extras) {
         // The package manifest (`defineAgent({ hosting })`) is the source of
         // truth for egress domains and expected secret names; flags override or
         // augment it. Directories without an agent project (static placeholder
-        // deploys) simply have no manifest.
-        const hosting = isAgent ? yield readHostingManifest(dir) : undefined;
+        // deploys) simply have no manifest. The same load supplies the
+        // cursorAccount connection refs for the post-deploy connector auth.
+        const manifest = isAgent ? yield readDeployManifest(dir) : undefined;
+        const hosting = manifest === null || manifest === void 0 ? void 0 : manifest.hosting;
         const egressAllowedDomains = [
             ...new Set([
                 ...((_e = hosting === null || hosting === void 0 ? void 0 : hosting.egressDomains) !== null && _e !== void 0 ? _e : []),
@@ -481,21 +492,90 @@ function deployOne(ctx, options, target, extras) {
             `  alias:       ${aliasUrl}\n` +
             `  playground:  ${aliasUrl}/playground (sign in with the alias token)\n` +
             `               open: ${CLI} playground --prod --slug ${slug} --team ${ctx.teamId}\n`);
+        yield runPostDeployConnectorAuth(ctx, options, {
+            slug,
+            connections: (_g = manifest === null || manifest === void 0 ? void 0 : manifest.cursorAccountConnections) !== null && _g !== void 0 ? _g : [],
+            serviceAccountId: deploymentServiceAccountId(detail),
+        });
         return 0;
     });
 }
 /**
- * Read the `hosting` block from the project manifest at `dir`, or
- * undefined when the directory is not an agent project (static deploys
- * have nothing to discover).
+ * Post-deploy connector authorization for `cursorAccount` connections: the
+ * agent's connectors execute with tokens owned by the deployment's service
+ * account, which start out unauthorized. On a TTY this runs the dashboard's
+ * Authenticate flow inline (browser OAuth per connector, already-authorized
+ * ones skipped); otherwise it reports status only. Never affects the deploy
+ * outcome — anything left unauthorized just gets a playground-page pointer.
  */
-function readHostingManifest(dir) {
+function runPostDeployConnectorAuth(ctx, options, args) {
     return __awaiter(this, void 0, void 0, function* () {
-        if (!(yield isAgentProjectDir(dir))) {
-            return undefined;
+        if (args.connections.length === 0) {
+            return;
+        }
+        const { serviceAccountId } = args;
+        if (serviceAccountId === undefined) {
+            ctx.err(`warning: this agent uses Cursor account connectors, but the deployment has no service account; redeploy to mint one.\n`);
+            return;
+        }
+        const backendClient = new CursorBackendClient({
+            backendUrl: ctx.backendUrl,
+            apiKey: ctx.apiKey,
+            fetchImpl: options.fetchImpl,
+        });
+        const interactive = options.openBrowserImpl !== undefined ||
+            (process.stdout.isTTY === true && process.stdin.isTTY === true);
+        let anyUnauthorized = false;
+        for (const ref of args.connections) {
+            ctx.out(`\nThis agent uses Cursor account connectors (connection "${ref.name}"${ref.servers === undefined || ref.servers.length === 0
+                ? ""
+                : `: ${ref.servers.join(", ")}`}).\n`);
+            try {
+                const result = yield authorizeCursorAccountConnectors({
+                    backendClient,
+                    teamId: ctx.teamId,
+                    slug: args.slug,
+                    serviceAccountId,
+                    connectionName: ref.name,
+                    servers: ref.servers,
+                    interactive,
+                    out: ctx.out,
+                    err: ctx.err,
+                    openBrowserImpl: options.openBrowserImpl,
+                    sleep: options.sleepImpl,
+                    pollIntervalMs: options.connectorPollIntervalMs,
+                    pollTimeoutMs: options.connectorPollTimeoutMs,
+                });
+                if (result.pending.length > 0 || result.errored.length > 0) {
+                    anyUnauthorized = true;
+                    if (result.pending.length > 0) {
+                        ctx.out(`Connectors not authorized yet: ${result.pending.join(", ")}.\n`);
+                    }
+                }
+            }
+            catch (error) {
+                anyUnauthorized = true;
+                ctx.err(`warning: could not check connector authorization for "${ref.name}": ${describeError(error)}\n`);
+            }
         }
+        if (anyUnauthorized) {
+            ctx.out(`You can authorize connectors at the playground page (cursor.com dashboard → Deployed Agents → ${args.slug}) or with \`${CLI} mcp oauth <connection>\`.\n`);
+        }
+    });
+}
+/**
+ * Read the deploy-relevant bits of the project manifest at `dir` in one
+ * load: the `hosting` block plus the agent's cursorAccount connections.
+ */
+function readDeployManifest(dir) {
+    return __awaiter(this, void 0, void 0, function* () {
         const project = yield loadAgentProject(dir);
-        return project.agent.hosting;
+        return {
+            hosting: project.agent.hosting,
+            cursorAccountConnections: project.agent.connections.flatMap((connection) => isCursorAccountTransport(connection.transport)
+                ? [{ name: connection.name, servers: connection.transport.servers }]
+                : []),
+        };
     });
 }
 /**

package/dist/internal/cli-mcp-oauth.d.ts

@@ -1,16 +1,28 @@
 /**
- * `agentkit mcp oauth <connection> [--store]` for `defineConnection({ url, oauth: true })`.
+ * `agentkit mcp oauth <connection> [--store]`.
+ *
+ * Host MCP OAuth for `defineConnection({ url, oauth: true })` (local tokens,
+ * optionally stored as deployment secrets), and service-account connector
+ * authorization for `defineConnection({ cursorAccount: true })` (tokens
+ * stored backend-side against the hosted deployment's service account — see
+ * `cursor-account-mcp-auth.ts`).
  */
 export type McpOauthCliOptions = {
     dir: string;
     connection: string;
-    /** Upsert MCP_OAUTH_* on the hosted deployment. */
+    /** Upsert MCP_OAUTH_* on the hosted deployment (host-OAuth connections only). */
     store?: boolean;
     slug?: string;
     team?: string;
     apiKey?: string;
     err?: (text: string) => void;
     out?: (text: string) => void;
+    /** Test seams. */
+    fetchImpl?: typeof fetch;
+    openBrowserImpl?: (url: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
 };
 export declare function cmdMcpOauth(options: McpOauthCliOptions): Promise<number>;
 //# sourceMappingURL=cli-mcp-oauth.d.ts.map

package/dist/internal/cli-mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/cli-mcp-oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAmBH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B,CAAC;AAiBF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAsIjB"}
+{"version":3,"file":"cli-mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/cli-mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAiBF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA6IjB"}

package/dist/internal/cli-mcp-oauth.js

@@ -1,5 +1,11 @@
 /**
- * `agentkit mcp oauth <connection> [--store]` for `defineConnection({ url, oauth: true })`.
+ * `agentkit mcp oauth <connection> [--store]`.
+ *
+ * Host MCP OAuth for `defineConnection({ url, oauth: true })` (local tokens,
+ * optionally stored as deployment secrets), and service-account connector
+ * authorization for `defineConnection({ cursorAccount: true })` (tokens
+ * stored backend-side against the hosted deployment's service account — see
+ * `cursor-account-mcp-auth.ts`).
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -14,7 +20,11 @@ import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { isCursorAccountTransport } from "../types.js";
 import { resolveDeployAuth } from "./cli-deploy.js";
+import { CursorBackendClient } from "./cursor/backend-client.js";
+import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
+import { deploymentServiceAccountId } from "./deploy-client.js";
 import { loadAgentProject } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
 import { createHostMcpOAuthProvider, MCP_OAUTH_CALLBACK_URL, mcpOauthSecretNames, openBrowser, waitForMcpOAuthCallback, } from "./mcp-oauth.js";
@@ -46,8 +56,15 @@ export function cmdMcpOauth(options) {
             return 1;
         }
         const transport = connection.transport;
+        if (isCursorAccountTransport(transport)) {
+            return cmdMcpOauthCursorAccount(options, {
+                servers: transport.servers,
+                out,
+                err,
+            });
+        }
         if (!("url" in transport) || transport.oauth !== true) {
-            err(`${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }).\n`);
+            err(`${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }) or defineConnection({ cursorAccount: true }).\n`);
             return 1;
         }
         out(`${LOG_PREFIX} Authorizing "${options.connection}" (${transport.url})…\n`);
@@ -142,6 +159,82 @@ export function cmdMcpOauth(options) {
         });
     });
 }
+/**
+ * `mcp oauth` for a `cursorAccount` connection: authorize the hosted
+ * deployment's service account for the connection's connectors. Tokens are
+ * stored backend-side by the cursor.com OAuth callback, so `--store` (a
+ * deployment-secrets concept) is a no-op here.
+ */
+function cmdMcpOauthCursorAccount(options, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { out, err } = args;
+        let slug;
+        try {
+            slug = resolveProdSlug({ dir: options.dir, slug: options.slug });
+        }
+        catch (error) {
+            err(`${LOG_PREFIX} ${describe(error)}\n`);
+            return 1;
+        }
+        const auth = yield resolveDeployAuth({
+            team: options.team,
+            apiKey: options.apiKey,
+            fetchImpl: options.fetchImpl,
+            err,
+        });
+        if (typeof auth === "number") {
+            return auth;
+        }
+        const backendClient = new CursorBackendClient({
+            backendUrl: auth.backendUrl,
+            apiKey: auth.apiKey,
+            fetchImpl: options.fetchImpl,
+        });
+        let serviceAccountId;
+        try {
+            const detail = yield auth.client.getDeployment({
+                teamId: auth.teamId,
+                slug,
+            });
+            serviceAccountId = deploymentServiceAccountId(detail);
+        }
+        catch (error) {
+            err(`${LOG_PREFIX} Could not load deployment "${slug}" (team ${auth.teamId}): ${describe(error)}\n` +
+                `${LOG_PREFIX} Deploy first with \`${CLI} deploy\`.\n`);
+            return 1;
+        }
+        if (serviceAccountId === undefined) {
+            err(`${LOG_PREFIX} Deployment "${slug}" has no service account yet (it predates service-account-backed deploys). Redeploy with \`${CLI} deploy\` and rerun.\n`);
+            return 1;
+        }
+        if (options.store === true) {
+            out(`${LOG_PREFIX} Note: --store is not needed for cursorAccount connections — tokens are stored on the Cursor backend against the deployment's service account.\n`);
+        }
+        out(`${LOG_PREFIX} Authorizing connection "${options.connection}" for ${slug}'s service account…\n`);
+        const result = yield authorizeCursorAccountConnectors({
+            backendClient,
+            teamId: auth.teamId,
+            slug,
+            serviceAccountId,
+            connectionName: options.connection,
+            servers: args.servers,
+            interactive: true,
+            out,
+            err,
+            openBrowserImpl: options.openBrowserImpl,
+            sleep: options.sleep,
+            pollIntervalMs: options.pollIntervalMs,
+            pollTimeoutMs: options.pollTimeoutMs,
+        });
+        if (result.pending.length > 0 || result.errored.length > 0) {
+            err(`${LOG_PREFIX} You can authorize connectors any time from the playground page ` +
+                `(cursor.com dashboard → Deployed Agents → ${slug}) or by rerunning ` +
+                `\`${CLI} mcp oauth ${options.connection}\`.\n`);
+            return 1;
+        }
+        return 0;
+    });
+}
 function storeOauthSecrets(args) {
     return __awaiter(this, void 0, void 0, function* () {
         const tokens = args.tokens;

package/dist/internal/cursor/backend-client.d.ts

@@ -31,6 +31,20 @@ export interface CursorGithubToken {
     token: string;
     expiresAt: string;
 }
+/** One connector row from the account's dashboard MCP listing. */
+export interface AvailableMcpServer {
+    id: number;
+    name: string;
+    isTeamServer: boolean;
+    serverIdentifier?: string;
+}
+/** Per-connector OAuth status (SA-scoped when `serviceAccountId` was sent). */
+export interface McpConnectorStatus {
+    id: number;
+    requiresAuth: boolean;
+    authUrl?: string;
+    error?: string;
+}
 export interface AccountMcpTool {
     /** Fully-qualified tool name (`<server>-<tool>`), the execution key. */
     name: string;
@@ -89,6 +103,26 @@ export declare class CursorBackendClient {
         toolName: string;
         args: Record<string, unknown>;
     }): Promise<AccountMcpCallResult>;
+    /**
+     * The account's dashboard MCP connector listing (id + name per server).
+     * `teamId` pins the ambient team so team-scoped connectors resolve for
+     * multi-team accounts.
+     */
+    getAvailableMcpServers(options?: {
+        teamId?: number;
+    }): Promise<AvailableMcpServer[]>;
+    /**
+     * Probe connectors for a service account and mint OAuth `authUrl`s where
+     * authorization is needed. This is the dashboard's Authenticate flow: the
+     * caller (a team member) opens the returned URL, the cursor.com callback
+     * stores the token backend-side against the service account, and repeat
+     * probes flip `requiresAuth` off.
+     */
+    checkHttpMcpStatus(args: {
+        serverIds: number[];
+        oauthRedirectUri: string;
+        serviceAccountId: string;
+    }): Promise<McpConnectorStatus[]>;
     /** Mint a short-lived GitHub token scoped to the requested repositories. */
     getGithubToken(repos: readonly string[], options?: {
         permissions?: "read" | "pr-write" | "contents-write";

package/dist/internal/cursor/backend-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-client.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/backend-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM;IAHhC,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,YAAY,CAAC,EAAE,MAAM,YAAA,EAI/B;CACF;AAMD,QAAA,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,CACpC;IACE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CACtC,EACD,OAAO,CAQP,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMjE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AA6BD,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAgDD,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,KAAK,CACV;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC9B;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAgED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,KAAK,CAAqD;IAClE,OAAO,CAAC,aAAa,CAA8B;IAEnD,YAAY,OAAO,EAAE,0BAA0B,EAO9C;IAED,gCAAgC;IAC1B,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,CAErC;IAED;;;;OAIG;IACG,mBAAmB,CACvB,iBAAiB,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgB7B;IAED;;;;OAIG;IACG,qBAAqB,CAAC,IAAI,EAAE;QAChC,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC;IAED,4EAA4E;IACtE,cAAc,CAClB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAA;KAAE,GACjE,OAAO,CAAC,iBAAiB,CAAC,CAsC5B;YAEa,GAAG;IAwCjB,OAAO,CAAC,cAAc;YAgBR,cAAc;CAuC7B;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB;AAqBD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB"}
+{"version":3,"file":"backend-client.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/backend-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM;IAHhC,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,YAAY,CAAC,EAAE,MAAM,YAAA,EAI/B;CACF;AAMD,QAAA,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,CACpC;IACE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CACtC,EACD,OAAO,CAQP,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMjE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AA6BD,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAeD,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAeD,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAgDD,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,KAAK,CACV;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC9B;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CACrD,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAkED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,KAAK,CAAqD;IAClE,OAAO,CAAC,aAAa,CAA8B;IAEnD,YAAY,OAAO,EAAE,0BAA0B,EAO9C;IAED,gCAAgC;IAC1B,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,CAErC;IAED;;;;OAIG;IACG,mBAAmB,CACvB,iBAAiB,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgB7B;IAED;;;;OAIG;IACG,qBAAqB,CAAC,IAAI,EAAE;QAChC,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC;IAED;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAahC;IAED;;;;;;OAMG;IACG,kBAAkB,CAAC,IAAI,EAAE;QAC7B,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiBhC;IAED,4EAA4E;IACtE,cAAc,CAClB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAA;KAAE,GACjE,OAAO,CAAC,iBAAiB,CAAC,CAsC5B;YAEa,GAAG;IA+CjB,OAAO,CAAC,cAAc;YAgBR,cAAc;CAuC7B;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB;AAqBD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB"}

package/dist/internal/cursor/backend-client.js

@@ -67,6 +67,26 @@ const mcpToolSchema = z.object({
     /** `google.protobuf.Value` — an arbitrary JSON Schema object. */
     inputSchema: z.unknown().optional(),
 });
+const getAvailableMcpServersResponseSchema = z.object({
+    servers: z
+        .array(z.object({
+        id: z.number().optional(),
+        name: z.string().optional(),
+        isTeamServer: z.boolean().optional(),
+        serverIdentifier: z.string().optional(),
+    }))
+        .optional(),
+});
+const checkHttpMcpStatusResponseSchema = z.object({
+    statuses: z
+        .array(z.object({
+        id: z.number().optional(),
+        requiresAuth: z.boolean().optional(),
+        authUrl: z.string().optional(),
+        error: z.string().optional(),
+    }))
+        .optional(),
+});
 const listSandMcpToolsResponseSchema = z.object({
     servers: z
         .array(z.object({
@@ -129,14 +149,7 @@ function dashboardRpc(args) {
         try {
             return yield args.fetchImpl(`${args.backendUrl}${SERVICE_PREFIX}/${args.method}`, {
                 method: "POST",
-                headers: {
-                    "content-type": "application/json",
-                    authorization: `Bearer ${args.bearer}`,
-                    "x-ghost-mode": "true",
-                    "x-cursor-client-version": CLIENT_VERSION,
-                    "x-cursor-client-type": "agent-serve",
-                    "x-request-id": randomUUID(),
-                },
+                headers: Object.assign({ "content-type": "application/json", authorization: `Bearer ${args.bearer}`, "x-ghost-mode": "true", "x-cursor-client-version": CLIENT_VERSION, "x-cursor-client-type": "agent-serve", "x-request-id": randomUUID() }, args.extraHeaders),
                 body: JSON.stringify((_a = args.body) !== null && _a !== void 0 ? _a : {}),
                 signal: AbortSignal.timeout(args.timeoutMs),
             });
@@ -216,6 +229,52 @@ export class CursorBackendClient {
             return toCallResult((_a = parsed.result) !== null && _a !== void 0 ? _a : {});
         });
     }
+    /**
+     * The account's dashboard MCP connector listing (id + name per server).
+     * `teamId` pins the ambient team so team-scoped connectors resolve for
+     * multi-team accounts.
+     */
+    getAvailableMcpServers(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const raw = yield this.rpc("GetAvailableMcpServers", {}, LIST_TIMEOUT_MS, {
+                teamId: options === null || options === void 0 ? void 0 : options.teamId,
+            });
+            const parsed = getAvailableMcpServersResponseSchema.parse(raw);
+            return ((_a = parsed.servers) !== null && _a !== void 0 ? _a : [])
+                .filter((server) => server.id !== undefined && server.id > 0)
+                .map((server) => { var _a; return ({
+                id: server.id,
+                name: (_a = server.name) !== null && _a !== void 0 ? _a : "",
+                isTeamServer: server.isTeamServer === true,
+                serverIdentifier: server.serverIdentifier,
+            }); });
+        });
+    }
+    /**
+     * Probe connectors for a service account and mint OAuth `authUrl`s where
+     * authorization is needed. This is the dashboard's Authenticate flow: the
+     * caller (a team member) opens the returned URL, the cursor.com callback
+     * stores the token backend-side against the service account, and repeat
+     * probes flip `requiresAuth` off.
+     */
+    checkHttpMcpStatus(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const raw = yield this.rpc("CheckHttpMcpStatus", {
+                serverIds: args.serverIds,
+                oauthRedirectUri: args.oauthRedirectUri,
+                serviceAccountId: args.serviceAccountId,
+            }, LIST_TIMEOUT_MS);
+            const parsed = checkHttpMcpStatusResponseSchema.parse(raw);
+            return ((_a = parsed.statuses) !== null && _a !== void 0 ? _a : []).map((status) => { var _a; return ({
+                id: (_a = status.id) !== null && _a !== void 0 ? _a : 0,
+                requiresAuth: status.requiresAuth === true,
+                authUrl: status.authUrl,
+                error: status.error,
+            }); });
+        });
+    }
     /** Mint a short-lived GitHub token scoped to the requested repositories. */
     getGithubToken(repos, options) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -251,8 +310,11 @@ export class CursorBackendClient {
         });
     }
     rpc(method_1, body_1) {
-        return __awaiter(this, arguments, void 0, function* (method, body, timeoutMs = LIST_TIMEOUT_MS) {
+        return __awaiter(this, arguments, void 0, function* (method, body, timeoutMs = LIST_TIMEOUT_MS, options) {
             var _a, _b;
+            const extraHeaders = (options === null || options === void 0 ? void 0 : options.teamId) === undefined
+                ? undefined
+                : { "x-cursor-team-id": String(options.teamId) };
             const bearer = yield this.getAccessToken();
             const first = yield dashboardRpc({
                 fetchImpl: this.fetchImpl,
@@ -261,6 +323,7 @@ export class CursorBackendClient {
                 bearer,
                 body,
                 timeoutMs,
+                extraHeaders,
             });
             if (first.status !== 401) {
                 return parseRpcResponse(method, first);
@@ -280,6 +343,7 @@ export class CursorBackendClient {
                 bearer: retryBearer,
                 body,
                 timeoutMs,
+                extraHeaders,
             });
             if (second.status === 401 && ((_b = this.token) === null || _b === void 0 ? void 0 : _b.value) === retryBearer) {
                 // The freshly minted token was rejected too; do not keep serving it.

package/dist/internal/cursor/credentials.d.ts

@@ -17,7 +17,13 @@
 import { z } from "zod";
 export declare const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
 export declare const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
-/** Backend API base URL (`CURSOR_API_BASE_URL` override for local dev). */
+/**
+ * Base URL for main-backend-only routes (key exchange, DashboardService —
+ * these 404 on api.cursor.com). Hosted pods pin `CURSOR_API_BASE_URL` to the
+ * external API, so `AGENT_SERVE_CURSOR_BACKEND_URL` re-pins this family
+ * there. Deliberately namespaced: pod env propagates to the SDK harness,
+ * which reads the generic `CURSOR_BACKEND_URL` for its own hosts.
+ */
 export declare function cursorBackendUrl(): string;
 /**
  * External API base URL for routes served only by the external-api

package/dist/internal/cursor/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAGxE,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAsBA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CActC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAA8F,CAAC;AAQ1H,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAGxE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAUD,QAAA,MAAM,uBAAuB,EAAE,CAAC,CAAC,SAAS,CACxC;IAAE,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAA;CAAE,EAChD,OAAO,CAKP,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CACpD,iBAAiB,GAAG,SAAS,CAC9B,CAsBA;AAED,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CActC;AAED,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,MAA8F,CAAC;AAQ1H,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAU9C;AAKD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmG3B"}

package/dist/internal/cursor/credentials.js

@@ -32,10 +32,16 @@ import { CLI_COMMAND_NAME } from "../distribution.js";
 export const DEFAULT_CURSOR_BACKEND_URL = "https://api2.cursor.sh";
 export const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
 const DEFAULT_CURSOR_WEBSITE_URL = "https://cursor.com";
-/** Backend API base URL (`CURSOR_API_BASE_URL` override for local dev). */
+/**
+ * Base URL for main-backend-only routes (key exchange, DashboardService —
+ * these 404 on api.cursor.com). Hosted pods pin `CURSOR_API_BASE_URL` to the
+ * external API, so `AGENT_SERVE_CURSOR_BACKEND_URL` re-pins this family
+ * there. Deliberately namespaced: pod env propagates to the SDK harness,
+ * which reads the generic `CURSOR_BACKEND_URL` for its own hosts.
+ */
 export function cursorBackendUrl() {
-    var _a;
-    return trimTrailingSlash((_a = process.env.CURSOR_API_BASE_URL) !== null && _a !== void 0 ? _a : DEFAULT_CURSOR_BACKEND_URL);
+    var _a, _b;
+    return trimTrailingSlash((_b = (_a = process.env.AGENT_SERVE_CURSOR_BACKEND_URL) !== null && _a !== void 0 ? _a : process.env.CURSOR_API_BASE_URL) !== null && _b !== void 0 ? _b : DEFAULT_CURSOR_BACKEND_URL);
 }
 /**
  * External API base URL for routes served only by the external-api

package/dist/internal/cursor-account-mcp-auth.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Service-account connector authorization for
+ * `defineConnection({ cursorAccount: true })` on hosted deployments.
+ *
+ * Hosted engines authenticate as their deployment's dedicated service
+ * account, whose connector OAuth tokens live backend-side. This flow is the
+ * dashboard's Authenticate button as a CLI loop: probe the connectors via
+ * `CheckHttpMcpStatus` (which mints a complete OAuth `authUrl` per connector
+ * needing auth), open each URL for the human to grant, and poll until the
+ * backend reports the token stored. Nothing token-shaped ever touches this
+ * process — the cursor.com callback stores tokens against the service
+ * account. Used by `agentkit mcp oauth <connection>` and the post-deploy
+ * hook in `cli-deploy.ts`.
+ */
+import type { CursorBackendClient } from "./cursor/backend-client.js";
+/** Same default the dashboard uses; MCP_OAUTH_REDIRECT_URI overrides for dev. */
+export declare function mcpOauthRedirectUri(): string;
+export interface AuthorizeCursorAccountConnectorsArgs {
+    backendClient: Pick<CursorBackendClient, "getAvailableMcpServers" | "checkHttpMcpStatus">;
+    teamId: number;
+    slug: string;
+    /** The deployment's dedicated service account (`sa_…`). */
+    serviceAccountId: string;
+    /** Connection name, for log lines. */
+    connectionName: string;
+    /** The connection's `servers` filter; undefined = every team connector. */
+    servers?: string[] | undefined;
+    /** Open auth URLs and poll for completion (TTY); false = report only. */
+    interactive: boolean;
+    out: (text: string) => void;
+    err: (text: string) => void;
+    /** Test seams. */
+    openBrowserImpl?: (url: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
+}
+export interface AuthorizeCursorAccountConnectorsResult {
+    /** Connectors with a stored credential after the flow. */
+    authorized: string[];
+    /** Connectors still requiring authorization. */
+    pending: string[];
+    /** Connectors the backend could not probe. */
+    errored: Array<{
+        name: string;
+        error: string;
+    }>;
+}
+/**
+ * Authorize the deployment service account for the connection's connectors.
+ * Already-authorized connectors are skipped; the rest get a browser OAuth
+ * each (sequentially), polled until the backend stores the token.
+ */
+export declare function authorizeCursorAccountConnectors(args: AuthorizeCursorAccountConnectorsArgs): Promise<AuthorizeCursorAccountConnectorsResult>;
+//# sourceMappingURL=cursor-account-mcp-auth.d.ts.map

package/dist/internal/cursor-account-mcp-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-account-mcp-auth.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-account-mcp-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAEV,mBAAmB,EAEpB,MAAM,4BAA4B,CAAC;AAOpC,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,MAAM,WAAW,oCAAoC;IACnD,aAAa,EAAE,IAAI,CACjB,mBAAmB,EACnB,wBAAwB,GAAG,oBAAoB,CAChD,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,yEAAyE;IACzE,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,kBAAkB;IAClB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sCAAsC;IACrD,0DAA0D;IAC1D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gDAAgD;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAMD;;;;GAIG;AACH,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,oCAAoC,GACzC,OAAO,CAAC,sCAAsC,CAAC,CA8FjD"}