@cursor/july 0.1.19 → 0.1.21

package/src/internal/cli-deploy.test.ts

@@ -0,0 +1,1991 @@
+/**
+ * Deploy client + CLI handlers against an in-process mock of the Agent
+ * Serve management API (backend/server/src/agentServe/agentServeEndpoints).
+ * The mock is a real HTTP server so status codes, Retry-After headers, and
+ * query strings travel the actual wire; state is a plain object the tests
+ * script (status progressions, injected errors, alias-token-once).
+ */
+
+import { execFile } from "node:child_process";
+import { once } from "node:events";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PassThrough } from "node:stream";
+import { promisify } from "node:util";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  cmdDeploy,
+  cmdDeploymentStatus,
+  cmdDeployments,
+  cmdRotatePodCredential,
+  cmdRotateToken,
+  cmdSecretsList,
+  cmdSecretsSet,
+  cmdSecretsUnset,
+  cmdStop,
+  promptChooseDeployTargets,
+  type SecretInputStream,
+} from "./cli-deploy.js";
+import { cmdMcpOauth } from "./cli-mcp-oauth.js";
+import {
+  AgentServeDeployClient,
+  DeployApiError,
+  slugFromDirectoryName,
+  validateDeploymentSlug,
+} from "./deploy-client.js";
+
+const execFileAsync = promisify(execFile);
+
+const TEAM_ID = 7;
+const API_KEY = "crsr_test_key";
+
+interface MockDeployment {
+  id: number;
+  slug: string;
+  teamId: number;
+  publicId: string;
+  generation: number;
+  status: string;
+  deploymentKind: string;
+  lastError: string | null;
+  desiredUpdatedAt: string;
+  aliasToken: string;
+  gitRepoUrl: string | null;
+  gitRef: string;
+  agentPath: string;
+  cursorEventRepos: string[];
+  egressAllowedDomains: string[];
+  secrets: Map<string, { value: string; createdAt: string }>;
+  podCredentialMaskedKey: string;
+  /** Statuses returned by successive detail GETs; last one repeats. */
+  statusQueue: string[];
+}
+
+interface MockControlPlane {
+  url: string;
+  close: () => Promise<void>;
+  deployments: Map<string, MockDeployment>;
+  /** When set, the next matching request answers with this and clears it. */
+  nextError?: { status: number; body: unknown; retryAfterSeconds?: number };
+  /** When set, the next accepted deploy converges through these statuses. */
+  nextDeployOutcome?: { statusQueue: string[]; lastError: string | null };
+  seenAuth: string[];
+  deployCount: number;
+  secretsPutCount: number;
+  /** Body of the most recent accepted deploy POST. */
+  lastDeployBody?: Record<string, unknown>;
+  /** CheckHttpMcpStatus calls seen (SA connector auth flow). */
+  mcpStatusCalls: number;
+  /** The connector reports authorized after this many status calls. */
+  mcpAuthorizeAfterCalls: number;
+}
+
+const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+
+function progressForStatus(status: string): string | undefined {
+  switch (status) {
+    case "pending":
+      return "creating";
+    case "deploying":
+      return "building";
+    case "running":
+      return "running";
+    case "failed":
+      return "failed";
+    case "degraded":
+      return "degraded";
+    case "stopping":
+      return "stopping";
+    case "stopped":
+      return "stopped";
+    default:
+      return undefined;
+  }
+}
+
+function statusMessageForStatus(status: string): string | null {
+  switch (status) {
+    case "pending":
+      return "Creating runtime…";
+    case "deploying":
+      return "Checking out source…";
+    case "stopping":
+      return "Stopping deployment…";
+    default:
+      return null;
+  }
+}
+
+function serializeDeployment(d: MockDeployment): Record<string, unknown> {
+  return {
+    id: d.id,
+    slug: d.slug,
+    teamId: d.teamId,
+    deploymentKind: d.deploymentKind,
+    gitRepoUrl: d.gitRepoUrl,
+    gitRef: d.gitRef,
+    agentPath: d.agentPath,
+    // Newer serializeDeployment fields (identity decoupling); the client
+    // must tolerate and pass these through.
+    cursorEventRepos: d.cursorEventRepos,
+    egressAllowedDomains: d.egressAllowedDomains,
+    serviceAccountId: 4242,
+    podCredentialMaskedKey: d.podCredentialMaskedKey,
+    secretNames: [...d.secrets.keys()].sort(),
+    desiredState: d.status === "stopped" ? "stopped" : "running",
+    status: d.status,
+    progress: progressForStatus(d.status),
+    statusMessage: statusMessageForStatus(d.status),
+    generation: d.generation,
+    observedGeneration: d.generation,
+    engineGeneration: d.status === "running" ? d.generation : null,
+    publicId: d.publicId,
+    engineUrl: d.status === "running" ? "http://engine.internal:3000" : null,
+    lastError: d.lastError,
+    engineAlias: `/internal/agent-serve/agents/${d.publicId}/engine`,
+    desiredUpdatedAt: d.desiredUpdatedAt,
+    lastReconciledAt: d.desiredUpdatedAt,
+  };
+}
+
+async function startMockControlPlane(): Promise<MockControlPlane> {
+  let nextId = 1;
+  const state: MockControlPlane = {
+    url: "",
+    close: async () => {},
+    deployments: new Map(),
+    seenAuth: [],
+    deployCount: 0,
+    secretsPutCount: 0,
+    mcpStatusCalls: 0,
+    mcpAuthorizeAfterCalls: 1,
+  };
+
+  const server: Server = createServer((req, res) => {
+    let raw = "";
+    req.on("data", (chunk: Buffer) => {
+      raw += chunk.toString("utf8");
+    });
+    req.on("end", () => {
+      const url = new URL(req.url ?? "/", "http://localhost");
+      const send = (status: number, body: unknown): void => {
+        res.writeHead(status, { "content-type": "application/json" });
+        res.end(JSON.stringify(body));
+      };
+
+      state.seenAuth.push(req.headers.authorization ?? "");
+
+      // Account RPCs used by default-team resolution.
+      if (url.pathname === "/auth/exchange_user_api_key") {
+        const claims = Buffer.from(
+          JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 3600 })
+        ).toString("base64url");
+        send(200, { accessToken: `header.${claims}.signature` });
+        return;
+      }
+      if (url.pathname === "/aiserver.v1.DashboardService/GetMe") {
+        send(200, {
+          authId: "auth0|1",
+          email: "dev@example.com",
+          teamId: TEAM_ID,
+          teamName: "Acme",
+        });
+        return;
+      }
+      if (
+        url.pathname === "/aiserver.v1.DashboardService/GetAvailableMcpServers"
+      ) {
+        send(200, {
+          servers: [
+            { id: 1, name: "Datadog", isTeamServer: true },
+            { id: 2, name: "Personal" },
+          ],
+        });
+        return;
+      }
+      if (url.pathname === "/aiserver.v1.DashboardService/CheckHttpMcpStatus") {
+        state.mcpStatusCalls++;
+        const authorized = state.mcpStatusCalls > state.mcpAuthorizeAfterCalls;
+        send(200, {
+          statuses: [
+            authorized
+              ? { id: 1, isAvailable: true, hasValidToken: true }
+              : {
+                  id: 1,
+                  requiresAuth: true,
+                  authUrl: "https://cursor.com/oauth/datadog",
+                },
+          ],
+        });
+        return;
+      }
+
+      if (!url.pathname.startsWith("/internal/agent-serve/deployments")) {
+        send(404, { error: "Not found" });
+        return;
+      }
+      if (req.headers.authorization !== `Bearer ${API_KEY}`) {
+        send(401, { error: "Unauthorized" });
+        return;
+      }
+      if (state.nextError !== undefined) {
+        const { status, body, retryAfterSeconds } = state.nextError;
+        state.nextError = undefined;
+        if (retryAfterSeconds !== undefined) {
+          res.setHeader("Retry-After", String(retryAfterSeconds));
+        }
+        send(status, body);
+        return;
+      }
+
+      const rest = url.pathname.slice(
+        "/internal/agent-serve/deployments".length
+      );
+      const teamId = Number(url.searchParams.get("teamId"));
+
+      // POST /  (deploy)
+      if (req.method === "POST" && (rest === "" || rest === "/")) {
+        const body = JSON.parse(raw) as {
+          teamId: number;
+          slug: string;
+          gitRepoUrl?: string;
+          gitRef?: string;
+          agentPath?: string;
+          cursorEventRepos?: string[];
+          egressAllowedDomains?: string[];
+        };
+        const existing = state.deployments.get(body.slug);
+        const effectiveRepo = body.gitRepoUrl ?? existing?.gitRepoUrl ?? null;
+        if (
+          (body.egressAllowedDomains?.length ?? 0) > 0 &&
+          effectiveRepo === null
+        ) {
+          send(400, {
+            error:
+              "egressAllowedDomains requires a repo-backed deployment; redeploy with a gitRepoUrl first",
+          });
+          return;
+        }
+        state.deployCount++;
+        state.lastDeployBody = body;
+        const outcome = state.nextDeployOutcome ?? {
+          statusQueue: ["pending", "deploying", "running"],
+          lastError: null,
+        };
+        state.nextDeployOutcome = undefined;
+        if (existing !== undefined) {
+          existing.generation++;
+          existing.status = "pending";
+          existing.statusQueue = [...outcome.statusQueue];
+          existing.lastError = outcome.lastError;
+          existing.gitRepoUrl = effectiveRepo;
+          existing.gitRef = body.gitRef ?? existing.gitRef;
+          existing.agentPath = body.agentPath ?? existing.agentPath;
+          existing.cursorEventRepos =
+            body.cursorEventRepos ?? existing.cursorEventRepos;
+          existing.egressAllowedDomains =
+            body.egressAllowedDomains ?? existing.egressAllowedDomains;
+          existing.deploymentKind =
+            effectiveRepo === null ? "static-http-200" : "engine";
+          send(202, {
+            id: existing.id,
+            slug: existing.slug,
+            teamId: existing.teamId,
+            status: "pending",
+            generation: existing.generation,
+            deploymentKind: existing.deploymentKind,
+            engineAlias: `/internal/agent-serve/agents/${existing.publicId}/engine`,
+          });
+          return;
+        }
+        const created: MockDeployment = {
+          id: nextId++,
+          slug: body.slug,
+          teamId: body.teamId,
+          publicId: `asd_${"0".repeat(31)}${nextId}`,
+          generation: 1,
+          status: "pending",
+          deploymentKind: effectiveRepo === null ? "static-http-200" : "engine",
+          lastError: outcome.lastError,
+          desiredUpdatedAt: "2026-07-14T00:00:00.000Z",
+          aliasToken: `alias_secret_${nextId}`,
+          gitRepoUrl: effectiveRepo,
+          gitRef: body.gitRef ?? "",
+          agentPath: body.agentPath ?? "",
+          cursorEventRepos: body.cursorEventRepos ?? [],
+          egressAllowedDomains: body.egressAllowedDomains ?? [],
+          secrets: new Map(),
+          podCredentialMaskedKey: `sk_agent_****${nextId}00a`,
+          statusQueue: [...outcome.statusQueue],
+        };
+        state.deployments.set(body.slug, created);
+        send(202, {
+          id: created.id,
+          slug: created.slug,
+          teamId: created.teamId,
+          status: "pending",
+          generation: created.generation,
+          deploymentKind: created.deploymentKind,
+          engineAlias: `/internal/agent-serve/agents/${created.publicId}/engine`,
+          aliasToken: created.aliasToken,
+        });
+        return;
+      }
+
+      // GET /  (list)
+      if (req.method === "GET" && (rest === "" || rest === "/")) {
+        const rows = [...state.deployments.values()].filter(
+          (d) => d.teamId === teamId
+        );
+        send(200, { deployments: rows.map(serializeDeployment) });
+        return;
+      }
+
+      const segments = rest.replace(/^\//, "").split("/");
+      const slug = decodeURIComponent(segments[0] ?? "");
+      const deployment = state.deployments.get(slug);
+
+      // POST /:slug/stop
+      if (req.method === "POST" && segments[1] === "stop") {
+        if (deployment === undefined) {
+          send(404, { error: "Deployment not found" });
+          return;
+        }
+        deployment.statusQueue = ["stopping", "stopped"];
+        send(202, { id: deployment.id, status: "stopping" });
+        return;
+      }
+
+      // POST /:slug/rotate-alias-token
+      if (req.method === "POST" && segments[1] === "rotate-alias-token") {
+        if (deployment === undefined) {
+          send(404, { error: "Deployment not found" });
+          return;
+        }
+        deployment.aliasToken = `alias_secret_rotated_${deployment.id}`;
+        send(200, { aliasToken: deployment.aliasToken });
+        return;
+      }
+
+      // POST /:slug/rotate-pod-credential
+      if (req.method === "POST" && segments[1] === "rotate-pod-credential") {
+        if (deployment === undefined) {
+          send(404, { error: "Deployment not found" });
+          return;
+        }
+        deployment.podCredentialMaskedKey = `sk_agent_****rot${deployment.id}`;
+        send(200, {
+          podCredentialMaskedKey: deployment.podCredentialMaskedKey,
+        });
+        return;
+      }
+
+      // PUT /:slug/secrets  (upsert by name; unlisted names untouched)
+      if (req.method === "PUT" && segments[1] === "secrets") {
+        state.secretsPutCount++;
+        if (deployment === undefined) {
+          send(404, { error: "Deployment not found" });
+          return;
+        }
+        if (deployment.gitRepoUrl === null) {
+          send(400, {
+            error:
+              "Secrets require a repo-backed deployment; redeploy with a gitRepoUrl first",
+          });
+          return;
+        }
+        const body = JSON.parse(raw) as {
+          teamId: number;
+          secrets: Array<{ name: string; value: string }>;
+        };
+        for (const { name, value } of body.secrets) {
+          if (
+            !SECRET_NAME_PATTERN.test(name) ||
+            name.length > 64 ||
+            name.startsWith("CURSOR_")
+          ) {
+            send(400, { error: `Invalid or reserved secret name: ${name}` });
+            return;
+          }
+          if (Buffer.byteLength(value, "utf8") > 4096) {
+            send(400, { error: `Secret value too large for ${name}` });
+            return;
+          }
+        }
+        const names = new Set([
+          ...deployment.secrets.keys(),
+          ...body.secrets.map((s) => s.name),
+        ]);
+        if (names.size > 32) {
+          send(400, { error: "Too many secrets (max 32)" });
+          return;
+        }
+        for (const { name, value } of body.secrets) {
+          deployment.secrets.set(name, {
+            value,
+            createdAt:
+              deployment.secrets.get(name)?.createdAt ??
+              "2026-07-14T00:00:00.000Z",
+          });
+        }
+        send(200, { secretNames: [...deployment.secrets.keys()].sort() });
+        return;
+      }
+
+      // GET /:slug/secrets  (names only, never values)
+      if (
+        req.method === "GET" &&
+        segments[1] === "secrets" &&
+        segments.length === 2
+      ) {
+        if (deployment === undefined) {
+          send(404, { error: "Deployment not found" });
+          return;
+        }
+        send(200, {
+          secrets: [...deployment.secrets.entries()]
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([name, entry]) => ({ name, createdAt: entry.createdAt })),
+        });
+        return;
+      }
+
+      // DELETE /:slug/secrets/:name
+      if (
+        req.method === "DELETE" &&
+        segments[1] === "secrets" &&
+        segments.length === 3
+      ) {
+        const name = decodeURIComponent(segments[2] ?? "");
+        if (name.startsWith("CURSOR_")) {
+          send(400, { error: `Reserved secret name: ${name}` });
+          return;
+        }
+        if (deployment === undefined || !deployment.secrets.has(name)) {
+          send(404, { error: "Secret not found" });
+          return;
+        }
+        deployment.secrets.delete(name);
+        send(200, { removed: name });
+        return;
+      }
+
+      // GET /:slug  (detail; advances the scripted status)
+      if (req.method === "GET" && segments.length === 1) {
+        if (deployment === undefined || deployment.teamId !== teamId) {
+          send(404, { error: "Deployment not found" });
+          return;
+        }
+        const next = deployment.statusQueue.shift();
+        if (next !== undefined) {
+          deployment.status = next;
+          if (deployment.statusQueue.length === 0) {
+            deployment.statusQueue = [next];
+          }
+        }
+        send(200, {
+          ...serializeDeployment(deployment),
+          engineAccess:
+            deployment.status === "running"
+              ? {
+                  url: "https://anyrun.example/proxy",
+                  headers: { "x-anyrun-port-token": "pt" },
+                  expiresAt: "2026-07-14T01:00:00.000Z",
+                }
+              : null,
+        });
+        return;
+      }
+
+      send(404, { error: "Not found" });
+    });
+  });
+
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const { port } = server.address() as AddressInfo;
+  state.url = `http://127.0.0.1:${port}`;
+  state.close = () =>
+    new Promise<void>((resolvePromise, reject) =>
+      server.close((error) => (error ? reject(error) : resolvePromise()))
+    );
+  return state;
+}
+
+/** Capture out/err streams for a handler invocation. */
+function capture(): {
+  out: (text: string) => void;
+  err: (text: string) => void;
+  stdout: () => string;
+  stderr: () => string;
+} {
+  let stdout = "";
+  let stderr = "";
+  return {
+    out: (text) => {
+      stdout += text;
+    },
+    err: (text) => {
+      stderr += text;
+    },
+    stdout: () => stdout,
+    stderr: () => stderr,
+  };
+}
+
+let backend: MockControlPlane;
+const savedEnv: Record<string, string | undefined> = {};
+
+beforeEach(async () => {
+  backend = await startMockControlPlane();
+  for (const key of [
+    "CURSOR_API_BASE_URL",
+    "CURSOR_API_KEY",
+    "AGENT_SERVE_CONFIG_DIR",
+  ]) {
+    savedEnv[key] = process.env[key];
+  }
+  process.env.CURSOR_API_BASE_URL = backend.url;
+  delete process.env.CURSOR_API_KEY;
+  // Point stored-credential reads at an empty dir so a developer's real
+  // login can never leak into these tests.
+  process.env.AGENT_SERVE_CONFIG_DIR = join(
+    tmpdir(),
+    `agentkit-deploy-test-${process.pid}`
+  );
+});
+
+afterEach(async () => {
+  await backend.close();
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+});
+
+function makeClient(): AgentServeDeployClient {
+  return new AgentServeDeployClient({
+    backendUrl: backend.url,
+    apiKey: API_KEY,
+  });
+}
+
+const fastPoll = { pollIntervalMs: 5, timeoutMs: 5_000 };
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (dir !== undefined) {
+      await rm(dir, { recursive: true, force: true });
+    }
+  }
+});
+
+/**
+ * Minimal agent project whose agent.mjs default-exports a pre-branded
+ * config (no framework import, so plain Node can load it under vitest).
+ */
+async function writeManifestProject(
+  hosting: Record<string, unknown>
+): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), "agentkit-manifest-"));
+  tempDirs.push(dir);
+  const agentDir = join(dir, "agent");
+  await mkdir(agentDir, { recursive: true });
+  await writeFile(
+    join(agentDir, "agent.mjs"),
+    `export default { __agentServe: "agent", model: "composer-2.5", hosting: ${JSON.stringify(hosting)} };\n`
+  );
+  await writeFile(join(agentDir, "instructions.md"), "manifest fixture\n");
+  return dir;
+}
+
+describe("slug validation", () => {
+  it("accepts lowercase letters, digits, - and _ up to 64 chars", () => {
+    expect(validateDeploymentSlug("weather-agent_2")).toBeUndefined();
+    expect(validateDeploymentSlug("a".repeat(64))).toBeUndefined();
+  });
+
+  it("rejects uppercase, spaces, dots, empty, and >64 chars", () => {
+    for (const bad of ["Weather", "has space", "dot.dot", "", "a".repeat(65)]) {
+      expect(validateDeploymentSlug(bad)).toMatch(/Invalid slug/);
+    }
+  });
+
+  it("derives slugs from directory names", () => {
+    expect(slugFromDirectoryName("Weather Agent")).toBe("weather-agent");
+    expect(slugFromDirectoryName("my_agent-2")).toBe("my_agent-2");
+    expect(slugFromDirectoryName("---")).toBeUndefined();
+  });
+});
+
+describe("AgentServeDeployClient", () => {
+  it("deploys, returns the alias token exactly once, and bumps generation on redeploy", async () => {
+    const client = makeClient();
+    const first = await client.deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: { kind: "git-ref" },
+    });
+    expect(first.generation).toBe(1);
+    expect(first.deploymentKind).toBe("static-http-200");
+    expect(first.aliasToken).toMatch(/^alias_secret_/);
+    expect(first.engineAlias).toMatch(/^\/internal\/agent-serve\/agents\/asd_/);
+
+    const second = await client.deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: { kind: "git-ref" },
+    });
+    expect(second.generation).toBe(2);
+    expect(second.aliasToken).toBeUndefined();
+  });
+
+  it("rejects an invalid slug client-side without calling the API", async () => {
+    const client = makeClient();
+    await expect(
+      client.deploy({
+        teamId: TEAM_ID,
+        slug: "Not A Slug",
+        source: { kind: "git-ref" },
+      })
+    ).rejects.toThrow(/Invalid slug/);
+    expect(backend.deployCount).toBe(0);
+  });
+
+  it("sends the API key as the bearer", async () => {
+    const client = makeClient();
+    await client.listDeployments({ teamId: TEAM_ID });
+    expect(backend.seenAuth.at(-1)).toBe(`Bearer ${API_KEY}`);
+  });
+
+  it("lists and gets deployments", async () => {
+    const client = makeClient();
+    await client.deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: { kind: "git-ref" },
+    });
+    const listed = await client.listDeployments({ teamId: TEAM_ID });
+    expect(listed).toHaveLength(1);
+    expect(listed[0]?.slug).toBe("weather");
+
+    const detail = await client.getDeployment({
+      teamId: TEAM_ID,
+      slug: "weather",
+    });
+    expect(detail.status).toBe("pending");
+    expect(detail.engineAlias).toContain("/engine");
+    // Fields the client does not model yet must pass through unchanged
+    // (schemas are passthrough), so --json output tracks the API.
+    expect(
+      (detail as unknown as Record<string, unknown>).serviceAccountId
+    ).toBe(4242);
+    expect(
+      (listed[0] as unknown as Record<string, unknown>)?.egressAllowedDomains
+    ).toEqual([]);
+  });
+
+  it("accepts string serviceAccountId ids from the API", async () => {
+    const server = createServer((_req, res) => {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          id: 1,
+          slug: "weather",
+          teamId: TEAM_ID,
+          deploymentKind: "engine",
+          status: "running",
+          generation: 1,
+          engineAlias: "/internal/agent-serve/agents/asd_x/engine",
+          serviceAccountId: "sa_f2178255-c11d-467e-bd30-f867d0127107",
+        })
+      );
+    });
+    await new Promise<void>((resolve) =>
+      server.listen(0, "127.0.0.1", resolve)
+    );
+    const { port } = server.address() as AddressInfo;
+    try {
+      const detail = await new AgentServeDeployClient({
+        backendUrl: `http://127.0.0.1:${port}`,
+        apiKey: API_KEY,
+      }).getDeployment({ teamId: TEAM_ID, slug: "weather" });
+      expect(detail.serviceAccountId).toBe(
+        "sa_f2178255-c11d-467e-bd30-f867d0127107"
+      );
+    } finally {
+      await new Promise<void>((resolve, reject) =>
+        server.close((error) => (error ? reject(error) : resolve()))
+      );
+    }
+  });
+
+  it("maps Fastify route-not-found 404s to a wrong-host hint", async () => {
+    backend.nextError = {
+      status: 404,
+      body: {
+        message: "Route POST:/internal/agent-serve/deployments not found",
+        error: "Not Found",
+        statusCode: 404,
+      },
+    };
+    await expect(
+      makeClient().deploy({
+        teamId: TEAM_ID,
+        slug: "weather",
+        source: { kind: "git-ref" },
+      })
+    ).rejects.toThrow(/api\.cursor\.com|CURSOR_API_BASE_URL/);
+  });
+
+  it("maps 403 to a team-permission message", async () => {
+    backend.nextError = {
+      status: 403,
+      body: { error: "Not authorized for this team" },
+    };
+    await expect(
+      makeClient().listDeployments({ teamId: TEAM_ID })
+    ).rejects.toThrow(/team-admin permission.*cloud-agent entitlement/);
+  });
+
+  it("maps 404 to a feature-gate hint", async () => {
+    backend.nextError = { status: 404, body: { error: "Not found" } };
+    await expect(
+      makeClient().getDeployment({ teamId: TEAM_ID, slug: "ghost" })
+    ).rejects.toThrow(/agent_serve_mvp feature gate/);
+  });
+
+  it("maps 409 to a retry suggestion", async () => {
+    backend.nextError = {
+      status: 409,
+      body: { error: "A concurrent deploy or stop changed this deployment" },
+    };
+    await expect(
+      makeClient().deploy({
+        teamId: TEAM_ID,
+        slug: "weather",
+        source: { kind: "git-ref" },
+      })
+    ).rejects.toThrow(/concurrent deploy or stop.*retry/);
+  });
+
+  it("maps 429 and surfaces Retry-After", async () => {
+    backend.nextError = {
+      status: 429,
+      body: { error: "Agent Serve deploys are limited to one per minute" },
+      retryAfterSeconds: 42,
+    };
+    const error = await makeClient()
+      .deploy({ teamId: TEAM_ID, slug: "weather", source: { kind: "git-ref" } })
+      .then(
+        () => undefined,
+        (e: unknown) => e
+      );
+    expect(error).toBeInstanceOf(DeployApiError);
+    expect((error as DeployApiError).status).toBe(429);
+    expect((error as DeployApiError).retryAfterSeconds).toBe(42);
+    expect((error as DeployApiError).message).toMatch(/retry in 42s/);
+  });
+
+  it("stops and rotates alias tokens", async () => {
+    const client = makeClient();
+    await client.deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: { kind: "git-ref" },
+    });
+    const stopped = await client.stopDeployment({
+      teamId: TEAM_ID,
+      slug: "weather",
+    });
+    expect(stopped.status).toBe("stopping");
+
+    const rotated = await client.rotateAliasToken({
+      teamId: TEAM_ID,
+      slug: "weather",
+    });
+    expect(rotated).toMatch(/^alias_secret_rotated_/);
+  });
+});
+
+describe("cmdDeploy", () => {
+  it("deploys, polls to running, and prints the alias token block once", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toContain("shown ONCE");
+    expect(io.stdout()).toContain("alias_secret_");
+    expect(io.stdout()).toContain("X-Agent-Alias-Token");
+    expect(io.stdout()).toContain("status:      running");
+    expect(io.stdout()).toContain("kind:        static-http-200");
+    expect(io.stdout()).toMatch(
+      /alias:\s+http.*\/internal\/agent-serve\/agents\/asd_.*\/engine/
+    );
+    expect(io.stdout()).toMatch(
+      /playground:\s+http.*\/internal\/agent-serve\/agents\/asd_.*\/engine\/playground/
+    );
+    expect(io.stdout()).toMatch(
+      /open: .*playground --prod --slug weather --team /
+    );
+    // Progress transitions on the (non-TTY) stderr stream — customer step
+    // text, not raw API status.
+    expect(io.stderr()).toContain("weather: Creating runtime");
+    expect(io.stderr()).toContain("weather: Checking out source");
+  });
+
+  it("does not print an alias token block on redeploy", async () => {
+    const first = capture();
+    await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: first.out,
+      err: first.err,
+      ...fastPoll,
+    });
+    const second = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: second.out,
+      err: second.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(second.stdout()).not.toContain("shown ONCE");
+    expect(second.stdout()).toContain("generation:  2");
+  });
+
+  it("returns right after the 202 with --no-wait", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toContain("Deploy accepted");
+    expect(io.stdout()).toContain("agentkit deployment weather");
+  });
+
+  it("prints lastError and exits non-zero when the deploy fails", async () => {
+    backend.nextDeployOutcome = {
+      statusQueue: ["pending", "deploying", "failed"],
+      lastError: "engine pod crashed: OOMKilled",
+    };
+    const failed = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: failed.out,
+      err: failed.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(1);
+    expect(failed.stderr()).toContain("engine pod crashed: OOMKilled");
+    expect(failed.stderr()).toContain("failed");
+  });
+
+  it("derives the slug from --dir and says so", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: "/tmp/My Weather Agent",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stderr()).toContain('Deploying as "my-weather-agent"');
+    expect(backend.deployments.has("my-weather-agent")).toBe(true);
+  });
+
+  it("resolves the default team from the account and says so", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stderr()).toContain(`Using team ${TEAM_ID} (Acme)`);
+    expect(backend.deployments.get("weather")?.teamId).toBe(TEAM_ID);
+  });
+
+  it("runs service-account connector auth after deploying a cursorAccount agent", async () => {
+    const dir = await writeManifestProject({});
+    await mkdir(join(dir, "agent", "mcp-connections"), { recursive: true });
+    await writeFile(
+      join(dir, "agent", "mcp-connections", "cursor.mjs"),
+      `export default { __agentServe: "connection", cursorAccount: true, servers: ["Datadog"] };\n`
+    );
+    const io = capture();
+    const opened: string[] = [];
+    const code = await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+      openBrowserImpl: (url) => void opened.push(url),
+      sleepImpl: async () => {},
+      connectorPollIntervalMs: 1,
+      connectorPollTimeoutMs: 1_000,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    // The minted authUrl was opened once, then polling saw the stored token.
+    expect(opened).toEqual(["https://cursor.com/oauth/datadog"]);
+    expect(io.stdout()).toContain("Datadog: authorized ✓");
+    expect(io.stdout()).toContain("as yourself");
+    expect(backend.mcpStatusCalls).toBeGreaterThanOrEqual(2);
+  });
+
+  it("keeps the deploy green and points at the playground when connector auth is left pending", async () => {
+    backend.mcpAuthorizeAfterCalls = Number.MAX_SAFE_INTEGER;
+    const dir = await writeManifestProject({});
+    await mkdir(join(dir, "agent", "mcp-connections"), { recursive: true });
+    await writeFile(
+      join(dir, "agent", "mcp-connections", "cursor.mjs"),
+      `export default { __agentServe: "connection", cursorAccount: true, servers: ["Datadog"] };\n`
+    );
+    const io = capture();
+    const code = await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+      openBrowserImpl: () => {},
+      sleepImpl: async () => {},
+      connectorPollIntervalMs: 1,
+      connectorPollTimeoutMs: 3,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toContain("status:      running");
+    expect(io.stdout()).toContain(
+      "You can authorize connectors at the playground page"
+    );
+    expect(io.stdout()).toContain("Deployed Agents → weather");
+  });
+
+  it("emits JSON with --json (including the one-time alias token)", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      json: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    const parsed = JSON.parse(io.stdout()) as {
+      status: string;
+      aliasToken: string;
+      generation: number;
+    };
+    expect(parsed.status).toBe("running");
+    expect(parsed.generation).toBe(1);
+    expect(parsed.aliasToken).toMatch(/^alias_secret_/);
+  });
+});
+
+describe("cmdMcpOauth cursorAccount connections", () => {
+  async function writeCursorAccountProject(): Promise<string> {
+    const dir = await writeManifestProject({});
+    await mkdir(join(dir, "agent", "mcp-connections"), { recursive: true });
+    await writeFile(
+      join(dir, "agent", "mcp-connections", "cursor.mjs"),
+      `export default { __agentServe: "connection", cursorAccount: true, servers: ["Datadog"] };\n`
+    );
+    return dir;
+  }
+
+  it("authorizes the deployment service account and treats --store as a no-op", async () => {
+    // Seed the deployment the SA flow resolves.
+    const seed = capture();
+    await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: seed.out,
+      err: seed.err,
+      ...fastPoll,
+    });
+
+    const dir = await writeCursorAccountProject();
+    const io = capture();
+    const opened: string[] = [];
+    const code = await cmdMcpOauth({
+      dir,
+      connection: "cursor",
+      store: true,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+      openBrowserImpl: (url) => void opened.push(url),
+      sleep: async () => {},
+      pollIntervalMs: 1,
+      pollTimeoutMs: 1_000,
+    });
+
+    expect(code).toBe(0);
+    expect(opened).toEqual(["https://cursor.com/oauth/datadog"]);
+    expect(io.stdout()).toContain("Datadog: authorized ✓");
+    expect(io.stdout()).toContain("--store is not needed");
+    // Nothing was written to deployment secrets.
+    expect(backend.secretsPutCount).toBe(0);
+  });
+
+  it("explains when the deployment does not exist yet", async () => {
+    const dir = await writeCursorAccountProject();
+    const io = capture();
+    const code = await cmdMcpOauth({
+      dir,
+      connection: "cursor",
+      slug: "ghost",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+      openBrowserImpl: () => {},
+      sleep: async () => {},
+    });
+
+    expect(code).toBe(1);
+    expect(io.stderr()).toContain('Could not load deployment "ghost"');
+    expect(io.stderr()).toContain("Deploy first");
+  });
+});
+
+describe("cmdDeployments / cmdDeploymentStatus", () => {
+  it("renders the table and the detail view", async () => {
+    const seed = capture();
+    await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: seed.out,
+      err: seed.err,
+      ...fastPoll,
+    });
+
+    const list = capture();
+    expect(
+      await cmdDeployments({
+        team: String(TEAM_ID),
+        apiKey: API_KEY,
+        out: list.out,
+        err: list.err,
+      })
+    ).toBe(0);
+    expect(list.stdout()).toMatch(/SLUG\s+STATUS\s+GEN\s+KIND\s+UPDATED/);
+    expect(list.stdout()).toMatch(/weather\s+running\s+1\s+static-http-200/);
+
+    const detail = capture();
+    expect(
+      await cmdDeploymentStatus("weather", {
+        team: String(TEAM_ID),
+        apiKey: API_KEY,
+        out: detail.out,
+        err: detail.err,
+      })
+    ).toBe(0);
+    expect(detail.stdout()).toContain("status:      running");
+    expect(detail.stdout()).toContain(
+      "engine:      http://engine.internal:3000"
+    );
+    expect(detail.stdout()).toContain(
+      "engine access: https://anyrun.example/proxy"
+    );
+  });
+
+  it("reports an unknown slug with the gate hint", async () => {
+    const io = capture();
+    const code = await cmdDeploymentStatus("ghost", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+    });
+    expect(code).toBe(1);
+    expect(io.stderr()).toMatch(/"ghost" was not found/);
+  });
+});
+
+describe("cmdStop", () => {
+  it("stops and polls to stopped", async () => {
+    const seed = capture();
+    await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: seed.out,
+      err: seed.err,
+      ...fastPoll,
+    });
+    const io = capture();
+    const code = await cmdStop("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toContain("Stopped weather");
+    expect(backend.deployments.get("weather")?.status).toBe("stopped");
+  });
+});
+
+describe("cmdRotateToken", () => {
+  it("prints the new token once with a warning", async () => {
+    const seed = capture();
+    await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: seed.out,
+      err: seed.err,
+      ...fastPoll,
+    });
+    const io = capture();
+    const code = await cmdRotateToken("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toContain("old token stopped working immediately");
+    expect(io.stdout()).toContain("shown ONCE");
+    expect(io.stdout()).toMatch(/alias_secret_rotated_\d+/);
+  });
+});
+
+describe("cmdDeploy multi-agent parent", () => {
+  async function writeMultiAgentParent(
+    slugs: string[]
+  ): Promise<{ parent: string; children: Record<string, string> }> {
+    const parent = await mkdtemp(join(tmpdir(), "agentkit-multi-"));
+    tempDirs.push(parent);
+    const children: Record<string, string> = {};
+    for (const slug of slugs) {
+      const dir = join(parent, slug);
+      await mkdir(join(dir, "agent"), { recursive: true });
+      await writeFile(
+        join(dir, "agent", "agent.mjs"),
+        `export default { __agentServe: "agent", model: "composer-2.5" };\n`
+      );
+      await writeFile(join(dir, "agent", "instructions.md"), `${slug}\n`);
+      children[slug] = dir;
+    }
+    return { parent, children };
+  }
+
+  it("auto-selects the only child under a multi-agent parent", async () => {
+    const { parent } = await writeMultiAgentParent(["weather-agent"]);
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: parent,
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stderr()).toContain("only agent under");
+    expect(backend.deployments.has("weather-agent")).toBe(true);
+  });
+
+  it("deploys every child with --all", async () => {
+    const { parent } = await writeMultiAgentParent([
+      "approval-buddy",
+      "weather-agent",
+    ]);
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: parent,
+      all: true,
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.deployments.has("approval-buddy")).toBe(true);
+    expect(backend.deployments.has("weather-agent")).toBe(true);
+    expect(io.stderr()).toContain("Deployed 2 agents");
+  });
+
+  it("rejects --all on a single agent project directory", async () => {
+    const dir = await writeManifestProject({});
+    const io = capture();
+    const code = await cmdDeploy({
+      dir,
+      all: true,
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(1);
+    expect(io.stderr()).toContain("--all requires a multi-agent parent");
+    expect(backend.deployCount).toBe(0);
+  });
+
+  it("ignores --path when deploying multiple agents", async () => {
+    const { parent } = await writeMultiAgentParent([
+      "approval-buddy",
+      "weather-agent",
+    ]);
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: parent,
+      all: true,
+      path: "agents/wrong",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/agents",
+      ref: "main",
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(io.stderr()).toContain("ignoring --path");
+    // Without per-agent git inference (tmpdir has no git), path stays unset
+    // rather than the shared override.
+    expect(backend.lastDeployBody?.agentPath).toBeUndefined();
+  });
+
+  it("picks one child via --slug under a multi-agent parent", async () => {
+    const { parent } = await writeMultiAgentParent([
+      "approval-buddy",
+      "weather-agent",
+    ]);
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: parent,
+      slug: "weather-agent",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.deployments.has("weather-agent")).toBe(true);
+    expect(backend.deployments.has("approval-buddy")).toBe(false);
+  });
+
+  it("uses the interactive chooser when multiple agents and no --slug/--all", async () => {
+    const { parent, children } = await writeMultiAgentParent([
+      "approval-buddy",
+      "weather-agent",
+    ]);
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: parent,
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      chooseTargets: async (agents) => {
+        expect(agents.map((a) => a.slug).sort()).toEqual([
+          "approval-buddy",
+          "weather-agent",
+        ]);
+        return [agents.find((a) => a.slug === "approval-buddy")!];
+      },
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.deployments.has("approval-buddy")).toBe(true);
+    expect(backend.deployments.has("weather-agent")).toBe(false);
+    expect(children["approval-buddy"]).toBeDefined();
+  });
+
+  it("requires --slug or --all when non-interactive and multiple agents", async () => {
+    const { parent } = await writeMultiAgentParent([
+      "approval-buddy",
+      "weather-agent",
+    ]);
+    const io = capture();
+    const code = await cmdDeploy({
+      dir: parent,
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      noWait: true,
+      chooseTargets: async () => [],
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(1);
+    expect(io.stderr()).toMatch(/Pass --slug|--all/);
+    expect(backend.deployCount).toBe(0);
+  });
+
+  it("promptChooseDeployTargets accepts number, slug, all, and cancel", async () => {
+    const agents = [
+      { slug: "approval-buddy", dir: "/a" },
+      { slug: "weather-agent", dir: "/w" },
+    ];
+    const ask = async (line: string) => {
+      const stdin = new PassThrough() as PassThrough & SecretInputStream;
+      stdin.isTTY = true;
+      queueMicrotask(() => {
+        stdin.write(`${line}\n`);
+        stdin.end();
+      });
+      const err = capture();
+      return promptChooseDeployTargets(agents, {
+        err: err.err,
+        stdin,
+        interactive: true,
+      });
+    };
+    await expect(ask("2")).resolves.toEqual([agents[1]]);
+    await expect(ask("approval-buddy")).resolves.toEqual([agents[0]]);
+    await expect(ask("all")).resolves.toEqual(agents);
+    await expect(ask("q")).resolves.toBeNull();
+  });
+});
+
+describe("cmdDeploy git source inference", () => {
+  it("fills repo/ref/path from git when deploying an agent project", async () => {
+    const dir = await writeManifestProject({});
+    const gitForDir = async (
+      args: readonly string[]
+    ): Promise<string | undefined> => {
+      const key = args.join(" ");
+      if (key === "rev-parse --show-toplevel") {
+        // Parent of the fixture dir → agentPath = basename(dir).
+        return join(dir, "..");
+      }
+      if (key === "remote get-url origin") {
+        return "git@github.com:acme/agents.git";
+      }
+      if (key === "rev-parse --abbrev-ref HEAD") {
+        return "release";
+      }
+      return undefined;
+    };
+    const io = capture();
+    const code = await cmdDeploy({
+      dir,
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      git: gitForDir,
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.lastDeployBody).toMatchObject({
+      gitRepoUrl: "https://github.com/acme/agents",
+      gitRef: "release",
+      agentPath: expect.stringMatching(/agentkit-manifest-/),
+    });
+    expect(io.stderr()).toContain("inferred repo, ref, path from git");
+    expect(io.stderr()).toContain("https://github.com/acme/agents @ release");
+  });
+
+  it("lets explicit --repo/--ref/--path win over git inference", async () => {
+    const dir = await writeManifestProject({});
+    const io = capture();
+    const code = await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/explicit",
+      ref: "v1",
+      path: "agents/weather",
+      git: async () => {
+        throw new Error("git should not be probed when all flags are set");
+      },
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.lastDeployBody).toMatchObject({
+      gitRepoUrl: "https://github.com/acme/explicit",
+      gitRef: "v1",
+      agentPath: "agents/weather",
+    });
+    expect(io.stderr()).not.toContain("inferred");
+  });
+});
+
+describe("cmdDeploy hosting manifest + repo flags", () => {
+  it("sends manifest egressDomains unioned with --allow-domain", async () => {
+    const dir = await writeManifestProject({
+      egressDomains: ["api.example.com", "*.internal.example.com"],
+    });
+    const io = capture();
+    const code = await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/agents",
+      allowDomains: ["api.example.com", "extra.example.org"],
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.lastDeployBody?.egressAllowedDomains).toEqual([
+      "api.example.com",
+      "*.internal.example.com",
+      "extra.example.org",
+    ]);
+  });
+
+  it("maps --repo/--ref/--path/--cursor-events-repo into the deploy body", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/agents",
+      ref: "release-1",
+      path: "agents/weather",
+      cursorEventsRepos: ["acme/agents", "acme/infra"],
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(backend.lastDeployBody).toMatchObject({
+      gitRepoUrl: "https://github.com/acme/agents",
+      gitRef: "release-1",
+      agentPath: "agents/weather",
+      cursorEventRepos: ["acme/agents", "acme/infra"],
+    });
+    expect(backend.deployments.get("weather")?.deploymentKind).toBe("engine");
+  });
+
+  it("rejects a non-https --repo and a malformed --cursor-events-repo before the API", async () => {
+    const nonHttps = capture();
+    const nonHttpsCode = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "git@github.com:acme/agents.git",
+      noWait: true,
+      out: nonHttps.out,
+      err: nonHttps.err,
+      ...fastPoll,
+    });
+    expect(nonHttpsCode).toBe(1);
+    expect(nonHttps.stderr()).toMatch(/Invalid --repo/);
+
+    // Cursor-event repos without a resolvable https origin fail before the
+    // owner/name grammar check (would otherwise become an invalid static deploy).
+    const missingRepo = capture();
+    const missingRepoCode = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      cursorEventsRepos: ["not-a-repo"],
+      noWait: true,
+      out: missingRepo.out,
+      err: missingRepo.err,
+      ...fastPoll,
+    });
+    expect(missingRepoCode).toBe(1);
+    expect(missingRepo.stderr()).toContain(
+      "Could not resolve an https:// git repository URL"
+    );
+
+    const badEventsRepo = capture();
+    const badEventsRepoCode = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/agents",
+      cursorEventsRepos: ["not-a-repo"],
+      noWait: true,
+      out: badEventsRepo.out,
+      err: badEventsRepo.err,
+      ...fastPoll,
+    });
+    expect(badEventsRepoCode).toBe(1);
+    expect(badEventsRepo.stderr()).toMatch(/Invalid --cursor-events-repo/);
+
+    expect(backend.deployCount).toBe(0);
+  });
+
+  it("rejects an invalid --allow-domain client-side without calling the API", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/agents",
+      allowDomains: ["Not_A_Domain"],
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(1);
+    expect(io.stderr()).toMatch(/Invalid egress domain "Not_A_Domain"/);
+    expect(backend.deployCount).toBe(0);
+  });
+
+  it("rejects egress on a static (repo-less) deploy before the API", async () => {
+    const io = capture();
+    const code = await cmdDeploy({
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      allowDomains: ["api.example.com"],
+      noWait: true,
+      out: io.out,
+      err: io.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(1);
+    expect(io.stderr()).toContain(
+      "Could not resolve an https:// git repository URL"
+    );
+    expect(backend.deployCount).toBe(0);
+  });
+
+  it("warns about declared-but-unset secrets after deploy, and stops once they are set", async () => {
+    const dir = await writeManifestProject({
+      secretNames: ["OPENAI_API_KEY", "WEATHER_TOKEN"],
+    });
+    const first = capture();
+    const code = await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      repo: "https://github.com/acme/agents",
+      out: first.out,
+      err: first.err,
+      ...fastPoll,
+    });
+    expect(code).toBe(0);
+    expect(first.stderr()).toContain(
+      "not set on weather: OPENAI_API_KEY, WEATHER_TOKEN"
+    );
+    expect(first.stderr()).toContain(
+      "agentkit secrets set weather OPENAI_API_KEY WEATHER_TOKEN"
+    );
+
+    await makeClient().setSecrets({
+      teamId: TEAM_ID,
+      slug: "weather",
+      secrets: [{ name: "OPENAI_API_KEY", value: "sk-1" }],
+    });
+    const second = capture();
+    await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: second.out,
+      err: second.err,
+      ...fastPoll,
+    });
+    expect(second.stderr()).toContain("not set on weather: WEATHER_TOKEN");
+    expect(second.stderr()).not.toContain("OPENAI_API_KEY");
+
+    await makeClient().setSecrets({
+      teamId: TEAM_ID,
+      slug: "weather",
+      secrets: [{ name: "WEATHER_TOKEN", value: "t-1" }],
+    });
+    const third = capture();
+    await cmdDeploy({
+      dir,
+      slug: "weather",
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: third.out,
+      err: third.err,
+      ...fastPoll,
+    });
+    expect(third.stderr()).not.toContain("declared in the agent manifest");
+  });
+});
+
+describe("secrets", () => {
+  async function seedRepoDeploy(slug = "weather"): Promise<void> {
+    await makeClient().deploy({
+      teamId: TEAM_ID,
+      slug,
+      source: {
+        kind: "git-ref",
+        gitRepoUrl: "https://github.com/acme/agents",
+      },
+    });
+  }
+
+  it("sets secrets from argv with a shell-history warning and upserts by name", async () => {
+    await seedRepoDeploy();
+    const first = capture();
+    const code = await cmdSecretsSet(
+      "weather",
+      ["OPENAI_API_KEY=sk-1", "WEATHER_TOKEN=t-1"],
+      {
+        team: String(TEAM_ID),
+        apiKey: API_KEY,
+        out: first.out,
+        err: first.err,
+      }
+    );
+    expect(code).toBe(0);
+    expect(first.stderr()).toContain("shell history");
+    expect(first.stdout()).toContain(
+      "Secrets now set: OPENAI_API_KEY, WEATHER_TOKEN"
+    );
+
+    // Upsert: overwrite one, add one; the untouched name stays.
+    const second = capture();
+    await cmdSecretsSet("weather", ["WEATHER_TOKEN=t-2", "EXTRA_TOKEN=e-1"], {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: second.out,
+      err: second.err,
+    });
+    expect(second.stdout()).toContain(
+      "Secrets now set: EXTRA_TOKEN, OPENAI_API_KEY, WEATHER_TOKEN"
+    );
+    const stored = backend.deployments.get("weather")?.secrets;
+    expect(stored?.get("WEATHER_TOKEN")?.value).toBe("t-2");
+    expect(stored?.get("OPENAI_API_KEY")?.value).toBe("sk-1");
+  });
+
+  it("reads values from piped stdin (one line per NAME) without echoing", async () => {
+    await seedRepoDeploy();
+    const stdin = new PassThrough();
+    stdin.end("sk-piped\nt-piped\n");
+    const io = capture();
+    const code = await cmdSecretsSet(
+      "weather",
+      ["OPENAI_API_KEY", "WEATHER_TOKEN"],
+      {
+        team: String(TEAM_ID),
+        apiKey: API_KEY,
+        stdin,
+        json: true,
+        out: io.out,
+        err: io.err,
+      }
+    );
+    expect(code).toBe(0);
+    expect(io.stderr()).not.toContain("shell history");
+    expect(io.stdout()).not.toContain("sk-piped");
+    expect(JSON.parse(io.stdout())).toEqual({
+      secretNames: ["OPENAI_API_KEY", "WEATHER_TOKEN"],
+    });
+    expect(
+      backend.deployments.get("weather")?.secrets.get("OPENAI_API_KEY")?.value
+    ).toBe("sk-piped");
+  });
+
+  it("prompts with hidden input on a TTY (backspace honored, no echo)", async () => {
+    await seedRepoDeploy();
+    const stdin = new PassThrough() as PassThrough & SecretInputStream;
+    stdin.isTTY = true;
+    const rawModes: boolean[] = [];
+    stdin.setRawMode = (mode: boolean) => {
+      rawModes.push(mode);
+    };
+    const io = capture();
+    const pending = cmdSecretsSet("weather", ["OPENAI_API_KEY"], {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      stdin,
+      out: io.out,
+      err: io.err,
+    });
+    // Wait for the prompt before "typing" (backspace fixes a typo).
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));
+    stdin.write("sk-secreX\u007ft\r");
+    const code = await pending;
+    expect(code).toBe(0);
+    expect(io.stderr()).toContain("Value for OPENAI_API_KEY:");
+    expect(io.stderr()).not.toContain("sk-secret");
+    expect(rawModes).toEqual([true, false]);
+    expect(
+      backend.deployments.get("weather")?.secrets.get("OPENAI_API_KEY")?.value
+    ).toBe("sk-secret");
+  });
+
+  it("rejects reserved and malformed names client-side without calling the API", async () => {
+    await seedRepoDeploy();
+    const requestsBefore = backend.secretsPutCount;
+    for (const [spec, message] of [
+      ["CURSOR_API_KEY=x", /platform-managed/],
+      ["lower_case=x", /Invalid secret name/],
+      [`${"A".repeat(65)}=x`, /too long/],
+    ] as const) {
+      const io = capture();
+      const code = await cmdSecretsSet("weather", [spec], {
+        team: String(TEAM_ID),
+        apiKey: API_KEY,
+        out: io.out,
+        err: io.err,
+      });
+      expect(code).toBe(1);
+      expect(io.stderr()).toMatch(message);
+    }
+    expect(backend.secretsPutCount).toBe(requestsBefore);
+  });
+
+  it("surfaces the backend 400 for secrets on a static deployment", async () => {
+    await makeClient().deploy({
+      teamId: TEAM_ID,
+      slug: "static",
+      source: { kind: "git-ref" },
+    });
+    const io = capture();
+    const code = await cmdSecretsSet("static", ["OPENAI_API_KEY=x"], {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+    });
+    expect(code).toBe(1);
+    expect(io.stderr()).toContain("redeploy with a gitRepoUrl first");
+  });
+
+  it("lists names + createdAt only (never values)", async () => {
+    await seedRepoDeploy();
+    await makeClient().setSecrets({
+      teamId: TEAM_ID,
+      slug: "weather",
+      secrets: [
+        { name: "OPENAI_API_KEY", value: "sk-1" },
+        { name: "WEATHER_TOKEN", value: "t-1" },
+      ],
+    });
+    const io = capture();
+    const code = await cmdSecretsList("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toMatch(/NAME\s+CREATED/);
+    expect(io.stdout()).toMatch(/OPENAI_API_KEY\s+2026-07-14T00:00:00.000Z/);
+    expect(io.stdout()).not.toContain("sk-1");
+
+    const json = capture();
+    await cmdSecretsList("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      json: true,
+      out: json.out,
+      err: json.err,
+    });
+    expect(JSON.parse(json.stdout())).toEqual({
+      secrets: [
+        { name: "OPENAI_API_KEY", createdAt: "2026-07-14T00:00:00.000Z" },
+        { name: "WEATHER_TOKEN", createdAt: "2026-07-14T00:00:00.000Z" },
+      ],
+    });
+  });
+
+  it("unsets one secret and reports missing names clearly", async () => {
+    await seedRepoDeploy();
+    await makeClient().setSecrets({
+      teamId: TEAM_ID,
+      slug: "weather",
+      secrets: [{ name: "OPENAI_API_KEY", value: "sk-1" }],
+    });
+    const io = capture();
+    const code = await cmdSecretsUnset("weather", "OPENAI_API_KEY", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toContain("Removed secret OPENAI_API_KEY");
+    expect(backend.deployments.get("weather")?.secrets.size).toBe(0);
+
+    const missing = capture();
+    const missingCode = await cmdSecretsUnset("weather", "OPENAI_API_KEY", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: missing.out,
+      err: missing.err,
+    });
+    expect(missingCode).toBe(1);
+    expect(missing.stderr()).toContain(
+      "No secret named OPENAI_API_KEY on deployment weather"
+    );
+
+    const reserved = capture();
+    const reservedCode = await cmdSecretsUnset("weather", "CURSOR_API_KEY", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: reserved.out,
+      err: reserved.err,
+    });
+    expect(reservedCode).toBe(1);
+    expect(reserved.stderr()).toMatch(/platform-managed/);
+  });
+});
+
+describe("cmdRotatePodCredential", () => {
+  it("prints the masked key and the redeploy note", async () => {
+    await makeClient().deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: { kind: "git-ref" },
+    });
+    const io = capture();
+    const code = await cmdRotatePodCredential("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: io.out,
+      err: io.err,
+    });
+    expect(code).toBe(0);
+    expect(io.stdout()).toMatch(/sk_agent_\*\*\*\*rot\d+/);
+    expect(io.stdout()).toContain("old credential until the next deploy");
+  });
+});
+
+describe("new response fields end-to-end", () => {
+  it("shows secretNames, egress, service account, and pod credential in the detail view", async () => {
+    const client = makeClient();
+    await client.deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: {
+        kind: "git-ref",
+        gitRepoUrl: "https://github.com/acme/agents",
+        egressAllowedDomains: ["api.example.com"],
+      },
+    });
+    await client.setSecrets({
+      teamId: TEAM_ID,
+      slug: "weather",
+      secrets: [{ name: "OPENAI_API_KEY", value: "sk-1" }],
+    });
+
+    const detail = capture();
+    const code = await cmdDeploymentStatus("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      out: detail.out,
+      err: detail.err,
+    });
+    expect(code).toBe(0);
+    expect(detail.stdout()).toContain("service account: 4242");
+    expect(detail.stdout()).toContain("egress:      api.example.com");
+    expect(detail.stdout()).toContain("secrets:     OPENAI_API_KEY");
+    expect(detail.stdout()).toMatch(/pod credential: sk_agent_\*\*\*\*/);
+
+    const json = capture();
+    await cmdDeploymentStatus("weather", {
+      team: String(TEAM_ID),
+      apiKey: API_KEY,
+      json: true,
+      out: json.out,
+      err: json.err,
+    });
+    const parsed = JSON.parse(json.stdout()) as Record<string, unknown>;
+    expect(parsed.serviceAccountId).toBe(4242);
+    expect(parsed.secretNames).toEqual(["OPENAI_API_KEY"]);
+    expect(parsed.egressAllowedDomains).toEqual(["api.example.com"]);
+  });
+});
+
+describe("CLI dispatch (subprocess)", () => {
+  it("runs `agentkit deployments --json` end to end through the bin entry", async () => {
+    const client = makeClient();
+    await client.deploy({
+      teamId: TEAM_ID,
+      slug: "weather",
+      source: { kind: "git-ref" },
+    });
+
+    const packageRoot = join(import.meta.dirname, "..", "..");
+    const { stdout } = await execFileAsync(
+      join(packageRoot, "node_modules", ".bin", "tsx"),
+      [
+        join(packageRoot, "src", "bin", "agent-serve.ts"),
+        "deployments",
+        "--team",
+        String(TEAM_ID),
+        "--json",
+      ],
+      {
+        env: {
+          ...process.env,
+          CURSOR_API_BASE_URL: backend.url,
+          CURSOR_API_KEY: API_KEY,
+        },
+        timeout: 25_000,
+      }
+    );
+    const parsed = JSON.parse(stdout) as {
+      deployments: Array<{ slug: string; status: string }>;
+    };
+    expect(parsed.deployments).toHaveLength(1);
+    expect(parsed.deployments[0]?.slug).toBe("weather");
+  }, 30_000);
+});