@cursor/july 0.1.2 → 0.1.3

package/dist/internal/playground-proxy.js

@@ -0,0 +1,468 @@
+/**
+ * Loopback reverse proxy that injects engine / bearer auth so a normal
+ * browser can use the hosted (or remote) playground SPA.
+ *
+ * Hosted engines sit behind short-lived `engineAccess` headers that a
+ * browser cannot set; alias tokens are header-only too. This proxy binds
+ * `127.0.0.1` only and forwards every request upstream with those headers.
+ *
+ * Access is gated by a per-proxy `accessToken` (query on first hit → HttpOnly
+ * cookie): other local processes cannot upgrade to injected credentials just
+ * by knowing the port. Mutating requests also require Origin/Referer to match
+ * this proxy's own origin so another `http://127.0.0.1:<port>` page cannot
+ * CSRF the cookie (cookies are host-scoped across ports). Absolute-form
+ * request-targets are rejected so injected headers never leave the configured
+ * upstream.
+ *
+ * When `refreshUpstream` is provided (hosted `--prod`), credentials are
+ * re-minted shortly before `expiresAt` and once on upstream 401 so a long
+ * playground session does not require restarting the CLI.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+import { randomBytes } from "node:crypto";
+import { createServer, request as httpRequest, } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { URL } from "node:url";
+import { openBrowser } from "./open-browser.js";
+export { openBrowser };
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailers",
+    "transfer-encoding",
+    "upgrade",
+    "host",
+    "content-length",
+]);
+/** Re-mint when the port token is within this window of expiry. */
+const ACCESS_EXPIRY_LEEWAY_MS = 5 * 60 * 1000;
+const PROXY_COOKIE = "agentkit_playground_proxy";
+const PROXY_TOKEN_QUERY = "proxyToken";
+/**
+ * Start a loopback proxy. Resolves once listening.
+ */
+export function startPlaygroundProxy(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const upstream = parseUpstreamUrl(args.upstreamUrl);
+        const state = {
+            upstream,
+            injectHeaders: buildInjectHeaders(args.headers, args.bearerToken),
+            expiresAtMs: parseExpiresAtMs(args.expiresAt),
+        };
+        const accessToken = (_a = args.accessToken) !== null && _a !== void 0 ? _a : randomBytes(32).toString("base64url");
+        const now = (_b = args.now) !== null && _b !== void 0 ? _b : Date.now;
+        let refreshInFlight;
+        /** Set after listen; used for Origin CSRF checks. */
+        let proxyOrigin = "";
+        const ensureFreshAccess = (force) => __awaiter(this, void 0, void 0, function* () {
+            if (args.refreshUpstream === undefined) {
+                return;
+            }
+            const expired = state.expiresAtMs !== undefined &&
+                now() >= state.expiresAtMs - ACCESS_EXPIRY_LEEWAY_MS;
+            if (!force && !expired) {
+                return;
+            }
+            if (refreshInFlight !== undefined) {
+                yield refreshInFlight;
+                return;
+            }
+            refreshInFlight = (() => __awaiter(this, void 0, void 0, function* () {
+                const next = yield args.refreshUpstream();
+                state.upstream = parseUpstreamUrl(next.upstreamUrl);
+                state.injectHeaders = buildInjectHeaders(next.headers, args.bearerToken);
+                state.expiresAtMs = parseExpiresAtMs(next.expiresAt);
+            }))().finally(() => {
+                refreshInFlight = undefined;
+            });
+            yield refreshInFlight;
+        });
+        const create = (_c = args.createServerImpl) !== null && _c !== void 0 ? _c : createServer;
+        const server = create((req, res) => {
+            void handleProxyRequest({
+                req,
+                res,
+                getState: () => state,
+                ensureFreshAccess,
+                canRefresh: args.refreshUpstream !== undefined,
+                accessToken,
+                proxyOrigin: () => proxyOrigin,
+            }).catch((error) => {
+                if (res.headersSent) {
+                    if (!res.writableEnded) {
+                        res.end();
+                    }
+                    return;
+                }
+                const message = error instanceof Error ? error.message : String(error);
+                res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+                res.end(`Playground proxy error: ${message}`);
+            });
+        });
+        yield new Promise((resolve, reject) => {
+            var _a;
+            server.once("error", reject);
+            server.listen((_a = args.port) !== null && _a !== void 0 ? _a : 0, "127.0.0.1", () => {
+                server.off("error", reject);
+                resolve();
+            });
+        });
+        const address = server.address();
+        const localUrl = `http://127.0.0.1:${address.port}`;
+        proxyOrigin = localUrl;
+        return {
+            localUrl,
+            port: address.port,
+            accessToken,
+            playgroundUrl: (sessionId) => {
+                const url = new URL(`${localUrl}/playground`);
+                url.searchParams.set(PROXY_TOKEN_QUERY, accessToken);
+                if (sessionId !== undefined && sessionId.trim() !== "") {
+                    url.searchParams.set("sessionId", sessionId.trim());
+                }
+                return url.toString();
+            },
+            close: () => new Promise((resolve, reject) => {
+                // Drop keep-alive / streamed playground connections so Ctrl-C
+                // does not hang waiting for active sockets.
+                server.closeAllConnections();
+                server.close((error) => {
+                    if (error) {
+                        reject(error);
+                        return;
+                    }
+                    resolve();
+                });
+            }),
+        };
+    });
+}
+function parseUpstreamUrl(raw) {
+    const upstream = new URL(raw.replace(/\/$/, ""));
+    if (upstream.protocol !== "http:" && upstream.protocol !== "https:") {
+        throw new Error(`Unsupported upstream protocol: ${upstream.protocol}`);
+    }
+    return upstream;
+}
+function parseExpiresAtMs(expiresAt) {
+    if (expiresAt === undefined || expiresAt.trim() === "") {
+        return undefined;
+    }
+    const ms = Date.parse(expiresAt);
+    return Number.isFinite(ms) ? ms : undefined;
+}
+function buildInjectHeaders(headers, bearerToken) {
+    const out = Object.assign({}, (headers !== null && headers !== void 0 ? headers : {}));
+    if (bearerToken !== undefined && bearerToken.trim() !== "") {
+        out.authorization = `Bearer ${bearerToken.trim()}`;
+    }
+    return out;
+}
+function readRequestBody(req) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, req_1, req_1_1;
+        var _b, e_1, _c, _d;
+        const chunks = [];
+        try {
+            for (_a = true, req_1 = __asyncValues(req); req_1_1 = yield req_1.next(), _b = req_1_1.done, !_b; _a = true) {
+                _d = req_1_1.value;
+                _a = false;
+                const chunk = _d;
+                chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+            }
+        }
+        catch (e_1_1) { e_1 = { error: e_1_1 }; }
+        finally {
+            try {
+                if (!_a && !_b && (_c = req_1.return)) yield _c.call(req_1);
+            }
+            finally { if (e_1) throw e_1.error; }
+        }
+        return Buffer.concat(chunks);
+    });
+}
+function handleProxyRequest(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const { req, res, getState, ensureFreshAccess, canRefresh, accessToken, proxyOrigin, } = args;
+        const pathWithQuery = (_a = req.url) !== null && _a !== void 0 ? _a : "/";
+        const pathParse = parseProxyPath(pathWithQuery);
+        if (!pathParse.ok) {
+            res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+            res.end("Absolute-form request targets are not allowed");
+            return;
+        }
+        const auth = authorizeLocalRequest({
+            pathWithQuery: pathParse.path,
+            cookieHeader: req.headers.cookie,
+            accessToken,
+        });
+        if (auth.kind === "deny") {
+            res.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+            res.end("Playground proxy requires the session access token");
+            return;
+        }
+        if (auth.kind === "bootstrap") {
+            res.writeHead(302, {
+                location: auth.redirectPath,
+                "set-cookie": auth.setCookie,
+                "cache-control": "no-store",
+            });
+            res.end();
+            return;
+        }
+        const method = (_b = req.method) !== null && _b !== void 0 ? _b : "GET";
+        if (!isTrustedBrowserOrigin({
+            method,
+            origin: headerString(req.headers.origin),
+            referer: headerString(req.headers.referer),
+            secFetchSite: headerString(req.headers["sec-fetch-site"]),
+            proxyOrigin: proxyOrigin(),
+        })) {
+            res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+            res.end("Playground proxy rejected cross-origin request");
+            return;
+        }
+        let body;
+        try {
+            body = yield readRequestBody(req);
+        }
+        catch (_c) {
+            if (!res.headersSent) {
+                res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+                res.end("Playground proxy failed to read request body");
+            }
+            return;
+        }
+        const forward = (state, deferWriteOnUnauthorized) => forwardOnce({
+            method,
+            pathWithQuery: pathParse.path,
+            inboundHeaders: req.headers,
+            body,
+            state,
+            res,
+            deferWriteOnUnauthorized,
+        });
+        try {
+            yield ensureFreshAccess(false);
+            let status = yield forward(getState(), canRefresh);
+            if (status === 401 && canRefresh) {
+                yield ensureFreshAccess(true);
+                // Retry once; always write this response (even if still 401).
+                status = yield forward(getState(), false);
+            }
+            void status;
+        }
+        catch (error) {
+            if (!res.headersSent) {
+                const message = error instanceof Error ? error.message : String(error);
+                res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+                res.end(`Playground proxy upstream error: ${message}`);
+            }
+            else if (!res.writableEnded) {
+                res.end();
+            }
+        }
+    });
+}
+/**
+ * Cookies are host-scoped across ports on 127.0.0.1, so SameSite=Strict alone
+ * does not stop CSRF from another loopback origin. Require the browser's
+ * Origin (or Referer / Sec-Fetch-Site: same-origin) to match this proxy for
+ * mutating methods. Safe methods stay cookie-gated only (no side effects).
+ */
+function isTrustedBrowserOrigin(args) {
+    const method = args.method.toUpperCase();
+    if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+        return true;
+    }
+    if (args.proxyOrigin === "") {
+        return false;
+    }
+    if (args.origin === args.proxyOrigin) {
+        return true;
+    }
+    if (args.referer !== undefined &&
+        (args.referer === args.proxyOrigin ||
+            args.referer.startsWith(`${args.proxyOrigin}/`))) {
+        return true;
+    }
+    // Some same-origin fetches omit Origin; modern browsers still send this.
+    if (args.secFetchSite === "same-origin") {
+        return true;
+    }
+    return false;
+}
+function headerString(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return Array.isArray(value) ? value[0] : value;
+}
+function authorizeLocalRequest(args) {
+    const cookieToken = readCookie(args.cookieHeader, PROXY_COOKIE);
+    if (cookieToken === args.accessToken) {
+        return { kind: "allow" };
+    }
+    const url = new URL(args.pathWithQuery, "http://127.0.0.1");
+    const queryToken = url.searchParams.get(PROXY_TOKEN_QUERY);
+    if (queryToken === args.accessToken) {
+        url.searchParams.delete(PROXY_TOKEN_QUERY);
+        const redirectPath = `${url.pathname}${url.search}`;
+        return {
+            kind: "bootstrap",
+            redirectPath,
+            setCookie: `${PROXY_COOKIE}=${args.accessToken}; Path=/; HttpOnly; SameSite=Strict`,
+        };
+    }
+    return { kind: "deny" };
+}
+function readCookie(header, name) {
+    if (header === undefined) {
+        return undefined;
+    }
+    const raw = Array.isArray(header) ? header.join("; ") : header;
+    for (const part of raw.split(";")) {
+        const trimmed = part.trim();
+        const eq = trimmed.indexOf("=");
+        if (eq <= 0)
+            continue;
+        if (trimmed.slice(0, eq) === name) {
+            return trimmed.slice(eq + 1);
+        }
+    }
+    return undefined;
+}
+function forwardOnce(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { method, pathWithQuery, inboundHeaders, body, state, res } = args;
+        const target = buildTargetUrl(pathWithQuery, state.upstream);
+        const outboundHeaders = {};
+        for (const [name, value] of Object.entries(inboundHeaders)) {
+            if (value === undefined)
+                continue;
+            const lower = name.toLowerCase();
+            if (HOP_BY_HOP.has(lower))
+                continue;
+            if (lower === "authorization")
+                continue;
+            // Do not forward the loopback session cookie upstream.
+            if (lower === "cookie")
+                continue;
+            outboundHeaders[name] = value;
+        }
+        for (const [name, value] of Object.entries(state.injectHeaders)) {
+            outboundHeaders[name] = value;
+        }
+        outboundHeaders.host = target.host;
+        outboundHeaders["content-length"] = String(body.byteLength);
+        const isHttps = target.protocol === "https:";
+        const requestFn = isHttps ? httpsRequest : httpRequest;
+        const options = {
+            protocol: target.protocol,
+            hostname: target.hostname,
+            port: target.port === "" ? (isHttps ? 443 : 80) : Number(target.port),
+            method,
+            path: `${target.pathname}${target.search}`,
+            headers: outboundHeaders,
+        };
+        return yield new Promise((resolve, reject) => {
+            const upstreamReq = requestFn(options, (upstreamRes) => {
+                var _a;
+                const status = (_a = upstreamRes.statusCode) !== null && _a !== void 0 ? _a : 502;
+                if (status === 401 && args.deferWriteOnUnauthorized) {
+                    // Drain so the socket can be reused; caller will refresh + retry.
+                    upstreamRes.resume();
+                    upstreamRes.on("end", () => resolve(status));
+                    upstreamRes.on("error", () => resolve(status));
+                    return;
+                }
+                const responseHeaders = Object.assign({}, upstreamRes.headers);
+                for (const hop of HOP_BY_HOP) {
+                    delete responseHeaders[hop];
+                }
+                res.writeHead(status, responseHeaders);
+                upstreamRes.pipe(res);
+                upstreamRes.on("end", () => resolve(status));
+                upstreamRes.on("error", () => {
+                    if (!res.writableEnded) {
+                        res.end();
+                    }
+                    resolve(status);
+                });
+            });
+            upstreamReq.on("error", (error) => {
+                reject(error);
+            });
+            res.on("close", () => {
+                if (!res.writableEnded) {
+                    upstreamReq.destroy();
+                }
+            });
+            upstreamReq.end(body);
+        });
+    });
+}
+/**
+ * Build an upstream URL that always keeps the configured host/port.
+ * Absolute-form or protocol-relative request-targets must not retarget
+ * outbound requests (injected engine/bearer credentials would follow).
+ */
+function buildTargetUrl(pathWithQuery, upstream) {
+    const pathParse = parseProxyPath(pathWithQuery);
+    const relative = pathParse.ok ? pathParse.path : "/";
+    const target = new URL(relative, upstream);
+    // Force authority back onto the configured upstream even if `new URL`
+    // accepted an absolute/protocol-relative request-target.
+    target.protocol = upstream.protocol;
+    target.hostname = upstream.hostname;
+    target.port = upstream.port;
+    target.username = "";
+    target.password = "";
+    // Preserve upstream pathname prefix when the base URL has one
+    // (unusual for engineAccess; kept for `--url` mounts).
+    if (upstream.pathname !== "/" && upstream.pathname !== "") {
+        const basePath = upstream.pathname.replace(/\/$/, "");
+        if (!pathnameHasPrefix(target.pathname, basePath)) {
+            target.pathname =
+                target.pathname === "/"
+                    ? `${basePath}/`
+                    : `${basePath}${target.pathname}`;
+        }
+    }
+    return target;
+}
+/** Reject absolute / scheme-relative request-targets; keep path + query only. */
+function parseProxyPath(pathWithQuery) {
+    const raw = pathWithQuery.trim();
+    if (raw === "") {
+        return { ok: true, path: "/" };
+    }
+    // Absolute-form ("http://evil/…") or protocol-relative ("//evil/…").
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/u.test(raw) || raw.startsWith("//")) {
+        return { ok: false };
+    }
+    return { ok: true, path: raw.startsWith("/") ? raw : `/${raw}` };
+}
+function pathnameHasPrefix(pathname, basePath) {
+    return pathname === basePath || pathname.startsWith(`${basePath}/`);
+}

package/dist/internal/prompt-context.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Framework-authored prompt context. Two pieces:
+ *
+ * 1. Identity section — static, appended to the agent's instructions (local
+ *    AGENTS.md and cloud first-turn preamble) so the model knows its own
+ *    name and how messages and sessions reach it.
+ * 2. Session context block — dynamic, prepended to the first turn's user
+ *    prompt only, telling the model which session/channel/environment it is
+ *    in plus a channel-appropriate presence line.
+ */
+import type { ResolvedAgent } from "../types.js";
+export declare const SCHEDULE_CHANNEL_PREFIX = "schedule:";
+export type PromptEnvironment = "hosted deployment" | "local dev server";
+export declare function buildIdentitySection(agent: Pick<ResolvedAgent, "name" | "description">): string;
+export interface SessionContextInput {
+    sessionId: string;
+    channelId: string;
+    /**
+     * The channel pack's `meta.kind` (e.g. `"slack"`, `"github"`). Channel ids
+     * are file stems, so kind — not id — identifies what the channel is.
+     */
+    channelKind?: string;
+    environment: PromptEnvironment;
+    /** Injectable clock for tests; defaults to now. */
+    now?: Date;
+}
+export declare function buildSessionContextBlock(input: SessionContextInput): string;
+/**
+ * One line telling the model whether anyone is watching this session and
+ * where its output lands. Resolved from the channel pack's declared kind
+ * when present, falling back to the built-in channel ids. Unknown channels
+ * get no line rather than a guess.
+ */
+export declare function channelPresenceLine(channel: Pick<SessionContextInput, "channelId" | "channelKind">): string | undefined;
+//# sourceMappingURL=prompt-context.d.ts.map

package/dist/internal/prompt-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-context.d.ts","sourceRoot":"","sources":["../../src/internal/prompt-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEzE,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,CAAC,GACjD,MAAM,CAWR;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,mDAAmD;IACnD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAc3E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,aAAa,CAAC,GAC9D,MAAM,GAAG,SAAS,CAepB"}

package/dist/internal/prompt-context.js

@@ -0,0 +1,71 @@
+/**
+ * Framework-authored prompt context. Two pieces:
+ *
+ * 1. Identity section — static, appended to the agent's instructions (local
+ *    AGENTS.md and cloud first-turn preamble) so the model knows its own
+ *    name and how messages and sessions reach it.
+ * 2. Session context block — dynamic, prepended to the first turn's user
+ *    prompt only, telling the model which session/channel/environment it is
+ *    in plus a channel-appropriate presence line.
+ */
+export const SCHEDULE_CHANNEL_PREFIX = "schedule:";
+export function buildIdentitySection(agent) {
+    var _a;
+    const description = (_a = agent.description) === null || _a === void 0 ? void 0 : _a.trim().replace(/\.$/, "");
+    const intro = description === undefined || description === ""
+        ? `You are "${agent.name}".`
+        : `You are "${agent.name}" — ${description}.`;
+    return [
+        "## About you",
+        "",
+        `${intro} You run as a persistent service: messages reach you through channels (such as Slack, GitHub, webhooks, or a web playground), and each conversation is a session that can continue across multiple turns.`,
+    ].join("\n");
+}
+export function buildSessionContextBlock(input) {
+    var _a;
+    const lines = [
+        "<agentkit_context>",
+        `session: ${input.sessionId}`,
+        `channel: ${input.channelId}`,
+        `environment: ${input.environment}`,
+        `time: ${((_a = input.now) !== null && _a !== void 0 ? _a : new Date()).toISOString()}`,
+        "</agentkit_context>",
+    ];
+    const presence = channelPresenceLine(input);
+    if (presence !== undefined) {
+        lines.push(presence);
+    }
+    return lines.join("\n");
+}
+/**
+ * One line telling the model whether anyone is watching this session and
+ * where its output lands. Resolved from the channel pack's declared kind
+ * when present, falling back to the built-in channel ids. Unknown channels
+ * get no line rather than a guess.
+ */
+export function channelPresenceLine(channel) {
+    var _a;
+    const kind = (_a = channel.channelKind) !== null && _a !== void 0 ? _a : builtinChannelKind(channel.channelId);
+    switch (kind) {
+        case "http":
+        case "mcp":
+            return "A user is interacting with you live and sees your replies as they stream.";
+        case "slack":
+            return "You are replying in a Slack thread; participants will read your messages.";
+        case "github":
+            return "You were triggered by a GitHub event. Deliver results through the actions available to you (comments, reviews, PRs); nobody sees your raw output otherwise.";
+        case "schedule":
+            return "This run was triggered automatically. No user is watching; complete the task autonomously and deliver results through your available tools/channels.";
+        default:
+            return undefined;
+    }
+}
+function builtinChannelKind(channelId) {
+    if (channelId === "http" || channelId === "mcp") {
+        return channelId;
+    }
+    if (channelId.startsWith(SCHEDULE_CHANNEL_PREFIX)) {
+        return "schedule";
+    }
+    return undefined;
+}

package/dist/internal/request-headers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Merge Authorization bearer + arbitrary request headers for agent HTTP
+ * clients (local `--bearer-token`, hosted `engineAccess.headers`, etc.).
+ */
+export interface RequestAuth {
+    bearerToken?: string;
+    /** Extra headers (e.g. X-Anyrun-Port-Token from engineAccess). */
+    headers?: Record<string, string>;
+}
+export declare function mergeRequestHeaders(auth: RequestAuth | undefined): Record<string, string>;
+//# sourceMappingURL=request-headers.d.ts.map

package/dist/internal/request-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-headers.d.ts","sourceRoot":"","sources":["../../src/internal/request-headers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAAG,SAAS,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB"}

package/dist/internal/request-headers.js

@@ -0,0 +1,14 @@
+/**
+ * Merge Authorization bearer + arbitrary request headers for agent HTTP
+ * clients (local `--bearer-token`, hosted `engineAccess.headers`, etc.).
+ */
+export function mergeRequestHeaders(auth) {
+    const out = {};
+    if ((auth === null || auth === void 0 ? void 0 : auth.headers) !== undefined) {
+        Object.assign(out, auth.headers);
+    }
+    if ((auth === null || auth === void 0 ? void 0 : auth.bearerToken) !== undefined) {
+        out.authorization = `Bearer ${auth.bearerToken}`;
+    }
+    return out;
+}

package/dist/internal/resolve-prod-target.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Resolve a hosted (managed) agent-serve deployment into a base URL +
+ * request headers for chat/run/call/eval `--prod`.
+ *
+ * Uses short-lived `engineAccess` from the deployment status route
+ * (Cursor API key on the management API; `X-Anyrun-Port-Token` on the
+ * engine). Alias tokens are out of scope here.
+ */
+/**
+ * Interactive CLI keep-alive for hosted engines. Without these, a hibernated
+ * Anyrun pod returns 417 `pod_hibernated` and never wakes. Matches the
+ * cloud-agent interactive keep-alive shape (lower ≤ upper, seconds).
+ */
+export declare const PROD_ENGINE_WAKE_HEADERS: Readonly<Record<string, string>>;
+export interface ResolveProdTargetOptions {
+    dir: string;
+    cwd?: string;
+    /** Explicit deployment slug; otherwise derived from `--dir` basename. */
+    slug?: string;
+    team?: string;
+    apiKey?: string;
+    fetchImpl?: typeof fetch;
+    err?: (text: string) => void;
+}
+export interface ResolvedProdTarget {
+    agentUrl: string;
+    headers: Record<string, string>;
+    slug: string;
+    expiresAt: string;
+}
+/**
+ * Look up a running deployment and return its engineAccess URL/headers.
+ * Throws {@link Error} with a CLI-ready message on failure.
+ */
+export declare function resolveProdTarget(options: ResolveProdTargetOptions): Promise<ResolvedProdTarget>;
+/** Resolve the deployment slug the same way `deploy` does for a single dir. */
+export declare function resolveProdSlug(options: {
+    dir: string;
+    cwd?: string;
+    slug?: string;
+}): string;
+//# sourceMappingURL=resolve-prod-target.d.ts.map

package/dist/internal/resolve-prod-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-prod-target.d.ts","sourceRoot":"","sources":["../../src/internal/resolve-prod-target.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGrE,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CA+D7B;AAWD,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAgBT"}