@cursor/july 0.1.21 → 0.1.22

package/src/channels/slack/types.ts

@@ -327,8 +327,19 @@ export interface SlackChannelPostsOptions {
  */
 export interface SlackBotMentionsOptions {
   /**
-   * Bots whose mentions may wake this agent: `bot_id`s (`B…`) and/or bot
-   * *user* ids (`U…`). Must be non-empty (empty is a definition error).
+   * Bots whose mentions may wake this agent. Three entry forms:
+   *
+   * - `"B…"` — a `bot_id` (dedicated Slack app).
+   * - `"U…"` — a bot *user* id.
+   * - `"<botId>:<username>"` — compound: the posting app's `bot_id` AND its
+   *   message `username` must both match (case-insensitive username). Use
+   *   this for shared multi-tenant apps like the Cursor Slack connection,
+   *   where every agent posts under one `bot_id` but the backend pins each
+   *   agent's `username` server-side — `"B0CURSOR…:Lasso"` trusts only the
+   *   Cursor app posting as Lasso, not every Cursor-connected agent.
+   *   Fails closed when the event carries no username.
+   *
+   * Must be non-empty (empty is a definition error).
    */
   allowFrom: string[];
   /**

package/src/internal/local-env.test.ts

@@ -55,6 +55,26 @@ describe("loadAgentLocalEnv", () => {
     expect(process.env.LOCALENV_NODE_MODULES).toBeUndefined();
   });
 
+  it("loads checked-in .env defaults under .env.local", async () => {
+    const dir = await makeDir();
+    await writeFile(
+      join(dir, ".env"),
+      "LOCALENV_DEFAULT=fromenv\nLOCALENV_BOTH=fromenv\n"
+    );
+    await writeFile(
+      join(dir, ".env.local"),
+      "LOCALENV_BOTH=fromlocal\nLOCALENV_ONLY_LOCAL=local\n"
+    );
+    setKeys.push("LOCALENV_DEFAULT", "LOCALENV_BOTH", "LOCALENV_ONLY_LOCAL");
+
+    const loaded = loadAgentLocalEnv(dir);
+
+    expect(loaded).toEqual([join(dir, ".env.local"), join(dir, ".env")]);
+    expect(process.env.LOCALENV_DEFAULT).toBe("fromenv");
+    expect(process.env.LOCALENV_BOTH).toBe("fromlocal");
+    expect(process.env.LOCALENV_ONLY_LOCAL).toBe("local");
+  });
+
   it("never overrides real environment variables", async () => {
     const dir = await makeDir();
     await writeFile(join(dir, ".env.local"), "LOCALENV_PRECEDENCE=fromfile\n");

package/src/internal/local-env.ts

@@ -1,8 +1,10 @@
 /**
- * Loads an agent directory's `.env.local` (and each immediate child's,
- * for multi-agent hosts) into process.env. Real env always wins —
- * `process.loadEnvFile` never overrides. Values a previous call loaded are
- * refreshed, so a reload picks up edits made since.
+ * Loads an agent directory's env files (and each immediate child's, for
+ * multi-agent hosts) into process.env. Load order per directory is
+ * `.env.local` then `.env` — `process.loadEnvFile` never overrides, so
+ * real env wins over both, and `.env.local` wins over checked-in `.env`
+ * defaults. Values a previous call loaded are refreshed, so a reload
+ * picks up edits made since.
  */
 
 import { existsSync, readdirSync } from "node:fs";
@@ -30,8 +32,14 @@ export function loadAgentLocalEnv(dir: string): string[] {
       Object.keys(process.env).filter((key) => !realKeys.has(key))
     );
   };
+  const tryLoadDir = (agentDir: string): void => {
+    // `.env.local` first so its values win over checked-in `.env` defaults
+    // under loadEnvFile's no-override semantics.
+    tryLoad(join(agentDir, ".env.local"));
+    tryLoad(join(agentDir, ".env"));
+  };
 
-  tryLoad(join(dir, ".env.local"));
+  tryLoadDir(dir);
 
   let children: string[];
   try {
@@ -46,7 +54,7 @@ export function loadAgentLocalEnv(dir: string): string[] {
     if (child === "node_modules") {
       continue;
     }
-    tryLoad(join(dir, child, ".env.local"));
+    tryLoadDir(join(dir, child));
   }
   trackLoadedKeys();
   return loaded;