@cursor/july 0.1.27 → 0.1.29

package/src/channels/slack/slack-channel.ts

@@ -43,6 +43,7 @@ import {
   buildDefaultEvents,
   createDefaultOnChannelPost,
   createDefaultOnInbound,
+  resolveSlackBlockExternals,
 } from "./defaults.js";
 import {
   dispatchInboundFromEventBody,
@@ -66,9 +67,53 @@ import {
   assertSlackCursorAgentName,
   type SlackChannelOptions,
   type SlackChannelState,
+  type SlackCredentials,
   type SlackCursorAgentName,
 } from "./types.js";
 
+/** Options used to construct a slack channel — for host-level credential binding. */
+const slackChannelOptionsByDefinition = new WeakMap<
+  object,
+  SlackChannelOptions
+>();
+
+/**
+ * Recover the {@link SlackChannelOptions} used to build a channel definition,
+ * if it was created via {@link slackChannel}.
+ */
+export function getSlackChannelOptions(
+  definition: object
+): SlackChannelOptions | undefined {
+  return slackChannelOptionsByDefinition.get(definition);
+}
+
+/** Dedicated Socket Mode credentials for `ctx.host.slack.getClient()`. */
+export interface SlackChannelHostBinding {
+  credentials: SlackCredentials;
+  envPrefix?: string;
+}
+
+/**
+ * First dedicated (Socket Mode) Slack channel on a project. Skips
+ * `cursorAccount` channels — those have no local bot token for
+ * {@link HostContext.slack.getClient}.
+ */
+export function resolveDedicatedSlackHostBinding(
+  channels: ReadonlyArray<{ definition: object }>
+): SlackChannelHostBinding | undefined {
+  for (const channel of channels) {
+    const options = slackChannelOptionsByDefinition.get(channel.definition);
+    if (options === undefined || options.cursorAccount === true) {
+      continue;
+    }
+    return {
+      credentials: options.credentials ?? credentialsFromEnv(options.envPrefix),
+      envPrefix: options.envPrefix,
+    };
+  }
+  return undefined;
+}
+
 /**
  * Create a Slack channel. Author as `agent/channels/slack.ts` default export.
  *
@@ -152,11 +197,14 @@ export function slackChannel<const Name extends string = string>(
       : (options.credentials ?? credentialsFromEnv(options.envPrefix));
   const envKeys = slackEnvKeys(options.envPrefix);
   const loadingMessages = options.loadingMessages;
-  const defaultInbound = createDefaultOnInbound(loadingMessages);
+  const policy = options.policy;
+  const blockExternals = resolveSlackBlockExternals(policy);
+  const defaultInbound = createDefaultOnInbound(loadingMessages, policy);
   const onAppMention = options.onAppMention ?? defaultInbound;
   const onDirectMessage = options.onDirectMessage ?? defaultInbound;
   const onChannelPost =
-    options.onChannelPost ?? createDefaultOnChannelPost(loadingMessages);
+    options.onChannelPost ??
+    createDefaultOnChannelPost(loadingMessages, policy);
   const engagement = options.engagement ?? {};
   const mentionsEnabled = engagement.mentions !== false;
   const directMessagesEnabled = engagement.directMessages !== false;
@@ -237,6 +285,8 @@ export function slackChannel<const Name extends string = string>(
       mentionsEnabled,
       directMessagesEnabled,
       evalCommandsEnabled,
+      // cursorAccount: backend router already refuses externals.
+      blockExternals: cursorAccount ? false : blockExternals,
       ...(args.hasContinuationSession === undefined
         ? {}
         : { hasContinuationSession: args.hasContinuationSession }),
@@ -329,10 +379,15 @@ export function slackChannel<const Name extends string = string>(
 
       let botUserId: string | undefined;
       let botId: string | undefined;
+      let installTeamId: string | undefined;
       let webClient: InstanceType<
         typeof import("@slack/web-api").WebClient
       > | null = null;
-      if (channelPosts !== undefined || botMentions !== undefined) {
+      if (
+        channelPosts !== undefined ||
+        botMentions !== undefined ||
+        routeInteractive
+      ) {
         try {
           const { WebClient } = await import("@slack/web-api");
           webClient = new WebClient(botToken);
@@ -341,6 +396,8 @@ export function slackChannel<const Name extends string = string>(
             typeof identity.user_id === "string" ? identity.user_id : undefined;
           botId =
             typeof identity.bot_id === "string" ? identity.bot_id : undefined;
+          installTeamId =
+            typeof identity.team_id === "string" ? identity.team_id : undefined;
         } catch (error) {
           getLog().error("bot identity lookup degraded", {
             error: error instanceof Error ? error.message : String(error),
@@ -416,6 +473,7 @@ export function slackChannel<const Name extends string = string>(
                   artifacts: args.artifacts,
                   log: getLog(),
                   evalCommandsEnabled,
+                  blockExternals,
                   ...(args.hasContinuationSession === undefined
                     ? {}
                     : {
@@ -491,6 +549,7 @@ export function slackChannel<const Name extends string = string>(
               resolveApproval: args.resolveApproval,
               waitUntil: args.waitUntil,
               log: getLog(),
+              blockExternals,
             }
           );
           if (handledAsApproval || onBlockAction === undefined) {
@@ -503,6 +562,8 @@ export function slackChannel<const Name extends string = string>(
             host: args.host,
             artifacts: args.artifacts,
             log: getLog(),
+            blockExternals,
+            installTeamId,
             hasContinuationSession: args.hasContinuationSession,
             isContinuationBusy: args.isContinuationBusy,
             getContinuationLastBotMessageTs:
@@ -542,6 +603,8 @@ export function slackChannel<const Name extends string = string>(
     },
   });
 
+  slackChannelOptionsByDefinition.set(definition, options);
+
   if (accountTransport !== undefined) {
     // Serve-time seam: the host discovers cursor-account channels through
     // this registry, binds the outbound transport, and dispatches relayed

package/src/channels/slack/types.ts

@@ -432,8 +432,20 @@ export function assertSlackCursorAgentName(name: string): void {
   }
 }
 
+/** `"thread"` = anyone in the thread (default); `"author"` = session starter only. */
+export type SlackRespondTo = "thread" | "author";
+
+export interface SlackAccessPolicy {
+  /** Defaults to `"thread"`. Applied by the default inbound handlers. */
+  respondTo?: SlackRespondTo;
+  /** Refuse Slack Connect / guest / other-workspace senders. Defaults to `true`. */
+  blockExternals?: boolean;
+}
+
 export interface SlackChannelOptions {
   credentials?: SlackCredentials;
+  /** Defaults to `{ respondTo: "thread", blockExternals: true }`. */
+  policy?: SlackAccessPolicy;
   /**
    * Per-agent env prefix for tokens. `envPrefix: "MY_AGENT"` reads
    * `MY_AGENT_SLACK_BOT_TOKEN` + `MY_AGENT_SLACK_APP_TOKEN`. Prefer this over

package/src/internal/cli-ax.ts

@@ -9,7 +9,7 @@
 
 import { mkdir, mkdtemp, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { Artifacts, JUnit } from "../evals/reporters.js";
 import type {
   EvalAssertionResult,
@@ -122,6 +122,12 @@ export interface AxCliOptions {
   skipReport?: boolean;
   /** `eval`: override `evals.config.ts` `maxConcurrency`. */
   maxConcurrency?: number;
+  /**
+   * `eval` / `eval status <runId>`: also write the full results JSON to this
+   * path. `session`: write the raw NDJSON trace (same format as `run
+   * --events` and the playground download) to this path instead of printing.
+   */
+  out?: string;
   /** Scaffold target directory for `init`. */
   initTarget?: string;
   /** Tool name for `call`. */
@@ -794,6 +800,18 @@ export async function cmdEval(options: AxCliOptions): Promise<number> {
       return 2;
     }
   }
+  if (trimNonEmpty(options.out) !== undefined) {
+    if (options.list === true) {
+      process.stderr.write("--out and --list are mutually exclusive\n");
+      return 2;
+    }
+    if (options.noWait === true) {
+      process.stderr.write(
+        `--out needs the finished results; drop --no-wait, or poll later with ${CLI_COMMAND_NAME} eval status <evalId> --out <path>\n`
+      );
+      return 2;
+    }
+  }
 
   const filterIds =
     options.evalIds === undefined || options.evalIds.length === 0
@@ -888,7 +906,12 @@ export async function cmdEval(options: AxCliOptions): Promise<number> {
           process.stderr.write("No matching evals found.\n");
           return 2;
         }
-        return printEvalResults(results, options, undefined, artifactsDir);
+        return await printEvalResults(
+          results,
+          options,
+          undefined,
+          artifactsDir
+        );
       } finally {
         progress?.close();
       }
@@ -944,7 +967,7 @@ export async function cmdEval(options: AxCliOptions): Promise<number> {
         process.stderr.write("No matching evals found.\n");
         return 2;
       }
-      return printEvalResults(results, options, {
+      return await printEvalResults(results, options, {
         runId: snapshot.runId,
         status: snapshot.status,
         error: snapshot.error,
@@ -1049,8 +1072,8 @@ async function printEvalAccepted(
     agentUrl
   );
   if (options.json) {
-    console.log(
-      JSON.stringify(
+    process.stdout.write(
+      `${JSON.stringify(
         {
           ok: true,
           accepted: true,
@@ -1064,7 +1087,7 @@ async function printEvalAccepted(
         },
         null,
         2
-      )
+      )}\n`
     );
   } else {
     const durable = started.config.durableRuns === true ? " (persisted)" : "";
@@ -1168,7 +1191,7 @@ export async function cmdEvalCancel(
       fetchImpl: options.fetchImpl,
     });
     if (options.json) {
-      console.log(JSON.stringify(snap, null, 2));
+      process.stdout.write(`${JSON.stringify(snap, null, 2)}\n`);
     } else {
       process.stdout.write(
         `Cancelled Eval ID ${snap.runId} (${snap.summary.done}/${snap.summary.total} cases finalized)\n`
@@ -1214,6 +1237,13 @@ export async function cmdEvalStatus(
     process.stderr.write("eval status does not accept --list or --no-wait\n");
     return 2;
   }
+  if (
+    trimNonEmpty(options.out) !== undefined &&
+    (runId === undefined || runId === "")
+  ) {
+    process.stderr.write("eval status --out requires an eval id\n");
+    return 2;
+  }
 
   const target = await resolveEvalTarget(options);
   if (typeof target === "number") {
@@ -1232,7 +1262,9 @@ export async function cmdEvalStatus(
         fetchImpl: options.fetchImpl,
       });
       if (options.json) {
-        console.log(JSON.stringify({ runs, activeRunId }, null, 2));
+        process.stdout.write(
+          `${JSON.stringify({ runs, activeRunId }, null, 2)}\n`
+        );
       } else if (runs.length === 0) {
         process.stdout.write("No eval runs on this agent.\n");
       } else {
@@ -1252,8 +1284,12 @@ export async function cmdEvalStatus(
       auth,
       fetchImpl: options.fetchImpl,
     });
+    const outPath = await writeJsonOutFile(options.out, snap);
     if (options.json) {
-      console.log(JSON.stringify(snap, null, 2));
+      process.stdout.write(`${JSON.stringify(snap, null, 2)}\n`);
+      if (outPath !== undefined) {
+        process.stderr.write(`results: ${outPath}\n`);
+      }
     } else {
       process.stdout.write(`${formatEvalRunSummaryLine(snap)}\n`);
       if (snap.error !== undefined && snap.error !== "") {
@@ -1271,6 +1307,9 @@ export async function cmdEvalStatus(
           process.stdout.write(`    error: ${c.error}\n`);
         }
       }
+      if (outPath !== undefined) {
+        process.stdout.write(`results: ${outPath}\n`);
+      }
     }
     if (snap.status === "running") {
       return 3;
@@ -1333,7 +1372,7 @@ function printListedEvals(
   emptyMessage: string
 ): number {
   if (options.json) {
-    console.log(JSON.stringify(listed, null, 2));
+    process.stdout.write(`${JSON.stringify(listed, null, 2)}\n`);
   } else if (listed.length === 0) {
     process.stdout.write(`${emptyMessage}\n`);
   } else {
@@ -1438,7 +1477,7 @@ const EVAL_VERDICT_LABEL: Record<EvalVerdict, string> = {
   skipped: "SKIP",
 };
 
-function printEvalResults(
+async function printEvalResults(
   results: EvalRunResult[],
   options: AxCliOptions,
   batch?: {
@@ -1447,7 +1486,7 @@ function printEvalResults(
     error?: string;
   },
   artifactsDir?: string
-): number {
+): Promise<number> {
   const strict = options.strict === true;
   const counts = { passed: 0, failed: 0, scored: 0, skipped: 0 };
   for (const result of results) {
@@ -1462,28 +1501,29 @@ function printEvalResults(
     process.stderr.write(`eval run error: ${batch.error}\n`);
   }
 
+  const payload = {
+    ok,
+    passed: counts.passed,
+    failed: counts.failed,
+    scored: counts.scored,
+    skipped: counts.skipped,
+    strict,
+    results,
+    ...(artifactsDir === undefined ? {} : { artifactsDir }),
+    ...(batch?.runId === undefined ? {} : { runId: batch.runId }),
+    ...(batch?.status === undefined ? {} : { status: batch.status }),
+    ...(batch?.error === undefined || batch.error === ""
+      ? {}
+      : { error: batch.error }),
+  };
+  const outPath = await writeJsonOutFile(options.out, payload);
+
   if (options.json) {
-    console.log(
-      JSON.stringify(
-        {
-          ok,
-          passed: counts.passed,
-          failed: counts.failed,
-          scored: counts.scored,
-          skipped: counts.skipped,
-          strict,
-          results,
-          ...(artifactsDir === undefined ? {} : { artifactsDir }),
-          ...(batch?.runId === undefined ? {} : { runId: batch.runId }),
-          ...(batch?.status === undefined ? {} : { status: batch.status }),
-          ...(batch?.error === undefined || batch.error === ""
-            ? {}
-            : { error: batch.error }),
-        },
-        null,
-        2
-      )
-    );
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    if (outPath !== undefined) {
+      // stdout stays pure JSON; report the file on stderr.
+      process.stderr.write(`results: ${outPath}\n`);
+    }
   } else {
     for (const r of results) {
       const verdict = evalVerdictOf(r);
@@ -1532,10 +1572,31 @@ function printEvalResults(
     if (artifactsDir !== undefined) {
       process.stdout.write(`artifacts: ${artifactsDir}\n`);
     }
+    if (outPath !== undefined) {
+      process.stdout.write(`results: ${outPath}\n`);
+    }
   }
   return ok ? 0 : 1;
 }
 
+/**
+ * `--out <path>`: write a JSON payload (results / run snapshot), creating
+ * parent directories. Returns the resolved path, or undefined when unset.
+ */
+async function writeJsonOutFile(
+  out: string | undefined,
+  payload: unknown
+): Promise<string | undefined> {
+  const trimmed = trimNonEmpty(out);
+  if (trimmed === undefined) {
+    return undefined;
+  }
+  const target = resolve(trimmed);
+  await mkdir(dirname(target), { recursive: true });
+  await writeFile(target, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+  return target;
+}
+
 /**
  * One assertion line. Soft assertions read `~` rather than `✗` when they miss,
  * so a tracked score is visibly different from a failed gate.
@@ -1721,6 +1782,8 @@ export async function cmdSessions(options: AxCliOptions): Promise<number> {
 /**
  * `session <id>` — view a full session (trajectory text by default).
  * `--json` → trajectory JSON; `--events` (`rawEvents`) → raw event list.
+ * `--out <path>` → write the raw NDJSON trace to a file instead of printing
+ * (same format as `run --events` and the playground download).
  * Interactive reattach: `resume [id]` / `chat --resume` (or `chat --session`).
  */
 export async function cmdSession(
@@ -1729,7 +1792,7 @@ export async function cmdSession(
 ): Promise<number> {
   if (sessionId === undefined || sessionId.trim() === "") {
     process.stderr.write(
-      `Usage: ${CLI_COMMAND_NAME} session <sessionId> [--url | --prod] [--json | --text | --events]\n`
+      `Usage: ${CLI_COMMAND_NAME} session <sessionId> [--url | --prod] [--json | --text | --events] [--out <file.ndjson>]\n`
     );
     return 2;
   }
@@ -1754,6 +1817,19 @@ export async function cmdSession(
       fetchImpl: options.fetchImpl,
     });
 
+    const outPath = trimNonEmpty(options.out);
+    if (outPath !== undefined) {
+      const targetPath = resolve(outPath);
+      await mkdir(dirname(targetPath), { recursive: true });
+      await writeFile(
+        targetPath,
+        `${events.map((e) => JSON.stringify(e)).join("\n")}\n`,
+        "utf8"
+      );
+      process.stdout.write(`trace: ${targetPath} (${events.length} events)\n`);
+      return 0;
+    }
+
     if (options.rawEvents === true) {
       process.stdout.write(
         `${JSON.stringify({ sessionId, events }, null, 2)}\n`

package/src/internal/cloud-turn-cost.ts

@@ -0,0 +1,158 @@
+/**
+ * Recover token usage / estimated cost for cloud turns that finished without
+ * either field on `turn.completed`.
+ *
+ * Cloud `run.wait()` often drops streamed usage after SSE reconnect, and
+ * older engines never persisted cost. The playground Trace tab only renders
+ * what is on the event, so historical sessions stay blank unless we backfill
+ * from `Agent.getUsage` when the stream is read.
+ */
+
+import type {
+  ModelSetting,
+  SessionEvent,
+  TurnCost,
+  TurnUsage,
+} from "../types.js";
+import { estimateTurnCost } from "./model-pricing.js";
+
+export interface CloudRunUsage {
+  runId: string;
+  usage: TurnUsage;
+}
+
+export interface CloudAgentUsage {
+  usage: TurnUsage;
+  runs: CloudRunUsage[];
+}
+
+export function usageTokenSum(usage: TurnUsage | undefined): number {
+  if (usage === undefined) {
+    return 0;
+  }
+  return (
+    usage.inputTokens +
+    usage.outputTokens +
+    usage.cacheReadTokens +
+    usage.cacheWriteTokens
+  );
+}
+
+export function isUnpricedCompletedTurn(event: SessionEvent): boolean {
+  return (
+    event.type === "turn.completed" &&
+    usageTokenSum(event.data.usage) <= 0 &&
+    event.data.cost === undefined
+  );
+}
+
+export function cloudSdkAgentIdFromEvents(
+  events: ReadonlyArray<SessionEvent>
+): string | undefined {
+  let sdkAgentId: string | undefined;
+  for (const event of events) {
+    if (event.type !== "agent.bound") {
+      continue;
+    }
+    const id = event.data.sdkAgentId.trim();
+    if (id.startsWith("bc-")) {
+      sdkAgentId = id;
+    }
+  }
+  return sdkAgentId;
+}
+
+/**
+ * Copy usage/cost onto unpriced `turn.completed` events. Returns undefined
+ * when the snapshot cannot be attributed safely (multiple unmatched turns).
+ */
+export function applyCloudUsageToEvents(
+  events: ReadonlyArray<SessionEvent>,
+  billed: CloudAgentUsage,
+  model: ModelSetting
+): SessionEvent[] | undefined {
+  const completedIndexes: number[] = [];
+  const unpricedIndexes: number[] = [];
+  for (let i = 0; i < events.length; i++) {
+    const event = events[i];
+    if (event === undefined || event.type !== "turn.completed") {
+      continue;
+    }
+    completedIndexes.push(i);
+    if (isUnpricedCompletedTurn(event)) {
+      unpricedIndexes.push(i);
+    }
+  }
+  if (unpricedIndexes.length === 0) {
+    return [...events];
+  }
+
+  const patches = new Map<
+    number,
+    { usage: TurnUsage; cost: TurnCost | undefined }
+  >();
+  if (
+    unpricedIndexes.length === 1 &&
+    completedIndexes.length === 1 &&
+    usageTokenSum(billed.usage) > 0
+  ) {
+    const index = unpricedIndexes[0];
+    if (index !== undefined) {
+      patches.set(index, {
+        usage: billed.usage,
+        cost: estimateTurnCost(model, billed.usage),
+      });
+    }
+  } else if (
+    billed.runs.length === unpricedIndexes.length &&
+    billed.runs.every((run) => usageTokenSum(run.usage) > 0)
+  ) {
+    for (let i = 0; i < unpricedIndexes.length; i++) {
+      const index = unpricedIndexes[i];
+      const run = billed.runs[i];
+      if (index === undefined || run === undefined) {
+        return undefined;
+      }
+      patches.set(index, {
+        usage: run.usage,
+        cost: estimateTurnCost(model, run.usage),
+      });
+    }
+  } else {
+    return undefined;
+  }
+
+  return events.map((event, index) => {
+    const patch = patches.get(index);
+    if (patch === undefined || event.type !== "turn.completed") {
+      return event;
+    }
+    return {
+      ...event,
+      data: {
+        ...event.data,
+        usage: patch.usage,
+        ...(patch.cost === undefined ? {} : { cost: patch.cost }),
+      },
+    };
+  });
+}
+
+export function mapSdkTokenUsage(usage: {
+  inputTokens: number;
+  outputTokens: number;
+  cacheReadTokens: number;
+  cacheWriteTokens: number;
+  reasoningTokens?: number;
+}): TurnUsage {
+  const mapped: TurnUsage = {
+    inputTokens: usage.inputTokens,
+    outputTokens: usage.outputTokens,
+    cacheReadTokens: usage.cacheReadTokens,
+    cacheWriteTokens: usage.cacheWriteTokens,
+  };
+  if (usage.reasoningTokens !== undefined) {
+    mapped.reasoningTokens = usage.reasoningTokens;
+  }
+  return mapped;
+}

package/src/internal/cursor-slack-relay.ts

@@ -23,6 +23,8 @@ export interface CursorSlackAgentRegistration {
   name: string;
   iconUrl?: string;
   iconEmoji?: string;
+  /** Opt out of the default external-sender block. */
+  blockExternals?: boolean;
 }
 
 interface RegistrationResponse {
@@ -160,6 +162,7 @@ export class CursorSlackRelay {
             name: agent.name,
             iconUrl: agent.iconUrl,
             iconEmoji: agent.iconEmoji,
+            blockExternals: agent.blockExternals === false ? false : undefined,
           })),
         };
       },

package/src/internal/deploy-client.ts

@@ -148,6 +148,8 @@ export interface Deployment {
   engineGeneration?: number | null;
   publicId?: string;
   engineUrl?: string | null;
+  /** Anyrun pod id for the active engine, when coordinates are known. */
+  enginePodId?: string | null;
   lastError?: string | null;
   engineAlias: string;
   desiredUpdatedAt?: string;
@@ -259,6 +261,7 @@ const deploymentSchema = z.object({
   engineGeneration: z.number().nullable().optional(),
   publicId: z.string().optional(),
   engineUrl: z.string().nullable().optional(),
+  enginePodId: z.string().nullable().optional(),
   lastError: z.string().nullable().optional(),
   engineAlias: z.string(),
   desiredUpdatedAt: z.string().optional(),

package/src/internal/discovery.ts

@@ -1753,6 +1753,7 @@ export function projectInfo(project: AgentProject): AgentProjectInfo {
   ];
   return {
     name: project.name,
+    description: agent.description,
     model: agent.model,
     runtime: agent.runtime,
     cloud:
@@ -2000,7 +2001,14 @@ function isModuleFile(fileName: string): boolean {
   if (fileName.endsWith(".d.ts") || fileName.startsWith(".")) {
     return false;
   }
-  return MODULE_EXTENSIONS.has(extname(fileName));
+  if (!MODULE_EXTENSIONS.has(extname(fileName))) {
+    return false;
+  }
+  // Colocated unit tests (Vitest/Jest convention) are not definitions.
+  // Without this, `channels/slack.test.ts` is scanned as a channel named
+  // "slack.test", fails NAME_PATTERN, and the whole agent refuses to serve.
+  const stem = moduleStem(fileName);
+  return !stem.endsWith(".test") && !stem.endsWith(".spec");
 }
 
 function moduleStem(fileName: string): string {

package/src/internal/event-log.ts

@@ -97,6 +97,23 @@ export class SessionEventLog {
     return startIndex <= 0 ? [...this.events] : this.events.slice(startIndex);
   }
 
+  /**
+   * Replace one already-recorded event in memory. Used to backfill usage/cost
+   * onto historical `turn.completed` rows without rewriting `events.ndjson`.
+   * Live subscribers are not notified — patch before opening a replay stream.
+   */
+  replace(index: number, event: SessionEvent): boolean {
+    if (index < 0 || index >= this.events.length) {
+      return false;
+    }
+    const current = this.events[index];
+    if (current === undefined || current.index !== index) {
+      return false;
+    }
+    this.events[index] = event;
+    return true;
+  }
+
   subscribe(listener: (event: SessionEvent) => void): () => void {
     this.listeners.add(listener);
     return () => {