@cursor/july 0.1.39 → 0.1.40

package/dist/internal/cursor-event-relay.js

@@ -36,22 +36,44 @@ export function formatCursorScmEventLog(event) {
     const delivery = (_a = event.deliveryId) !== null && _a !== void 0 ? _a : "no delivery id";
     return `${event.eventName}${action} on ${pr} received=${received}${occurred} (${delivery})`;
 }
+/** Relay log suffix for one fan-out target, including parse errors on 4xx. */
+export function formatCursorScmDispatchOutcome(target) {
+    const slug = target.slug === "" ? "default" : target.slug;
+    if (target.status < 400) {
+        return `${slug}:${target.status}`;
+    }
+    const error = readDispatchError(target.body);
+    return error === undefined
+        ? `${slug}:${target.status}`
+        : `${slug}:${target.status} ${error}`;
+}
+function readDispatchError(body) {
+    if (typeof body !== "object" || body === null)
+        return undefined;
+    if (!("error" in body))
+        return undefined;
+    const error = body.error;
+    return typeof error === "string" && error !== "" ? error : undefined;
+}
 /**
  * Minimal GitHub webhook body from an SCM-events metadata envelope.
  * When `pullRequest` has title + head/base refs+shas, emits a Zod-valid
  * `pull_request` object for `onPullRequest`; otherwise identity-only stubs.
  * When `comment` is present, emits a Zod-valid `comment` object so relayed
  * `issue_comment` / `pull_request_review_comment` deliveries dispatch.
+ * When a CI snapshot is present, emits `check_run` / `check_suite` /
+ * `workflow_run` so those typed hooks parse on the `--cursor-events` path.
  */
 export function scmMetadataToGitHubPayload(event) {
     var _a, _b, _c;
+    var _d, _e, _f, _g, _h;
     const slash = event.repo.indexOf("/");
     const owner = slash === -1 ? "" : event.repo.slice(0, slash);
     const name = slash === -1 ? event.repo : event.repo.slice(slash + 1);
     const repoUrl = `https://github.com/${event.repo}`;
     const prMeta = event.pullRequest;
-    const prNumber = (_a = prMeta === null || prMeta === void 0 ? void 0 : prMeta.number) !== null && _a !== void 0 ? _a : event.prNumber;
-    const prUrl = (_c = (_b = prMeta === null || prMeta === void 0 ? void 0 : prMeta.url) !== null && _b !== void 0 ? _b : event.prUrl) !== null && _c !== void 0 ? _c : (prNumber !== undefined ? `${repoUrl}/pull/${prNumber}` : undefined);
+    const prNumber = (_d = prMeta === null || prMeta === void 0 ? void 0 : prMeta.number) !== null && _d !== void 0 ? _d : event.prNumber;
+    const prUrl = (_f = (_e = prMeta === null || prMeta === void 0 ? void 0 : prMeta.url) !== null && _e !== void 0 ? _e : event.prUrl) !== null && _f !== void 0 ? _f : (prNumber !== undefined ? `${repoUrl}/pull/${prNumber}` : undefined);
     const payload = {
         repository: {
             full_name: event.repo,
@@ -96,6 +118,20 @@ export function scmMetadataToGitHubPayload(event) {
         }
         payload.comment = comment;
     }
+    const checkPullRequests = stubGitHubCiPullRequests({
+        snapshot: (_h = (_g = (_a = event.checkRun) === null || _a === void 0 ? void 0 : _a.pullRequests) !== null && _g !== void 0 ? _g : (_b = event.checkSuite) === null || _b === void 0 ? void 0 : _b.pullRequests) !== null && _h !== void 0 ? _h : (_c = event.workflowRun) === null || _c === void 0 ? void 0 : _c.pullRequests,
+        prNumber,
+        prUrl,
+    });
+    if (event.checkRun !== undefined) {
+        payload.check_run = stubGitHubCheckRun(event.checkRun, checkPullRequests);
+    }
+    if (event.checkSuite !== undefined) {
+        payload.check_suite = stubGitHubCheckSuite(event.checkSuite, checkPullRequests);
+    }
+    if (event.workflowRun !== undefined) {
+        payload.workflow_run = stubGitHubWorkflowRun(event.workflowRun, checkPullRequests);
+    }
     const title = prMeta === null || prMeta === void 0 ? void 0 : prMeta.title;
     const headRef = prMeta === null || prMeta === void 0 ? void 0 : prMeta.headRef;
     const headSha = prMeta === null || prMeta === void 0 ? void 0 : prMeta.headSha;
@@ -143,6 +179,64 @@ export function scmMetadataToGitHubPayload(event) {
     }
     return payload;
 }
+function stubGitHubCiPullRequests(input) {
+    if (input.snapshot !== undefined && input.snapshot.length > 0) {
+        return input.snapshot.map((pr) => (Object.assign({ number: pr.number }, (pr.url === undefined ? {} : { html_url: pr.url }))));
+    }
+    if (input.prNumber === undefined)
+        return [];
+    return [
+        Object.assign({ number: input.prNumber }, (input.prUrl === undefined ? {} : { html_url: input.prUrl })),
+    ];
+}
+function stubGitHubCiApp(app) {
+    if (app === undefined)
+        return undefined;
+    const out = {};
+    if (app.slug !== undefined)
+        out.slug = app.slug;
+    if (app.name !== undefined)
+        out.name = app.name;
+    return out;
+}
+function stubGitHubCiBase(meta, pullRequests) {
+    const object = {
+        id: meta.id,
+        head_sha: meta.headSha,
+    };
+    if (meta.status !== undefined)
+        object.status = meta.status;
+    if (meta.conclusion !== undefined)
+        object.conclusion = meta.conclusion;
+    if (meta.htmlUrl !== undefined)
+        object.html_url = meta.htmlUrl;
+    const app = stubGitHubCiApp(meta.app);
+    if (app !== undefined)
+        object.app = app;
+    if (pullRequests.length > 0)
+        object.pull_requests = pullRequests;
+    return object;
+}
+function stubGitHubCheckRun(meta, pullRequests) {
+    const object = stubGitHubCiBase(meta, pullRequests);
+    if (meta.name !== undefined)
+        object.name = meta.name;
+    if (meta.checkSuiteId !== undefined) {
+        object.check_suite = { id: meta.checkSuiteId };
+    }
+    return object;
+}
+function stubGitHubCheckSuite(meta, pullRequests) {
+    return stubGitHubCiBase(meta, pullRequests);
+}
+function stubGitHubWorkflowRun(meta, pullRequests) {
+    const object = stubGitHubCiBase(meta, pullRequests);
+    if (meta.name !== undefined)
+        object.name = meta.name;
+    if (meta.workflowId !== undefined)
+        object.workflow_id = meta.workflowId;
+    return object;
+}
 /**
  * GitHub SCM-events relay: a thin {@link CursorRelayCore} adapter. Consumers
  * keep the same `new CursorEventRelay(options).start()/.stop()` surface.

package/dist/internal/mcp-oauth.d.ts

@@ -78,7 +78,18 @@ export type OAuthCallbackResult = {
     code: string;
     state?: string;
 };
-export declare function waitForMcpOAuthCallback(args?: {
+/**
+ * Deliberately not `@anysphere/mcp-core/oauth/loopback`, which is the canonical
+ * implementation every other Cursor surface shares. `@cursor/july` publishes to
+ * public npm with no private workspace dependencies, and its OAuth state is a
+ * bare UUID rather than the payload that module's validator expects.
+ *
+ * Nothing here reads Statsig, so this listener is outside
+ * `unified_mcp_loopback`: turning that gate off restores the other surfaces'
+ * original servers but leaves this one, and its state check, in place.
+ */
+export declare function waitForMcpOAuthCallback(args: {
+    authorizationUrl: string;
     port?: number;
     path?: string;
     timeoutMs?: number;

package/dist/internal/mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AAEF,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IAEpC,YAAY,IAAI,EAAE,YAAY,EAW7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAchC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgF/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AAEF,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IAEpC,YAAY,IAAI,EAAE,YAAY,EAW7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAchC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}

package/dist/internal/mcp-oauth.js

@@ -307,12 +307,23 @@ export function createHostMcpOAuthProvider(args) {
         });
     });
 }
+/**
+ * Deliberately not `@anysphere/mcp-core/oauth/loopback`, which is the canonical
+ * implementation every other Cursor surface shares. `@cursor/july` publishes to
+ * public npm with no private workspace dependencies, and its OAuth state is a
+ * bare UUID rather than the payload that module's validator expects.
+ *
+ * Nothing here reads Statsig, so this listener is outside
+ * `unified_mcp_loopback`: turning that gate off restores the other surfaces'
+ * original servers but leaves this one, and its state check, in place.
+ */
 export function waitForMcpOAuthCallback(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
-        const port = (_a = args === null || args === void 0 ? void 0 : args.port) !== null && _a !== void 0 ? _a : MCP_OAUTH_CALLBACK_PORT;
-        const path = (_b = args === null || args === void 0 ? void 0 : args.path) !== null && _b !== void 0 ? _b : MCP_OAUTH_CALLBACK_PATH;
-        const timeoutMs = (_c = args === null || args === void 0 ? void 0 : args.timeoutMs) !== null && _c !== void 0 ? _c : 5 * 60 * 1000;
+        const port = (_a = args.port) !== null && _a !== void 0 ? _a : MCP_OAUTH_CALLBACK_PORT;
+        const path = (_b = args.path) !== null && _b !== void 0 ? _b : MCP_OAUTH_CALLBACK_PATH;
+        const timeoutMs = (_c = args.timeoutMs) !== null && _c !== void 0 ? _c : 5 * 60 * 1000;
+        const expectedState = new URL(args.authorizationUrl).searchParams.get("state");
         return new Promise((resolve, reject) => {
             let done = false;
             const finish = (result, error) => {
@@ -344,6 +355,17 @@ export function waitForMcpOAuthCallback(args) {
                 const code = url.searchParams.get("code");
                 const oauthError = url.searchParams.get("error");
                 const state = (_b = url.searchParams.get("state")) !== null && _b !== void 0 ? _b : undefined;
+                // Without this, any page that can reach the loopback port during a login
+                // can inject its own authorization code into the exchange. Ignore what is
+                // not ours rather than failing the login: treating a stray request as
+                // fatal would let any page cancel a login, and free the port for someone
+                // else to bind before the real callback arrives.
+                if (state !== (expectedState !== null && expectedState !== void 0 ? expectedState : undefined)) {
+                    res
+                        .writeHead(404, { "content-type": "text/html; charset=utf-8" })
+                        .end("<!doctype html><html><body><h1>Not found</h1></body></html>");
+                    return;
+                }
                 if (code) {
                     res
                         .writeHead(200, { "content-type": "text/html; charset=utf-8" })

package/dist/internal/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4BH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAmGrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAiBpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAaD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAmuB3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4BH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAoGrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAiBpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAaD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAmuB3B"}

package/dist/internal/server.js

@@ -44,7 +44,7 @@ import { CursorAccountMcpBridge, collectCursorAccountConnections, cursorAccountM
 import { CursorBackendClient } from "./cursor/backend-client.js";
 import { cursorExternalApiUrl, resolveApiKey, SIGN_IN_HINT, } from "./cursor/credentials.js";
 import { CursorGithubCredentialProvider } from "./cursor/github-credentials.js";
-import { CursorEventRelay, formatCursorScmEventLog, scmMetadataToGitHubPayload, } from "./cursor-event-relay.js";
+import { CursorEventRelay, formatCursorScmDispatchOutcome, formatCursorScmEventLog, scmMetadataToGitHubPayload, } from "./cursor-event-relay.js";
 import { CursorSlackRelay, createCursorSlackApiCaller, formatCursorSlackEventLog, } from "./cursor-slack-relay.js";
 import { formatDiagnostics, hasErrorDiagnostics, projectInfo, } from "./discovery.js";
 import { packageVersion } from "./distribution.js";
@@ -1401,8 +1401,12 @@ function startCursorEventRelay(input) {
                 targets,
             });
             const outcomes = result.targets
-                .map((target) => `${target.slug || "default"}:${target.status}`)
+                .map((target) => formatCursorScmDispatchOutcome(target))
                 .join(", ");
+            const rejected = result.targets.filter((target) => target.status >= 400);
+            if (rejected.length > 0) {
+                logger(`[agent-sdk] cursor-events: dropped ${formatCursorScmEventLog(event)} before hook: ${rejected.map(formatCursorScmDispatchOutcome).join(", ")}`);
+            }
             logger(`[agent-sdk] cursor-events: dispatched ${formatCursorScmEventLog(event)}${outcomes === "" ? "" : ` → ${outcomes}`}`);
         }),
     });