@cursor/july 0.1.40 → 0.1.42

package/AGENTS.md

@@ -20,9 +20,8 @@ built-in read/grep fail and sends models into retry loops.
 
 Before scaffolding, wiring channels, writing evals, or deploying, **read the
 matching skill under `skills/<task>/SKILL.md`** (paths
-below are relative to this package). These files are the single source of
-truth; they ship with `@cursor/july`. There are no
-`.cursor/skills/` stubs — open the package skill directly.
+below are relative to this package). Those files ship with `@cursor/july`.
+Open them directly — there are no `.cursor/skills/` stubs for authoring.
 
 | Skill | Read it when |
 | --- | --- |
@@ -35,6 +34,13 @@ truth; they ship with `@cursor/july`. There are no
 | `skills/setup-slack/SKILL.md` | Slack wiring and Slack tool approvals |
 | `skills/mcp-auth/SKILL.md` | Host MCP OAuth (`mcp oauth`, `--store`, `hostOnly`) |
 | `skills/debug/SKILL.md` | Something misbehaving locally (symptom → cause) |
+| `skills/operate/SKILL.md` | Dogfood host, corp ECS, hosted-platform map |
+
+Hosted-platform debug (stopped / slow start / health-fail, Datadog
+`cursor.agent_serve.*`) is the monorepo skill
+`.cursor/skills/debugging/debug-agent-serve-deployment/SKILL.md` — it does
+not ship with `@cursor/july`. Dual-pod alerts:
+`docs/agent-serve/orphan-engines-runbook.md`.
 
 ## Recommended loop
 
@@ -139,10 +145,11 @@ export default defineEvalConfig({
   `init <dir>` scaffolds (skipping existing files), runs `npm install`,
   offers to install/update package skills into
   `~/.cursor/skills/agentkit/` (TTY only; always overwrites with the
-  package copy), runs `login` and waits when unsigned, then prints `cd`
-  (when needed) and bare `dev`. `--json` still installs but never blocks
+  package copy), links `agent-sdk` onto the npm global bin (so bare
+  `agent-sdk` works on PATH), runs `login` and waits when unsigned, then
+  prints `cd` (when needed) and `agent-sdk dev`. `--json` still installs but never blocks
   on login or skill install; it prints
-  `{ ok, directory, created, skipped, installed, installError, next }`.
+  `{ ok, directory, created, skipped, installed, installError, cliOnPath, cliLinkError, next }`.
 - `chat --json --message "..."` talks to a running server and prints a trajectory.
 
 ## Agent-to-agent (MCP endpoint + peer MCP connections)

package/dist/bin/agent-serve.js

@@ -106,8 +106,8 @@ Usage:
   ${CLI} stop        <slug> [--team <id>] [--json] [--no-wait]
   ${CLI} rotate-token <slug> [--team <id>]
   ${CLI} rotate-pod-credential <slug> [--team <id>]
-  ${CLI} secrets     set <slug> NAME[=VALUE]... | list <slug> | unset <slug> NAME
-                          [--team <id>] [--json]
+  ${CLI} secrets     set <slug> NAME... | list <slug> | unset <slug> NAME
+                          [--team <id>] [--json] [--from-argv]
   ${CLI} slack       <subcommand> …
   ${CLI} github      <subcommand> …
 
@@ -227,9 +227,9 @@ Commands:
   rotate-pod-credential
               Rotate a deployment's pod credential (prints the masked key);
               the running pod keeps the old one until the next deploy.
-  secrets     Manage deployment secrets: set (upsert by name; NAMEs without
-              =VALUE are prompted for with hidden input, or read from piped
-              stdin), list (names + createdAt; never values), unset.
+  secrets     Manage deployment secrets: set (names only by default: hidden
+              prompt or piped stdin; NAME=VALUE requires --from-argv), list
+              (names + createdAt; never values), unset.
   slack       Slack channel pack: create/destroy/icon (Cursor Add to Slack
               provisioning), init, manifests, doctor (see slack help).
   github      GitHub webhook pack: forward live deliveries, events, doctor
@@ -246,7 +246,9 @@ Agent loop:
 Options:
   --version, -V      Print the installed version and exit.
   --dir             Project root (defaults to the current directory).
-  --port             Port to listen on (default 3000).
+  --port             Port to listen on (default 3000). When the default is
+                     taken, serve tries the next free port and prints a notice.
+                     An explicit --port fails with a next-port hint instead.
   --host             Host to bind (default 127.0.0.1).
   --mode             serve: "multi" (default, slugged /<dir>/v1/*) or "single"
                      (unslugged /v1/*). Multi also exposes host /v1/health for
@@ -372,6 +374,9 @@ Options:
   --allow-domain     deploy: egress domain the engine pod may reach
                      (repeatable; unioned with hosting.egressDomains from the
                      agent manifest). Repo-backed deploys only.
+  --from-argv        secrets set: allow NAME=VALUE on argv (leaks into shell
+                     history and agent-captured terminals). Default is names
+                     only with a hidden prompt or piped stdin.
   --org              github forward: organization login (org-level hooks).
   --channel          github: select one channel id when several are declared.
   --secret           github forward: webhook signing secret (defaults to
@@ -501,6 +506,7 @@ function main(argv) {
                 all: { type: "boolean", default: false },
                 "cursor-events-repo": { type: "string", multiple: true },
                 "allow-domain": { type: "string", multiple: true },
+                "from-argv": { type: "boolean", default: false },
                 strict: { type: "boolean", default: false },
                 junit: { type: "string" },
                 artifacts: { type: "string" },
@@ -967,8 +973,11 @@ function main(argv) {
                     return 1;
                 }
                 const serveDir = serveDirResult;
-                const port = values.port === undefined ? 3000 : Number.parseInt(values.port, 10);
-                if (Number.isNaN(port) || port < 0 || port > 65535) {
+                const port = values.port === undefined
+                    ? undefined
+                    : Number.parseInt(values.port, 10);
+                if (port !== undefined &&
+                    (Number.isNaN(port) || port < 0 || port > 65535)) {
                     process.stderr.write(`invalid --port: ${values.port}\n`);
                     return 1;
                 }
@@ -1096,7 +1105,13 @@ function main(argv) {
     });
 }
 function deployOptionsFromValues(values) {
-    return Object.assign(Object.assign(Object.assign({}, (values.team === undefined ? {} : { team: values.team })), { json: values.json === true, noWait: values["no-wait"] === true }), (values["api-key"] === undefined ? {} : { apiKey: values["api-key"] }));
+    return {
+        team: values.team,
+        json: values.json === true,
+        noWait: values["no-wait"] === true,
+        apiKey: values["api-key"],
+        fromArgv: values["from-argv"] === true ? true : undefined,
+    };
 }
 function axFromOptions(partial) {
     return {
@@ -1247,6 +1262,10 @@ function printServeBanner(handle, opts) {
     if (playgroundUrl !== undefined) {
         process.stdout.write(`  playground  ${c.cyan(playgroundUrl)}\n`);
     }
+    // `/` is only mounted when the playground host home is enabled.
+    if (!opts.noPlayground) {
+        process.stdout.write(`  home        ${c.cyan(handle.url + "/")}\n`);
+    }
     // Dev is playground-first (Vite proxies the API). Keep API/route detail for
     // plain `serve`, where operators often curl the HTTP surface directly.
     if (!opts.dev) {

package/dist/channels/slack/attachments.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Download and classify Slack file uploads for agent turns.
+ *
+ * Images become vision inputs (SDK `images`). Documents and videos land under
+ * `slack-attachments/` in the session workspace so the model can Read them.
+ */
+import type { SlackLog } from "./log.js";
+import type { SlackBotToken, SlackMessageFile } from "./types.js";
+export declare const SLACK_ATTACHMENTS_DIR = "slack-attachments";
+export declare const SLACK_ATTACHMENT_ONLY_PROMPT = "The user shared Slack attachment(s) with no message text. Review the attached files.";
+/** Keep path-safe basename pieces (mirrors cloud-agent sanitizeFilename). */
+export declare function sanitizeSlackFilename(name: string): string;
+export declare function isSupportedImageFormat(mimeType: string): boolean;
+export declare function isSupportedDocumentFormat(args: {
+    mimeType: string;
+    filename?: string;
+}): boolean;
+export declare function isSupportedVideoFormat(mimeType: string): boolean;
+/** Raw Slack file object (message `files[]` or forwarded share). */
+export interface RawSlackFile {
+    id?: unknown;
+    mimetype?: unknown;
+    filetype?: unknown;
+    mode?: unknown;
+    name?: unknown;
+    title?: unknown;
+    size?: unknown;
+    url_private_download?: unknown;
+    dataBase64?: unknown;
+}
+export type SlackFileClassification = {
+    kind: "image";
+    mimeType: string;
+} | {
+    kind: "video";
+    mimeType: string;
+} | {
+    kind: "document";
+    mimeType: string;
+    isTextLike: boolean;
+};
+/**
+ * Classify a Slack file as image / document / video. Tolerates empty
+ * `mimetype` on snippets (Slack fills it asynchronously).
+ */
+export declare function classifySlackFile(file: RawSlackFile): SlackFileClassification | undefined;
+/** Top-level uploads plus files nested in forwarded `is_share` attachments. */
+export declare function collectSlackMessageFiles(message: unknown): RawSlackFile[];
+export declare function parseSlackFileRefs(message: unknown): SlackMessageFile[] | undefined;
+export interface SlackTurnImage {
+    data: string;
+    mimeType: string;
+}
+/** Relative path → utf8 or base64-blob workspace entry. */
+export type SlackWorkspaceBlob = string | {
+    encoding: "base64";
+    data: string;
+    mimeType?: string;
+};
+export interface PreparedSlackAttachments {
+    images: SlackTurnImage[];
+    workspaceFiles: Record<string, SlackWorkspaceBlob>;
+    /** Prompt markers like `[Image 1: shot.png]`. */
+    annotations: string[];
+}
+export interface PrepareSlackAttachmentsOptions {
+    botToken?: SlackBotToken;
+    files: readonly SlackMessageFile[];
+    maxFiles?: number;
+    maxFileBytes?: number;
+    maxTotalBytes?: number;
+    downloadTimeoutMs?: number;
+    log?: SlackLog;
+}
+/**
+ * Download (or use pre-attached) Slack files and split them into vision
+ * images + workspace blobs for the turn.
+ */
+export declare function prepareSlackAttachments(options: PrepareSlackAttachmentsOptions): Promise<PreparedSlackAttachments>;
+/** Merge attachment annotations into the user prompt. */
+export declare function appendSlackAttachmentAnnotations(prompt: string, annotations: readonly string[]): string;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/channels/slack/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../../src/channels/slack/attachments.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,4BAA4B,yFAC+C,CAAC;AA8FzF,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQhE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CA2EV;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC;AAWhE;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,YAAY,GACjB,uBAAuB,GAAG,SAAS,CA8BrC;AAOD,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,EAAE,CAmBzE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,GACf,gBAAgB,EAAE,GAAG,SAAS,CAoBhC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACnD,iDAAiD;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA+HD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,QAAQ,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAoInC;AAED,yDAAyD;AACzD,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM,CAcR"}