@cursor/july 0.1.43 → 0.1.45

package/dist/internal/session-engine.js

@@ -40,6 +40,7 @@ import { TurnEventMapper } from "./event-mapper.js";
 import { selectFrameworkStorageDefinition } from "./framework-storage-selection.js";
 import { createHostFilesApi } from "./host-files.js";
 import { createHostKvApi } from "./host-kv.js";
+import { createHostOtelApi } from "./host-otel.js";
 import { createHostPlatforms, createHostSlackClient, } from "./host-platforms.js";
 import { formatContinuationToken, newContinuationKey, newSessionId, newToolCallId, } from "./ids.js";
 import { validateToolInput } from "./json-schema.js";
@@ -153,6 +154,11 @@ export class SessionEngine {
         this.getCloudUsage = (_b = options.getCloudUsage) !== null && _b !== void 0 ? _b : defaultGetCloudUsage;
         this.estimateTurnCost = (_c = options.estimateTurnCost) !== null && _c !== void 0 ? _c : estimateTurnCostFromApi;
         this.otel = options.otel;
+        this.otelHost = createHostOtelApi({
+            agentName: options.project.name,
+            meter: options.otelMeter,
+            collector: options.otel,
+        });
         this.turnGovernor = new TurnGovernor(options.project.agent.concurrency);
         this.sessions = new SessionStore(join(options.stateRoot, "sessions"));
         this.nudgeStore = new SlackNudgeStore(join(options.stateRoot, "slack-nudges"));
@@ -287,7 +293,7 @@ export class SessionEngine {
     setCloudServerToolsConnection(connection) {
         this.cloudServerToolsConnection = connection;
     }
-    /** Shared host services (MCP / GitHub / Slack / reminders / evals / kv / Slack nudges). */
+    /** Shared host services (MCP / GitHub / Slack / reminders / evals / kv / files / otel / Slack nudges). */
     get host() {
         return {
             mcp: this.mcpHost,
@@ -297,6 +303,7 @@ export class SessionEngine {
             evals: this.evalsApi,
             kv: this.kvApi,
             files: this.filesApi,
+            otel: this.otelHost,
             slackNudges: this.slackNudgeHostApi(),
         };
     }
@@ -310,7 +317,7 @@ export class SessionEngine {
         const host = this.host;
         return sessionId === undefined
             ? host
-            : Object.assign(Object.assign({}, host), { files: this.filesApi.forSession(sessionId) });
+            : Object.assign(Object.assign({}, host), { files: this.filesApi.forSession(sessionId), otel: this.otelHost.forSession(sessionId) });
     }
     /** Unbound `ctx.artifacts` facade (channel handlers, scratch tool calls). */
     get artifacts() {
@@ -914,7 +921,9 @@ export class SessionEngine {
             }
             const startedAt = Date.now();
             try {
-                const outcome = yield this.runner.prewarm(Object.assign({ workspaceDir, runnerStateDir: join(this.stateRoot, "runner"), sandbox: ((_b = agent.local) === null || _b === void 0 ? void 0 : _b.sandbox) === true, mcpServers: this.buildMcpServers("local"), subagents: buildRunnerSubagents(agent) }, (agent.model === undefined ? {} : { model: agent.model })));
+                const outcome = yield this.runner.prewarm(Object.assign(Object.assign(Object.assign({ workspaceDir, runnerStateDir: join(this.stateRoot, "runner"), sandbox: ((_b = agent.local) === null || _b === void 0 ? void 0 : _b.sandbox) === true }, (agent.allowedTools === undefined
+                    ? {}
+                    : { tools: agent.allowedTools })), { mcpServers: this.buildMcpServers("local"), subagents: buildRunnerSubagents(agent) }), (agent.model === undefined ? {} : { model: agent.model })));
                 // Report what happened rather than that the call returned: a runner
                 // that cannot warm resolves cleanly, and logging success there would
                 // tell an operator the workspace is hot when nothing touched it.
@@ -1107,6 +1116,13 @@ export class SessionEngine {
             agentRuntime: agent.runtime,
             cloudOverride: record.cloudOverride,
         });
+        // Fail closed: the SDK cannot enforce the built-in tool allowlist on
+        // cloud agents yet, and a restriction that silently does not apply is
+        // worse than a refused turn. Cloud-runtime agents already fail
+        // discovery; this guards hybrid agents' per-send cloud sessions.
+        if (runtime === "cloud" && agent.allowedTools !== undefined) {
+            throw new Error(`Agent "${agent.name}" declares a built-in tool allowlist (tools), which cannot be enforced on cloud turns yet. Refusing the cloud session rather than running it unrestricted.`);
+        }
         const mergedCloud = runtime === "cloud"
             ? mergeCloudOptions({
                 base: agent.cloud,
@@ -1153,9 +1169,11 @@ export class SessionEngine {
                 turnPrompt = `${preamble}\n\n${turnPrompt}`;
             }
         }
-        return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ sessionId: record.sessionId }, (record.sdkAgentId === undefined
+        return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ sessionId: record.sessionId }, (record.sdkAgentId === undefined
             ? {}
-            : { sdkAgentId: record.sdkAgentId })), { workspaceDir: this.harnessCwd(record), sandbox: ((_c = this.project.agent.local) === null || _c === void 0 ? void 0 : _c.sandbox) === true, runnerStateDir: join(this.stateRoot, "runner"), prompt: turnPrompt, isFirstTurn }), (images !== undefined && images.length > 0 ? { images } : {})), (agent.model === undefined ? {} : { model: agent.model })), { runtime }), (mergedCloud === undefined ? {} : { cloud: mergedCloud })), { customTools: runtime === "local" ? this.buildCustomTools(record, turnId, emit) : {}, mcpServers: this.buildMcpServers(runtime, record.sessionId), subagents: buildRunnerSubagents(agent), onUpdate,
+            : { sdkAgentId: record.sdkAgentId })), { workspaceDir: this.harnessCwd(record), sandbox: ((_c = this.project.agent.local) === null || _c === void 0 ? void 0 : _c.sandbox) === true }), (runtime === "local" && agent.allowedTools !== undefined
+            ? { tools: agent.allowedTools }
+            : {})), { runnerStateDir: join(this.stateRoot, "runner"), prompt: turnPrompt, isFirstTurn }), (images !== undefined && images.length > 0 ? { images } : {})), (agent.model === undefined ? {} : { model: agent.model })), { runtime }), (mergedCloud === undefined ? {} : { cloud: mergedCloud })), { customTools: runtime === "local" ? this.buildCustomTools(record, turnId, emit) : {}, mcpServers: this.buildMcpServers(runtime, record.sessionId), subagents: buildRunnerSubagents(agent), onUpdate,
             signal, 
             // Local follow-ups expire any lingering active run so a preempted turn
             // (or one orphaned by a crashed process) never blocks this send.