@cursor/july 0.1.54 → 0.1.61

package/templates/agentic-owners/agent/lib/github.ts

@@ -0,0 +1,241 @@
+import type { HostGitHubClient } from "@cursor/july";
+
+export interface PrRef {
+  owner: string;
+  repo: string;
+  number: number;
+}
+
+export interface PullRequestSnapshot {
+  number: number;
+  state: "open" | "closed";
+  merged: boolean;
+  headSha: string;
+  baseRef: string;
+  authorLogin?: string;
+  /**
+   * Total changed files GitHub reports for the PR. Compared against the
+   * `listChangedFiles` result: the list API caps at 3000 files, and paths
+   * it omits would otherwise never enter policy matching or the evidence
+   * hold.
+   */
+  changedFilesCount: number;
+  /** Users as bare logins, teams as `owner/slug`. */
+  requestedReviewers: string[];
+}
+
+export interface ChangedFile {
+  filename: string;
+  status: string;
+  previousFilename?: string;
+  patch?: string;
+}
+
+export interface PrReview {
+  id: number;
+  state: string;
+  body: string;
+}
+
+export interface PrComment {
+  id: number;
+  body: string;
+}
+
+/**
+ * Everything the review pipeline needs from GitHub, bound to one PR. The
+ * pipeline stays testable against a fake; this file owns the octokit calls.
+ */
+export interface OwnersForge {
+  ref: PrRef;
+  getPullRequest(): Promise<PullRequestSnapshot>;
+  listChangedFiles(): Promise<ChangedFile[]>;
+  /** Fetch file contents at a ref; absent paths are simply omitted. */
+  readFilesAtRef(
+    ref: string,
+    paths: readonly string[]
+  ): Promise<Map<string, string>>;
+  requestReviewers(input: { users: string[]; teams: string[] }): Promise<void>;
+  /** Submit an APPROVE review pinned to `commitId` (never the live head). */
+  submitApproval(input: { body: string; commitId: string }): Promise<void>;
+  /** Dismiss a previously submitted approval (e.g. after a base retarget). */
+  dismissApproval(input: { reviewId: number; message: string }): Promise<void>;
+  listReviews(): Promise<PrReview[]>;
+  listComments(): Promise<PrComment[]>;
+  createComment(body: string): Promise<void>;
+  updateComment(id: number, body: string): Promise<void>;
+}
+
+function isNotFound(error: unknown): boolean {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    "status" in error &&
+    error.status === 404
+  );
+}
+
+export function githubOwnersForge(
+  github: HostGitHubClient,
+  ref: PrRef
+): OwnersForge {
+  const repo = { owner: ref.owner, repo: ref.repo };
+  return {
+    ref,
+
+    async getPullRequest(): Promise<PullRequestSnapshot> {
+      const octokit = await github.getOctokit();
+      const { data } = await octokit.rest.pulls.get({
+        ...repo,
+        pull_number: ref.number,
+      });
+      const requestedUsers = (data.requested_reviewers ?? []).flatMap(
+        (reviewer) => ("login" in reviewer ? [reviewer.login] : [])
+      );
+      const requestedTeams = (data.requested_teams ?? []).map(
+        (team) => `${ref.owner}/${team.slug}`
+      );
+      return {
+        number: data.number,
+        state: data.state === "closed" ? "closed" : "open",
+        merged: data.merged === true,
+        headSha: data.head.sha,
+        baseRef: data.base.ref,
+        authorLogin: data.user?.login,
+        changedFilesCount: data.changed_files,
+        requestedReviewers: [...requestedUsers, ...requestedTeams],
+      };
+    },
+
+    async listChangedFiles(): Promise<ChangedFile[]> {
+      const octokit = await github.getOctokit();
+      const files = await octokit.paginate(octokit.rest.pulls.listFiles, {
+        ...repo,
+        pull_number: ref.number,
+        per_page: 100,
+      });
+      return files.map((file) => ({
+        filename: file.filename,
+        status: file.status,
+        previousFilename: file.previous_filename,
+        patch: file.patch,
+      }));
+    },
+
+    async readFilesAtRef(
+      gitRef: string,
+      paths: readonly string[]
+    ): Promise<Map<string, string>> {
+      const octokit = await github.getOctokit();
+      const found = new Map<string, string>();
+      for (const path of paths) {
+        let data: unknown;
+        try {
+          ({ data } = await octokit.rest.repos.getContent({
+            ...repo,
+            path,
+            ref: gitRef,
+          }));
+        } catch (error) {
+          if (isNotFound(error)) {
+            continue;
+          }
+          throw error;
+        }
+        if (typeof data !== "object" || data === null || Array.isArray(data)) {
+          continue; // directory listing — not a file
+        }
+        const file = data as { content?: string; encoding?: string };
+        if (file.encoding !== "base64" || typeof file.content !== "string") {
+          continue;
+        }
+        found.set(path, Buffer.from(file.content, "base64").toString("utf8"));
+      }
+      return found;
+    },
+
+    async requestReviewers(input: {
+      users: string[];
+      teams: string[];
+    }): Promise<void> {
+      const octokit = await github.getOctokit();
+      await octokit.rest.pulls.requestReviewers({
+        ...repo,
+        pull_number: ref.number,
+        reviewers: input.users,
+        team_reviewers: input.teams,
+      });
+    },
+
+    async submitApproval(input: {
+      body: string;
+      commitId: string;
+    }): Promise<void> {
+      const octokit = await github.getOctokit();
+      await octokit.rest.pulls.createReview({
+        ...repo,
+        pull_number: ref.number,
+        commit_id: input.commitId,
+        event: "APPROVE",
+        body: input.body,
+      });
+    },
+
+    async dismissApproval(input: {
+      reviewId: number;
+      message: string;
+    }): Promise<void> {
+      const octokit = await github.getOctokit();
+      await octokit.rest.pulls.dismissReview({
+        ...repo,
+        pull_number: ref.number,
+        review_id: input.reviewId,
+        message: input.message,
+      });
+    },
+
+    async listReviews(): Promise<PrReview[]> {
+      const octokit = await github.getOctokit();
+      const reviews = await octokit.paginate(octokit.rest.pulls.listReviews, {
+        ...repo,
+        pull_number: ref.number,
+        per_page: 100,
+      });
+      return reviews.map((review) => ({
+        id: review.id,
+        state: review.state,
+        body: review.body ?? "",
+      }));
+    },
+
+    async listComments(): Promise<PrComment[]> {
+      const octokit = await github.getOctokit();
+      const comments = await octokit.paginate(
+        octokit.rest.issues.listComments,
+        { ...repo, issue_number: ref.number, per_page: 100 }
+      );
+      return comments.map((comment) => ({
+        id: comment.id,
+        body: comment.body ?? "",
+      }));
+    },
+
+    async createComment(body: string): Promise<void> {
+      const octokit = await github.getOctokit();
+      await octokit.rest.issues.createComment({
+        ...repo,
+        issue_number: ref.number,
+        body,
+      });
+    },
+
+    async updateComment(id: number, body: string): Promise<void> {
+      const octokit = await github.getOctokit();
+      await octokit.rest.issues.updateComment({
+        ...repo,
+        comment_id: id,
+        body,
+      });
+    },
+  };
+}

package/templates/agentic-owners/agent/lib/owners/README.md

@@ -0,0 +1,50 @@
+# Vendored Agentic Owners policy core
+
+This directory is the policy core of Cursor's Agentic Owners: the
+`.agentic-owners/policy.yml` schema, CODEOWNERS-style path matching with
+closest-policy precedence, and the deterministic approval decision. It is
+vendored from the internal source (`packages/agentic-owners`, via the hosted
+agent's fork in `factory/agentic-owners/agent/lib/owners/`) so a scaffolded
+project installs from this directory alone.
+
+Parsing, matching, and precedence semantics for the committed policy files
+this template reads must stay identical to the source; `decideApproval`
+keeps the source's policy rules and adds the fail-closes listed below. Edit
+`prompts/base-review.md` freely (it is your risk rubric); change the `.ts`
+files only if you accept drifting from upstream.
+
+Deliberate divergences from the source (generalizations for use outside the
+Cursor monorepo, or fail-closed tightenings — never approve-more changes):
+
+- No hardcoded GitHub org: bare `team:` slugs stay bare and resolve against
+  the watched repository's owner at actuation. The Canon-specific
+  `<slug>-reviewers` convention, team-handle probing, and the Graphite
+  mention-sentinel repair are dropped.
+- The default-fallback auto-approve calibration (`fallbackRiskAutoApproves`,
+  Statsig-tuned) is dropped: unowned changes go through the same
+  `decideApproval` path, so only Very Low / Low risk auto-approves.
+- Reply-text verdict parsing (`parseReviewResult`) is dropped: the model
+  records its verdict through the `record_review` tool instead.
+- `delegated_automations` (Cursor-automation approvals satisfying a rule) is
+  rejected at parse time instead of validated-and-ignored: nothing in this
+  template consumes automation approvals.
+- Team membership is never resolved (repo-scoped credentials cannot read
+  org teams), so `self_review` lifts apply only to `user:` owners; team
+  ownership stays fail-closed for the author, the source's posture when
+  membership is unresolved. `ApprovalAuthor` accordingly carries no
+  `teamSlugs`.
+- The CI-gate merge fields (`approvalTeams` / `approvalUsers` /
+  `approvalMode`) and the runtime CODEOWNERS→policy bridge (`isGenerated`,
+  its precedence carve-outs, and the empty-generated-shim allowance) are
+  dropped: this agent never reads `.agentic-owners/generated/` and consumes
+  none of the gate internals.
+- Medium+ `self_review` requires the author's authority to cover EVERY
+  review-capable matched rule (`self_review` clears *that rule*; one owned
+  rule must not stamp a PR whose other matched rules still require review).
+- The host fail-closes live inside `decideApproval` (`evidence` +
+  `governanceTouch` inputs): a governance touch or incomplete evidence
+  (empty / truncated diff, capped file list) downgrades a would-be approve
+  to requesting reviewers, so actuation only writes the returned decision.
+- `prompts/base-review.md` is a generic rewrite of the source rubric with
+  the Cursor-repo region overrides removed. The security posture
+  (adversarial PR content, the policy self-modification guard) is kept.

package/templates/agentic-owners/agent/lib/owners/constants.ts

@@ -0,0 +1,22 @@
+// Vendored from the Agentic Owners policy core; see README.md in this
+// directory. Values must stay identical to the source's, except the source's
+// `CURSOR_GITHUB_ORG` constant: this template resolves bare team slugs
+// against the watched repository's owner instead of a hardcoded org.
+
+export const AGENTIC_OWNERS_DIR = ".agentic-owners";
+
+export const AGENTIC_OWNERS_POLICY_FILE = "policy.yml";
+
+/**
+ * Directory (under {@link AGENTIC_OWNERS_DIR}) for machine-generated policy
+ * files produced at review time (e.g. a CODEOWNERS → policy bridge). Never
+ * committed; always excluded from the agent's changed-file set.
+ */
+export const AGENTIC_OWNERS_GENERATED_DIR: `${typeof AGENTIC_OWNERS_DIR}/generated` = `${AGENTIC_OWNERS_DIR}/generated`;
+
+/** The root policy file — the only place `global_exclusions` is allowed. */
+export const ROOT_POLICY_SOURCE_PATH = ".agentic-owners/policy.yml";
+
+export const AGENTIC_OWNERS_CONFIG_VERSION = 1;
+
+export const AGENTIC_OWNERS_MAX_COMPOSED_PROMPT_CHARS = 120_000;