@cursor/july 0.1.55 → 0.1.61

package/src/channels/github/types.ts

@@ -6,6 +6,7 @@ import type {
   ChannelEventHandlers,
   ChannelStartArgs,
   HostContext,
+  SendMessageOptions,
 } from "../../types.js";
 import type { GitHubApiOptions } from "./api.js";
 import type { GitHubHandle, GitHubThread } from "./binding.js";
@@ -165,6 +166,13 @@ export type GitHubPullRequestPayload = {
       sha?: string;
     };
   };
+  /**
+   * Present on `edited` deliveries; `changes.base.ref.from` carries the
+   * previous base branch when the PR was retargeted.
+   */
+  changes?: {
+    base?: { ref?: { from?: string } };
+  } | null;
   sender?: {
     login?: string;
     id?: number;
@@ -186,6 +194,13 @@ export interface GitHubPullRequestEvent {
   headSha: string;
   baseRef: string;
   baseSha?: string;
+  /**
+   * On `edited` deliveries where the PR base was retargeted, the previous
+   * base branch (`changes.base.ref.from`). Undefined for every other edit
+   * (title / body), so `action === "edited" && baseRefChangedFrom` gates
+   * base-retarget handling without waking on prose edits.
+   */
+  baseRefChangedFrom?: string;
   draft: boolean;
   /** True when the PR was merged (from the webhook payload). */
   merged: boolean;
@@ -324,6 +339,11 @@ export interface GitHubEventContext {
  */
 export type GitHubDispatch = GitHubTurnDispatch | GitHubTaskDispatch;
 
+/** Files seeded into the session workspace before the turn. */
+export type GitHubWorkspaceFiles = NonNullable<
+  SendMessageOptions["workspaceFiles"]
+>;
+
 /** Start (or resume) a model turn for the event. */
 export interface GitHubTurnDispatch {
   /** Who the turn runs as. Use `defaultGitHubAuth(ctx)` to derive it from the actor. */
@@ -334,6 +354,17 @@ export interface GitHubTurnDispatch {
   message?: string;
   /** Optional session title override. */
   title?: string;
+  /**
+   * Seeded into the session workspace before the turn (`send`'s
+   * `workspaceFiles`). A function runs after the webhook is
+   * acknowledged (202) so fetch I/O can outlive GitHub's ~10s window.
+   */
+  workspaceFiles?:
+    | GitHubWorkspaceFiles
+    | (() =>
+        | GitHubWorkspaceFiles
+        | undefined
+        | Promise<GitHubWorkspaceFiles | undefined>);
 }
 
 /**

package/src/channels/origin/cursor-account.ts

@@ -0,0 +1,64 @@
+/**
+ * Cursor-account mode for Origin channels.
+ *
+ * Origin identity is the signed-in Cursor user (no third-party OAuth). The
+ * channel declares repos at definition time; the serve host subscribes
+ * `/v0/scm-events` with `provider: "origin"` as that user. Unlike GitHub,
+ * there is no installation token to mint — outbound Origin API calls already
+ * authenticate as the Cursor principal.
+ */
+
+import type { OriginChannelOptions } from "./types.js";
+
+export const CURSOR_ORIGIN_MAX_REPOS = 20;
+const CURSOR_ORIGIN_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export interface CursorOriginRepoScope {
+  repos: readonly string[];
+}
+
+export interface OriginCursorAccountRuntime {
+  options: OriginChannelOptions;
+  scope: CursorOriginRepoScope | undefined;
+}
+
+const runtimeByDefinition = new WeakMap<object, OriginCursorAccountRuntime>();
+
+export function parseCursorOriginRepoScope(
+  values: readonly string[]
+): CursorOriginRepoScope {
+  const repos = [
+    ...new Set(values.map((repo) => repo.trim().toLowerCase()).filter(Boolean)),
+  ];
+  if (repos.length === 0) {
+    throw new Error(
+      "originChannel({ cursorAccount }) requires at least one repository."
+    );
+  }
+  if (repos.length > CURSOR_ORIGIN_MAX_REPOS) {
+    throw new Error(
+      `originChannel({ cursorAccount }) supports at most ${CURSOR_ORIGIN_MAX_REPOS} repositories.`
+    );
+  }
+  for (const repo of repos) {
+    if (!CURSOR_ORIGIN_REPO_PATTERN.test(repo) || repo.includes("..")) {
+      throw new Error(
+        `Invalid Origin repository "${repo}"; expected owner/repo.`
+      );
+    }
+  }
+  return { repos };
+}
+
+export function registerOriginCursorAccountRuntime(
+  definition: object,
+  runtime: OriginCursorAccountRuntime
+): void {
+  runtimeByDefinition.set(definition, runtime);
+}
+
+export function getOriginCursorAccountRuntime(
+  definition: object
+): OriginCursorAccountRuntime | undefined {
+  return runtimeByDefinition.get(definition);
+}

package/src/channels/origin/events.ts

@@ -0,0 +1,41 @@
+/** {@link ChannelMeta.kind} value used by {@link originChannel}. */
+export const ORIGIN_CHANNEL_KIND = "origin";
+
+const BASE_WEBHOOK_EVENTS: readonly string[] = [
+  "pull_request.created",
+  "pull_request.published",
+  "pull_request.head_ref.pushed",
+  "pull_request.base_ref.updated",
+  "pull_request.closed",
+  "pull_request.merged",
+];
+
+const COMMENT_EVENTS: readonly string[] = ["pull_request.comment.created"];
+const REVIEW_EVENTS: readonly string[] = ["pull_request.review.submitted"];
+
+export interface OriginWebhookEventOptions {
+  webhookEvents?: readonly string[];
+  onComment?: unknown;
+  onReview?: unknown;
+  onEvent?: unknown;
+}
+
+export function deriveOriginWebhookEvents(
+  options: OriginWebhookEventOptions
+): string[] {
+  if (options.webhookEvents !== undefined) {
+    return [
+      ...new Set(
+        options.webhookEvents.map((event) => event.trim()).filter(Boolean)
+      ),
+    ];
+  }
+  const events: string[] = [...BASE_WEBHOOK_EVENTS];
+  if (options.onComment !== undefined) {
+    events.push(...COMMENT_EVENTS);
+  }
+  if (options.onReview !== undefined) {
+    events.push(...REVIEW_EVENTS);
+  }
+  return [...new Set(events)];
+}

package/src/channels/origin/index.ts

@@ -0,0 +1,29 @@
+/**
+ * Origin webhook channel pack for agent-serve.
+ *
+ * ```ts
+ * import { defaultOriginAuth, originChannel } from "@cursor/july/channels/origin";
+ *
+ * export default originChannel({
+ *   cursorAccount: { repos: ["owner/repo"] },
+ *   onPullRequest: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ *   onComment: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ * });
+ * ```
+ *
+ * Direct webhook mode verifies Standard-Webhooks v1ed signatures **and**
+ * binds `envelope.appId` to {@link OriginChannelOptions.appId} (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`). v1ed alone is not channel auth — Origin
+ * signs every app's deliveries with the same JWKS. Pass
+ * `{ cursorAccount: true }` to receive events from
+ * `serve({ cursor: { events: true } })` after `/v0/scm-events`
+ * (`provider: "origin"`) already verified them. The turn principal is
+ * `origin-webhook` plus the Origin actor — not the Cursor subscriber —
+ * matching GitHub's `github-webhook` pattern.
+ */
+
+export * from "./cursor-account.js";
+export * from "./events.js";
+export * from "./origin-channel.js";
+export * from "./origin-webhook.js";
+export * from "./types.js";