@cursor/july 0.1.55 → 0.1.61

package/templates/security-reviewer/README.md

@@ -0,0 +1,31 @@
+# Security reviewer
+
+Reviews pull requests for exploitable bugs. Posts one review comment.
+
+```bash
+npx @cursor/july init ./security-reviewer --template security-reviewer
+```
+
+`init` asks which repos to watch. Skip the prompt with
+`--var repos=owner/repo`.
+
+## Run
+
+Connect GitHub in Cursor for those repos. Then sign the host in:
+
+```bash
+agent-sdk login
+agent-sdk dev
+```
+
+Events and API calls use your Cursor GitHub connection. Replay a PR:
+
+```bash
+agent-sdk github replay https://github.com/owner/repo/pull/1 --dir .
+```
+
+## Files
+
+- `agent/lib/repos.ts`: watched repos
+- `agent/instructions.md`: what counts as a finding
+- `evals/review.eval.ts`: two smoke cases

package/templates/security-reviewer/agent/agent.ts

@@ -0,0 +1,15 @@
+import { defineAgent } from "@cursor/july";
+
+export default defineAgent({
+  model: {
+    id: "grok-4.5",
+    params: [
+      { id: "effort", value: "high" },
+      { id: "fast", value: "true" },
+    ],
+  },
+  tools: ["read", "grep"],
+  local: {
+    sandbox: true,
+  },
+});

package/templates/security-reviewer/agent/channels/github.ts

@@ -0,0 +1,46 @@
+import {
+  defaultGitHubPullRequestDispatch,
+  githubChannel,
+} from "@cursor/july/channels/github";
+import { REPOS, watches } from "../lib/repos.js";
+
+const MAX_DIFF_CHARS = 150_000;
+
+export default githubChannel({
+  cursorAccount: { repos: REPOS },
+  deliverReplies: false,
+  onComment: () => null,
+  onPullRequest: (ctx, pr) => {
+    if (!watches(ctx.repository.fullName) || pr.draft) {
+      return null;
+    }
+    const dispatch = defaultGitHubPullRequestDispatch(ctx, pr);
+    if (dispatch === null) {
+      return null;
+    }
+    return {
+      auth: dispatch.auth,
+      context: ["Read pr/diff.patch."],
+      async workspaceFiles() {
+        const octokit = await ctx.github.getOctokit();
+        const pull = {
+          owner: ctx.repository.owner,
+          repo: ctx.repository.name,
+          pull_number: pr.number,
+        };
+        const [meta, diff] = await Promise.all([
+          octokit.rest.pulls.get(pull),
+          octokit.rest.pulls.get({ ...pull, mediaType: { format: "diff" } }),
+        ]);
+        const text = String(diff.data);
+        return {
+          "pr/diff.patch":
+            text.length > MAX_DIFF_CHARS
+              ? `${text.slice(0, MAX_DIFF_CHARS)}\n…[truncated]\n`
+              : text,
+          "pr/head.sha": meta.data.head.sha,
+        };
+      },
+    };
+  },
+});

package/templates/security-reviewer/agent/instructions.md

@@ -0,0 +1,22 @@
+# Security reviewer
+
+You review pull requests for exploitable security bugs.
+
+## Review
+
+The workspace has `pr/diff.patch`. Read it. Report only exploitable
+issues: injection, authz bypass, secret leak, unsafe deserialization,
+SSRF, RCE. Skip style, tests, and hypotheticals.
+
+Call `post_findings` once with structured findings. Reply with the
+count and one line per finding. Clean review: empty findings.
+
+The host writes the GitHub comment. Verdict is CLEAN when the list
+is empty.
+
+## Finding
+
+- `severity`: `high`, `medium`, or `low`
+- `file`, `line`: path and line in the diff
+- `title`: short name
+- `detail`: one-line impact and fix

package/templates/security-reviewer/agent/lib/repos.ts

@@ -0,0 +1,5 @@
+export const REPOS: readonly string[] = ["owner/repo"];
+
+export function watches(fullName: string): boolean {
+  return REPOS.some((repo) => repo.toLowerCase() === fullName.toLowerCase());
+}

package/templates/security-reviewer/agent/tools/post_findings.ts

@@ -0,0 +1,72 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseGitHubPrRef } from "@cursor/july/channels/github";
+import { defineTool } from "@cursor/july/tools";
+import { z } from "zod";
+
+const SHA = /^[0-9a-f]{40}$/i;
+
+const finding = z.object({
+  severity: z.enum(["high", "medium", "low"]),
+  file: z.string().min(1).max(240),
+  line: z.number().int().positive(),
+  title: z.string().min(1).max(160),
+  detail: z.string().min(1).max(280),
+});
+
+type Finding = z.infer<typeof finding>;
+
+export default defineTool({
+  description:
+    "Post the security review on this session's pull request. Call once. Empty findings = CLEAN.",
+  inputSchema: z.object({
+    findings: z
+      .array(finding)
+      .describe("Exploitable issues. Empty for CLEAN."),
+  }),
+  async execute({ findings }, ctx) {
+    if (ctx.session.purpose === "eval") {
+      return { posted: false, reason: "eval" };
+    }
+    const key = ctx.session.continuationKey ?? "";
+    if (!key.startsWith("github-pr:")) {
+      throw new Error("post_findings requires a GitHub pull request session");
+    }
+    const ref = parseGitHubPrRef(key.slice("github-pr:".length));
+    if (ref === undefined) {
+      throw new Error(`unrecognized PR: ${key}`);
+    }
+    const headSha = (
+      await readFile(join(ctx.workspaceDir, "pr/head.sha"), "utf8")
+    ).trim();
+    if (!SHA.test(headSha)) {
+      throw new Error("missing pr/head.sha");
+    }
+    const octokit = await ctx.host.github.getOctokit();
+    const response = await octokit.rest.pulls.createReview({
+      owner: ref.owner,
+      repo: ref.repo,
+      pull_number: ref.number,
+      commit_id: headSha,
+      body: reviewBody(findings),
+      event: "COMMENT",
+    });
+    return { posted: true, pr: ref.label, url: response.data.html_url };
+  },
+});
+
+function flatten(value: string): string {
+  return value.replace(/\s+/g, " ").trim();
+}
+
+function reviewBody(findings: Finding[]): string {
+  const verdict = findings.length === 0 ? "CLEAN" : "FINDINGS";
+  const lines = ["## Security review", "", `**Verdict:** ${verdict}`];
+  for (const item of findings) {
+    lines.push(
+      `- **${item.severity}** \`${flatten(item.file)}:${item.line}\` — ${flatten(item.title)}`
+    );
+    lines.push(`  ${flatten(item.detail)}`);
+  }
+  return lines.join("\n");
+}

package/templates/security-reviewer/evals/evals.config.ts

@@ -0,0 +1,5 @@
+import { defineEvalConfig } from "@cursor/july/evals";
+
+export default defineEvalConfig({
+  maxConcurrency: 10,
+});

package/templates/security-reviewer/evals/review.eval.ts

@@ -0,0 +1,53 @@
+import { defineEval, includes } from "@cursor/july/evals";
+
+const OPENED = [
+  "GitHub pull request trigger: acme/api#12",
+  "Action: opened",
+  "PR: https://github.com/acme/api/pull/12",
+  "Title: Search results",
+  "Head: feat/search (aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa)",
+  "Base: main",
+  "Author: sam",
+  "",
+  "Read pr/diff.patch.",
+].join("\n");
+
+export default defineEval({
+  tags: ["smoke"],
+  cases: [
+    {
+      id: "xss",
+      description: "Unescaped query reflection is posted as a finding.",
+      async test(t) {
+        await t.send(OPENED, {
+          workspaceFiles: {
+            "pr/diff.patch": [
+              "diff --git a/app/routes/search.ts b/app/routes/search.ts",
+              "+res.send(`<h1>Results for ${req.query.q}</h1>`);",
+            ].join("\n"),
+          },
+        });
+        t.succeeded();
+        t.calledTool("post_findings");
+        t.check(t.reply, includes(/xss|cross-site|injection|finding/i));
+      },
+    },
+    {
+      id: "clean",
+      description: "A docs-only change is posted as clean.",
+      async test(t) {
+        await t.send(OPENED.replace("Search results", "Docs"), {
+          workspaceFiles: {
+            "pr/diff.patch": [
+              "diff --git a/README.md b/README.md",
+              "+# API",
+            ].join("\n"),
+          },
+        });
+        t.succeeded();
+        t.calledTool("post_findings");
+        t.check(t.reply, includes(/clean|no findings|no vulnerabilities/i));
+      },
+    },
+  ],
+});

package/templates/security-reviewer/init.json

@@ -0,0 +1,25 @@
+{
+  "questions": [
+    {
+      "id": "repos",
+      "prompt": "Which GitHub repos should this agent review?",
+      "hint": "Comma-separated owner/repo. One GitHub owner.",
+      "placeholder": "acme/api, acme/web",
+      "parse": "owner-repo-list"
+    }
+  ],
+  "replace": [
+    {
+      "file": "agent/lib/repos.ts",
+      "find": "[\"owner/repo\"]",
+      "answer": "repos",
+      "as": "json-array"
+    },
+    {
+      "file": "README.md",
+      "find": "owner/repo",
+      "answer": "repos",
+      "as": "first"
+    }
+  ]
+}

package/templates/security-reviewer/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "security-reviewer",
+  "private": true,
+  "type": "module",
+  "description": "Reviews pull requests for exploitable security bugs.",
+  "scripts": {
+    "check": "tsc --noEmit",
+    "dev": "agent-sdk dev"
+  },
+  "dependencies": {
+    "@cursor/july": "latest",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.14.0",
+    "typescript": "^5.8.0"
+  }
+}

package/templates/security-reviewer/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["agent/**/*", "evals/**/*"]
+}