@cursor/july 0.1.62 → 0.1.73

package/dist/internal/mcp-oauth.d.ts

@@ -46,7 +46,24 @@ type ProviderArgs = {
     onRedirect?: (url: URL) => void;
     tokens?: OAuthTokens;
     clientInformation?: OAuthClientInformationFull;
+    /**
+     * True when authorize/token requests must NOT carry the RFC 8707
+     * `resource` indicator, read off the server's protected-resource
+     * metadata (`cursor_omit_resource_indicator`). Entra rejects the
+     * indicator with AADSTS9010010, so Microsoft 365 flows through Cursor's
+     * REST-as-MCP translator fail pre-auth without this.
+     */
+    omitResourceIndicator?: boolean;
 };
+/**
+ * Reads the Cursor REST-as-MCP translator's OAuth quirk off the resource's
+ * RFC 9728 protected-resource metadata. Deliberately self-contained
+ * (`@cursor/july` publishes to public npm with no private workspace
+ * dependencies — see `waitForMcpOAuthCallback`): matches the translator
+ * path shape on any origin so local translators work, and fails to the
+ * default behavior (indicator kept) when the PRM is unreachable.
+ */
+export declare function fetchOmitResourceIndicatorFromPrm(resourceUrl: string, fetchImpl?: typeof fetch): Promise<boolean>;
 export declare class HostMcpOAuthProvider implements OAuthClientProvider {
     private tokensValue;
     private clientInfo;
@@ -54,6 +71,11 @@ export declare class HostMcpOAuthProvider implements OAuthClientProvider {
     private redirect;
     private readonly meta;
     private readonly args;
+    /**
+     * Assigned only when the PRM sets `cursor_omit_resource_indicator`; left
+     * absent otherwise so the SDK's default resource validation applies.
+     */
+    readonly validateResourceURL: (() => Promise<URL | undefined>) | undefined;
     constructor(args: ProviderArgs);
     get redirectUrl(): string;
     get clientMetadata(): OAuthClientMetadata;

package/dist/internal/mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AAEF,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IAEpC,YAAY,IAAI,EAAE,YAAY,EAW7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAchC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAE3E,YAAY,IAAI,EAAE,YAAY,EAc7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgBhC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}

package/dist/internal/mcp-oauth.js

@@ -210,12 +210,49 @@ export class FileMcpOAuthStore {
         });
     }
 }
+/**
+ * Reads the Cursor REST-as-MCP translator's OAuth quirk off the resource's
+ * RFC 9728 protected-resource metadata. Deliberately self-contained
+ * (`@cursor/july` publishes to public npm with no private workspace
+ * dependencies — see `waitForMcpOAuthCallback`): matches the translator
+ * path shape on any origin so local translators work, and fails to the
+ * default behavior (indicator kept) when the PRM is unreachable.
+ */
+export function fetchOmitResourceIndicatorFromPrm(resourceUrl_1) {
+    return __awaiter(this, arguments, void 0, function* (resourceUrl, fetchImpl = fetch) {
+        let url;
+        try {
+            url = new URL(resourceUrl);
+        }
+        catch (_a) {
+            return false;
+        }
+        if (!/^\/rest-mcp\/[^/]+\/mcp\/?$/.test(url.pathname)) {
+            return false;
+        }
+        const prmUrl = `${url.origin}/.well-known/oauth-protected-resource${url.pathname.replace(/\/+$/, "")}`;
+        try {
+            const response = yield fetchImpl(prmUrl);
+            if (!response.ok) {
+                return false;
+            }
+            const document = (yield response.json());
+            return document.cursor_omit_resource_indicator === true;
+        }
+        catch (_b) {
+            return false;
+        }
+    });
+}
 export class HostMcpOAuthProvider {
     constructor(args) {
         var _a;
         this.args = args;
         this.tokensValue = args.tokens;
         this.clientInfo = args.clientInformation;
+        if (args.omitResourceIndicator === true) {
+            this.validateResourceURL = () => __awaiter(this, void 0, void 0, function* () { return undefined; });
+        }
         this.meta = {
             redirect_uris: [(_a = args.redirectUrl) !== null && _a !== void 0 ? _a : MCP_OAUTH_CALLBACK_URL],
             token_endpoint_auth_method: "none",
@@ -293,9 +330,10 @@ export function createHostMcpOAuthProvider(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const store = (_a = args.store) !== null && _a !== void 0 ? _a : new FileMcpOAuthStore();
-        const [fileTokens, fileClient] = yield Promise.all([
+        const [fileTokens, fileClient, omitResourceIndicator] = yield Promise.all([
             store.loadTokens(args.identifier, args.resourceUrl),
             store.loadClientInformation(args.identifier, args.resourceUrl),
+            fetchOmitResourceIndicatorFromPrm(args.resourceUrl),
         ]);
         return new HostMcpOAuthProvider({
             identifier: args.identifier,
@@ -304,6 +342,7 @@ export function createHostMcpOAuthProvider(args) {
             tokens: fileTokens !== null && fileTokens !== void 0 ? fileTokens : tokensFromEnv(args.identifier),
             clientInformation: fileClient !== null && fileClient !== void 0 ? fileClient : clientIdFromEnv(args.identifier),
             onRedirect: args.onRedirect,
+            omitResourceIndicator,
         });
     });
 }

package/dist/internal/package-inline-stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-inline-stdio.d.ts","sourceRoot":"","sources":["../../src/internal/package-inline-stdio.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAE5B,MAAM,aAAa,CAAC;AA+BrB,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC5C,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsE/B"}
+{"version":3,"file":"package-inline-stdio.d.ts","sourceRoot":"","sources":["../../src/internal/package-inline-stdio.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAE5B,MAAM,aAAa,CAAC;AAmCrB,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC5C,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsE/B"}

package/dist/internal/package-inline-stdio.js

@@ -16,7 +16,7 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import * as esbuild from "esbuild";
-import { toolInputJsonSchema } from "./json-schema.js";
+import { toolInputJsonSchema, toolOutputJsonSchema } from "./json-schema.js";
 const require = createRequire(import.meta.url);
 const CONNECTION_SPECIFIERS = new Set([
     "@anysphere/agent-serve/connections",
@@ -31,10 +31,10 @@ function sibling(basename) {
 function jsonSchemaCatalog(tools) {
     const catalog = {};
     for (const [name, tool] of Object.entries(tools)) {
-        catalog[name] = {
-            description: tool.description,
-            inputSchema: toolInputJsonSchema(tool.inputSchema),
-        };
+        const outputSchema = toolOutputJsonSchema(tool.outputSchema);
+        catalog[name] = Object.assign({ description: tool.description, inputSchema: toolInputJsonSchema(tool.inputSchema) }, (outputSchema === undefined
+            ? {}
+            : { outputSchema: outputSchema }));
     }
     return catalog;
 }

package/dist/internal/review-comments.d.ts

@@ -6,6 +6,20 @@ export type ReviewCommentPostResult = {
     mode: "review_with_inline_comments" | "review_body_only" | "skipped";
     inlineCommentCount: number;
     detail: string;
+    /**
+     * Ids of the inline comments this post created, when the publisher could
+     * read them back. Callers that later re-read a PR's comments use these as
+     * the provenance allowlist: a comment id we did not create is not ours,
+     * no matter what its body looks like. Empty when the publisher cannot
+     * resolve them (it never guesses).
+     */
+    postedComments?: PostedReviewComment[];
+};
+/** One inline comment this agent created, as the SCM assigned it. */
+export type PostedReviewComment = {
+    id: number;
+    file: string;
+    line: number;
 };
 export type ReviewInlineComment = {
     file: string;
@@ -33,6 +47,88 @@ export type ReviewCommentsRequest = {
 export type ReviewCommentPublisherImplementation = {
     postReview: (args: ReviewCommentPostArgs) => Promise<ReviewCommentPostResult>;
 };
+/**
+ * SCMs this module can read review comments back from. Same growth seam as
+ * `shallow-clone.ts`'s {@link import("./shallow-clone.js").ScmProvider}:
+ * adding GitLab/Bitbucket/Origin means a resolver case plus a reader
+ * implementation, and nothing above this line changes.
+ */
+export type ScmReviewProvider = "github";
+/** Which SCM's PR to read review comments from. */
+export type ScmReviewTarget = {
+    provider: ScmReviewProvider;
+    /** `owner/name`. */
+    repo: string;
+    prNumber: number;
+};
+/**
+ * One existing inline review comment, provider-neutral.
+ *
+ * Field names follow Bugbot's `ExistingInlineComment`
+ * (`backend/server/src/bugbot/review/applyBugbotPRReview.ts`), which is the
+ * shape its resolution judge consumes after normalizing each provider's
+ * `getPRComments` output — so the same review logic reads the same way here.
+ */
+export type ExistingReviewComment = {
+    id: number;
+    file: string;
+    startLine: number;
+    endLine: number;
+    body: string;
+};
+export type GetReviewCommentsArgs = {
+    target: ScmReviewTarget;
+    /** Comment ids to fetch; ids the SCM no longer has are omitted. */
+    commentIds: readonly number[];
+    signal?: AbortSignal;
+};
+/**
+ * Read side of the review-comment seam, mirroring
+ * {@link ReviewCommentPublisherImplementation}. Bugbot's equivalent is
+ * `IGitProvider.getPRComments`.
+ *
+ * By id rather than by listing: callers only ever want comments they
+ * recorded creating, and a busy PR's comment list runs to thousands, where
+ * any page cap silently drops exactly the older comments a re-review needs.
+ */
+export type ReviewCommentReaderImplementation = {
+    getReviewComments: (args: GetReviewCommentsArgs) => Promise<ExistingReviewComment[]>;
+};
+/** Parse a PR URL into the SCM target to read comments from. */
+export declare function resolveScmReviewTarget(prUrl: string): ScmReviewTarget | undefined;
+/**
+ * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
+ * dispatch. Returns undefined when the host cannot serve that provider (no
+ * GitHub client bound), so callers degrade instead of throwing.
+ */
+export declare function createReviewCommentReader(args: {
+    target: ScmReviewTarget;
+    github?: HostGitHubClient;
+}): ReviewCommentReaderImplementation | undefined;
+/**
+ * Reads inline review comments through the host GitHub client (Cursor
+ * account lease, App installation token, or PAT).
+ */
+export declare function createHostGithubReviewCommentReader(github: HostGitHubClient): ReviewCommentReaderImplementation;
+type GithubReviewCommentLike = {
+    id: number;
+    path: string;
+    body: string;
+    line?: number | null;
+    start_line?: number | null;
+    original_line?: number | null;
+    original_start_line?: number | null;
+};
+/**
+ * GitHub review comment → {@link ExistingReviewComment}.
+ *
+ * Prefers the `original_*` fields — the path/lines/commit as of the review
+ * the comment belongs to. `line` drifts as the PR gains commits, so a
+ * caller correlating a comment with the review that produced it needs the
+ * original position, the same fields Bugbot carries on
+ * `PullRequestCommentOutput`.
+ */
+export declare function normalizeGithubReviewComment(comment: GithubReviewCommentLike): ExistingReviewComment | undefined;
 /**
  * Prepares the provider-neutral review payload used by local `gh` posting.
  */
@@ -55,4 +151,5 @@ export declare function createLocalGhReviewPublisher(): ReviewCommentPublisherIm
  * cursorAccount })` is bound.
  */
 export declare function createHostGithubReviewPublisher(github: HostGitHubClient): ReviewCommentPublisherImplementation;
+export {};
 //# sourceMappingURL=review-comments.d.ts.map

package/dist/internal/review-comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAOF;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gBAAgB,GACvB,oCAAoC,CAMtC"}
+{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEzC,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iBAAiB,EAAE,CACjB,IAAI,EAAE,qBAAqB,KACxB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,SAAS,CAS7B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,iCAAiC,GAAG,SAAS,CAOhD;AAMD;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,gBAAgB,GACvB,iCAAiC,CA6BnC;AAED,KAAK,uBAAuB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,qBAAqB,GAAG,SAAS,CAoBnC;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gBAAgB,GACvB,oCAAoC,CAMtC"}

package/dist/internal/review-comments.js

@@ -8,6 +8,100 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { spawn } from "node:child_process";
+/** Parse a PR URL into the SCM target to read comments from. */
+export function resolveScmReviewTarget(prUrl) {
+    const parsed = parseGithubPrUrl(prUrl);
+    return parsed.kind === "valid"
+        ? {
+            provider: "github",
+            repo: parsed.value.repo,
+            prNumber: parsed.value.prNumber,
+        }
+        : undefined;
+}
+/**
+ * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
+ * dispatch. Returns undefined when the host cannot serve that provider (no
+ * GitHub client bound), so callers degrade instead of throwing.
+ */
+export function createReviewCommentReader(args) {
+    switch (args.target.provider) {
+        case "github":
+            return args.github === undefined
+                ? undefined
+                : createHostGithubReviewCommentReader(args.github);
+    }
+}
+/** Cap on pages pulled per PR; GitHub serves 100 comments per page. */
+const REVIEW_COMMENTS_MAX_PAGES = 5;
+const REVIEW_COMMENTS_PAGE_SIZE = 100;
+/**
+ * Reads inline review comments through the host GitHub client (Cursor
+ * account lease, App installation token, or PAT).
+ */
+export function createHostGithubReviewCommentReader(github) {
+    return {
+        getReviewComments(_a) {
+            return __awaiter(this, arguments, void 0, function* ({ target, commentIds, signal }) {
+                const [owner, repo] = target.repo.split("/", 2);
+                if (owner === undefined || repo === undefined || repo === "") {
+                    return [];
+                }
+                const octokit = yield github.getOctokit();
+                const comments = [];
+                for (const commentId of commentIds) {
+                    signal === null || signal === void 0 ? void 0 : signal.throwIfAborted();
+                    try {
+                        const response = yield octokit.rest.pulls.getReviewComment({
+                            owner,
+                            repo,
+                            comment_id: commentId,
+                        });
+                        const normalized = normalizeGithubReviewComment(response.data);
+                        if (normalized !== undefined) {
+                            comments.push(normalized);
+                        }
+                    }
+                    catch (_b) {
+                        // Deleted or otherwise unreadable: that finding simply has no
+                        // prior text to judge, which is the same as it not being there.
+                    }
+                }
+                return comments;
+            });
+        },
+    };
+}
+/**
+ * GitHub review comment → {@link ExistingReviewComment}.
+ *
+ * Prefers the `original_*` fields — the path/lines/commit as of the review
+ * the comment belongs to. `line` drifts as the PR gains commits, so a
+ * caller correlating a comment with the review that produced it needs the
+ * original position, the same fields Bugbot carries on
+ * `PullRequestCommentOutput`.
+ */
+export function normalizeGithubReviewComment(comment) {
+    var _a, _b, _c;
+    // Take both lines from the same position set. Mixing them (original end
+    // line with the drifted current start line) would describe a range that
+    // never existed in either revision.
+    const original = (_a = comment.original_line) !== null && _a !== void 0 ? _a : undefined;
+    const endLine = (_b = original !== null && original !== void 0 ? original : comment.line) !== null && _b !== void 0 ? _b : undefined;
+    if (endLine === undefined || endLine === null) {
+        return undefined;
+    }
+    const startLine = (_c = (original === undefined
+        ? comment.start_line
+        : comment.original_start_line)) !== null && _c !== void 0 ? _c : endLine;
+    return {
+        id: comment.id,
+        file: comment.path,
+        startLine,
+        endLine,
+        body: comment.body,
+    };
+}
 /**
  * Prepares the provider-neutral review payload used by local `gh` posting.
  */
@@ -97,6 +191,15 @@ function postReviewViaHostGithub(github, args) {
                 detail: htmlUrl
                     ? `posted via host GitHub: ${htmlUrl}`
                     : `posted via host GitHub with ${inlineCommentCount} inline comment(s)`,
+                postedComments: yield readPostedComments({
+                    octokit,
+                    owner,
+                    repo,
+                    prNumber: request.prNumber,
+                    reviewId: response.data.id,
+                    expected: inlineCommentCount,
+                    signal: args.signal,
+                }),
             };
         }
         catch (error) {
@@ -107,6 +210,54 @@ function postReviewViaHostGithub(github, args) {
         }
     });
 }
+/**
+ * Ids of the inline comments a just-created review owns.
+ *
+ * `pulls.createReview` returns the review, not its comments, so they come
+ * from the review-scoped listing. Scoping to the review matters: the
+ * PR-wide list is ordered oldest-first and runs to thousands on a busy PR,
+ * so the comments we just created are the ones a page cap would drop.
+ * Best-effort: any failure yields an empty list, which costs the next run
+ * its prior findings rather than risking a wrong id. Never throws — the
+ * review is already posted by this point.
+ */
+function readPostedComments(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b;
+        if (args.expected === 0) {
+            return [];
+        }
+        try {
+            const posted = [];
+            for (let page = 1; page <= REVIEW_COMMENTS_MAX_PAGES; page++) {
+                (_a = args.signal) === null || _a === void 0 ? void 0 : _a.throwIfAborted();
+                const response = yield args.octokit.rest.pulls.listCommentsForReview({
+                    owner: args.owner,
+                    repo: args.repo,
+                    pull_number: args.prNumber,
+                    review_id: args.reviewId,
+                    per_page: REVIEW_COMMENTS_PAGE_SIZE,
+                    page,
+                });
+                for (const comment of response.data) {
+                    const line = (_b = comment.original_line) !== null && _b !== void 0 ? _b : comment.line;
+                    if (line === null || line === undefined) {
+                        continue;
+                    }
+                    posted.push({ id: comment.id, file: comment.path, line });
+                }
+                if (response.data.length < REVIEW_COMMENTS_PAGE_SIZE) {
+                    break;
+                }
+            }
+            return posted;
+        }
+        catch (_c) {
+            return [];
+        }
+    });
+}
 function postReviewViaLocalGh(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;

package/dist/internal/sanitize-mcp-tool-name.d.ts

@@ -0,0 +1,20 @@
+/**
+ * MCP tool-name sanitization shared by the Cursor-account bridge
+ * (`account-mcp.ts`) and advertised connections (`advertise-tools.ts`).
+ *
+ * Connector display names — and the aggregate `/v1/agent/mcp` names minted
+ * from them (`<serverIdentifier>-<tool>`) — can contain spaces, dots, and
+ * other characters that are illegal as the tool name a model sees.
+ *
+ * Character class matches `packages/agent` `normalizeMcpToolName`
+ * (`[^a-zA-Z0-9_-]` → `_`). Length cap and the empty fallback match the
+ * account bridge (MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$`).
+ * Callers that talk to the backend keep the original advertised name.
+ */
+/** MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$` for tool names. */
+export declare const MAX_MCP_TOOL_NAME_LENGTH = 128;
+/** Connector display names can contain anything (spaces, dots, emoji). */
+export declare function sanitizeMcpToolName(name: string): string;
+/** `base` for the first claimant, `base_2` / `base_3` … for colliders. */
+export declare function suffixMcpToolName(base: string, index: number): string;
+//# sourceMappingURL=sanitize-mcp-tool-name.d.ts.map

package/dist/internal/sanitize-mcp-tool-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-mcp-tool-name.d.ts","sourceRoot":"","sources":["../../src/internal/sanitize-mcp-tool-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrE"}

package/dist/internal/sanitize-mcp-tool-name.js

@@ -0,0 +1,30 @@
+/**
+ * MCP tool-name sanitization shared by the Cursor-account bridge
+ * (`account-mcp.ts`) and advertised connections (`advertise-tools.ts`).
+ *
+ * Connector display names — and the aggregate `/v1/agent/mcp` names minted
+ * from them (`<serverIdentifier>-<tool>`) — can contain spaces, dots, and
+ * other characters that are illegal as the tool name a model sees.
+ *
+ * Character class matches `packages/agent` `normalizeMcpToolName`
+ * (`[^a-zA-Z0-9_-]` → `_`). Length cap and the empty fallback match the
+ * account bridge (MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$`).
+ * Callers that talk to the backend keep the original advertised name.
+ */
+/** MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$` for tool names. */
+export const MAX_MCP_TOOL_NAME_LENGTH = 128;
+/** Connector display names can contain anything (spaces, dots, emoji). */
+export function sanitizeMcpToolName(name) {
+    const cleaned = name
+        .replace(/[^a-zA-Z0-9_-]/g, "_")
+        .slice(0, MAX_MCP_TOOL_NAME_LENGTH);
+    return cleaned === "" ? "tool" : cleaned;
+}
+/** `base` for the first claimant, `base_2` / `base_3` … for colliders. */
+export function suffixMcpToolName(base, index) {
+    if (index === 0) {
+        return base;
+    }
+    const suffix = `_${index + 1}`;
+    return `${base.slice(0, MAX_MCP_TOOL_NAME_LENGTH - suffix.length)}${suffix}`;
+}

package/dist/internal/sdk-runner.d.ts

@@ -24,7 +24,7 @@ export interface AgentRunner {
  * a subset of {@link RunnerTurnRequest} — anything that disagrees warms an
  * executor no turn will ask for.
  */
-export type RunnerPrewarmRequest = Pick<RunnerTurnRequest, "workspaceDir" | "runnerStateDir" | "sandbox" | "tools" | "mcpServers" | "subagents" | "model">;
+export type RunnerPrewarmRequest = Pick<RunnerTurnRequest, "workspaceDir" | "runnerStateDir" | "sandbox" | "tools" | "mcpServers" | "perSendMcpServers" | "subagents" | "model">;
 /** Whether a workspace was actually resolved, and why not when it wasn't. */
 export type PrewarmOutcome = {
     readonly warmed: true;

package/dist/internal/sdk-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-runner.d.ts","sourceRoot":"","sources":["../../src/internal/sdk-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAQL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAEjB,MAAM,aAAa,CAAC;AAGrB,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,iBAAiB,EACf,cAAc,GACd,gBAAgB,GAChB,SAAS,GACT,OAAO,GACP,YAAY,GACZ,WAAW,GACX,OAAO,CACV,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAcxD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAA4B,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,GAAG,SAAS,CAYrB;AAED,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAwBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKvE;AAED,qBAAa,eAAgB,YAAW,WAAW;IAKrC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+C;IACtE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;IAElE,YAA6B,OAAO,GAAE,sBAA2B,EAShE;IAEK,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAkC9D;YAEa,cAAc;IA6F5B;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAepE;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAY7B;IAED,OAAO,CAAC,QAAQ;IA0BhB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,kBAAkB;IAc1B;;;OAGG;YACW,iBAAiB;YAuBjB,SAAS;YAOT,cAAc;YA6Bd,cAAc;IA6C5B,OAAO,CAAC,QAAQ;CAUjB;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAMT;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,cAAc,CAQpE;AAwGD,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,MAAM,CAExE"}
+{"version":3,"file":"sdk-runner.d.ts","sourceRoot":"","sources":["../../src/internal/sdk-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAQL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAEjB,MAAM,aAAa,CAAC;AAGrB,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,iBAAiB,EACf,cAAc,GACd,gBAAgB,GAChB,SAAS,GACT,OAAO,GACP,YAAY,GACZ,mBAAmB,GACnB,WAAW,GACX,OAAO,CACV,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAcxD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,EAAE,MAA4B,CAAC;AAE7E;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE;IACxD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,GAAG,SAAS,CAYrB;AAED,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAwBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKvE;AAwBD,qBAAa,eAAgB,YAAW,WAAW;IAKrC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+C;IACtE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;IAElE,YAA6B,OAAO,GAAE,sBAA2B,EAShE;IAEK,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CA+B9D;YAEa,cAAc;IA2G5B;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAepE;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAY7B;IAED,OAAO,CAAC,QAAQ;IA0BhB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,aAAa;IAUrB,OAAO,CAAC,kBAAkB;IAmB1B;;;OAGG;YACW,iBAAiB;YAuBjB,SAAS;YAOT,cAAc;YA6Bd,cAAc;IA6C5B,OAAO,CAAC,QAAQ;CAUjB;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAMT;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,cAAc,CAQpE;AAwGD,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,MAAM,CAExE"}

package/dist/internal/sdk-runner.js

@@ -73,6 +73,23 @@ export function isAuthErrorMessage(message) {
     }
     return /authentication error|try logging out and back in/i.test(message);
 }
+/** Cloud `wait()` copy for `stream_expired` / a missing start-state blob. */
+function isStreamExpiredErrorMessage(message) {
+    if (message === undefined) {
+        return false;
+    }
+    return /run stream is no longer available|\[stream_expired\]/i.test(message);
+}
+function retryReason(message, isFirstTurn) {
+    if (isStreamExpiredErrorMessage(message)) {
+        return "cloud run stream expired";
+    }
+    // First-turn auth is the credential; a fresh handle cannot fix it.
+    if (!isFirstTurn && isAuthErrorMessage(message)) {
+        return "authentication failure";
+    }
+    return undefined;
+}
 export class CursorSdkRunner {
     constructor(options = {}) {
         this.options = options;
@@ -96,24 +113,21 @@ export class CursorSdkRunner {
                 } });
             const outcome = yield this.runTurnAttempt(tracked);
             if (outcome.status !== "error" ||
-                !isAuthErrorMessage(outcome.errorMessage) ||
                 sawUpdate ||
-                request.isFirstTurn ||
                 ((_a = request.signal) === null || _a === void 0 ? void 0 : _a.aborted) === true) {
                 return outcome;
             }
-            // The turn died on an authentication failure before producing any output
-            // — the signature of a handle whose exchanged access token expired (the
-            // failed attempt already evicted it). Retrying once on a fresh handle is
-            // safe here because nothing streamed and no tool ran. First turns are
-            // excluded: their token was exchanged moments ago, so the credential
-            // itself is the problem and a retry cannot succeed.
-            this.log(`[agent-sdk] session ${request.sessionId}: retrying the turn on a fresh SDK agent handle after an authentication failure`);
+            const reason = retryReason(outcome.errorMessage, request.isFirstTurn);
+            if (reason === undefined) {
+                return outcome;
+            }
+            // Log the original error even when the retry succeeds so the expiry
+            // still shows up in Datadog.
+            this.log(`[agent-sdk] session ${request.sessionId}: ${reason}: ${outcome.errorMessage}; retrying the turn`);
             try {
                 return yield this.runTurnAttempt(tracked);
             }
             catch (_b) {
-                // The retry was best effort; report the original failure.
                 return outcome;
             }
         });
@@ -132,14 +146,16 @@ export class CursorSdkRunner {
                         })),
                     }
                     : request.prompt;
-                const run = yield agent.send(sendMessage, Object.assign({ onDelta: (_a) => __awaiter(this, [_a], void 0, function* ({ update }) {
+                const run = yield agent.send(sendMessage, Object.assign(Object.assign({ onDelta: (_a) => __awaiter(this, [_a], void 0, function* ({ update }) {
                         try {
                             yield request.onUpdate(update);
                         }
                         catch (_b) {
                             // Stream mapping must never reject into the SDK transport.
                         }
-                    }) }, (request.runtime === "local"
+                    }) }, (request.runtime === "local" && request.perSendMcpServers === true
+                    ? { mcpServers: request.mcpServers }
+                    : {})), (request.runtime === "local"
                     ? {
                         local: Object.assign({ customTools: request.customTools }, (request.forceExpireActiveRun === true
                             ? { force: true }
@@ -168,6 +184,12 @@ export class CursorSdkRunner {
                 if (request.onSdkAgentId !== undefined) {
                     yield request.onSdkAgentId(agent.agentId);
                 }
+                // Readable on the handle as soon as send resolves, long before wait().
+                if (request.onRequestId !== undefined &&
+                    run.requestId !== undefined &&
+                    run.requestId !== "") {
+                    yield request.onRequestId(run.requestId);
+                }
                 try {
                     const result = yield run.wait();
                     let outcome = toTurnOutcome(result);
@@ -287,7 +309,8 @@ export class CursorSdkRunner {
     buildSharedOptions(request) {
         var _a;
         const subagents = toAgentDefinitions(request.subagents);
-        return Object.assign(Object.assign({ model: toModelSelection((_a = request.model) !== null && _a !== void 0 ? _a : DEFAULT_MODEL), apiKey: this.requireApiKey() }, (Object.keys(request.mcpServers).length > 0
+        return Object.assign(Object.assign({ model: toModelSelection((_a = request.model) !== null && _a !== void 0 ? _a : DEFAULT_MODEL), apiKey: this.requireApiKey() }, (Object.keys(request.mcpServers).length > 0 &&
+            request.perSendMcpServers !== true
             ? { mcpServers: request.mcpServers }
             : {})), (subagents === undefined ? {} : { agents: subagents }));
     }

package/dist/internal/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkCH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAgHrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAwBpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAaD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAywB3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkCH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAkHrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAwBpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAaD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAywB3B"}