@cursor/july 0.1.62 → 0.1.73

package/src/internal/mcp-endpoint.ts

@@ -218,6 +218,9 @@ function buildToolMcpServer(
         name: tool.name,
         description: tool.description,
         inputSchema: tool.inputSchema,
+        ...(tool.outputSchema === undefined
+          ? {}
+          : { outputSchema: tool.outputSchema }),
       })),
     })
   );
@@ -298,6 +301,9 @@ function buildConnectionBridgeMcpServer(
           ? {}
           : { description: tool.description }),
         inputSchema: tool.inputSchema ?? { type: "object" },
+        ...(tool.outputSchema === undefined
+          ? {}
+          : { outputSchema: tool.outputSchema }),
       })),
     };
   });

package/src/internal/mcp-host.ts

@@ -29,6 +29,18 @@ interface OpenedConnection {
   close: () => Promise<void>;
 }
 
+/**
+ * A non-caching view of one connection: every operation opens a fresh
+ * client and closes it afterwards. See {@link McpHost.oneOff}.
+ */
+export interface HostMcpOneOff {
+  listTools(): Promise<HostMcpToolInfo[]>;
+  callTool(
+    toolName: string,
+    args?: Record<string, unknown>
+  ): Promise<HostMcpCallResult>;
+}
+
 export class McpHost implements HostMcpRegistry {
   private readonly byName = new Map<string, DiscoveredConnection>();
   private readonly clients = new Map<string, Promise<OpenedConnection>>();
@@ -54,18 +66,47 @@ export class McpHost implements HostMcpRegistry {
   async listTools(connectionName: string): Promise<HostMcpToolInfo[]> {
     return this.withClient(connectionName, async (client) => {
       const listed = await client.listTools();
-      return listed.tools.map((tool) => ({
-        name: tool.name,
-        ...(tool.description === undefined
-          ? {}
-          : { description: tool.description }),
-        ...(tool.inputSchema === undefined
-          ? {}
-          : { inputSchema: tool.inputSchema as JsonObject }),
-      }));
+      return listed.tools.map(toToolInfo);
     });
   }
 
+  /**
+   * A one-off view of a connection that is not (or not exactly) in the
+   * registry — e.g. a registered connection with per-session auth headers
+   * substituted in. Every operation opens a fresh client and closes it
+   * afterwards: the registry's cached per-name client would leak one
+   * session's identity into another, and stateless streamable-HTTP
+   * servers answer a fresh initialize cheaply. Results ride the same
+   * mapping as registry calls.
+   */
+  oneOff(connection: DiscoveredConnection): HostMcpOneOff {
+    const withFreshClient = async <T>(
+      run: (client: Client) => Promise<T>
+    ): Promise<T> => {
+      const opened = await openConnection(connection);
+      try {
+        return await run(opened.client);
+      } finally {
+        await opened.close();
+      }
+    };
+    return {
+      listTools: () =>
+        withFreshClient(async (client) => {
+          const listed = await client.listTools();
+          return listed.tools.map(toToolInfo);
+        }),
+      callTool: (toolName, args = {}) =>
+        withFreshClient(async (client) => {
+          const result = await client.callTool({
+            name: toolName,
+            arguments: args,
+          });
+          return normalizeCallResult(result);
+        }),
+    };
+  }
+
   async callTool(
     connectionName: string,
     toolName: string,
@@ -172,6 +213,26 @@ export function isStaleMcpSessionError(error: unknown): boolean {
   return code === 404;
 }
 
+function toToolInfo(tool: {
+  name: string;
+  description?: string;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
+}): HostMcpToolInfo {
+  return {
+    name: tool.name,
+    ...(tool.description === undefined
+      ? {}
+      : { description: tool.description }),
+    ...(tool.inputSchema === undefined
+      ? {}
+      : { inputSchema: tool.inputSchema as JsonObject }),
+    ...(tool.outputSchema === undefined
+      ? {}
+      : { outputSchema: tool.outputSchema as JsonObject }),
+  };
+}
+
 async function openConnection(
   connection: DiscoveredConnection
 ): Promise<OpenedConnection> {

package/src/internal/mcp-oauth.ts

@@ -259,8 +259,52 @@ type ProviderArgs = {
   onRedirect?: (url: URL) => void;
   tokens?: OAuthTokens;
   clientInformation?: OAuthClientInformationFull;
+  /**
+   * True when authorize/token requests must NOT carry the RFC 8707
+   * `resource` indicator, read off the server's protected-resource
+   * metadata (`cursor_omit_resource_indicator`). Entra rejects the
+   * indicator with AADSTS9010010, so Microsoft 365 flows through Cursor's
+   * REST-as-MCP translator fail pre-auth without this.
+   */
+  omitResourceIndicator?: boolean;
 };
 
+/**
+ * Reads the Cursor REST-as-MCP translator's OAuth quirk off the resource's
+ * RFC 9728 protected-resource metadata. Deliberately self-contained
+ * (`@cursor/july` publishes to public npm with no private workspace
+ * dependencies — see `waitForMcpOAuthCallback`): matches the translator
+ * path shape on any origin so local translators work, and fails to the
+ * default behavior (indicator kept) when the PRM is unreachable.
+ */
+export async function fetchOmitResourceIndicatorFromPrm(
+  resourceUrl: string,
+  fetchImpl: typeof fetch = fetch
+): Promise<boolean> {
+  let url: URL;
+  try {
+    url = new URL(resourceUrl);
+  } catch {
+    return false;
+  }
+  if (!/^\/rest-mcp\/[^/]+\/mcp\/?$/.test(url.pathname)) {
+    return false;
+  }
+  const prmUrl = `${url.origin}/.well-known/oauth-protected-resource${url.pathname.replace(/\/+$/, "")}`;
+  try {
+    const response = await fetchImpl(prmUrl);
+    if (!response.ok) {
+      return false;
+    }
+    const document = (await response.json()) as {
+      cursor_omit_resource_indicator?: unknown;
+    };
+    return document.cursor_omit_resource_indicator === true;
+  } catch {
+    return false;
+  }
+}
+
 export class HostMcpOAuthProvider implements OAuthClientProvider {
   private tokensValue: OAuthTokens | undefined;
   private clientInfo: OAuthClientInformationFull | undefined;
@@ -268,11 +312,19 @@ export class HostMcpOAuthProvider implements OAuthClientProvider {
   private redirect: URL | undefined;
   private readonly meta: OAuthClientMetadata;
   private readonly args: ProviderArgs;
+  /**
+   * Assigned only when the PRM sets `cursor_omit_resource_indicator`; left
+   * absent otherwise so the SDK's default resource validation applies.
+   */
+  readonly validateResourceURL: (() => Promise<URL | undefined>) | undefined;
 
   constructor(args: ProviderArgs) {
     this.args = args;
     this.tokensValue = args.tokens;
     this.clientInfo = args.clientInformation;
+    if (args.omitResourceIndicator === true) {
+      this.validateResourceURL = async () => undefined;
+    }
     this.meta = {
       redirect_uris: [args.redirectUrl ?? MCP_OAUTH_CALLBACK_URL],
       token_endpoint_auth_method: "none",
@@ -366,9 +418,10 @@ export async function createHostMcpOAuthProvider(args: {
   onRedirect?: (url: URL) => void;
 }): Promise<HostMcpOAuthProvider> {
   const store = args.store ?? new FileMcpOAuthStore();
-  const [fileTokens, fileClient] = await Promise.all([
+  const [fileTokens, fileClient, omitResourceIndicator] = await Promise.all([
     store.loadTokens(args.identifier, args.resourceUrl),
     store.loadClientInformation(args.identifier, args.resourceUrl),
+    fetchOmitResourceIndicatorFromPrm(args.resourceUrl),
   ]);
   return new HostMcpOAuthProvider({
     identifier: args.identifier,
@@ -377,6 +430,7 @@ export async function createHostMcpOAuthProvider(args: {
     tokens: fileTokens ?? tokensFromEnv(args.identifier),
     clientInformation: fileClient ?? clientIdFromEnv(args.identifier),
     onRedirect: args.onRedirect,
+    omitResourceIndicator,
   });
 }
 

package/src/internal/package-inline-stdio.ts

@@ -14,7 +14,7 @@ import type {
   JsonSchemaObject,
 } from "../types.js";
 import type { InlineStdioCatalogEntry } from "./inline-stdio-mcp.js";
-import { toolInputJsonSchema } from "./json-schema.js";
+import { toolInputJsonSchema, toolOutputJsonSchema } from "./json-schema.js";
 
 const require = createRequire(import.meta.url);
 
@@ -35,9 +35,13 @@ function jsonSchemaCatalog(
 ): Record<string, InlineStdioCatalogEntry> {
   const catalog: Record<string, InlineStdioCatalogEntry> = {};
   for (const [name, tool] of Object.entries(tools)) {
+    const outputSchema = toolOutputJsonSchema(tool.outputSchema);
     catalog[name] = {
       description: tool.description,
       inputSchema: toolInputJsonSchema(tool.inputSchema) as JsonSchemaObject,
+      ...(outputSchema === undefined
+        ? {}
+        : { outputSchema: outputSchema as JsonSchemaObject }),
     };
   }
   return catalog;

package/src/internal/review-comments.ts

@@ -9,6 +9,21 @@ export type ReviewCommentPostResult = {
   mode: "review_with_inline_comments" | "review_body_only" | "skipped";
   inlineCommentCount: number;
   detail: string;
+  /**
+   * Ids of the inline comments this post created, when the publisher could
+   * read them back. Callers that later re-read a PR's comments use these as
+   * the provenance allowlist: a comment id we did not create is not ours,
+   * no matter what its body looks like. Empty when the publisher cannot
+   * resolve them (it never guesses).
+   */
+  postedComments?: PostedReviewComment[];
+};
+
+/** One inline comment this agent created, as the SCM assigned it. */
+export type PostedReviewComment = {
+  id: number;
+  file: string;
+  line: number;
 };
 
 export type ReviewInlineComment = {
@@ -41,6 +56,175 @@ export type ReviewCommentPublisherImplementation = {
   postReview: (args: ReviewCommentPostArgs) => Promise<ReviewCommentPostResult>;
 };
 
+/**
+ * SCMs this module can read review comments back from. Same growth seam as
+ * `shallow-clone.ts`'s {@link import("./shallow-clone.js").ScmProvider}:
+ * adding GitLab/Bitbucket/Origin means a resolver case plus a reader
+ * implementation, and nothing above this line changes.
+ */
+export type ScmReviewProvider = "github";
+
+/** Which SCM's PR to read review comments from. */
+export type ScmReviewTarget = {
+  provider: ScmReviewProvider;
+  /** `owner/name`. */
+  repo: string;
+  prNumber: number;
+};
+
+/**
+ * One existing inline review comment, provider-neutral.
+ *
+ * Field names follow Bugbot's `ExistingInlineComment`
+ * (`backend/server/src/bugbot/review/applyBugbotPRReview.ts`), which is the
+ * shape its resolution judge consumes after normalizing each provider's
+ * `getPRComments` output — so the same review logic reads the same way here.
+ */
+export type ExistingReviewComment = {
+  id: number;
+  file: string;
+  startLine: number;
+  endLine: number;
+  body: string;
+};
+
+export type GetReviewCommentsArgs = {
+  target: ScmReviewTarget;
+  /** Comment ids to fetch; ids the SCM no longer has are omitted. */
+  commentIds: readonly number[];
+  signal?: AbortSignal;
+};
+
+/**
+ * Read side of the review-comment seam, mirroring
+ * {@link ReviewCommentPublisherImplementation}. Bugbot's equivalent is
+ * `IGitProvider.getPRComments`.
+ *
+ * By id rather than by listing: callers only ever want comments they
+ * recorded creating, and a busy PR's comment list runs to thousands, where
+ * any page cap silently drops exactly the older comments a re-review needs.
+ */
+export type ReviewCommentReaderImplementation = {
+  getReviewComments: (
+    args: GetReviewCommentsArgs
+  ) => Promise<ExistingReviewComment[]>;
+};
+
+/** Parse a PR URL into the SCM target to read comments from. */
+export function resolveScmReviewTarget(
+  prUrl: string
+): ScmReviewTarget | undefined {
+  const parsed = parseGithubPrUrl(prUrl);
+  return parsed.kind === "valid"
+    ? {
+        provider: "github",
+        repo: parsed.value.repo,
+        prNumber: parsed.value.prNumber,
+      }
+    : undefined;
+}
+
+/**
+ * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
+ * dispatch. Returns undefined when the host cannot serve that provider (no
+ * GitHub client bound), so callers degrade instead of throwing.
+ */
+export function createReviewCommentReader(args: {
+  target: ScmReviewTarget;
+  github?: HostGitHubClient;
+}): ReviewCommentReaderImplementation | undefined {
+  switch (args.target.provider) {
+    case "github":
+      return args.github === undefined
+        ? undefined
+        : createHostGithubReviewCommentReader(args.github);
+  }
+}
+
+/** Cap on pages pulled per PR; GitHub serves 100 comments per page. */
+const REVIEW_COMMENTS_MAX_PAGES = 5;
+const REVIEW_COMMENTS_PAGE_SIZE = 100;
+
+/**
+ * Reads inline review comments through the host GitHub client (Cursor
+ * account lease, App installation token, or PAT).
+ */
+export function createHostGithubReviewCommentReader(
+  github: HostGitHubClient
+): ReviewCommentReaderImplementation {
+  return {
+    async getReviewComments({ target, commentIds, signal }) {
+      const [owner, repo] = target.repo.split("/", 2);
+      if (owner === undefined || repo === undefined || repo === "") {
+        return [];
+      }
+      const octokit = await github.getOctokit();
+      const comments: ExistingReviewComment[] = [];
+      for (const commentId of commentIds) {
+        signal?.throwIfAborted();
+        try {
+          const response = await octokit.rest.pulls.getReviewComment({
+            owner,
+            repo,
+            comment_id: commentId,
+          });
+          const normalized = normalizeGithubReviewComment(response.data);
+          if (normalized !== undefined) {
+            comments.push(normalized);
+          }
+        } catch {
+          // Deleted or otherwise unreadable: that finding simply has no
+          // prior text to judge, which is the same as it not being there.
+        }
+      }
+      return comments;
+    },
+  };
+}
+
+type GithubReviewCommentLike = {
+  id: number;
+  path: string;
+  body: string;
+  line?: number | null;
+  start_line?: number | null;
+  original_line?: number | null;
+  original_start_line?: number | null;
+};
+
+/**
+ * GitHub review comment → {@link ExistingReviewComment}.
+ *
+ * Prefers the `original_*` fields — the path/lines/commit as of the review
+ * the comment belongs to. `line` drifts as the PR gains commits, so a
+ * caller correlating a comment with the review that produced it needs the
+ * original position, the same fields Bugbot carries on
+ * `PullRequestCommentOutput`.
+ */
+export function normalizeGithubReviewComment(
+  comment: GithubReviewCommentLike
+): ExistingReviewComment | undefined {
+  // Take both lines from the same position set. Mixing them (original end
+  // line with the drifted current start line) would describe a range that
+  // never existed in either revision.
+  const original = comment.original_line ?? undefined;
+  const endLine = original ?? comment.line ?? undefined;
+  if (endLine === undefined || endLine === null) {
+    return undefined;
+  }
+  const startLine =
+    (original === undefined
+      ? comment.start_line
+      : comment.original_start_line) ?? endLine;
+  return {
+    id: comment.id,
+    file: comment.path,
+    startLine,
+    endLine,
+    body: comment.body,
+  };
+}
+
 type ParsedGithubPrUrl = {
   repo: string;
   prNumber: number;
@@ -148,6 +332,15 @@ async function postReviewViaHostGithub(
       detail: htmlUrl
         ? `posted via host GitHub: ${htmlUrl}`
         : `posted via host GitHub with ${inlineCommentCount} inline comment(s)`,
+      postedComments: await readPostedComments({
+        octokit,
+        owner,
+        repo,
+        prNumber: request.prNumber,
+        reviewId: response.data.id,
+        expected: inlineCommentCount,
+        signal: args.signal,
+      }),
     };
   } catch (error) {
     if (args.signal?.aborted) {
@@ -159,6 +352,58 @@ async function postReviewViaHostGithub(
   }
 }
 
+/**
+ * Ids of the inline comments a just-created review owns.
+ *
+ * `pulls.createReview` returns the review, not its comments, so they come
+ * from the review-scoped listing. Scoping to the review matters: the
+ * PR-wide list is ordered oldest-first and runs to thousands on a busy PR,
+ * so the comments we just created are the ones a page cap would drop.
+ * Best-effort: any failure yields an empty list, which costs the next run
+ * its prior findings rather than risking a wrong id. Never throws — the
+ * review is already posted by this point.
+ */
+async function readPostedComments(args: {
+  octokit: Awaited<ReturnType<HostGitHubClient["getOctokit"]>>;
+  owner: string;
+  repo: string;
+  prNumber: number;
+  reviewId: number;
+  expected: number;
+  signal?: AbortSignal;
+}): Promise<PostedReviewComment[]> {
+  if (args.expected === 0) {
+    return [];
+  }
+  try {
+    const posted: PostedReviewComment[] = [];
+    for (let page = 1; page <= REVIEW_COMMENTS_MAX_PAGES; page++) {
+      args.signal?.throwIfAborted();
+      const response = await args.octokit.rest.pulls.listCommentsForReview({
+        owner: args.owner,
+        repo: args.repo,
+        pull_number: args.prNumber,
+        review_id: args.reviewId,
+        per_page: REVIEW_COMMENTS_PAGE_SIZE,
+        page,
+      });
+      for (const comment of response.data) {
+        const line = comment.original_line ?? comment.line;
+        if (line === null || line === undefined) {
+          continue;
+        }
+        posted.push({ id: comment.id, file: comment.path, line });
+      }
+      if (response.data.length < REVIEW_COMMENTS_PAGE_SIZE) {
+        break;
+      }
+    }
+    return posted;
+  } catch {
+    return [];
+  }
+}
+
 async function postReviewViaLocalGh(
   args: ReviewCommentPostArgs
 ): Promise<ReviewCommentPostResult> {

package/src/internal/sanitize-mcp-tool-name.ts

@@ -0,0 +1,33 @@
+/**
+ * MCP tool-name sanitization shared by the Cursor-account bridge
+ * (`account-mcp.ts`) and advertised connections (`advertise-tools.ts`).
+ *
+ * Connector display names — and the aggregate `/v1/agent/mcp` names minted
+ * from them (`<serverIdentifier>-<tool>`) — can contain spaces, dots, and
+ * other characters that are illegal as the tool name a model sees.
+ *
+ * Character class matches `packages/agent` `normalizeMcpToolName`
+ * (`[^a-zA-Z0-9_-]` → `_`). Length cap and the empty fallback match the
+ * account bridge (MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$`).
+ * Callers that talk to the backend keep the original advertised name.
+ */
+
+/** MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$` for tool names. */
+export const MAX_MCP_TOOL_NAME_LENGTH = 128;
+
+/** Connector display names can contain anything (spaces, dots, emoji). */
+export function sanitizeMcpToolName(name: string): string {
+  const cleaned = name
+    .replace(/[^a-zA-Z0-9_-]/g, "_")
+    .slice(0, MAX_MCP_TOOL_NAME_LENGTH);
+  return cleaned === "" ? "tool" : cleaned;
+}
+
+/** `base` for the first claimant, `base_2` / `base_3` … for colliders. */
+export function suffixMcpToolName(base: string, index: number): string {
+  if (index === 0) {
+    return base;
+  }
+  const suffix = `_${index + 1}`;
+  return `${base.slice(0, MAX_MCP_TOOL_NAME_LENGTH - suffix.length)}${suffix}`;
+}

package/src/internal/sdk-runner.ts

@@ -55,6 +55,7 @@ export type RunnerPrewarmRequest = Pick<
   | "sandbox"
   | "tools"
   | "mcpServers"
+  | "perSendMcpServers"
   | "subagents"
   | "model"
 >;
@@ -159,6 +160,28 @@ export function isAuthErrorMessage(message: string | undefined): boolean {
   return /authentication error|try logging out and back in/i.test(message);
 }
 
+/** Cloud `wait()` copy for `stream_expired` / a missing start-state blob. */
+function isStreamExpiredErrorMessage(message: string | undefined): boolean {
+  if (message === undefined) {
+    return false;
+  }
+  return /run stream is no longer available|\[stream_expired\]/i.test(message);
+}
+
+function retryReason(
+  message: string | undefined,
+  isFirstTurn: boolean
+): string | undefined {
+  if (isStreamExpiredErrorMessage(message)) {
+    return "cloud run stream expired";
+  }
+  // First-turn auth is the credential; a fresh handle cannot fix it.
+  if (!isFirstTurn && isAuthErrorMessage(message)) {
+    return "authentication failure";
+  }
+  return undefined;
+}
+
 export class CursorSdkRunner implements AgentRunner {
   private readonly agents = new Map<string, CachedAgentHandle>();
   private readonly stores = new Map<string, Promise<LocalAgentStore>>();
@@ -187,26 +210,23 @@ export class CursorSdkRunner implements AgentRunner {
     const outcome = await this.runTurnAttempt(tracked);
     if (
       outcome.status !== "error" ||
-      !isAuthErrorMessage(outcome.errorMessage) ||
       sawUpdate ||
-      request.isFirstTurn ||
       request.signal?.aborted === true
     ) {
       return outcome;
     }
-    // The turn died on an authentication failure before producing any output
-    // — the signature of a handle whose exchanged access token expired (the
-    // failed attempt already evicted it). Retrying once on a fresh handle is
-    // safe here because nothing streamed and no tool ran. First turns are
-    // excluded: their token was exchanged moments ago, so the credential
-    // itself is the problem and a retry cannot succeed.
+    const reason = retryReason(outcome.errorMessage, request.isFirstTurn);
+    if (reason === undefined) {
+      return outcome;
+    }
+    // Log the original error even when the retry succeeds so the expiry
+    // still shows up in Datadog.
     this.log(
-      `[agent-sdk] session ${request.sessionId}: retrying the turn on a fresh SDK agent handle after an authentication failure`
+      `[agent-sdk] session ${request.sessionId}: ${reason}: ${outcome.errorMessage}; retrying the turn`
     );
     try {
       return await this.runTurnAttempt(tracked);
     } catch {
-      // The retry was best effort; report the original failure.
       return outcome;
     }
   }
@@ -235,6 +255,12 @@ export class CursorSdkRunner implements AgentRunner {
             // Stream mapping must never reject into the SDK transport.
           }
         },
+        // The SDK builds this send's MCP session from exactly this set, so
+        // a turn always runs on the headers the engine evaluated for it —
+        // never on the ones a previous turn opened the cached handle with.
+        ...(request.runtime === "local" && request.perSendMcpServers === true
+          ? { mcpServers: request.mcpServers as AgentOptions["mcpServers"] }
+          : {}),
         ...(request.runtime === "local"
           ? {
               local: {
@@ -270,6 +296,14 @@ export class CursorSdkRunner implements AgentRunner {
       if (request.onSdkAgentId !== undefined) {
         await request.onSdkAgentId(agent.agentId);
       }
+      // Readable on the handle as soon as send resolves, long before wait().
+      if (
+        request.onRequestId !== undefined &&
+        run.requestId !== undefined &&
+        run.requestId !== ""
+      ) {
+        await request.onRequestId(run.requestId);
+      }
       try {
         const result = await run.wait();
         let outcome = toTurnOutcome(result);
@@ -401,7 +435,12 @@ export class CursorSdkRunner implements AgentRunner {
     return {
       model: toModelSelection(request.model ?? DEFAULT_MODEL),
       apiKey: this.requireApiKey(),
-      ...(Object.keys(request.mcpServers).length > 0
+      // Per-send servers ride each agent.send instead (fresh per-session
+      // auth headers every turn). Keeping them out of the create/resume
+      // options also keeps the local executor cache key — which hashes
+      // these options — stable while credentials rotate.
+      ...(Object.keys(request.mcpServers).length > 0 &&
+      request.perSendMcpServers !== true
         ? { mcpServers: request.mcpServers as AgentOptions["mcpServers"] }
         : {}),
       ...(subagents === undefined ? {} : { agents: subagents }),

package/src/internal/server.ts

@@ -70,12 +70,14 @@ import {
   scmEventToGitHubPayload,
   scmMetadataToOriginPayload,
 } from "./cursor-event-relay.js";
+import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
 import {
   type CursorSlackAgentRegistration,
   CursorSlackRelay,
   createCursorSlackApiCaller,
   formatCursorSlackEventLog,
 } from "./cursor-slack-relay.js";
+import { buildAgentDeployManifest } from "./deploy-manifest.js";
 import {
   formatDiagnostics,
   hasErrorDiagnostics,
@@ -1111,6 +1113,23 @@ function mountAgentRoutes(
     handler: () => jsonResponse(projectInfo(project)),
   });
 
+  // Hosted-only: the control plane's provision flow reads the deploy manifest
+  // from the running engine (same derivation as `july manifest`) right after
+  // the health probe, so every deploy surface — CLI, UI, redeploy — gets its
+  // declarations from the installed code without a client-side extraction
+  // step. `auth: "none"` mirrors `/v1/health`: hosted engines are reachable
+  // only through the anyrun port proxy (network token) or the alias route
+  // (alias token), and the route is not registered outside hosted mode, so
+  // self-hosted `july serve` never exposes the manifest unauthenticated.
+  if (process.env[AGENT_SERVE_GENERATION_ENV_VAR] !== undefined) {
+    router.add({
+      method: "GET",
+      pattern: `${base}/v1/manifest`,
+      auth: "none",
+      handler: () => jsonResponse(buildAgentDeployManifest(project)),
+    });
+  }
+
   // Playground Logs tab: recent ServeOptions.logger lines (channels, sessions,
   // webhook capture). `after` is an exclusive index cursor for polling.
   router.add({