@cursor/july 0.1.68 → 0.1.74

package/src/internal/review-comments.ts

@@ -9,6 +9,21 @@ export type ReviewCommentPostResult = {
   mode: "review_with_inline_comments" | "review_body_only" | "skipped";
   inlineCommentCount: number;
   detail: string;
+  /**
+   * Ids of the inline comments this post created, when the publisher could
+   * read them back. Callers that later re-read a PR's comments use these as
+   * the provenance allowlist: a comment id we did not create is not ours,
+   * no matter what its body looks like. Empty when the publisher cannot
+   * resolve them (it never guesses).
+   */
+  postedComments?: PostedReviewComment[];
+};
+
+/** One inline comment this agent created, as the SCM assigned it. */
+export type PostedReviewComment = {
+  id: number;
+  file: string;
+  line: number;
 };
 
 export type ReviewInlineComment = {
@@ -41,6 +56,175 @@ export type ReviewCommentPublisherImplementation = {
   postReview: (args: ReviewCommentPostArgs) => Promise<ReviewCommentPostResult>;
 };
 
+/**
+ * SCMs this module can read review comments back from. Same growth seam as
+ * `shallow-clone.ts`'s {@link import("./shallow-clone.js").ScmProvider}:
+ * adding GitLab/Bitbucket/Origin means a resolver case plus a reader
+ * implementation, and nothing above this line changes.
+ */
+export type ScmReviewProvider = "github";
+
+/** Which SCM's PR to read review comments from. */
+export type ScmReviewTarget = {
+  provider: ScmReviewProvider;
+  /** `owner/name`. */
+  repo: string;
+  prNumber: number;
+};
+
+/**
+ * One existing inline review comment, provider-neutral.
+ *
+ * Field names follow Bugbot's `ExistingInlineComment`
+ * (`backend/server/src/bugbot/review/applyBugbotPRReview.ts`), which is the
+ * shape its resolution judge consumes after normalizing each provider's
+ * `getPRComments` output — so the same review logic reads the same way here.
+ */
+export type ExistingReviewComment = {
+  id: number;
+  file: string;
+  startLine: number;
+  endLine: number;
+  body: string;
+};
+
+export type GetReviewCommentsArgs = {
+  target: ScmReviewTarget;
+  /** Comment ids to fetch; ids the SCM no longer has are omitted. */
+  commentIds: readonly number[];
+  signal?: AbortSignal;
+};
+
+/**
+ * Read side of the review-comment seam, mirroring
+ * {@link ReviewCommentPublisherImplementation}. Bugbot's equivalent is
+ * `IGitProvider.getPRComments`.
+ *
+ * By id rather than by listing: callers only ever want comments they
+ * recorded creating, and a busy PR's comment list runs to thousands, where
+ * any page cap silently drops exactly the older comments a re-review needs.
+ */
+export type ReviewCommentReaderImplementation = {
+  getReviewComments: (
+    args: GetReviewCommentsArgs
+  ) => Promise<ExistingReviewComment[]>;
+};
+
+/** Parse a PR URL into the SCM target to read comments from. */
+export function resolveScmReviewTarget(
+  prUrl: string
+): ScmReviewTarget | undefined {
+  const parsed = parseGithubPrUrl(prUrl);
+  return parsed.kind === "valid"
+    ? {
+        provider: "github",
+        repo: parsed.value.repo,
+        prNumber: parsed.value.prNumber,
+      }
+    : undefined;
+}
+
+/**
+ * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
+ * dispatch. Returns undefined when the host cannot serve that provider (no
+ * GitHub client bound), so callers degrade instead of throwing.
+ */
+export function createReviewCommentReader(args: {
+  target: ScmReviewTarget;
+  github?: HostGitHubClient;
+}): ReviewCommentReaderImplementation | undefined {
+  switch (args.target.provider) {
+    case "github":
+      return args.github === undefined
+        ? undefined
+        : createHostGithubReviewCommentReader(args.github);
+  }
+}
+
+/** Cap on pages pulled per PR; GitHub serves 100 comments per page. */
+const REVIEW_COMMENTS_MAX_PAGES = 5;
+const REVIEW_COMMENTS_PAGE_SIZE = 100;
+
+/**
+ * Reads inline review comments through the host GitHub client (Cursor
+ * account lease, App installation token, or PAT).
+ */
+export function createHostGithubReviewCommentReader(
+  github: HostGitHubClient
+): ReviewCommentReaderImplementation {
+  return {
+    async getReviewComments({ target, commentIds, signal }) {
+      const [owner, repo] = target.repo.split("/", 2);
+      if (owner === undefined || repo === undefined || repo === "") {
+        return [];
+      }
+      const octokit = await github.getOctokit();
+      const comments: ExistingReviewComment[] = [];
+      for (const commentId of commentIds) {
+        signal?.throwIfAborted();
+        try {
+          const response = await octokit.rest.pulls.getReviewComment({
+            owner,
+            repo,
+            comment_id: commentId,
+          });
+          const normalized = normalizeGithubReviewComment(response.data);
+          if (normalized !== undefined) {
+            comments.push(normalized);
+          }
+        } catch {
+          // Deleted or otherwise unreadable: that finding simply has no
+          // prior text to judge, which is the same as it not being there.
+        }
+      }
+      return comments;
+    },
+  };
+}
+
+type GithubReviewCommentLike = {
+  id: number;
+  path: string;
+  body: string;
+  line?: number | null;
+  start_line?: number | null;
+  original_line?: number | null;
+  original_start_line?: number | null;
+};
+
+/**
+ * GitHub review comment → {@link ExistingReviewComment}.
+ *
+ * Prefers the `original_*` fields — the path/lines/commit as of the review
+ * the comment belongs to. `line` drifts as the PR gains commits, so a
+ * caller correlating a comment with the review that produced it needs the
+ * original position, the same fields Bugbot carries on
+ * `PullRequestCommentOutput`.
+ */
+export function normalizeGithubReviewComment(
+  comment: GithubReviewCommentLike
+): ExistingReviewComment | undefined {
+  // Take both lines from the same position set. Mixing them (original end
+  // line with the drifted current start line) would describe a range that
+  // never existed in either revision.
+  const original = comment.original_line ?? undefined;
+  const endLine = original ?? comment.line ?? undefined;
+  if (endLine === undefined || endLine === null) {
+    return undefined;
+  }
+  const startLine =
+    (original === undefined
+      ? comment.start_line
+      : comment.original_start_line) ?? endLine;
+  return {
+    id: comment.id,
+    file: comment.path,
+    startLine,
+    endLine,
+    body: comment.body,
+  };
+}
+
 type ParsedGithubPrUrl = {
   repo: string;
   prNumber: number;
@@ -148,6 +332,15 @@ async function postReviewViaHostGithub(
       detail: htmlUrl
         ? `posted via host GitHub: ${htmlUrl}`
         : `posted via host GitHub with ${inlineCommentCount} inline comment(s)`,
+      postedComments: await readPostedComments({
+        octokit,
+        owner,
+        repo,
+        prNumber: request.prNumber,
+        reviewId: response.data.id,
+        expected: inlineCommentCount,
+        signal: args.signal,
+      }),
     };
   } catch (error) {
     if (args.signal?.aborted) {
@@ -159,6 +352,58 @@ async function postReviewViaHostGithub(
   }
 }
 
+/**
+ * Ids of the inline comments a just-created review owns.
+ *
+ * `pulls.createReview` returns the review, not its comments, so they come
+ * from the review-scoped listing. Scoping to the review matters: the
+ * PR-wide list is ordered oldest-first and runs to thousands on a busy PR,
+ * so the comments we just created are the ones a page cap would drop.
+ * Best-effort: any failure yields an empty list, which costs the next run
+ * its prior findings rather than risking a wrong id. Never throws — the
+ * review is already posted by this point.
+ */
+async function readPostedComments(args: {
+  octokit: Awaited<ReturnType<HostGitHubClient["getOctokit"]>>;
+  owner: string;
+  repo: string;
+  prNumber: number;
+  reviewId: number;
+  expected: number;
+  signal?: AbortSignal;
+}): Promise<PostedReviewComment[]> {
+  if (args.expected === 0) {
+    return [];
+  }
+  try {
+    const posted: PostedReviewComment[] = [];
+    for (let page = 1; page <= REVIEW_COMMENTS_MAX_PAGES; page++) {
+      args.signal?.throwIfAborted();
+      const response = await args.octokit.rest.pulls.listCommentsForReview({
+        owner: args.owner,
+        repo: args.repo,
+        pull_number: args.prNumber,
+        review_id: args.reviewId,
+        per_page: REVIEW_COMMENTS_PAGE_SIZE,
+        page,
+      });
+      for (const comment of response.data) {
+        const line = comment.original_line ?? comment.line;
+        if (line === null || line === undefined) {
+          continue;
+        }
+        posted.push({ id: comment.id, file: comment.path, line });
+      }
+      if (response.data.length < REVIEW_COMMENTS_PAGE_SIZE) {
+        break;
+      }
+    }
+    return posted;
+  } catch {
+    return [];
+  }
+}
+
 async function postReviewViaLocalGh(
   args: ReviewCommentPostArgs
 ): Promise<ReviewCommentPostResult> {

package/src/internal/sanitize-mcp-tool-name.ts

@@ -0,0 +1,33 @@
+/**
+ * MCP tool-name sanitization shared by the Cursor-account bridge
+ * (`account-mcp.ts`) and advertised connections (`advertise-tools.ts`).
+ *
+ * Connector display names — and the aggregate `/v1/agent/mcp` names minted
+ * from them (`<serverIdentifier>-<tool>`) — can contain spaces, dots, and
+ * other characters that are illegal as the tool name a model sees.
+ *
+ * Character class matches `packages/agent` `normalizeMcpToolName`
+ * (`[^a-zA-Z0-9_-]` → `_`). Length cap and the empty fallback match the
+ * account bridge (MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$`).
+ * Callers that talk to the backend keep the original advertised name.
+ */
+
+/** MCP clients commonly enforce `^[a-zA-Z0-9_-]{1,128}$` for tool names. */
+export const MAX_MCP_TOOL_NAME_LENGTH = 128;
+
+/** Connector display names can contain anything (spaces, dots, emoji). */
+export function sanitizeMcpToolName(name: string): string {
+  const cleaned = name
+    .replace(/[^a-zA-Z0-9_-]/g, "_")
+    .slice(0, MAX_MCP_TOOL_NAME_LENGTH);
+  return cleaned === "" ? "tool" : cleaned;
+}
+
+/** `base` for the first claimant, `base_2` / `base_3` … for colliders. */
+export function suffixMcpToolName(base: string, index: number): string {
+  if (index === 0) {
+    return base;
+  }
+  const suffix = `_${index + 1}`;
+  return `${base.slice(0, MAX_MCP_TOOL_NAME_LENGTH - suffix.length)}${suffix}`;
+}

package/src/internal/sdk-runner.ts

@@ -14,12 +14,12 @@ import {
   type CloudAgentOptions,
   Cursor,
   createAgentPlatform,
-  JsonlLocalAgentStore,
   type LocalAgentStore,
   type ModelSelection,
   type RunResult,
   type SDKAgent,
 } from "@cursor/sdk";
+import { SqliteLocalAgentStore } from "@cursor/sdk/sqlite";
 import {
   DEFAULT_MODEL,
   type ModelSetting,
@@ -558,8 +558,11 @@ export class CursorSdkRunner implements AgentRunner {
   private getStore(stateDir: string): Promise<LocalAgentStore> {
     let storePromise = this.stores.get(stateDir);
     if (storePromise === undefined) {
-      storePromise = mkdir(stateDir, { recursive: true }).then(
-        () => new JsonlLocalAgentStore(stateDir)
+      storePromise = mkdir(stateDir, { recursive: true }).then(() =>
+        SqliteLocalAgentStore.open({
+          stateRoot: stateDir,
+          workspaceRef: stateDir,
+        })
       );
       this.stores.set(stateDir, storePromise);
     }

package/src/internal/session-engine.ts

@@ -2327,6 +2327,13 @@ export class SessionEngine {
       tools[tool.name] = {
         description: tool.description,
         inputSchema: tool.inputSchema as SDKCustomTool["inputSchema"],
+        // `SDKCustomTool.outputSchema` ships in the next published
+        // @cursor/sdk; the conditional spread carries the field through the
+        // pinned SDK's type until the dependency bumps, at which point local
+        // runs start advertising it.
+        ...(tool.outputSchema === undefined
+          ? {}
+          : { outputSchema: tool.outputSchema }),
         execute: async (args, context) => {
           return this.executeServerTool({
             tool,