@cursor/july 0.1.76 → 0.1.79

package/src/types.ts

@@ -240,31 +240,8 @@ export interface AgentConfig {
    * it only shapes what the model can call.
    */
   tools?: ToolName[];
-  /**
-   * How the serve host coordinates event delivery and turn execution. See
-   * {@link AgentServingMode}. Defaults to `"resident"`; opt in to
-   * `"ledger"` per agent — rollback is flipping the value back.
-   */
-  serving?: AgentServingMode;
 }
 
-/**
- * Serving coordination mode on {@link AgentConfig.serving}.
- *
- * - `"resident"` (default): the in-process session engine owns delivery —
- *   today's behavior, unchanged.
- * - `"ledger"`: every delivery coordinates through the KV session ledger
- *   before its turn runs: session identity, a one-writer-per-session
- *   lease with generation fencing, and a fenced commit sequence.
- *   Requires a store with conditional writes (the `cas` group on
- *   `defineStorage`, or an explicit CAS-capable override); startup fails
- *   fast otherwise. This stage is coordination only — there is no
- *   durable inbox yet, so an event arriving while the lease is held
- *   waits in-process and a crash loses it exactly as resident serving
- *   does. The durable mailbox lands in a follow-up.
- */
-export type AgentServingMode = "resident" | "ledger";
-
 /**
  * Built-in tools on {@link AgentConfig.builtinTools}. Each enabled
  * capability materializes as ordinary server tools at discovery time, so
@@ -596,14 +573,12 @@ export type KvCasResult =
   | { ok: false; current: KvVersionedEntry | undefined };
 
 /**
- * Conditional-write superset of {@link HostKvApi} for coordination
- * protocols (the upcoming session ledger). Version-token CAS was chosen
- * over compare-value: every candidate backend can mint a cheap opaque
- * token (counter, UUID, row version), while compare-value would force
- * deep JSON equality with key-order pitfalls on each of them. The
+ * Conditional-write superset of {@link HostKvApi}. Version-token CAS was
+ * chosen over compare-value: every candidate backend can mint a cheap
+ * opaque token (counter, UUID, row version), while compare-value would
+ * force deep JSON equality with key-order pitfalls on each of them. The
  * agent-facing `host.kv` stays plain {@link HostKvApi}; storage backends
- * supply CAS via the optional `cas` group on `defineStorage`, and
- * coordination features fail fast when the backend lacks it.
+ * supply CAS via the optional `cas` group on `defineStorage`.
  */
 export interface HostKvCasApi extends HostKvApi {
   /** Read one value with its version token. Miss → `undefined`. */
@@ -2574,11 +2549,6 @@ export interface ResolvedAgent {
   hosting?: AgentHostingOptions;
   /** Validated turn admission limits from {@link AgentConfig.concurrency}. */
   concurrency?: AgentConcurrencyOptions;
-  /**
-   * Validated serving mode from {@link AgentConfig.serving}. Undefined
-   * means `"resident"` (the default path).
-   */
-  serving?: AgentServingMode;
   tools: DiscoveredTool[];
   skills: DiscoveredSkill[];
   connections: DiscoveredConnection[];

package/templates/agentic-owners/agent/lib/owners/match.ts

@@ -1,6 +1,8 @@
 // Vendored from the Agentic Owners policy core; see README.md in this
 // directory. Precedence must stay identical to the source's.
 
+import { posix } from "node:path";
+import { AGENTIC_OWNERS_DIR } from "./constants.js";
 import { patternMatchesFile, patternSpecificity } from "./matching.js";
 import type {
   AgenticOwnersMatchedConfig,
@@ -12,10 +14,63 @@ type PathScopedRule = {
   readonly scopeDepth: number;
   readonly sourcePath: string;
   readonly paths: readonly string[];
-  /** Root-only absolute exemption, produced from `global_exclusions`. */
+  /** Root-only repository-wide exemption, produced from `global_exclusions`. */
   readonly globalExclusion?: boolean;
 };
 
+/**
+ * Convert a repository-relative changed path to the path seen by a policy.
+ *
+ * `foo/.agentic-owners/policy.yml` owns the `foo/` scope, so its `paths`
+ * entries match against filenames relative to `foo/`. Root policies continue
+ * to see repository-relative paths. Explicit leading `../` segments can
+ * address a sibling tree.
+ */
+function filepathRelativeToPolicyScope({
+  sourcePath,
+  filepath,
+}: {
+  sourcePath: string;
+  filepath: string;
+}): string {
+  const normalizedSourcePath = sourcePath.replace(/^\/+/, "");
+  const normalizedFilepath = filepath.replace(/^\/+/, "");
+  const marker = `/${AGENTIC_OWNERS_DIR}/`;
+  const markerIndex = normalizedSourcePath.lastIndexOf(marker);
+  if (markerIndex < 0) {
+    return normalizedFilepath;
+  }
+
+  const scope = normalizedSourcePath.slice(0, markerIndex);
+  return posix.relative(scope, normalizedFilepath);
+}
+
+function patternMatchesFileFromPolicy({
+  rule,
+  pattern,
+  filepath,
+}: {
+  rule: PathScopedRule;
+  pattern: string;
+  filepath: string;
+}): boolean {
+  const relativeFilepath = filepathRelativeToPolicyScope({
+    sourcePath: rule.sourcePath,
+    filepath,
+  });
+  const filepathIsOutsideScope =
+    relativeFilepath === ".." || relativeFilepath.startsWith("../");
+  if (filepathIsOutsideScope && !pattern.startsWith("../")) {
+    return false;
+  }
+  const slashlessPatternMatchesOnlyPolicyRoot =
+    pattern !== "**" && !pattern.includes("/");
+  if (slashlessPatternMatchesOnlyPolicyRoot && relativeFilepath.includes("/")) {
+    return false;
+  }
+  return patternMatchesFile(pattern, relativeFilepath);
+}
+
 function ruleMatchesFile({
   rule,
   filepath,
@@ -23,7 +78,13 @@ function ruleMatchesFile({
   rule: PathScopedRule;
   filepath: string;
 }): boolean {
-  return rule.paths.some((pattern) => patternMatchesFile(pattern, filepath));
+  return rule.paths.some((pattern) =>
+    patternMatchesFileFromPolicy({
+      rule,
+      pattern,
+      filepath,
+    })
+  );
 }
 
 function bestMatchingPatternSpecificity(
@@ -32,7 +93,7 @@ function bestMatchingPatternSpecificity(
 ): number {
   let best = 0;
   for (const pattern of rule.paths) {
-    if (patternMatchesFile(pattern, filepath)) {
+    if (patternMatchesFileFromPolicy({ rule, pattern, filepath })) {
       best = Math.max(best, patternSpecificity(pattern));
     }
   }

package/templates/agentic-owners/agent/lib/owners/parse.ts

@@ -120,6 +120,18 @@ function parsePaths(
     issues.push(`${label}: paths must not be empty`);
     return undefined;
   }
+  let hasInvalidPath = false;
+  for (const [index, path] of paths.entries()) {
+    if (path.startsWith("/")) {
+      issues.push(
+        `${label}[${index}]: path must be relative to the policy directory (no leading /)`
+      );
+      hasInvalidPath = true;
+    }
+  }
+  if (hasInvalidPath) {
+    return undefined;
+  }
   return paths;
 }
 
@@ -141,7 +153,15 @@ function parseGlobalExclusions({
     );
     return [];
   }
-  return parsePaths(value, `${sourcePath}: global_exclusions`, issues) ?? [];
+  const label = `${sourcePath}: global_exclusions`;
+  const paths = parsePaths(value, label, issues) ?? [];
+  validatePathsStayWithinRepository({
+    paths,
+    sourcePath,
+    label,
+    issues,
+  });
+  return paths;
 }
 
 function parsePromptPath(
@@ -335,6 +355,34 @@ function scopeDepthForConfigPath(configPath: string): number {
   return prefix.split("/").filter((segment) => segment !== "").length;
 }
 
+function validatePathsStayWithinRepository({
+  paths,
+  sourcePath,
+  label,
+  issues,
+}: {
+  paths: readonly string[];
+  sourcePath: string;
+  label: string;
+  issues: string[];
+}): void {
+  const scopeDepth = scopeDepthForConfigPath(sourcePath);
+  for (const [index, path] of paths.entries()) {
+    const segments = path.split("/");
+    let parentSegments = 0;
+    while (segments[parentSegments] === "..") {
+      parentSegments += 1;
+    }
+    if (segments.slice(parentSegments).includes("..")) {
+      issues.push(
+        `${label}[${index}]: .. segments must precede the path pattern`
+      );
+    } else if (parentSegments > scopeDepth) {
+      issues.push(`${label}[${index}]: path escapes the repository root`);
+    }
+  }
+}
+
 function parsePolicyRecord({
   record,
   sourcePath,
@@ -417,6 +465,12 @@ function parsePolicyRecord({
   }
 
   const scopeDepth = scopeDepthForConfigPath(sourcePath);
+  validatePathsStayWithinRepository({
+    paths,
+    sourcePath,
+    label: `${label}.paths`,
+    issues,
+  });
 
   if (
     alwaysApprove &&

package/templates/agentic-owners/agent/lib/owners/types.ts

@@ -12,6 +12,11 @@ export type AgenticOwnersPathRule = {
    * no owners, so they never enroll a review.
    */
   readonly globalExclusion?: boolean;
+  /**
+   * Glob patterns relative to the directory containing `.agentic-owners`.
+   * Root-policy paths are relative to the repository root.
+   * Leading `../` segments may address sibling trees but cannot leave the repo.
+   */
   readonly paths: readonly string[];
   /**
    * Team slugs (or `org/team` handles) that own these paths. A policy may