@cursor/july 0.1.78 → 0.1.80

package/dist/internal/review-comments.d.ts

@@ -1,5 +1,5 @@
 import type { HostGitHubClient } from "../types.js";
-export type ReviewCommentPublisher = "local_gh" | "host_github";
+export type ReviewCommentPublisher = "local_gh" | "host_github" | "host_origin";
 export type ReviewCommentPostResult = {
     posted: boolean;
     publisher: ReviewCommentPublisher;
@@ -48,12 +48,24 @@ export type ReviewCommentPublisherImplementation = {
     postReview: (args: ReviewCommentPostArgs) => Promise<ReviewCommentPostResult>;
 };
 /**
- * SCMs this module can read review comments back from. Same growth seam as
- * `shallow-clone.ts`'s {@link import("./shallow-clone.js").ScmProvider}:
- * adding GitLab/Bitbucket/Origin means a resolver case plus a reader
- * implementation, and nothing above this line changes.
+ * SCMs this module can address. Same growth seam as `shallow-clone.ts`'s
+ * {@link import("./shallow-clone.js").ScmProvider}: adding a forge means a
+ * resolver case plus a publisher (and, when the public API supports it, a
+ * reader / thread resolver). Callers above this line stay provider-neutral.
  */
-export type ScmReviewProvider = "github";
+export type ScmReviewProvider = "github" | "origin";
+/**
+ * Origin public REST client used to post PR reviews (`ctx.origin` /
+ * {@link import("../channels/origin/api.js").createOriginClient}). Narrower
+ * than the full Origin handle so tests and CLI paths can inject `request()`.
+ */
+export type HostOriginReviewClient = {
+    request(input: {
+        method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
+        path: string;
+        body?: unknown;
+    }): Promise<unknown>;
+};
 /** Which SCM's PR to read review comments from. */
 export type ScmReviewTarget = {
     provider: ScmReviewProvider;
@@ -126,7 +138,7 @@ export type ResolveReviewThreadsResult = {
 export type ReviewThreadResolverImplementation = {
     resolveReviewThreadsForComments: (args: ResolveReviewThreadsArgs) => Promise<ResolveReviewThreadsResult>;
 };
-/** Parse a PR URL into the SCM target to read comments from. */
+/** Parse a PR URL into the SCM target to read or post comments on. */
 export declare function resolveScmReviewTarget(prUrl: string): ScmReviewTarget | undefined;
 /**
  * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
@@ -213,5 +225,23 @@ export declare function createLocalGhReviewPublisher(): ReviewCommentPublisherIm
  * cursorAccount })` is bound.
  */
 export declare function createHostGithubReviewPublisher(github: HostGitHubClient): ReviewCommentPublisherImplementation;
+/**
+ * Pick the publisher for `prUrl`'s SCM. GitHub falls back to local `gh`
+ * when no host client is bound (CLI). Origin has no local CLI publisher —
+ * returns undefined unless an Origin REST client is provided.
+ */
+export declare function createReviewCommentPublisher(args: {
+    prUrl: string;
+    github?: HostGitHubClient;
+    origin?: HostOriginReviewClient;
+}): ReviewCommentPublisherImplementation | undefined;
+/**
+ * Posts a COMMENT-verdict Origin review through the public REST API.
+ *
+ * Public Origin REST has no diff-anchored review comments (those are an
+ * internal CreateCommentThread RPC). Inline comments in the request are
+ * folded into the review body so findings still land on the PR.
+ */
+export declare function createHostOriginReviewPublisher(origin: HostOriginReviewClient): ReviewCommentPublisherImplementation;
 export {};
 //# sourceMappingURL=review-comments.d.ts.map

package/dist/internal/review-comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEzC,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iBAAiB,EAAE,CACjB,IAAI,EAAE,qBAAqB,KACxB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,eAAe,CAAC;IACxB,yDAAyD;IACzD,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,+BAA+B,EAAE,CAC/B,IAAI,EAAE,wBAAwB,KAC3B,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,SAAS,CAS7B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,iCAAiC,GAAG,SAAS,CAOhD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,kCAAkC,GAAG,SAAS,CAOjD;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,IAAI,EAAE;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,kCAAkC,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AASD;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,gBAAgB,GACvB,iCAAiC,CA6BnC;AA2BD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,gBAAgB,GACvB,kCAAkC,CAkHpC;AAkCD,KAAK,uBAAuB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,qBAAqB,GAAG,SAAS,CAoBnC;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gBAAgB,GACvB,oCAAoC,CAMtC"}
+{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,CAAC;AAEhF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,CAAC,KAAK,EAAE;QACb,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;QACpD,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,CAAC;AAEF,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iBAAiB,EAAE,CACjB,IAAI,EAAE,qBAAqB,KACxB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,eAAe,CAAC;IACxB,yDAAyD;IACzD,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,+BAA+B,EAAE,CAC/B,IAAI,EAAE,wBAAwB,KAC3B,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C,CAAC;AAEF,sEAAsE;AACtE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,SAAS,CAG7B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,iCAAiC,GAAG,SAAS,CAWhD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,kCAAkC,GAAG,SAAS,CASjD;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,IAAI,EAAE;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,kCAAkC,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA0BtC;AASD;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,gBAAgB,GACvB,iCAAiC,CA6BnC;AA2BD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,gBAAgB,GACvB,kCAAkC,CAkHpC;AAkCD,KAAK,uBAAuB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,qBAAqB,GAAG,SAAS,CAoBnC;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gBAAgB,GACvB,oCAAoC,CAMtC;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC,GAAG,oCAAoC,GAAG,SAAS,CAenD;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,sBAAsB,GAC7B,oCAAoC,CAMtC"}

package/dist/internal/review-comments.js

@@ -8,16 +8,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { spawn } from "node:child_process";
-/** Parse a PR URL into the SCM target to read comments from. */
+/** Parse a PR URL into the SCM target to read or post comments on. */
 export function resolveScmReviewTarget(prUrl) {
-    const parsed = parseGithubPrUrl(prUrl);
-    return parsed.kind === "valid"
-        ? {
-            provider: "github",
-            repo: parsed.value.repo,
-            prNumber: parsed.value.prNumber,
-        }
-        : undefined;
+    const parsed = parseReviewPrUrl(prUrl);
+    return parsed.kind === "valid" ? parsed.value : undefined;
 }
 /**
  * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
@@ -30,6 +24,10 @@ export function createReviewCommentReader(args) {
             return args.github === undefined
                 ? undefined
                 : createHostGithubReviewCommentReader(args.github);
+        case "origin":
+            // Public Origin REST lists discussion comments, not diff-anchored
+            // review threads. Stay undefined until a reader can fetch by id.
+            return undefined;
     }
 }
 /**
@@ -42,6 +40,8 @@ export function createReviewThreadResolver(args) {
             return args.github === undefined
                 ? undefined
                 : createHostGithubReviewThreadResolver(args.github);
+        case "origin":
+            return undefined;
     }
 }
 /**
@@ -66,7 +66,9 @@ export function resolveReviewThreadsForComments(args) {
             github: args.github,
         });
         if (resolver === undefined) {
-            return skippedResolve("no GitHub client bound to resolve threads");
+            return skippedResolve(target.provider === "github"
+                ? "no GitHub client bound to resolve threads"
+                : `no thread resolver for ${target.provider}`);
         }
         return resolver.resolveReviewThreadsForComments({
             target,
@@ -341,6 +343,43 @@ export function createHostGithubReviewPublisher(github) {
         },
     };
 }
+/**
+ * Pick the publisher for `prUrl`'s SCM. GitHub falls back to local `gh`
+ * when no host client is bound (CLI). Origin has no local CLI publisher —
+ * returns undefined unless an Origin REST client is provided.
+ */
+export function createReviewCommentPublisher(args) {
+    const target = resolveScmReviewTarget(args.prUrl);
+    if (target === undefined) {
+        return undefined;
+    }
+    switch (target.provider) {
+        case "github":
+            return args.github !== undefined
+                ? createHostGithubReviewPublisher(args.github)
+                : createLocalGhReviewPublisher();
+        case "origin":
+            return args.origin === undefined
+                ? undefined
+                : createHostOriginReviewPublisher(args.origin);
+    }
+}
+/**
+ * Posts a COMMENT-verdict Origin review through the public REST API.
+ *
+ * Public Origin REST has no diff-anchored review comments (those are an
+ * internal CreateCommentThread RPC). Inline comments in the request are
+ * folded into the review body so findings still land on the PR.
+ */
+export function createHostOriginReviewPublisher(origin) {
+    return {
+        postReview(args) {
+            return __awaiter(this, void 0, void 0, function* () {
+                return postReviewViaHostOrigin(origin, args);
+            });
+        },
+    };
+}
 function postReviewViaHostGithub(github, args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
@@ -523,6 +562,70 @@ function skippedHost(detail) {
         detail,
     };
 }
+function skippedOrigin(detail) {
+    return {
+        posted: false,
+        publisher: "host_origin",
+        mode: "skipped",
+        inlineCommentCount: 0,
+        detail,
+    };
+}
+function postReviewViaHostOrigin(origin, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const target = resolveScmReviewTarget(args.prUrl);
+        if (target === undefined || target.provider !== "origin") {
+            return skippedOrigin("host Origin publisher only supports Origin PRs");
+        }
+        const [owner, repo] = target.repo.split("/", 2);
+        if (owner === undefined || repo === undefined || repo === "") {
+            return skippedOrigin("unparseable owner/repo from PR URL");
+        }
+        try {
+            (_a = args.signal) === null || _a === void 0 ? void 0 : _a.throwIfAborted();
+            yield origin.request({
+                method: "POST",
+                path: `/v1/origin/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls/${target.prNumber}/reviews`,
+                body: {
+                    verdict: "comment",
+                    body: originReviewBody(args),
+                },
+            });
+            return {
+                posted: true,
+                publisher: "host_origin",
+                mode: "review_body_only",
+                inlineCommentCount: 0,
+                detail: `posted Origin review on ${target.repo}#${target.prNumber}`,
+            };
+        }
+        catch (error) {
+            if ((_b = args.signal) === null || _b === void 0 ? void 0 : _b.aborted) {
+                throw error;
+            }
+            return skippedOrigin(`host Origin review post failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+}
+/**
+ * Origin's public CreatePullRequestReview has a body, not inline comments.
+ * Fold attempted anchors into the summary so findings are not dropped.
+ */
+function originReviewBody(args) {
+    if (args.comments.length === 0) {
+        return args.message;
+    }
+    const sections = args.comments.map((comment) => {
+        const location = comment.start_line !== undefined &&
+            comment.start_line > 0 &&
+            comment.start_line !== comment.line
+            ? `${comment.file}:${comment.start_line}-${comment.line}`
+            : `${comment.file}:${comment.line}`;
+        return `### \`${location}\`\n\n${comment.body}`;
+    });
+    return [args.message, ...sections].join("\n\n");
+}
 function skippedResolve(detail) {
     return {
         requested: 0,
@@ -533,6 +636,102 @@ function skippedResolve(detail) {
         detail,
     };
 }
+const ORIGIN_PR_PAGE_HOST_PATTERN = /^origin(-[a-z0-9]+)?\.cursor\.com$/i;
+/**
+ * Provider-neutral PR URL parse. GitHub.com plus the Origin page shapes
+ * `parsePrTarget` in security-review-lib accepts. Duplicated here so
+ * agent-serve does not import that package.
+ */
+function parseReviewPrUrl(prUrl) {
+    let url;
+    try {
+        url = new URL(prUrl);
+    }
+    catch (error) {
+        return {
+            kind: "invalid",
+            detail: `unparseable PR URL: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    const parts = url.pathname.split("/").filter(Boolean);
+    const hostname = url.hostname;
+    if (hostname === "github.com" && parts.length >= 4 && parts[2] === "pull") {
+        const prNumber = Number(parts[3]);
+        if (Number.isInteger(prNumber) && prNumber > 0) {
+            return {
+                kind: "valid",
+                value: {
+                    provider: "github",
+                    repo: `${parts[0]}/${parts[1]}`,
+                    prNumber,
+                },
+            };
+        }
+    }
+    if (ORIGIN_PR_PAGE_HOST_PATTERN.test(hostname) &&
+        parts.length >= 4 &&
+        parts[2] === "github") {
+        const prNumber = Number(parts[3]);
+        if (Number.isInteger(prNumber) && prNumber > 0) {
+            return {
+                kind: "valid",
+                value: {
+                    provider: "origin",
+                    repo: `${parts[0]}/${parts[1]}`,
+                    prNumber,
+                },
+            };
+        }
+    }
+    if (/^(www\.)?cursor\.com$/i.test(hostname) &&
+        parts[0] === "codebase" &&
+        parts.length >= 5 &&
+        parts[3] === "pull") {
+        const prNumber = Number(parts[4]);
+        if (Number.isInteger(prNumber) && prNumber > 0) {
+            return {
+                kind: "valid",
+                value: {
+                    provider: "origin",
+                    repo: `${parts[1]}/${parts[2]}`,
+                    prNumber,
+                },
+            };
+        }
+    }
+    if (hostname === "review.cursor.com" && parts[0] === "pr") {
+        if (parts.length >= 5 && parts[3] === "github") {
+            const prNumber = Number(parts[4]);
+            if (Number.isInteger(prNumber) && prNumber > 0) {
+                return {
+                    kind: "valid",
+                    value: {
+                        provider: "origin",
+                        repo: `${parts[1]}/${parts[2]}`,
+                        prNumber,
+                    },
+                };
+            }
+        }
+        if (parts.length >= 4) {
+            const prNumber = Number(parts[3]);
+            if (Number.isInteger(prNumber) && prNumber > 0) {
+                return {
+                    kind: "valid",
+                    value: {
+                        provider: "origin",
+                        repo: `${parts[1]}/${parts[2]}`,
+                        prNumber,
+                    },
+                };
+            }
+        }
+    }
+    return {
+        kind: "invalid",
+        detail: "unparseable PR URL: not a GitHub or Origin pull request",
+    };
+}
 function parseGithubPrUrl(prUrl) {
     let url;
     try {

package/dist/internal/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAwHrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAwBpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAaD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAoxB3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwCH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAwHrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAwBpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAaD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAwzB3B"}

package/dist/internal/server.js

@@ -36,7 +36,7 @@ import { once } from "node:events";
 import { createServer, } from "node:http";
 import { join } from "node:path";
 import { dispatchDeploymentEvent, getDeploymentsChannelOptions, } from "../channels/deployments/deployments-channel.js";
-import { createCursorAccountGithubTokenResolver, getGithubCursorAccountRuntime, parseCursorGithubRepoScope, resolveCursorGithubPermissions, resolveCursorGithubProxyUrl, } from "../channels/github/cursor-account.js";
+import { createCursorAccountGithubTokenResolver, cursorGithubPermissionsForChannel, getGithubCursorAccountRuntime, resolveCursorGithubCredentialScope, resolveCursorGithubPermissions, resolveCursorGithubProxyUrl, } from "../channels/github/cursor-account.js";
 import { findGitHubChannelTargets } from "../channels/github/forward.js";
 import { getOriginCursorAccountRuntime, parseCursorOriginRepoScope, } from "../channels/origin/cursor-account.js";
 import { findOriginChannelTargets } from "../channels/origin/origin-channel.js";
@@ -160,53 +160,82 @@ export function startServer(mounts_1) {
             ? undefined
             : requireCursorEventsAuth(effectiveCursorEvents, accountKey);
         let cursorGithubCredentials;
-        if (cursorGithubConfig.scope !== undefined) {
-            if (cursorEventsAuth === undefined) {
-                throw new Error("githubChannel({ cursorAccount: true }) could not resolve Cursor event authentication.");
-            }
-            if (options.allowAnonymous === true) {
-                if (options.allowAnonymousCursorGithub !== true) {
-                    throw new Error("githubChannel({ cursorAccount: true }) cannot be served with --allow-anonymous because admitted callers could use the signed-in account's GitHub access. If every admitted caller is trusted (e.g. behind an SSO proxy), opt in with --allow-anonymous-cursor-github.");
+        if (cursorGithubTargets.length > 0) {
+            const githubProxyRequested = options.cursorGithubProxy === true;
+            const needsGithubAuth = cursorGithubConfig.scope !== undefined || githubProxyRequested;
+            if (needsGithubAuth) {
+                const cursorGithubAuth = cursorEventsAuth !== null && cursorEventsAuth !== void 0 ? cursorEventsAuth : ((accountKey === null || accountKey === void 0 ? void 0 : accountKey.apiKey) !== undefined && accountKey.apiKey.trim() !== ""
+                    ? {
+                        apiKey: accountKey.apiKey.trim(),
+                        baseUrl: cursorExternalApiUrl(),
+                    }
+                    : undefined);
+                if (cursorGithubAuth === undefined) {
+                    throw new Error("githubChannel({ cursorAccount: true }) could not resolve Cursor event authentication.");
                 }
-                logger("[agent-sdk] warning: --allow-anonymous-cursor-github — every admitted HTTP caller can drive sessions holding the signed-in account's repo-scoped GitHub credential; serve this only behind a trusted boundary (e.g. an SSO proxy)");
-            }
-            if (cursorGithubConfig.scope.permissions === "contents-write") {
-                logger('[agent-sdk] warning: Cursor GitHub credentials include contents:write — the host holds a push-capable token shared with model-driven tools and untrusted webhook content; prefer permissions: "pr-write" unless this agent must push code');
-            }
-            const provider = new CursorGithubCredentialProvider({
-                client: new CursorBackendClient({
-                    backendUrl: cursorEventsAuth.baseUrl,
-                    apiKey: cursorEventsAuth.apiKey,
-                    logger,
-                }),
-                scope: cursorGithubConfig.scope,
-                logger,
-            });
-            cursorGithubCredentials = provider;
-            const githubProxyUrl = options.cursorGithubProxy === true
-                ? resolveCursorGithubProxyUrl(cursorEventsAuth.baseUrl)
-                : undefined;
-            if (githubProxyUrl !== undefined) {
-                // Proxy mode: channel Octokit calls carry the Cursor API key to the
-                // backend forwarder, which swaps in the installation token server-side
-                // and logs every call with per-deployment attribution. The provider
-                // still runs so child `gh` processes get a `GH_TOKEN` lease (v1).
-                const proxyTransport = {
-                    apiBaseUrl: githubProxyUrl,
-                    headers: {
-                        "x-cursor-github-repos": cursorGithubConfig.scope.repos.join(","),
-                        "x-cursor-github-permissions": cursorGithubConfig.scope.permissions,
-                    },
-                };
-                for (const target of cursorGithubTargets) {
-                    target.accountRuntime.credentials.bind(() => __awaiter(this, void 0, void 0, function* () { return cursorEventsAuth.apiKey; }));
-                    target.accountRuntime.credentials.bindProxyTransport(proxyTransport);
+                if (options.allowAnonymous === true) {
+                    if (options.allowAnonymousCursorGithub !== true) {
+                        throw new Error("githubChannel({ cursorAccount: true }) cannot be served with --allow-anonymous because admitted callers could use the signed-in account's GitHub access. If every admitted caller is trusted (e.g. behind an SSO proxy), opt in with --allow-anonymous-cursor-github.");
+                    }
+                    logger("[agent-sdk] warning: --allow-anonymous-cursor-github — every admitted HTTP caller can drive sessions holding the signed-in account's repo-scoped GitHub credential; serve this only behind a trusted boundary (e.g. an SSO proxy)");
                 }
-                logger(`[agent-sdk] GitHub auth: channel API calls route through ${githubProxyUrl}`);
-            }
-            else {
-                for (const target of cursorGithubTargets) {
-                    target.accountRuntime.credentials.bind(() => provider.getToken());
+                if (cursorGithubConfig.permissions === "contents-write") {
+                    logger('[agent-sdk] warning: Cursor GitHub credentials include contents:write — the host holds a push-capable token shared with model-driven tools and untrusted webhook content; prefer permissions: "pr-write" unless this agent must push code');
+                }
+                const githubProxyUrl = githubProxyRequested
+                    ? resolveCursorGithubProxyUrl(cursorGithubAuth.baseUrl)
+                    : undefined;
+                if (cursorGithubConfig.scope !== undefined) {
+                    const provider = new CursorGithubCredentialProvider({
+                        client: new CursorBackendClient({
+                            backendUrl: cursorGithubAuth.baseUrl,
+                            apiKey: cursorGithubAuth.apiKey,
+                            logger,
+                        }),
+                        scope: cursorGithubConfig.scope,
+                        logger,
+                    });
+                    cursorGithubCredentials = provider;
+                    if (githubProxyUrl !== undefined) {
+                        // Proxy mode: channel Octokit calls carry the Cursor API key to the
+                        // backend forwarder, which swaps in the installation token server-side
+                        // and logs every call with per-deployment attribution. The provider
+                        // still runs so child `gh` processes get a `GH_TOKEN` lease (v1).
+                        const proxyTransport = {
+                            apiBaseUrl: githubProxyUrl,
+                            headers: {
+                                "x-cursor-github-repos": cursorGithubConfig.scope.repos.join(","),
+                                "x-cursor-github-permissions": cursorGithubConfig.permissions,
+                            },
+                        };
+                        for (const target of cursorGithubTargets) {
+                            target.accountRuntime.credentials.bind(() => __awaiter(this, void 0, void 0, function* () { return cursorGithubAuth.apiKey; }));
+                            target.accountRuntime.credentials.bindProxyTransport(proxyTransport);
+                        }
+                        logger(`[agent-sdk] GitHub auth: channel API calls route through ${githubProxyUrl}`);
+                    }
+                    else {
+                        for (const target of cursorGithubTargets) {
+                            target.accountRuntime.credentials.bind(() => provider.getToken());
+                        }
+                    }
+                }
+                else if (githubProxyUrl !== undefined) {
+                    // `cursorAccount: true` with no `--repo`: skip the startup token mint
+                    // (it requires a repo list) and let github-proxy take the repo from
+                    // each Octokit call. Hosted multi-tenant uses this with the
+                    // deployment event stream.
+                    const proxyTransport = {
+                        apiBaseUrl: githubProxyUrl,
+                        headers: {
+                            "x-cursor-github-permissions": cursorGithubConfig.permissions,
+                        },
+                    };
+                    for (const target of cursorGithubTargets) {
+                        target.accountRuntime.credentials.bind(() => __awaiter(this, void 0, void 0, function* () { return cursorGithubAuth.apiKey; }));
+                        target.accountRuntime.credentials.bindProxyTransport(proxyTransport);
+                    }
+                    logger(`[agent-sdk] GitHub auth: channel API calls route through ${githubProxyUrl} (repo scope per request)`);
                 }
             }
         }
@@ -1543,11 +1572,23 @@ function collectCursorGithubTargets(mounts) {
     }
     return targets;
 }
+function cursorGithubPermissionsForTarget(target) {
+    var _a;
+    var _b;
+    const authored = typeof target.accountRuntime.options.cursorAccount === "object"
+        ? target.accountRuntime.options.cursorAccount.permissions
+        : undefined;
+    return ((_b = (_a = target.accountRuntime.scope) === null || _a === void 0 ? void 0 : _a.permissions) !== null && _b !== void 0 ? _b : cursorGithubPermissionsForChannel(target.accountRuntime.options, authored));
+}
 function resolveCursorGithubEventConfig(input) {
     var _a;
     var _b;
     if (input.targets.length === 0) {
-        return { cursorEvents: input.configured, scope: undefined };
+        return {
+            cursorEvents: input.configured,
+            scope: undefined,
+            permissions: "pr-write",
+        };
     }
     const repos = [
         ...((_b = (_a = input.configured) === null || _a === void 0 ? void 0 : _a.repos) !== null && _b !== void 0 ? _b : []),
@@ -1555,11 +1596,19 @@ function resolveCursorGithubEventConfig(input) {
             ...((_b = (_a = target.accountRuntime.scope) === null || _a === void 0 ? void 0 : _a.repos) !== null && _b !== void 0 ? _b : []),
         ]; }),
     ];
-    const permissions = resolveCursorGithubPermissions(input.targets.map((target) => { var _a; var _b; return (_b = (_a = target.accountRuntime.scope) === null || _a === void 0 ? void 0 : _a.permissions) !== null && _b !== void 0 ? _b : "pr-write"; }));
-    const scope = parseCursorGithubRepoScope(repos, permissions);
+    const permissions = resolveCursorGithubPermissions(input.targets.map(cursorGithubPermissionsForTarget));
+    const scope = resolveCursorGithubCredentialScope(repos, permissions);
+    if (scope === undefined) {
+        return {
+            cursorEvents: input.configured,
+            scope: undefined,
+            permissions,
+        };
+    }
     return {
         cursorEvents: Object.assign(Object.assign({}, input.configured), { repos: [...scope.repos] }),
         scope,
+        permissions,
     };
 }
 function collectCursorOriginTargets(mounts) {
@@ -1591,6 +1640,9 @@ function resolveCursorOriginRepoScope(input) {
         ...(wantsHostRepos ? input.explicitRepos : []),
         ...input.targets.flatMap((target) => { var _a; var _b; return (_b = (_a = target.accountRuntime.scope) === null || _a === void 0 ? void 0 : _a.repos) !== null && _b !== void 0 ? _b : []; }),
     ];
+    if (repos.length === 0) {
+        return undefined;
+    }
     return parseCursorOriginRepoScope(repos);
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cursor/july",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "description": "(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {

package/src/channels/github/api.ts

@@ -20,6 +20,7 @@ import {
 import {
   type CursorAccountGithubTokenResolver,
   getCursorAccountGithubProxyTransport,
+  githubRepoFromOctokitRequest,
   isCursorAccountGithubTokenResolver,
 } from "./cursor-account.js";
 import type { GitHubChannelCredentials } from "./types.js";
@@ -121,6 +122,13 @@ export async function createGitHubOctokit(input: {
       request.headers.authorization = `Bearer ${token}`;
       if (proxyTransport !== undefined) {
         Object.assign(request.headers, proxyTransport.headers);
+        const existingRepos = request.headers["x-cursor-github-repos"];
+        if (typeof existingRepos !== "string" || existingRepos.trim() === "") {
+          const repo = githubRepoFromOctokitRequest(request);
+          if (repo !== undefined) {
+            request.headers["x-cursor-github-repos"] = repo;
+          }
+        }
       }
     });
     return octokit;

package/src/channels/github/cursor-account.ts

@@ -77,6 +77,62 @@ export function parseCursorGithubPermissions(
   );
 }
 
+/**
+ * `owner/repo` from an Octokit request, for github-proxy calls that have no
+ * static `x-cursor-github-repos` header (`cursorAccount: true` with no
+ * `--repo` / channel `{ repos }`).
+ */
+export function githubRepoFromOctokitRequest(request: {
+  owner?: unknown;
+  repo?: unknown;
+  url?: unknown;
+}): string | undefined {
+  if (typeof request.owner === "string" && typeof request.repo === "string") {
+    const slug = `${request.owner.trim()}/${request.repo.trim()}`.toLowerCase();
+    if (CURSOR_GITHUB_REPO_PATTERN.test(slug) && !slug.includes("..")) {
+      return slug;
+    }
+  }
+  if (typeof request.url !== "string") {
+    return undefined;
+  }
+  const match = request.url.match(/\/repos\/([^/?#]+)\/([^/?#]+)/);
+  const owner = match?.[1]?.trim() ?? "";
+  const repo = match?.[2]?.trim() ?? "";
+  if (
+    owner === "" ||
+    repo === "" ||
+    owner.includes("{") ||
+    repo.includes("{")
+  ) {
+    return undefined;
+  }
+  const slug = `${owner}/${repo}`.toLowerCase();
+  if (!CURSOR_GITHUB_REPO_PATTERN.test(slug) || slug.includes("..")) {
+    return undefined;
+  }
+  return slug;
+}
+
+/**
+ * Merge `--repo` / channel-declared repos into a lease scope. Empty is
+ * valid for `cursorAccount: true`: hosted engines that pull events from
+ * the deployment stream (no `--cursor-events --repo`) still start, and
+ * github-proxy fills `x-cursor-github-repos` per Octokit call.
+ */
+export function resolveCursorGithubCredentialScope(
+  values: readonly string[],
+  permissions: CursorGithubPermissions = "pr-write"
+): CursorGithubRepoScope | undefined {
+  const repos = [
+    ...new Set(values.map((repo) => repo.trim().toLowerCase()).filter(Boolean)),
+  ];
+  if (repos.length === 0) {
+    return undefined;
+  }
+  return parseCursorGithubRepoScope(repos, permissions);
+}
+
 export function parseCursorGithubRepoScope(
   values: readonly string[],
   permissions: CursorGithubPermissions = "pr-write"