@cursor/july 0.1.83 → 0.1.85

package/src/internal/cursor-deployment-relay.ts

@@ -22,13 +22,13 @@ const DEFAULT_EVENTS: readonly DeploymentEventType[] = ["deployment.succeeded"];
 export type DeploymentRelayEvent = DeploymentEvent & { offset: string };
 
 export interface ResolvedSubscription {
-  repo: string;
+  deploySourceUri: string;
   environments: string[];
   events: Set<DeploymentEventType>;
 }
 
 interface SubscriptionStatus {
-  repo: string;
+  deploySourceUri: string;
   isSubscribed: boolean;
   detail?: string;
 }
@@ -44,22 +44,22 @@ export interface DeploymentEventRelayOptions {
   pollWaitMs?: number;
 }
 
-/** Normalize the channel's `repos` option into concrete subscriptions. */
+/** Normalize the channel's `deploySourceUris` option into concrete subscriptions. */
 export function resolveDeploymentSubscriptions(options: {
-  repos: readonly (string | DeploymentSubscription)[];
+  deploySourceUris: readonly (string | DeploymentSubscription)[];
   environments?: readonly string[];
   events?: readonly DeploymentEventType[];
 }): ResolvedSubscription[] {
-  const byRepo = new Map<string, ResolvedSubscription>();
-  for (const entry of options.repos) {
+  const bySource = new Map<string, ResolvedSubscription>();
+  for (const entry of options.deploySourceUris) {
     const subscription: DeploymentSubscription =
-      typeof entry === "string" ? { repo: entry } : entry;
-    // Case-folded only: `Deployment.repository` has no documented format, and
-    // the server keys subscriptions the same way.
-    const repo = subscription.repo.trim().toLowerCase();
-    if (repo === "") {
+      typeof entry === "string" ? { deploySourceUri: entry } : entry;
+    // Case-folded only: `Deployment.deploy_source_uri` has no documented
+    // format, and the server keys subscriptions the same way.
+    const deploySourceUri = subscription.deploySourceUri.trim().toLowerCase();
+    if (deploySourceUri === "") {
       throw new Error(
-        `deploymentsChannel: invalid repo "${subscription.repo}".`
+        `deploymentsChannel: invalid deploy source "${subscription.deploySourceUri}".`
       );
     }
     const environments = [
@@ -74,14 +74,14 @@ export function resolveDeploymentSubscriptions(options: {
     );
     if (events.size === 0) {
       throw new Error(
-        `deploymentsChannel: repo "${repo}" subscribes to no events.`
+        `deploymentsChannel: deploy source "${deploySourceUri}" subscribes to no events.`
       );
     }
-    // Later entries for the same repo widen the earlier one rather than
-    // silently replacing it.
-    const existing = byRepo.get(repo);
+    // Later entries for the same deploy source widen the earlier one rather
+    // than silently replacing it.
+    const existing = bySource.get(deploySourceUri);
     if (existing === undefined) {
-      byRepo.set(repo, { repo, environments, events });
+      bySource.set(deploySourceUri, { deploySourceUri, environments, events });
       continue;
     }
     for (const event of events) existing.events.add(event);
@@ -91,9 +91,10 @@ export function resolveDeploymentSubscriptions(options: {
         : [...new Set([...existing.environments, ...environments])];
   }
   // Empty is legal here and means "this channel wants nothing", which is how
-  // an env-configured channel stays inert without a repo list. The wire-level
-  // empty list means deregister, so the host simply never registers it.
-  return [...byRepo.values()];
+  // an env-configured channel stays inert without a deploy-source list. The
+  // wire-level empty list means deregister, so the host simply never
+  // registers it.
+  return [...bySource.values()];
 }
 
 /** Whether one confirmed subscription wants this event. */
@@ -136,7 +137,7 @@ export async function fanOutDeploymentEvent(input: {
   const matched = input.targets.filter((target) =>
     target.subscriptions.some(
       (subscription) =>
-        subscription.repo === event.repo &&
+        subscription.deploySourceUri === event.deploySourceUri &&
         deploymentEventMatches(subscription, event)
     )
   );
@@ -154,7 +155,7 @@ export async function fanOutDeploymentEvent(input: {
     }
   }
   logger(
-    `[agent-sdk] deployment-events: ${event.eventType} ${event.repo}@${event.sha} (${event.environment}) → ${matched.length - failures.length}/${matched.length} channel(s)`
+    `[agent-sdk] deployment-events: ${event.eventType} ${event.deploySourceUri}@${event.deployVersion} (${event.environment}) → ${matched.length - failures.length}/${matched.length} channel(s)`
   );
   if (failures.length > 0 && failures.length === matched.length) {
     throw new Error(
@@ -166,7 +167,7 @@ export async function fanOutDeploymentEvent(input: {
 export class DeploymentEventRelay {
   private readonly core: CursorRelayCore<DeploymentRelayEvent>;
   private subscribed = new Map<string, ResolvedSubscription>();
-  private readonly loggedSkippedRepos = new Set<string>();
+  private readonly loggedSkippedSources = new Set<string>();
 
   constructor(private readonly options: DeploymentEventRelayOptions) {
     const adapter: RelayAdapter<DeploymentRelayEvent> = {
@@ -176,7 +177,7 @@ export class DeploymentEventRelay {
       buildRegistrationBody: (consumerId) => ({
         consumerId,
         subscriptions: options.subscriptions.map((subscription) => ({
-          repo: subscription.repo,
+          deploySourceUri: subscription.deploySourceUri,
           environments: subscription.environments,
           events: [...subscription.events],
         })),
@@ -188,23 +189,24 @@ export class DeploymentEventRelay {
         subscriptions: [],
       }),
       applyRegistrationResponse: (json) => {
-        const result = json as { repos?: SubscriptionStatus[] };
+        const result = json as { deploySourceUris?: SubscriptionStatus[] };
         this.subscribed = new Map();
-        this.loggedSkippedRepos.clear();
+        this.loggedSkippedSources.clear();
         const lines: string[] = [];
         const confirmed: string[] = [];
-        for (const status of result.repos ?? []) {
+        for (const status of result.deploySourceUris ?? []) {
           const wanted = options.subscriptions.find(
-            (subscription) => subscription.repo === status.repo
+            (subscription) =>
+              subscription.deploySourceUri === status.deploySourceUri
           );
           if (!status.isSubscribed || wanted === undefined) {
             lines.push(
-              `not subscribed to ${status.repo}: ${status.detail ?? "unknown reason"}`
+              `not subscribed to ${status.deploySourceUri}: ${status.detail ?? "unknown reason"}`
             );
             continue;
           }
-          this.subscribed.set(status.repo, wanted);
-          confirmed.push(status.repo);
+          this.subscribed.set(status.deploySourceUri, wanted);
+          confirmed.push(status.deploySourceUri);
         }
         if (confirmed.length > 0) {
           const kinds = [
@@ -247,16 +249,16 @@ export class DeploymentEventRelay {
     if (
       envelope === null ||
       typeof envelope !== "object" ||
-      typeof envelope.repo !== "string"
+      typeof envelope.deploySourceUri !== "string"
     ) {
       return false;
     }
-    const subscription = this.subscribed.get(envelope.repo);
+    const subscription = this.subscribed.get(envelope.deploySourceUri);
     if (subscription === undefined) {
-      if (!this.loggedSkippedRepos.has(envelope.repo)) {
-        this.loggedSkippedRepos.add(envelope.repo);
+      if (!this.loggedSkippedSources.has(envelope.deploySourceUri)) {
+        this.loggedSkippedSources.add(envelope.deploySourceUri);
         this.options.logger(
-          `[agent-sdk] deployment-events: skipping events for ${envelope.repo}: not in this host's subscription (another consumer of this API key likely subscribed it)`
+          `[agent-sdk] deployment-events: skipping events for ${envelope.deploySourceUri}: not in this host's subscription (another consumer of this API key likely subscribed it)`
         );
       }
       return false;

package/src/internal/discovery.ts

@@ -59,6 +59,7 @@ import {
   type SkillDefinition,
   type SkillFileSource,
   type ToolDefinition,
+  type ToolEffect,
   toPublicCloudInfo,
 } from "../types.js";
 import { registerAuthoredModuleLoaders } from "./authored-loaders.js";
@@ -870,6 +871,7 @@ async function loadTools(
     const execution = tool.execution === "agent" ? "agent" : "server";
     const needsApprovalConfigured =
       tool.needsApproval === true || typeof tool.needsApproval === "function";
+    const effect = declaredEffect(tool);
     if (execution === "agent") {
       if (isBlank(tool.script)) {
         ctx.diagnostics.push({
@@ -935,6 +937,7 @@ async function loadTools(
       ...(outputSchema === undefined ? {} : { outputSchema }),
       execution,
       needsApproval: needsApprovalConfigured,
+      ...(effect === undefined ? {} : { effect }),
       ...(execution === "agent" && tool.script !== undefined
         ? { script: tool.script }
         : {}),
@@ -944,6 +947,23 @@ async function loadTools(
   return tools;
 }
 
+/**
+ * Static view of a tool's `effect` for the manifest: the literal when it is
+ * one, `"dynamic"` for a per-call predicate, `undefined` when undeclared. A
+ * malformed value is left undeclared rather than guessed — undeclared is the
+ * safe state (a dry run stubs it), where a guess could be the unsafe one.
+ */
+function declaredEffect(
+  tool: ToolDefinition
+): ToolEffect | "dynamic" | undefined {
+  if (typeof tool.effect === "function") {
+    return "dynamic";
+  }
+  return tool.effect === "read" || tool.effect === "write"
+    ? tool.effect
+    : undefined;
+}
+
 // ============================================================================
 // Skills
 // ============================================================================

package/src/internal/event-mapper.ts

@@ -88,7 +88,15 @@ export class TurnEventMapper {
   /** Per-parent-call accumulators for nested subagent streams. */
   private readonly nested = new Map<string, NestedAccumulators>();
 
-  constructor(private readonly emit: (payload: SessionEventPayload) => void) {}
+  /**
+   * @param isStubbed Reports whether a finished tool call was answered by the
+   * host rather than executed. The harness reports an answered call exactly
+   * like a real one, so the engine is the only place that knows.
+   */
+  constructor(
+    private readonly emit: (payload: SessionEventPayload) => void,
+    private readonly isStubbed: (callId: string) => boolean = () => false
+  ) {}
 
   /** Per-turn token usage summed across model steps. */
   get usage(): TurnUsage | undefined {
@@ -303,6 +311,7 @@ export class TurnEventMapper {
         toolName: description.toolName,
         output: result.output,
         isError: result.isError,
+        ...(this.isStubbed(callId) ? { stubbed: true as const } : {}),
         parentCallId,
       },
     });

package/src/internal/http-channel.ts

@@ -109,6 +109,7 @@ export function buildHttpChannelRoutes(args: {
         ...(body.state === undefined ? {} : { state: body.state as JsonValue }),
         ...(typeof body.title === "string" ? { title: body.title } : {}),
         ...(body.purpose === "eval" ? { purpose: "eval" as const } : {}),
+        ...(body.dryRun === true ? { dryRun: true } : {}),
         ...(workspaceFiles === undefined ? {} : { workspaceFiles }),
         ...(cloud === undefined ? {} : { cloud }),
       });

package/src/internal/mcp-endpoint.ts

@@ -312,6 +312,15 @@ function buildConnectionBridgeMcpServer(
     if (reason !== undefined) {
       return errorResult(reason);
     }
+    // The one tool path that never reaches `executeServerTool`, so it asks
+    // the policy itself.
+    const answer = engine.bridgedCallAnswer({
+      sessionId: sessionId ?? "",
+      toolName: request.params.name,
+    });
+    if (answer.answered) {
+      return sdkResultToMcpResult(answer.result);
+    }
     try {
       const result = await engine.host.mcp.callTool(
         connectionName,

package/src/internal/prompt-context.ts

@@ -39,17 +39,40 @@ export interface SessionContextInput {
    */
   channelKind?: string;
   environment: PromptEnvironment;
-  /** Injectable clock for tests; defaults to now. */
+  /**
+   * Injectable clock for tests; defaults to the mocked prompt time when
+   * `CURSOR_SDK_MOCK_PROMPT_TIME` is set, then to now.
+   */
   now?: Date;
 }
 
+/**
+ * Development-only override for the wall clock rendered into prompt content.
+ * Same variable the Cursor SDK harness reads for its prompt clock (the
+ * user-message <timestamp> prefix and user_info date), so one knob keeps the
+ * session context block and the harness-rendered clock consistent. Read on
+ * every render so a simulation harness can advance the instant between
+ * sessions. Never affects runtime clocks (schedules, reminders) or tools.
+ */
+const MOCK_PROMPT_TIME_ENV = "CURSOR_SDK_MOCK_PROMPT_TIME";
+
+function readMockPromptTimeFromEnv(): Date | undefined {
+  const raw = process.env[MOCK_PROMPT_TIME_ENV];
+  if (raw === undefined || raw === "") {
+    return undefined;
+  }
+  const parsed = new Date(raw);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+}
+
 export function buildSessionContextBlock(input: SessionContextInput): string {
+  const now = input.now ?? readMockPromptTimeFromEnv() ?? new Date();
   const lines = [
     "<agentkit_context>",
     `session: ${input.sessionId}`,
     `channel: ${input.channelId}`,
     `environment: ${input.environment}`,
-    `time: ${(input.now ?? new Date()).toISOString()}`,
+    `time: ${now.toISOString()}`,
     "</agentkit_context>",
   ];
   const presence = channelPresenceLine(input);

package/src/internal/review-comments.ts

@@ -690,10 +690,13 @@ async function postReviewViaHostGithub(
 /**
  * Ids of the inline comments a just-created review owns.
  *
- * `pulls.createReview` returns the review, not its comments, so they come
- * from the review-scoped listing. Scoping to the review matters: the
- * PR-wide list is ordered oldest-first and runs to thousands on a busy PR,
- * so the comments we just created are the ones a page cap would drop.
+ * `pulls.createReview` returns the review, not its comments.
+ * `listCommentsForReview` either omits those rows or returns them with
+ * `line` / `original_line` unset, so the line filter drops every id, the
+ * store records no findings, and the next run cannot judge or resolve
+ * those threads. Read the PR-wide list instead and keep only this
+ * review's rows. Newest-first so a busy PR's older comments cannot push
+ * ours past the page cap.
  * Best-effort: any failure yields an empty list, which costs the next run
  * its prior findings rather than risking a wrong id. Never throws — the
  * review is already posted by this point.
@@ -714,22 +717,29 @@ async function readPostedComments(args: {
     const posted: PostedReviewComment[] = [];
     for (let page = 1; page <= REVIEW_COMMENTS_MAX_PAGES; page++) {
       args.signal?.throwIfAborted();
-      const response = await args.octokit.rest.pulls.listCommentsForReview({
+      const response = await args.octokit.rest.pulls.listReviewComments({
         owner: args.owner,
         repo: args.repo,
         pull_number: args.prNumber,
-        review_id: args.reviewId,
+        sort: "created",
+        direction: "desc",
         per_page: REVIEW_COMMENTS_PAGE_SIZE,
         page,
       });
       for (const comment of response.data) {
+        if (comment.pull_request_review_id !== args.reviewId) {
+          continue;
+        }
         const line = comment.original_line ?? comment.line;
         if (line === null || line === undefined) {
           continue;
         }
         posted.push({ id: comment.id, file: comment.path, line });
       }
-      if (response.data.length < REVIEW_COMMENTS_PAGE_SIZE) {
+      if (
+        posted.length >= args.expected ||
+        response.data.length < REVIEW_COMMENTS_PAGE_SIZE
+      ) {
         break;
       }
     }

package/src/internal/server.ts

@@ -2291,7 +2291,7 @@ function collectCursorDeploymentTargets(
       }
       const subscriptions = resolveDeploymentSubscriptions(options);
       if (subscriptions.length === 0) {
-        // Declared the channel but named no repositories — usually an unset
+        // Declared the channel but named no deploy sources — usually an unset
         // env var. Say so rather than starting a relay that receives nothing.
         skipped.push(`${runtime.slug || runtime.project.name}/${channel.id}`);
         continue;
@@ -2305,7 +2305,7 @@ function collectCursorDeploymentTargets(
 /**
  * Cursor deployment-events relay: automatic when a mounted agent authored
  * `deploymentsChannel({ ... })`. One relay per process reads
- * `/v0/deployment-events` for the union of every channel's repositories, and
+ * `/v0/deployment-events` for the union of every channel's deploy sources, and
  * each event is routed to the channels that asked for it — the same ownership
  * `startCursorSlackRelay` and `startCursorEventRelay` have.
  */
@@ -2320,7 +2320,7 @@ function startCursorDeploymentRelay(input: {
   const targets = collectCursorDeploymentTargets(runtimes, skipped);
   if (skipped.length > 0) {
     logger(
-      `[agent-sdk] deployment-events: no repositories declared on ${skipped.join(", ")}; those channels receive nothing`
+      `[agent-sdk] deployment-events: no deploy sources declared on ${skipped.join(", ")}; those channels receive nothing`
     );
   }
   if (targets.length === 0) {
@@ -2328,19 +2328,19 @@ function startCursorDeploymentRelay(input: {
   }
   if (accountKey === undefined) {
     throw new Error(
-      `This project has channels subscribed to deployment events (deploymentsChannel({ repos })) but the host is not signed in to Cursor. ${SIGN_IN_HINT}`
+      `This project has channels subscribed to deployment events (deploymentsChannel({ deploySourceUris })) but the host is not signed in to Cursor. ${SIGN_IN_HINT}`
     );
   }
-  // Union across channels: one registration per repo for the whole process,
-  // however many channels named it. Per-channel environment and event-type
-  // filtering happens at dispatch.
-  const byRepo = new Map<string, ResolvedSubscription>();
+  // Union across channels: one registration per deploy source for the whole
+  // process, however many channels named it. Per-channel environment and
+  // event-type filtering happens at dispatch.
+  const bySource = new Map<string, ResolvedSubscription>();
   for (const target of targets) {
     for (const subscription of target.subscriptions) {
-      const existing = byRepo.get(subscription.repo);
+      const existing = bySource.get(subscription.deploySourceUri);
       if (existing === undefined) {
-        byRepo.set(subscription.repo, {
-          repo: subscription.repo,
+        bySource.set(subscription.deploySourceUri, {
+          deploySourceUri: subscription.deploySourceUri,
           environments: [...subscription.environments],
           events: new Set(subscription.events),
         });
@@ -2369,7 +2369,7 @@ function startCursorDeploymentRelay(input: {
     baseUrl: cursorExternalApiUrl(),
     apiKey: accountKey.apiKey,
     stateDir: join(baseStateRoot, "deployment-events"),
-    subscriptions: [...byRepo.values()],
+    subscriptions: [...bySource.values()],
     logger,
     dispatch: async (event) =>
       fanOutDeploymentEvent({
@@ -2392,7 +2392,7 @@ function startCursorDeploymentRelay(input: {
   });
   relay.start();
   logger(
-    `[agent-sdk] deployment-events: relaying ${byRepo.size} repository subscription(s) to ${targets.length} channel(s)`
+    `[agent-sdk] deployment-events: relaying ${bySource.size} deploy-source subscription(s) to ${targets.length} channel(s)`
   );
   return relay;
 }