@cursor/july 0.1.89 → 0.1.91

package/src/internal/sdk-runner.ts

@@ -29,6 +29,7 @@ import {
   type TurnUsage,
 } from "../types.js";
 import { mapSdkTokenUsage, usageTokenSum } from "./cloud-turn-cost.js";
+import { resolveApiKeySync } from "./cursor/credentials.js";
 
 /** Internal seam between the session engine and the Cursor SDK harness. */
 export interface AgentRunner {
@@ -427,14 +428,19 @@ export class CursorSdkRunner implements AgentRunner {
     (this.options.logger ?? (() => {}))(line);
   }
 
+  /**
+   * Re-resolve on every turn. Hosted freeze snapshots listen unsigned; the
+   * binder drops `CURSOR_API_KEY` / `CURSOR_API_KEY_FILE` at task time into
+   * the already-running process, which must not have closed over `undefined`.
+   */
   private requireApiKey(): string {
-    const apiKey = this.options.apiKey ?? process.env.CURSOR_API_KEY;
-    if (apiKey === undefined || apiKey.trim() === "") {
+    const resolved = resolveApiKeySync({ apiKey: this.options.apiKey });
+    if (resolved === undefined) {
       throw new Error(
-        "The Cursor SDK runner requires a Cursor credential: run `agent-serve login`, set CURSOR_API_KEY, or pass serve({ apiKey })."
+        "The Cursor SDK runner requires a Cursor credential: run `agent-serve login`, set CURSOR_API_KEY or CURSOR_API_KEY_FILE, or pass serve({ apiKey })."
       );
     }
-    return apiKey;
+    return resolved.apiKey;
   }
 
   private buildSharedOptions(

package/src/internal/server.ts

@@ -64,9 +64,11 @@ import {
 } from "./cursor/account-mcp.js";
 import { CursorBackendClient } from "./cursor/backend-client.js";
 import {
+  cursorBackendUrl,
   cursorExternalApiUrl,
   type ResolvedApiKey,
   resolveApiKey,
+  resolveApiKeySync,
   SIGN_IN_HINT,
 } from "./cursor/credentials.js";
 import { CursorGithubCredentialProvider } from "./cursor/github-credentials.js";
@@ -281,9 +283,9 @@ export async function startServer(
   const runSchedules = options.schedules ?? !dev;
   const runReminders = options.reminders ?? !dev;
 
-  // Identify this process to the Cursor backend as agentkit (the SDK reads
-  // this when building its client-version header) so the internal-only
-  // agentkit_enabled gate applies to every turn.
+  // CURSOR_AGENTKIT_VERSION is still the env the SDK reads when building
+  // its client-version header (wire prefix remains `agentkit-`). Setting it
+  // here makes the internal-only agentkit_enabled gate apply to every turn.
   process.env.CURSOR_AGENTKIT_VERSION ??= packageVersion();
 
   const authoredOtel = pickAuthoredOtel(
@@ -328,10 +330,18 @@ export async function startServer(
 
   // One resolution for every Cursor credential consumer (SDK runner, account
   // MCP bridge, SCM event relay, GitHub credentials): explicit option →
-  // CURSOR_API_KEY → stored `agent-serve login`.
+  // CURSOR_API_KEY → CURSOR_API_KEY_FILE (or the hosted default path) →
+  // stored `agent-serve login`. SDK / GitHub / account MCP re-read later;
+  // Slack and deployment-event relays capture the key at start.
   const accountKey = await resolveApiKey(
     options.apiKey === undefined ? {} : { apiKey: options.apiKey }
   );
+  // First present source wins (we define the order): option → env → file →
+  // stored login. Re-read so bind can drop env or file onto a listening process.
+  const liveCursorApiKey = (): string | undefined =>
+    resolveApiKeySync(
+      options.apiKey === undefined ? {} : { apiKey: options.apiKey }
+    )?.apiKey;
 
   // The SCM relay reads the event stream as the signed-in user, so
   // `cursorEvents` cannot work signed out. Require the credential before any
@@ -365,15 +375,15 @@ export async function startServer(
     const needsGithubAuth =
       cursorGithubConfig.scope !== undefined || githubProxyRequested;
     if (needsGithubAuth) {
-      const cursorGithubAuth =
-        cursorEventsAuth ??
-        (accountKey?.apiKey !== undefined && accountKey.apiKey.trim() !== ""
-          ? {
-              apiKey: accountKey.apiKey.trim(),
-              baseUrl: cursorExternalApiUrl(),
-            }
-          : undefined);
-      if (cursorGithubAuth === undefined) {
+      const currentGithubApiKey = (): string | undefined => {
+        const fromEvents = cursorEventsAuth?.apiKey.trim();
+        if (fromEvents !== undefined && fromEvents !== "") {
+          return fromEvents;
+        }
+        return liveCursorApiKey();
+      };
+      const githubApiKeyNow = currentGithubApiKey();
+      if (githubApiKeyNow === undefined && options.allowAnonymous !== true) {
         throw new Error(
           "githubChannel({ cursorAccount: true }) could not resolve Cursor event authentication."
         );
@@ -387,20 +397,39 @@ export async function startServer(
         logger(
           "[agent-sdk] warning: --allow-anonymous-cursor-github — every admitted HTTP caller can drive sessions holding the signed-in account's repo-scoped GitHub credential; serve this only behind a trusted boundary (e.g. an SSO proxy)"
         );
+        if (githubApiKeyNow === undefined) {
+          logger(
+            "[agent-sdk] GitHub auth: listening unsigned; credentials bind at task via CURSOR_API_KEY or CURSOR_API_KEY_FILE"
+          );
+        }
       }
       if (cursorGithubConfig.permissions === "contents-write") {
         logger(
           '[agent-sdk] warning: Cursor GitHub credentials include contents:write — the host holds a push-capable token shared with model-driven tools and untrusted webhook content; prefer permissions: "pr-write" unless this agent must push code'
         );
       }
+      const githubAuthBaseUrl = cursorExternalApiUrl();
+      const requireGithubApiKey = async (): Promise<string> => {
+        const apiKey = currentGithubApiKey();
+        if (apiKey === undefined) {
+          throw new Error(
+            `githubChannel({ cursorAccount: true }) has no Cursor credential yet. ${SIGN_IN_HINT}`
+          );
+        }
+        return apiKey;
+      };
       const githubProxyUrl = githubProxyRequested
-        ? resolveCursorGithubProxyUrl(cursorGithubAuth.baseUrl)
+        ? resolveCursorGithubProxyUrl(githubAuthBaseUrl)
         : undefined;
-      if (cursorGithubConfig.scope !== undefined) {
+      if (
+        cursorGithubConfig.scope !== undefined &&
+        githubApiKeyNow !== undefined
+      ) {
         const provider = new CursorGithubCredentialProvider({
           client: new CursorBackendClient({
-            backendUrl: cursorGithubAuth.baseUrl,
-            apiKey: cursorGithubAuth.apiKey,
+            backendUrl: githubAuthBaseUrl,
+            apiKey: githubApiKeyNow,
+            getApiKey: () => currentGithubApiKey() ?? "",
             logger,
           }),
           scope: cursorGithubConfig.scope,
@@ -420,9 +449,7 @@ export async function startServer(
             },
           };
           for (const target of cursorGithubTargets) {
-            target.accountRuntime.credentials.bind(
-              async () => cursorGithubAuth.apiKey
-            );
+            target.accountRuntime.credentials.bind(requireGithubApiKey);
             target.accountRuntime.credentials.bindProxyTransport(
               proxyTransport
             );
@@ -438,8 +465,8 @@ export async function startServer(
       } else if (githubProxyUrl !== undefined) {
         // `cursorAccount: true` with no `--repo`: skip the startup token mint
         // (it requires a repo list) and let github-proxy take the repo from
-        // each Octokit call. Hosted multi-tenant uses this with the
-        // deployment event stream.
+        // each Octokit call. Hosted freeze bakes this flag into the template
+        // so restore is GitHub-ready once Bind drops the key.
         const proxyTransport = {
           apiBaseUrl: githubProxyUrl,
           headers: {
@@ -447,16 +474,14 @@ export async function startServer(
           },
         };
         for (const target of cursorGithubTargets) {
-          target.accountRuntime.credentials.bind(
-            async () => cursorGithubAuth.apiKey
-          );
+          target.accountRuntime.credentials.bind(requireGithubApiKey);
           target.accountRuntime.credentials.bindProxyTransport(proxyTransport);
         }
         // `ctx.host.github` gets the same proxy transport; without this it
         // would fall back to ambient auth (env token / `gh`) or an
         // unauthenticated Octokit, and every host GitHub call would 404.
         hostGithubProxyResolver = createCursorGithubProxyHostResolver({
-          getApiKey: async () => cursorGithubAuth.apiKey,
+          getApiKey: requireGithubApiKey,
           transport: proxyTransport,
         });
         logger(
@@ -496,7 +521,12 @@ export async function startServer(
   }
   const sdkRunner =
     options.runner ??
-    new CursorSdkRunner({ apiKey: accountKey?.apiKey, logger });
+    new CursorSdkRunner({
+      ...(options.apiKey === undefined || options.apiKey.trim() === ""
+        ? {}
+        : { apiKey: options.apiKey }),
+      logger,
+    });
   // Grok Bot turns run on Cursor's hosted Grok Bot (Sand) harness through
   // the /v0/grokbot session API; the SDK side is a thin remote client. The
   // dispatching runner is only interposed when a mount needs it. An
@@ -521,7 +551,16 @@ export async function startServer(
   if (hasGrokBotMounts && options.runner === undefined) {
     runner = new RuntimeDispatchingRunner({
       sdkRunner,
-      grokbot: { apiKey: accountKey?.apiKey },
+      grokbot: {
+        ...(options.apiKey === undefined || options.apiKey.trim() === ""
+          ? {}
+          : { apiKey: options.apiKey }),
+        // `/v0/grokbot` lives on the external API (api.cursor.com), not
+        // api2. Prefer that default over the account key's backendUrl.
+        // Do not pass stored login as apiKey: that would pin it as an
+        // option and beat a later CURSOR_API_KEY_FILE bind.
+        backendUrl: cursorExternalApiUrl(),
+      },
     });
     logger(
       "[agent-sdk] grokbot runtime: remote client (turns run on the hosted Grok Bot harness)"
@@ -559,15 +598,21 @@ export async function startServer(
   }
   let accountBridge: CursorAccountMcpBridge | undefined;
   if (accountRefsBySlug.size > 0) {
-    if (accountKey === undefined) {
+    if (accountKey === undefined && options.allowAnonymous !== true) {
       throw new Error(
         `This project has Cursor account MCP connections (defineConnection({ cursorAccount: true })) but the host is not signed in to Cursor. ${SIGN_IN_HINT}`
       );
     }
+    if (accountKey === undefined) {
+      logger(
+        "[agent-sdk] Cursor account MCP: listening unsigned; credentials bind at task via CURSOR_API_KEY or CURSOR_API_KEY_FILE"
+      );
+    }
     accountBridge = new CursorAccountMcpBridge({
       client: new CursorBackendClient({
-        backendUrl: accountKey.backendUrl,
-        apiKey: accountKey.apiKey,
+        backendUrl: accountKey?.backendUrl ?? cursorBackendUrl(),
+        apiKey: accountKey?.apiKey ?? "",
+        getApiKey: () => liveCursorApiKey() ?? "",
         logger,
       }),
       logger,
@@ -1035,8 +1080,13 @@ export async function startServer(
               ? undefined
               : { authorization: `Bearer ${options.authToken}` };
         if (options.cloudToolsUrl !== undefined && headers === undefined) {
-          throw new Error(
-            `Agent "${runtime.project.name}" needs a Cursor API key to authenticate --cloud-tools-url. ${SIGN_IN_HINT}`
+          if (options.allowAnonymous !== true) {
+            throw new Error(
+              `Agent "${runtime.project.name}" needs a Cursor API key to authenticate --cloud-tools-url. ${SIGN_IN_HINT}`
+            );
+          }
+          logger(
+            `[agent-sdk] --cloud-tools-url: listening unsigned; Bearer is taken from the key present at start`
           );
         }
         runtime.engine.setCloudServerToolsConnection({
@@ -2509,6 +2559,12 @@ function startCursorDeploymentRelay(input: {
     return undefined;
   }
   if (accountKey === undefined) {
+    if (input.options.allowAnonymous === true) {
+      logger(
+        "[agent-sdk] deployment-events: skipped while unsigned; long-poll relays need a key at start"
+      );
+      return undefined;
+    }
     throw new Error(
       `This project has channels subscribed to deployment events (deploymentsChannel({ deploySourceUris })) but the host is not signed in to Cursor. ${SIGN_IN_HINT}`
     );
@@ -2591,6 +2647,12 @@ async function startCursorSlackRelay(input: {
     return undefined;
   }
   if (accountKey === undefined) {
+    if (options.allowAnonymous === true) {
+      logger(
+        "[agent-sdk] cursor-slack: skipped while unsigned; long-poll relays need a key at start"
+      );
+      return undefined;
+    }
     throw new Error(
       `This project has Slack channels using the Cursor account connection (slackChannel({ cursorAccount: true })) but the host is not signed in to Cursor. ${SIGN_IN_HINT}`
     );

package/src/internal/session-engine.ts

@@ -925,6 +925,51 @@ export class SessionEngine {
     return this.channelSession(record.sessionId, record, true, false, since);
   }
 
+  /**
+   * Atomically validate and rotate an HTTP follow-up credential, then admit
+   * the message to its exact session without changing the owning channel key.
+   */
+  async followUpHttp(
+    sessionId: string,
+    token: { channelId: string; key: string },
+    message: string
+  ): Promise<string | undefined> {
+    const next = newContinuationKey();
+    const stale = new Error("stale HTTP continuation");
+    let previous: string | undefined;
+    try {
+      await this.updateRecord(sessionId, (record) => {
+        const expectedChannel =
+          record.httpContinuationKey === undefined
+            ? record.channelId
+            : HTTP_CHANNEL_ID;
+        const expectedKey =
+          record.httpContinuationKey ?? record.continuationKey;
+        if (token.channelId !== expectedChannel || token.key !== expectedKey) {
+          throw stale;
+        }
+        previous = record.httpContinuationKey;
+        return { ...record, httpContinuationKey: next };
+      });
+    } catch (error) {
+      if (error === stale) {
+        return undefined;
+      }
+      throw error;
+    }
+    try {
+      await this.startTurn(sessionId, message);
+      return next;
+    } catch (error) {
+      await this.updateRecord(sessionId, (record) =>
+        record.httpContinuationKey === next
+          ? { ...record, httpContinuationKey: previous }
+          : record
+      );
+      throw error;
+    }
+  }
+
   /** Whether a continuation token already maps to a session on this channel. */
   async hasContinuationSession(
     channelId: string,
@@ -3315,12 +3360,17 @@ export class SessionEngine {
           createdAt: record.createdAt,
           updatedAt: record.updatedAt,
           continuationToken:
-            record.continuationKey === null
-              ? null
-              : formatContinuationToken(
-                  record.channelId,
-                  record.continuationKey
-                ),
+            record.httpContinuationKey !== undefined
+              ? formatContinuationToken(
+                  HTTP_CHANNEL_ID,
+                  record.httpContinuationKey
+                )
+              : record.continuationKey === null
+                ? null
+                : formatContinuationToken(
+                    record.channelId,
+                    record.continuationKey
+                  ),
           externalUrl: links.slack ?? links.github,
           prUrl: links.github,
         };
@@ -3606,8 +3656,8 @@ export class SessionEngine {
       ...current,
       continuationKey: token,
     }));
-    // Keep armed reminders addressed at the conversation across rotation
-    // (the built-in HTTP channel rotates after every follow-up).
+    // Keep armed reminders addressed at the conversation across channel
+    // continuation rotation.
     if (
       previous?.continuationKey != null &&
       token !== null &&

package/src/reminders.ts

@@ -2,7 +2,7 @@
  * Runtime reminders — per-session durable wakes.
  *
  * ```ts
- * import type { ReminderCreateInput } from "@anysphere/agent-serve/reminders";
+ * import type { ReminderCreateInput } from "@cursor/july/reminders";
  *
  * // Recurring ≈ setInterval; one-shot ≈ setTimeout.
  * await host.reminders?.create({

package/src/schedules.ts

@@ -6,7 +6,7 @@
  * handler form hands work off to a channel (and can call MCP via `args.host.mcp`):
  *
  * ```ts
- * import { defineSchedule } from "@anysphere/agent-serve/schedules";
+ * import { defineSchedule } from "@cursor/july/schedules";
  *
  * export default defineSchedule({
  *   cron: "0 9 * * 1-5",

package/src/skills.ts

@@ -7,7 +7,7 @@
  * content or inline sibling files:
  *
  * ```ts
- * import { defineSkill } from "@anysphere/agent-serve/skills";
+ * import { defineSkill } from "@cursor/july/skills";
  *
  * export default defineSkill({
  *   description: "Research unfamiliar topics before answering.",

package/src/storage.ts

@@ -16,7 +16,7 @@
  * not as required-or-lose-history hooks:
  *
  * ```ts
- * import { defineStorage } from "@anysphere/agent-serve/storage";
+ * import { defineStorage } from "@cursor/july/storage";
  *
  * export default defineStorage({
  *   put: (key, value) => db.upsert(key, value),

package/src/tools.ts

@@ -5,7 +5,7 @@
  * name the model sees. Export the definition as the module's default export:
  *
  * ```ts
- * import { defineTool } from "@anysphere/agent-serve/tools";
+ * import { defineTool } from "@cursor/july/tools";
  * import { z } from "zod";
  *
  * // Runs in-process on the agent-serve host (default). Authored MCP

package/src/types.ts

@@ -1,5 +1,5 @@
 /**
- * Public types for @anysphere/agent-serve.
+ * Public types for @cursor/july.
  *
  * The framework is filesystem-first: customers author an agent as files under
  * an `agent/` directory (markdown for prose, TypeScript for typed behavior),
@@ -1201,10 +1201,8 @@ export type ConnectionConfig = (
    *
    * Derive the identity from durable session facts — `session.auth`,
    * `session.id`, or your channel's own session state. Do **not** key it
-   * off `session.continuationKey`: the HTTP channel rotates the
-   * continuation key after every accepted follow-up, so a tenant mapping
-   * keyed on it silently breaks mid-conversation. (Channels that mint
-   * stable, parseable tokens by design are the exception.)
+   * off `session.continuationKey`: it is a channel routing key, and channels
+   * may re-key it independently of the authenticated principal.
    *
    * Works attached or advertised. Advertised connections
    * ({@link advertiseTools}) open per-operation clients with the
@@ -1593,6 +1591,11 @@ export interface SessionRecord {
   abs?: Record<string, string | null>;
   /** Channel-local continuation key; null when the session is not addressable. */
   continuationKey: string | null;
+  /**
+   * Rotating HTTP follow-up credential for a channel-owned session.
+   * Omitted until HTTP accepts the first follow-up.
+   */
+  httpContinuationKey?: string;
   auth: AuthContext | null;
   title?: string;
   channelState?: JsonValue;
@@ -1668,7 +1671,7 @@ export interface SessionSummary {
   queued?: boolean;
   createdAt: string;
   updatedAt: string;
-  /** `<channelId>:<key>` wire token, or null when not addressable. */
+  /** Active wire token for HTTP follow-ups, or null when not addressable. */
   continuationToken: string | null;
   /**
    * Conversation permalink (Slack thread, else GitHub PR).
@@ -2690,7 +2693,7 @@ export interface DiscoveredHook {
 /** Live A/B metrics experiment (`agent/ab.ts` or `agent/ab/<name>.ts`). */
 export interface DiscoveredAB {
   name: string;
-  /** Branded `defineAB({ ... })` config (see `@anysphere/agent-serve/ab`). */
+  /** Branded `defineAB({ ... })` config (see `@cursor/july/ab`). */
   definition: BrandedDefinition<"ab">;
 }
 

package/templates/security-help/README.md

@@ -0,0 +1,37 @@
+# Security help
+
+Answers security questions in Slack from your FAQ files and takes a first
+look when someone pastes a GitHub pull request.
+
+```bash
+npx @cursor/july init ./security-help --template security-help
+```
+
+`init` asks which repos it may read. Skip the prompt with
+`--var repos=owner/repo`.
+
+## Run
+
+```bash
+agent-sdk login
+agent-sdk slack create --name "Security Help" --channel-posts
+agent-sdk dev
+```
+
+Slack is a dedicated bot (`@Security Help`). Mentions, DMs, and channel
+watch go through that app. GitHub reads use your Cursor GitHub connection
+for the repos in `agent/lib/repos.ts`. Paste a PR URL in Slack, or replay
+one in the playground.
+
+## Edit
+
+- `agent/lib/repos.ts`: repos it may read
+- `agent/channels/slack.ts`: channel ids to watch (`watch`)
+- `agent/knowledge/faq/`: answers for your company
+- `agent/skills/`: how to look at a PR, a leak, or an access ask
+- `agent/instructions.md`: routing
+
+`--channel-posts` is required to watch channels. Mentions and DMs work
+without it.
+
+`agent-sdk eval` runs three smoke turns and writes nothing to Slack or GitHub.

package/templates/security-help/agent/agent.ts

@@ -0,0 +1,18 @@
+import { defineAgent } from "@cursor/july";
+
+export default defineAgent({
+  name: "Security Help",
+  description:
+    "Answers security questions in Slack and takes a first look at a GitHub pull request.",
+  model: {
+    id: "grok-4.6",
+    params: [
+      { id: "effort", value: "high" },
+      { id: "fast", value: "true" },
+    ],
+  },
+  tools: ["read", "grep"],
+  local: {
+    sandbox: true,
+  },
+});

package/templates/security-help/agent/channels/github.ts

@@ -0,0 +1,13 @@
+import { githubChannel } from "@cursor/july/channels/github";
+import { REPOS } from "../lib/repos.js";
+
+export default githubChannel({
+  webhookEvents: [],
+  deliverReplies: false,
+  cursorAccount: {
+    repos: REPOS,
+    permissions: "read",
+  },
+  onPullRequest: () => null,
+  onComment: () => null,
+});

package/templates/security-help/agent/channels/slack.ts

@@ -0,0 +1,89 @@
+import {
+  defaultSlackAuth,
+  extractGithubPrRef,
+  type SlackMessageHandler,
+  slackChannel,
+} from "@cursor/july/channels/slack";
+import { loadPrFiles } from "../lib/pr-first-pass.js";
+import { REPOS, watches } from "../lib/repos.js";
+
+const watch: string[] = [];
+
+const clear = {
+  "pr/meta.md": "",
+  "pr/diff.patch": "",
+  "pr/head.sha": "",
+};
+
+const handleSlack: SlackMessageHandler = async (ctx, message) => {
+  const auth = defaultSlackAuth(message, ctx);
+  if (auth === null) {
+    return null;
+  }
+
+  const pr = extractGithubPrRef(message.markdown);
+  if (pr === undefined) {
+    return { auth };
+  }
+
+  const title = `Security Help ${pr.label}`;
+  const fullName = `${pr.owner}/${pr.repo}`;
+  if (!watches(fullName)) {
+    return {
+      auth,
+      title,
+      workspaceFiles: clear,
+      context: [
+        `Security help can only fetch ${REPOS.join(", ")} (got ${fullName}).`,
+      ],
+    };
+  }
+
+  const loaded = await loadPrFiles({
+    github: ctx.host.github,
+    ref: pr,
+  });
+  return {
+    auth,
+    title,
+    workspaceFiles: loaded ?? clear,
+    context:
+      loaded === undefined
+        ? ["Could not fetch the pull request. Connect GitHub or check the URL."]
+        : undefined,
+  };
+};
+
+export default slackChannel({
+  envPrefix: "SECURITY_HELP",
+  policy: {
+    blockExternals: true,
+  },
+  engagement: {
+    channelPosts:
+      watch.length === 0
+        ? undefined
+        : {
+            allow: watch,
+            posts: "top-level" as const,
+          },
+  },
+  onAppMention: handleSlack,
+  onDirectMessage: handleSlack,
+  onChannelPost: watch.length === 0 ? undefined : handleSlack,
+  suggestedPrompts: [
+    {
+      title: "Look at a PR",
+      message: "First look at https://github.com/owner/repo/pull/1",
+    },
+    {
+      title: "How urgent",
+      message: "How urgent is this?",
+    },
+    {
+      title: "Ask for context",
+      message: "What else do we need before answering?",
+    },
+  ],
+  suggestedPromptsTitle: "Ask security",
+});

package/templates/security-help/agent/instructions.md

@@ -0,0 +1,20 @@
+# Security help
+
+Answer security questions in Slack from the FAQ and skills.
+If you do not know, say so and ask a human.
+
+Open the skill or FAQ for the ask. Those files are under `agent/skills/` and `agent/knowledge/faq/`.
+
+| If the ask is about | Open |
+| --- | --- |
+| A GitHub pull request | `agent/skills/security-pr-first-pass.md` |
+| An access request | `agent/skills/access-request.md` |
+| A leak, alert, or incident | `agent/skills/security-playbooks.md` |
+| Who can approve, privacy, or policy | `agent/knowledge/faq/approvals.md` |
+| Phishing text, email, or a call | `agent/knowledge/faq/phishing.md` |
+| Which team or channel owns a request | `agent/knowledge/faq/channels.md` |
+| Another security question | `agent/skills/security-first-pass.md` |
+
+A pull request earlier in the thread is not this one.
+
+If you say an incident is over or a system is safe, show why. Looking at a pull request is not that.

package/templates/security-help/agent/knowledge/faq/approvals.md

@@ -0,0 +1,5 @@
+# Approvals
+
+Who can say yes depends on the request. If this file does not name an owner, ask a human for that topic.
+
+Privacy questions (training, retention, where prompts sit) go to a privacy or security person.

package/templates/security-help/agent/knowledge/faq/channels.md

@@ -0,0 +1,6 @@
+# Channels
+
+`#security` is for security questions and phishing reports.
+
+Name the channel that owns SaaS access, identity groups, laptops, and billing.
+Until you do, say you do not know which team owns that request.