@cursor/july 0.1.9 → 0.1.11

package/src/internal/discovery.ts

@@ -21,6 +21,7 @@ import { type ABConfigFile, resolveABMaxPlaygroundSessions } from "../ab.js";
 import { httpChannel } from "../channels.js";
 import type { StorageDefinition } from "../storage.js";
 import {
+  type AgentConcurrencyOptions,
   type AgentConfigDefinition,
   type AgentHostingOptions,
   type AgentProject,
@@ -40,6 +41,7 @@ import {
   type HookDefinition,
   type HttpChannelDefinition,
   type InstructionsDefinition,
+  MAX_RUNNING_TURNS_LIMIT,
   type ModelSetting,
   type ResolvedAgent,
   type ScheduleDefinition,
@@ -50,6 +52,7 @@ import {
   toPublicCloudInfo,
 } from "../types.js";
 import { registerAuthoredModuleLoaders } from "./authored-loaders.js";
+import { normalizePositiveInt } from "./bounded-int.js";
 import { getDefinitionKind } from "./brand.js";
 import { isValidCron } from "./cron.js";
 import { parseFrontmatter } from "./frontmatter.js";
@@ -372,6 +375,7 @@ async function loadAgent(
           cwd: localCwd,
         };
   const hosting = resolveHosting(ctx, agentDir, config?.hosting);
+  const concurrency = resolveConcurrency(ctx, agentDir, config?.concurrency);
 
   if (runtime === "cloud") {
     warnCloudRuntimeLimitations(ctx, agentDir, {
@@ -393,6 +397,7 @@ async function loadAgent(
     cloud,
     local,
     hosting,
+    concurrency,
     tools,
     skills,
     connections,
@@ -469,6 +474,37 @@ function resolveHosting(
   };
 }
 
+/**
+ * Validate the authored `concurrency` block. Invalid values are **error**
+ * diagnostics (serve refuses to start): silently dropping a turn ceiling
+ * would fail open to unlimited parallelism, the opposite of what the
+ * author asked for.
+ */
+function resolveConcurrency(
+  ctx: DiscoveryContext,
+  agentDir: string,
+  concurrency: AgentConcurrencyOptions | undefined
+): AgentConcurrencyOptions | undefined {
+  if (concurrency === undefined || concurrency.maxRunningTurns === undefined) {
+    return undefined;
+  }
+  try {
+    return {
+      maxRunningTurns: normalizePositiveInt(concurrency.maxRunningTurns, {
+        label: "concurrency.maxRunningTurns",
+        max: MAX_RUNNING_TURNS_LIMIT,
+      }),
+    };
+  } catch (error) {
+    ctx.diagnostics.push({
+      severity: "error",
+      path: displayPath(ctx, join(agentDir, "agent.ts")),
+      message: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+}
+
 async function loadAgentConfig(
   ctx: DiscoveryContext,
   agentDir: string,
@@ -831,11 +867,24 @@ function connectionTransportLabel(transport: ConnectionTransport): string {
     return `agent:${transport.agent}`;
   }
   if ("url" in transport) {
-    return transport.url;
+    return transport.oauth === true
+      ? `${transport.url} (oauth)`
+      : transport.url;
   }
   return transport.command;
 }
 
+function hasAuthorizationHeader(
+  headers: Record<string, string> | undefined
+): boolean {
+  if (headers === undefined) {
+    return false;
+  }
+  return Object.keys(headers).some(
+    (key) => key.toLowerCase() === "authorization"
+  );
+}
+
 function connectionTransport(
   connection: ConnectionDefinition
 ): ConnectionTransport | undefined {
@@ -852,11 +901,10 @@ function connectionTransport(
   }
   if ("url" in connection && !isBlank(connection.url)) {
     return {
-      ...(connection.type === undefined ? {} : { type: connection.type }),
+      type: connection.type,
       url: connection.url,
-      ...(connection.headers === undefined
-        ? {}
-        : { headers: connection.headers }),
+      headers: connection.headers,
+      oauth: connection.oauth === true ? true : undefined,
     };
   }
   if ("command" in connection && !isBlank(connection.command)) {
@@ -974,6 +1022,19 @@ async function loadConnections(
       continue;
     }
     const connection = definition as ConnectionDefinition;
+    if (
+      "url" in connection &&
+      connection.oauth === true &&
+      hasAuthorizationHeader(connection.headers)
+    ) {
+      ctx.diagnostics.push({
+        severity: "error",
+        path: displayPath(ctx, entryPath),
+        message:
+          "MCP connection `oauth: true` cannot set an Authorization header. Drop the header or remove `oauth`.",
+      });
+      continue;
+    }
     const transport = connectionTransport(connection);
     if (transport === undefined) {
       ctx.diagnostics.push({
@@ -1009,9 +1070,8 @@ async function loadConnections(
     connections.push({
       name,
       transport,
-      ...(connection.description === undefined
-        ? {}
-        : { description: connection.description }),
+      description: connection.description,
+      hostOnly: connection.hostOnly,
     });
   }
   return connections;
@@ -1529,6 +1589,7 @@ export function projectInfo(project: AgentProject): AgentProjectInfo {
       agent.cloud === undefined ? undefined : toPublicCloudInfo(agent.cloud),
     local: agent.local,
     hosting: agent.hosting,
+    concurrency: agent.concurrency,
     mcp: { path: MCP_ENDPOINT_PATH, tools: mcpEndpointToolNames(project) },
     instructions:
       agent.instructions === undefined
@@ -1554,6 +1615,7 @@ export function projectInfo(project: AgentProject): AgentProjectInfo {
     connections: agent.connections.map((connection) => ({
       name: connection.name,
       transport: connectionTransportLabel(connection.transport),
+      hostOnly: connection.hostOnly,
     })),
     subagents: agent.subagents.map((subagent) => ({
       name: subagent.name,

package/src/internal/distribution.ts

@@ -100,6 +100,7 @@ export const AUTHORING_ENTRY_FILES: ReadonlyArray<
   ["reminders", "reminders.js"],
   ["connections", "connections.js"],
   ["hooks", "hooks.js"],
+  ["prompt", "prompt.js"],
   ["evals", "evals.js"],
   ["ab", "ab.js"],
   ["storage", "storage.js"],

package/src/internal/logs-client.ts

@@ -49,7 +49,7 @@ const PROGRESS_MESSAGES: Readonly<Record<LogsProgress, string>> = {
   queued: "Waiting to start…",
   preparing: "Preparing runtime…",
   creating: "Creating runtime…",
-  building: "Checking out source and installing dependencies…",
+  building: "Checking out source…",
   starting: "Starting agent and waiting for health…",
   finalizing: "Finishing deployment…",
   running: "Deployment running",

package/src/internal/mcp-host.ts

@@ -9,6 +9,7 @@
  *   {@link HostMcpRegistry} on {@link ChannelHandlerArgs.host}.mcp
  */
 
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -20,6 +21,8 @@ import type {
   HostMcpToolInfo,
   JsonObject,
 } from "../types.js";
+import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
+import { createHostMcpOAuthProvider } from "./mcp-oauth.js";
 
 interface OpenedConnection {
   client: Client;
@@ -118,8 +121,21 @@ async function openConnection(
     name: "agent-serve",
     version: "0.1.0",
   });
-  const transport = createTransport(connection);
-  await client.connect(transport);
+  const transport = await createTransport(connection);
+  try {
+    await client.connect(transport);
+  } catch (error) {
+    if (
+      error instanceof UnauthorizedError &&
+      isOauthHttpTransport(connection.transport)
+    ) {
+      throw new Error(
+        `MCP connection "${connection.name}" needs authorization. Run \`${CLI} mcp oauth ${connection.name}\`.`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
 
   return {
     client,
@@ -138,7 +154,7 @@ async function openConnection(
   };
 }
 
-function createTransport(connection: DiscoveredConnection) {
+async function createTransport(connection: DiscoveredConnection) {
   const transport = connection.transport;
   if ("agent" in transport) {
     // Peers are resolved to concrete URLs by the serve host before any call
@@ -176,16 +192,24 @@ function createTransport(connection: DiscoveredConnection) {
     transport.headers === undefined
       ? undefined
       : { headers: transport.headers };
+  const authProvider =
+    transport.oauth === true
+      ? await createHostMcpOAuthProvider({
+          identifier: connection.name,
+          resourceUrl: transport.url,
+        })
+      : undefined;
 
   if (transport.type === "sse") {
-    return new SSEClientTransport(url, {
-      ...(requestInit === undefined ? {} : { requestInit }),
-    });
+    return new SSEClientTransport(url, { requestInit, authProvider });
   }
+  return new StreamableHTTPClientTransport(url, { requestInit, authProvider });
+}
 
-  return new StreamableHTTPClientTransport(url, {
-    ...(requestInit === undefined ? {} : { requestInit }),
-  });
+function isOauthHttpTransport(
+  transport: DiscoveredConnection["transport"]
+): boolean {
+  return "url" in transport && transport.oauth === true;
 }
 
 function normalizeCallResult(result: unknown): HostMcpCallResult {