npm - @cursor/july - Versions diffs - 0.1.90 → 0.1.91 - Mend

@@ -0,0 +1,42 @@
+import { prompt, type HostGitHubClient } from "@cursor/july";
+import type { GitHubPrRef } from "@cursor/july/channels/github";
+const MAX_DIFF_CHARS = 150_000;
+export async function loadPrFiles(args: {
+  github: HostGitHubClient;
+  ref: GitHubPrRef;
+}): Promise<Record<string, string> | undefined> {
+  try {
+    const octokit = await args.github.getOctokit();
+    const pull = {
+      owner: args.ref.owner,
+      repo: args.ref.repo,
+      pull_number: args.ref.number,
+    };
+    const [meta, diff] = await Promise.all([
+      octokit.rest.pulls.get(pull),
+      octokit.rest.pulls.get({ ...pull, mediaType: { format: "diff" } }),
+    ]);
+    const data = meta.data;
+    const text = String(diff.data);
+    const header = prompt`
+      # ${data.title}
+      url: ${args.ref.url}
+      author: @${data.user?.login ?? "unknown"}
+      head: ${data.head.ref} (${data.head.sha})
+      base: ${data.base.ref}
+    `;
+    return {
+      "pr/meta.md": `${header}\n\n${data.body ?? ""}`,
+      "pr/diff.patch":
+        text.length > MAX_DIFF_CHARS
+          ? `${text.slice(0, MAX_DIFF_CHARS)}\n…[truncated]\n`
+          : text,
+      "pr/head.sha": data.head.sha,
+    };
+  } catch {
+    return undefined;
+  }
+}

@@ -0,0 +1,5 @@
+export const REPOS: readonly string[] = ["owner/repo"];
+export function watches(fullName: string): boolean {
+  return REPOS.some((repo) => repo.toLowerCase() === fullName.toLowerCase());
+}

@@ -0,0 +1,10 @@
+---
+description: use when Slack has an access request or request number
+---
+# Access request
+This skill is the access request. SaaS or identity-group asks go to the team named in `agent/knowledge/faq/channels.md`.
+Say what they asked for, why, and how long it lasts, from the request.
+Do not invent a grant that is not on the request.

@@ -0,0 +1,15 @@
+---
+description: use for Slack security questions; open the skill or FAQ you need
+---
+# Security questions
+Open the security skill or FAQ for the ask.
+SaaS access, identity groups, laptops, and billing go to the team named in `agent/knowledge/faq/channels.md`.
+If this looks like production secrets out, an exploit, customer data out, malware, or an account takeover, they should stop it now and wait for a human.
+Training, retention, or policy ownership: `agent/knowledge/faq/approvals.md`.
+If the skills and the topic file for this ask do not have it, say you do not know and ask a human.

@@ -0,0 +1,12 @@
+---
+description: use when Slack looks like a leak, alert, access, privacy, or incident
+---
+# Security playbooks
+If a production secret is already out, revoke or rotate it at the place that issued it, or turn it off there.
+For other alerts, follow the FAQ or runbook under `agent/knowledge/`.
+Do not call it safe without a human.
+If you cannot see who is affected, skip that.

@@ -0,0 +1,12 @@
+---
+description: use when they asked for a look at a GitHub pull request
+---
+# Looking at a pull request
+They asked for a first look. Summarize the change. Note anything that looks like a security issue.
+The look is in `pr/meta.md` and `pr/diff.patch`.
+Read those files.
+You only have those files. Do not guess at CI, review checks, or anything that is not in them.

@@ -0,0 +1,5 @@
+import { defineEvalConfig } from "@cursor/july/evals";
+export default defineEvalConfig({
+  maxConcurrency: 10,
+});

@@ -0,0 +1,53 @@
+import { defineEval, includes } from "@cursor/july/evals";
+export default defineEval({
+  tags: ["smoke"],
+  cases: [
+    {
+      id: "phishing",
+      description: "A phishing text is left alone and confirmed over Slack.",
+      async test(t) {
+        await t.send(
+          "got a text saying my okta expired and i should tap a link. what do i do?"
+        );
+        t.succeeded();
+        t.check(t.reply, includes(/leave|don't click|do not click|slack/i));
+      },
+    },
+    {
+      id: "saas-access",
+      description: "SaaS access is not granted until the FAQ names an owner.",
+      async test(t) {
+        await t.send("can you add me to the figma okta group?");
+        t.succeeded();
+        t.check(t.reply, includes(/do not know|don't know|faq|human/i));
+      },
+    },
+    {
+      id: "pr-first-pass",
+      description: "A seeded PR look says what the change is.",
+      async test(t) {
+        await t.send("first look at https://github.com/acme/api/pull/12", {
+          workspaceFiles: {
+            "pr/meta.md": [
+              "# add search highlighting",
+              "",
+              "url: https://github.com/acme/api/pull/12",
+              "author: @sam",
+              "head: feat/search (aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa)",
+              "base: main",
+              "",
+              "highlight the query in search results",
+            ].join("\n"),
+            "pr/diff.patch": [
+              "diff --git a/app/routes/search.ts b/app/routes/search.ts",
+              "+res.send(`<h1>Results for ${req.query.q}</h1>`);",
+            ].join("\n"),
+          },
+        });
+        t.succeeded();
+        t.check(t.reply, includes(/search|highlight/i));
+      },
+    },
+  ],
+});

@@ -0,0 +1,31 @@
+{
+  "questions": [
+    {
+      "id": "repos",
+      "prompt": "Which GitHub repos may this agent read?",
+      "hint": "Comma-separated owner/repo. One GitHub owner.",
+      "placeholder": "acme/api, acme/web",
+      "parse": "owner-repo-list"
+    }
+  ],
+  "replace": [
+    {
+      "file": "agent/lib/repos.ts",
+      "find": "[\"owner/repo\"]",
+      "answer": "repos",
+      "as": "json-array"
+    },
+    {
+      "file": "README.md",
+      "find": "owner/repo",
+      "answer": "repos",
+      "as": "first"
+    },
+    {
+      "file": "agent/channels/slack.ts",
+      "find": "owner/repo",
+      "answer": "repos",
+      "as": "first"
+    }
+  ]
+}

@@ -0,0 +1,18 @@
+{
+  "name": "security-help-agent",
+  "private": true,
+  "type": "module",
+  "description": "Answers security questions in Slack and takes a first look at a pull request.",
+  "scripts": {
+    "check": "tsc --noEmit",
+    "dev": "agent-sdk dev"
+  },
+  "dependencies": {
+    "@cursor/july": "latest",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.14.0",
+    "typescript": "^5.8.0"
+  }
+}

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["agent/**/*", "evals/**/*"]
+}

@@ -1,4 +1,4 @@
-import { allowAll, defineChannel, POST } from "@cursor/july/channels";
+import { defineChannel, POST, publicEndpoint } from "@cursor/july/channels";
 import { z } from "zod";
 import {
   formatQueuePrompt,
@@ -7,7 +7,7 @@ import {
 import { verifyTrackerWebhook } from "../lib/verify-webhook.js";
 export default defineChannel({
-  auth: [allowAll()],
+  auth: [publicEndpoint()],
   routes: [
     POST("/", {
       description: "Signed Linear or Jira issue-created webhook",

@cursor/july 0.1.90 → 0.1.91