@cursor/july 0.1.92 → 0.1.94

package/dist/internal/hosted-delivery.js

@@ -0,0 +1,239 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { randomBytes } from "node:crypto";
+import { dispatchGitHubWebhook, getGitHubChannelOptions, getGitHubDispatchOutcome, withPropagatingGitHubBackgroundErrors, } from "../channels/github/github-channel.js";
+import { HOSTED_ADMISSION_PATH, HOSTED_DELIVERY_HEADER, HOSTED_DELIVERY_PROTOCOL_VERSION, HOSTED_EXECUTION_PATH, parseHostedAdmission, parseHostedExecution, } from "./hosted-delivery-protocol.js";
+import { errorResponse, readJsonObject } from "./http-channel.js";
+class HostedSendAdmitted extends Error {
+    constructor(prompt, options) {
+        super("hosted channel admitted a send");
+        this.prompt = prompt;
+        this.options = options;
+    }
+}
+/**
+ * Run authored admission without creating a framework session. V1 GitHub
+ * `task` callbacks execute as sessionless work; `send` is captured and
+ * resumed only after the control plane allocates `ses_…`.
+ */
+export function dispatchHostedAdmission(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const github = getGitHubChannelOptions(input.definition);
+        if (github === undefined) {
+            return {
+                response: Response.json({ ok: false, error: "channel_kind_mismatch" }, { status: 422 }),
+            };
+        }
+        const background = [];
+        let deferredSend;
+        const args = withPropagatingGitHubBackgroundErrors(Object.assign(Object.assign({}, input.args), { send: (message_1, ...args_1) => __awaiter(this, [message_1, ...args_1], void 0, function* (message, options = {}) {
+                throw new HostedSendAdmitted(message, options);
+            }), waitUntil: (promise) => {
+                background.push(promise.catch((error) => {
+                    if (error instanceof HostedSendAdmitted) {
+                        deferredSend = error;
+                        return;
+                    }
+                    throw error;
+                }));
+            } }));
+        let dispatched;
+        try {
+            dispatched = yield dispatchGitHubWebhook({
+                options: github,
+                eventName: input.delivery.eventType,
+                payload: input.delivery.payload,
+                deliveryId: input.delivery.deliveryId,
+                args,
+            });
+        }
+        catch (error) {
+            if (error instanceof HostedSendAdmitted) {
+                return {
+                    response: Response.json({
+                        ok: true,
+                        v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                        outcome: "send",
+                    }),
+                    pendingSend: {
+                        channelId: input.delivery.channelId,
+                        message: error.prompt,
+                        options: error.options,
+                        mailboxContinuationKey: input.delivery.mailboxContinuationKey,
+                    },
+                };
+            }
+            throw error;
+        }
+        if (!dispatched.ok) {
+            return {
+                response: Response.json({ ok: false, error: "channel_dispatch_failed" }, { status: dispatched.status >= 400 ? dispatched.status : 502 }),
+            };
+        }
+        try {
+            yield Promise.all(background);
+        }
+        catch (_a) {
+            return {
+                response: Response.json({ ok: false, error: "background_dispatch_failed" }, { status: 503 }),
+            };
+        }
+        if (deferredSend !== undefined) {
+            return {
+                response: Response.json({
+                    ok: true,
+                    v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                    outcome: "send",
+                }),
+                pendingSend: {
+                    channelId: input.delivery.channelId,
+                    message: deferredSend.prompt,
+                    options: deferredSend.options,
+                    mailboxContinuationKey: input.delivery.mailboxContinuationKey,
+                },
+            };
+        }
+        const outcome = getGitHubDispatchOutcome(dispatched);
+        if (outcome === undefined) {
+            return {
+                response: Response.json({ ok: false, error: "channel_outcome_missing" }, { status: 502 }),
+            };
+        }
+        return {
+            response: Response.json({
+                ok: true,
+                v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                outcome,
+            }),
+        };
+    });
+}
+function withServerTiming(response, durationMs) {
+    const headers = new Headers(response.headers);
+    headers.set("Server-Timing", `agent_sdk;desc="hosted";dur=${Math.max(0, durationMs).toFixed(1)}`);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+export function registerHostedDeliveryRoute(input) {
+    const pending = new Map();
+    const pendingTtlMs = 10 * 60000;
+    const pruneExpired = () => {
+        const now = Date.now();
+        for (const [token, item] of pending) {
+            if (item.expiresAt <= now) {
+                pending.delete(token);
+            }
+        }
+    };
+    // Hosted callers reach this only through AnyRun's signed pod-port URL.
+    // The marker is a second, route-specific fence distinct from channel auth.
+    const auth = (request) => {
+        if (request.headers.get(HOSTED_DELIVERY_HEADER) !== "1") {
+            return null;
+        }
+        return {
+            authenticator: "app",
+            principalId: "agent-sdk:hosted-delivery",
+            principalType: "runtime",
+        };
+    };
+    input.router.add({
+        method: "POST",
+        pattern: `${input.base}${HOSTED_ADMISSION_PATH}`,
+        auth: [auth],
+        handler: (request) => __awaiter(this, void 0, void 0, function* () {
+            const startedAt = performance.now();
+            const finish = (response) => withServerTiming(response, performance.now() - startedAt);
+            const delivery = parseHostedAdmission(yield readJsonObject(request));
+            if (delivery === undefined) {
+                return finish(errorResponse(400, "invalid_hosted_admission", "Expected a supported Agent SDK hosted-admission envelope."));
+            }
+            const channel = input.channels.find((candidate) => candidate.id === delivery.channelId);
+            if (channel === undefined) {
+                return finish(errorResponse(404, "channel_not_found", `No channel named "${delivery.channelId}" is mounted.`));
+            }
+            const admitted = yield dispatchHostedAdmission({
+                delivery,
+                definition: channel.definition,
+                args: input.buildHandlerArgs(delivery.channelId),
+            });
+            if (admitted.pendingSend === undefined) {
+                return finish(admitted.response);
+            }
+            pruneExpired();
+            const admissionToken = randomBytes(24).toString("hex");
+            pending.set(admissionToken, {
+                send: admitted.pendingSend,
+                expiresAt: Date.now() + pendingTtlMs,
+            });
+            return finish(Response.json({
+                ok: true,
+                v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                outcome: "send",
+                admissionToken,
+            }));
+        }),
+    });
+    input.router.add({
+        method: "POST",
+        pattern: `${input.base}${HOSTED_EXECUTION_PATH}`,
+        auth: [auth],
+        handler: (request) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const startedAt = performance.now();
+            const finish = (response) => withServerTiming(response, performance.now() - startedAt);
+            const execution = parseHostedExecution(yield readJsonObject(request));
+            if (execution === undefined) {
+                return finish(errorResponse(400, "invalid_hosted_execution", "Expected a supported Agent SDK hosted-execution envelope."));
+            }
+            pruneExpired();
+            const admitted = pending.get(execution.admissionToken);
+            if (admitted === undefined) {
+                return finish(errorResponse(409, "hosted_admission_unavailable", "The hosted admission token is missing or expired."));
+            }
+            if (admitted.sessionPublicId !== undefined &&
+                admitted.sessionPublicId !== execution.sessionPublicId) {
+                return finish(errorResponse(409, "hosted_admission_session_mismatch", "The hosted admission token is already bound to another session."));
+            }
+            admitted.sessionPublicId = execution.sessionPublicId;
+            (_a = admitted.execution) !== null && _a !== void 0 ? _a : (admitted.execution = (() => __awaiter(this, void 0, void 0, function* () {
+                const args = input.buildHandlerArgs(admitted.send.channelId, execution.sessionPublicId);
+                const session = yield args.send(admitted.send.message, Object.assign(Object.assign({}, admitted.send.options), { mailboxContinuation: {
+                        key: admitted.send.mailboxContinuationKey,
+                    } }));
+                const outcome = yield session.waitForCompletion();
+                if (outcome.status !== "finished") {
+                    return {
+                        status: 503,
+                        body: {
+                            ok: false,
+                            error: "turn_failed",
+                            turnStatus: outcome.status,
+                            message: outcome.errorMessage,
+                        },
+                    };
+                }
+                return {
+                    status: 200,
+                    body: {
+                        ok: true,
+                        v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+                        outcome: "send",
+                    },
+                };
+            }))());
+            const reply = yield admitted.execution;
+            return finish(Response.json(reply.body, { status: reply.status }));
+        }),
+    });
+}

package/dist/internal/http-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-channel.d.ts","sourceRoot":"","sources":["../../src/internal/http-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,qBAAqB,EAErB,aAAa,EACd,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAQ7B,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,WAAW,EAAE,CAmZhB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GACA,QAAQ,GAAG,SAAS,CAiBtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC/D,QAAQ,CAQV;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,QAAQ,CAEV;AAoGD,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAc9C"}
+{"version":3,"file":"http-channel.d.ts","sourceRoot":"","sources":["../../src/internal/http-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAQ7B,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,WAAW,EAAE,CAkZhB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GACA,QAAQ,GAAG,SAAS,CAiBtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC/D,QAAQ,CAQV;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,QAAQ,CAEV;AAoGD,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAc9C"}

package/dist/internal/http-channel.js

@@ -53,7 +53,7 @@ export function buildHttpChannelRoutes(args) {
             // Per-session cloud attach (create only). Eval harness uses this to pin
             // fixture repos without putting them on the agent's default cloud.repos.
             const cloud = readCloudOptions(body.cloud);
-            const session = yield engine.send(HTTP_CHANNEL_ID, message, Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ auth: ctx.auth }, (body.state === undefined ? {} : { state: body.state })), (typeof body.title === "string" ? { title: body.title } : {})), (body.purpose === "eval" ? { purpose: "eval" } : {})), (body.dryRun === true ? { dryRun: true } : {})), (workspaceFiles === undefined ? {} : { workspaceFiles })), (cloud === undefined ? {} : { cloud })));
+            const session = yield engine.send(HTTP_CHANNEL_ID, message, Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ auth: ctx.auth }, (typeof body.title === "string" ? { title: body.title } : {})), (body.purpose === "eval" ? { purpose: "eval" } : {})), (body.dryRun === true ? { dryRun: true } : {})), (workspaceFiles === undefined ? {} : { workspaceFiles })), (cloud === undefined ? {} : { cloud })));
             return jsonResponse({
                 ok: true,
                 sessionId: session.id,

package/dist/internal/mcp-endpoint.js

@@ -166,9 +166,9 @@ function buildToolMcpServer(engine, sessionId) {
  * travels in the turn's MCP config or lands on the VM.
  *
  * The engine gates access twice, mirroring the authored server-tool path:
- * only bridgeable names (`isCloudBridgedConnection`) — `hostOnly`
- * connections and unknown names stay unreachable from a VM even with a
- * valid endpoint credential — and only while the bound session has a turn
+ * only bridgeable names (`isCloudBridgedConnection`) — unknown names
+ * stay unreachable from a VM even with a valid endpoint credential —
+ * and only while the bound session has a turn
  * in flight (`hasActiveTurn`), so a credential that persists on a VM after
  * its turn cannot keep calling host connectors. Listing forwards per
  * request, so a server that adds tools mid-session (`tools/list_changed`,

package/dist/internal/mcp-host.d.ts

@@ -1,12 +1,13 @@
 /**
- * Host-side MCP clients for authored `agent/mcp-connections/*`.
+ * Host-side MCP clients for authored `agent/mcp-connections/*` and
+ * `agent/host-connections/*`.
  *
- * Every connection is always available in three places:
- * - the Cursor agent, via SDK `mcpServers` (local harness or cloud)
- * - the agent-serve host, for in-process server tools through
- *   {@link HostMcpRegistry} on {@link ToolContext.host}.mcp
- * - channel / webhook route handlers through
- *   {@link HostMcpRegistry} on {@link ChannelHandlerArgs.host}.mcp
+ * Model-visible connections (`mcp-connections/`) are available in three
+ * places: SDK `mcpServers`, in-process server tools through
+ * {@link HostMcpRegistry} on {@link ToolContext.host}.mcp, and channel /
+ * webhook handlers through {@link HostMcpRegistry} on
+ * {@link ChannelHandlerArgs.host}.mcp. Host connections skip the model
+ * and stay on `host.mcp` plus `mcp oauth`.
  */
 import type { DiscoveredConnection, HostMcpCallResult, HostMcpRegistry, HostMcpToolInfo, McpToolAnnotations } from "../types.js";
 /**

package/dist/internal/mcp-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AASrB;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA0BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}
+{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AASrB;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA0BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}

package/dist/internal/mcp-host.js

@@ -1,12 +1,13 @@
 /**
- * Host-side MCP clients for authored `agent/mcp-connections/*`.
+ * Host-side MCP clients for authored `agent/mcp-connections/*` and
+ * `agent/host-connections/*`.
  *
- * Every connection is always available in three places:
- * - the Cursor agent, via SDK `mcpServers` (local harness or cloud)
- * - the agent-serve host, for in-process server tools through
- *   {@link HostMcpRegistry} on {@link ToolContext.host}.mcp
- * - channel / webhook route handlers through
- *   {@link HostMcpRegistry} on {@link ChannelHandlerArgs.host}.mcp
+ * Model-visible connections (`mcp-connections/`) are available in three
+ * places: SDK `mcpServers`, in-process server tools through
+ * {@link HostMcpRegistry} on {@link ToolContext.host}.mcp, and channel /
+ * webhook handlers through {@link HostMcpRegistry} on
+ * {@link ChannelHandlerArgs.host}.mcp. Host connections skip the model
+ * and stay on `host.mcp` plus `mcp oauth`.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

package/dist/internal/peer-connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peer-connections.d.ts","sourceRoot":"","sources":["../../src/internal/peer-connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,YAAY,EAA6B,MAAM,aAAa,CAAC;AAE3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,GACrD,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CA+BlC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,wBAAwB,EAAE,CAkB7B"}
+{"version":3,"file":"peer-connections.d.ts","sourceRoot":"","sources":["../../src/internal/peer-connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,YAAY,EAA6B,MAAM,aAAa,CAAC;AAE3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,GACrD,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAkClC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,wBAAwB,EAAE,CAkB7B"}

package/dist/internal/peer-connections.js

@@ -18,11 +18,15 @@ import { MCP_ENDPOINT_PATH } from "./mcp-endpoint.js";
  * self-references (an agent asking itself recurses forever).
  */
 export function collectPeerConnections(mounts) {
+    var _a;
     const knownSlugs = new Set(mounts.map(({ slug }) => slug).filter((slug) => slug !== ""));
     const bySlug = new Map();
     for (const { slug, project } of mounts) {
         const refs = [];
-        for (const connection of project.agent.connections) {
+        for (const connection of [
+            ...project.agent.connections,
+            ...((_a = project.agent.hostConnections) !== null && _a !== void 0 ? _a : []),
+        ]) {
             if (!isPeerConnectionTransport(connection.transport)) {
                 continue;
             }

package/dist/internal/playground/static.d.ts

@@ -27,9 +27,6 @@ export declare function renderPlaygroundIndexHtml(baseHref: string): string;
 export declare function renderPlaygroundAsset(file: string): Response;
 /** Slack surface summary for the host home / `GET /v1/agents`. */
 export type AgentIndexSlack = {
-    kind: "cursor-account";
-    handle: string;
-} | {
     kind: "socket";
 };
 /** One row on the host home page and `GET /v1/agents`. */

package/dist/internal/playground/static.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../../src/internal/playground/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmBvD,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAsB5D;AAED,kEAAkE;AAClE,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAgCR"}
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../../src/internal/playground/static.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmBvD,CAAC;AAEF,uEAAuE;AACvE,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAsB5D;AAED,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,EAAE,EACzB,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAgCR"}

package/dist/internal/resolved-connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved-connections.d.ts","sourceRoot":"","sources":["../../src/internal/resolved-connections.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAkC,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAE5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,IAAI,CAgCP;AAED,qEAAqE;AACrE,wBAAgB,wCAAwC,CAAC,IAAI,EAAE;IAC7D,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,mBAAmB,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACzD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,IAAI,CAoBP;AAED,iFAAiF;AACjF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC,qBAAqB,EAAE,OAAO,CAAC;CAChC,GAAG,IAAI,CAUP;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC3C,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,wBAAwB,EAAE,CAoE7B"}
+{"version":3,"file":"resolved-connections.d.ts","sourceRoot":"","sources":["../../src/internal/resolved-connections.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAkC,MAAM,aAAa,CAAC;AAChF,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAE5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,IAAI,CAgCP;AAED,qEAAqE;AACrE,wBAAgB,wCAAwC,CAAC,IAAI,EAAE;IAC7D,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B,mBAAmB,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACzD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,IAAI,CAoBP;AAED,iFAAiF;AACjF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC,qBAAqB,EAAE,OAAO,CAAC;CAChC,GAAG,IAAI,CAUP;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC3C,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,wBAAwB,EAAE,CAkE7B"}

package/dist/internal/resolved-connections.js

@@ -11,6 +11,7 @@ import { resolveCursorAccountConnections, } from "./cursor/account-mcp.js";
 import { resolvePeerConnections, } from "./peer-connections.js";
 /** Fail fast before listen when static cloud config cannot honor `servers`. */
 export function validateMountConnectionsConfig(args) {
+    var _a;
     if (args.accountRefs === undefined || args.accountRefs.length === 0) {
         return;
     }
@@ -22,10 +23,8 @@ export function validateMountConnectionsConfig(args) {
         return;
     }
     const label = args.slug === "" ? args.project.name : args.slug;
-    const hostOnlyNames = new Set(agent.connections
-        .filter((connection) => connection.hostOnly === true)
-        .map((connection) => connection.name));
-    const filteredRefs = args.accountRefs.filter((ref) => ref.servers !== undefined && !hostOnlyNames.has(ref.name));
+    const hostConnectionNames = new Set(((_a = args.project.agent.hostConnections) !== null && _a !== void 0 ? _a : []).map((connection) => connection.name));
+    const filteredRefs = args.accountRefs.filter((ref) => ref.servers !== undefined && !hostConnectionNames.has(ref.name));
     if (filteredRefs.length === 0) {
         return;
     }
@@ -65,13 +64,12 @@ export function resolveMountConnections(args) {
     const resolved = [];
     if (cloudCapable) {
         const hostOauthNames = agent.connections
-            .filter((connection) => connection.hostOnly !== true &&
-            isHostOauthConnectionTransport(connection.transport))
+            .filter((connection) => isHostOauthConnectionTransport(connection.transport))
             .map((connection) => connection.name);
         if (hostOauthNames.length > 0) {
             args.logger(args.cloudToolsBridge === true
                 ? `[agent-sdk] agent "${label}": host-OAuth MCP connections (${hostOauthNames.join(", ")}) reach cloud turns through the host connection bridge; their tokens stay on this serve host.`
-                : `[agent-sdk] warning: agent "${label}" has host-OAuth MCP connections (${hostOauthNames.join(", ")}) whose tokens live on this serve host; cloud-runtime turns omit them. Mark them \`hostOnly: true\` and call them from host tools, or drop \`oauth\` and authorize the server another way.`);
+                : `[agent-sdk] warning: agent "${label}" has host-OAuth MCP connections (${hostOauthNames.join(", ")}) whose tokens live on this serve host; cloud-runtime turns omit them. Serve with a cloud tools URL so they reach turns through the host connection bridge, or drop \`oauth\` and authorize the server another way.`);
         }
     }
     if (args.peerRefs !== undefined && args.peerRefs.length > 0) {