@cursor/july 0.1.93 → 0.1.95

package/dist/internal/discovery.js

@@ -31,7 +31,7 @@ import { pathToFileURL } from "node:url";
 import { resolveABMaxPlaygroundSessions } from "../ab.js";
 import { resolveArtifactsMax } from "../artifacts.js";
 import { httpChannel } from "../channels.js";
-import { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, isInlineStdioConnection, MAX_RUNNING_TURNS_LIMIT, normalizeCursorAccountServers, toPublicCloudInfo, } from "../types.js";
+import { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, isInlineStdioConnection, isToolEffect, MAX_RUNNING_TURNS_LIMIT, normalizeConnectionEffects, normalizeCursorAccountServers, toPublicCloudInfo, } from "../types.js";
 import { registerAuthoredModuleLoaders } from "./authored-loaders.js";
 import { normalizePositiveInt } from "./bounded-int.js";
 import { getDefinitionKind } from "./brand.js";
@@ -212,7 +212,7 @@ export function loadAgentProject(dir_1) {
         const hooks = yield loadHooks(ctx, join(agentDir, "hooks"));
         const abs = yield loadABs(ctx, agentDir);
         const abConfig = yield loadABConfig(ctx, agentDir);
-        const storage = yield loadStorage(ctx, agentDir);
+        const storage = yield loadStorage(ctx, agentDir, agent.architecture);
         const artifacts = yield loadArtifacts(ctx, agentDir);
         const otel = yield loadOtel(ctx, agentDir);
         yield appendArtifactTool(ctx, agentDir, agent, artifacts);
@@ -306,11 +306,12 @@ function loadAgent(ctx, agentDir, options) {
             }
             return Object.assign(Object.assign(Object.assign(Object.assign({ name }, ((config === null || config === void 0 ? void 0 : config.description) === undefined
                 ? {}
-                : { description: config.description })), ((config === null || config === void 0 ? void 0 : config.model) === undefined ? {} : { model: config.model })), (instructions === undefined ? {} : { instructions })), { runtime: "local", tools: [], skills: [], connections: [], subagents: [], seedFiles: [] });
+                : { description: config.description })), ((config === null || config === void 0 ? void 0 : config.model) === undefined ? {} : { model: config.model })), (instructions === undefined ? {} : { instructions })), { runtime: "local", tools: [], skills: [], connections: [], hostConnections: [], subagents: [], seedFiles: [] });
         }
         const tools = yield loadTools(ctx, join(agentDir, "tools"));
         const skills = yield loadSkills(ctx, join(agentDir, "skills"));
         const connections = yield loadConnections(ctx, yield resolveMcpConnectionsDir(ctx, agentDir));
+        const hostConnections = yield loadHostConnections(ctx, agentDir, connections);
         const seedFiles = yield loadSeedFiles(ctx, agentDir);
         const subagents = yield loadSubagents(ctx, join(agentDir, "subagents"));
         const runtime = resolveRuntime(ctx, agentDir, config === null || config === void 0 ? void 0 : config.runtime);
@@ -415,7 +416,7 @@ function loadAgent(ctx, agentDir, options) {
                 agentTools: tools.filter((tool) => tool.execution === "agent").length,
                 skills: skills.length,
                 seedFiles: seedFiles.length,
-                connections: connections.length,
+                connections: connections.length + hostConnections.length,
                 subagents: subagents.length,
                 hasCloudOptions: cloud !== undefined,
                 hasLocalSandbox: localSandbox,
@@ -430,6 +431,7 @@ function loadAgent(ctx, agentDir, options) {
             concurrency }), (architecture === undefined ? {} : { architecture })), { tools,
             skills,
             connections,
+            hostConnections,
             subagents,
             seedFiles });
     });
@@ -904,6 +906,23 @@ function hasAuthorizationHeader(headers) {
     }
     return Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
 }
+function parseConnectionEffects(effects) {
+    if (effects === undefined) {
+        return { ok: true, value: undefined };
+    }
+    const raw = typeof effects === "string" ? [effects] : effects;
+    if (!Array.isArray(raw) || raw.length === 0) {
+        return { ok: false };
+    }
+    const parsed = [];
+    for (const value of raw) {
+        if (!isToolEffect(value)) {
+            return { ok: false };
+        }
+        parsed.push(value);
+    }
+    return { ok: true, value: normalizeConnectionEffects(parsed) };
+}
 function connectionHasSpawnOrRemote(connection) {
     if ("cursorAccount" in connection && connection.cursorAccount === true) {
         return true;
@@ -1002,6 +1021,42 @@ function resolveMcpConnectionsDir(ctx, agentDir) {
         return preferred;
     });
 }
+function loadHostConnections(ctx, agentDir, modelConnections) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const hostDir = join(agentDir, "host-connections");
+        const loaded = yield loadConnections(ctx, hostDir);
+        const modelNames = new Set(modelConnections.map((connection) => connection.name));
+        const hostConnections = [];
+        for (const connection of loaded) {
+            if (modelNames.has(connection.name)) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, join(hostDir, `${connection.name}.ts`)),
+                    message: `Host connection "${connection.name}" collides with agent/mcp-connections/${connection.name}. Rename one of them.`,
+                });
+                continue;
+            }
+            if (connection.advertiseTools === true) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, join(hostDir, `${connection.name}.ts`)),
+                    message: "Host connections are off the model. `advertiseTools` cannot apply. Drop it.",
+                });
+                continue;
+            }
+            if (connection.auth !== undefined) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, join(hostDir, `${connection.name}.ts`)),
+                    message: "Host connections are off the model. `auth` cannot apply. Use static headers or `oauth: true`.",
+                });
+                continue;
+            }
+            hostConnections.push(connection);
+        }
+        return hostConnections;
+    });
+}
 function loadConnections(ctx, connectionsDir) {
     return __awaiter(this, void 0, void 0, function* () {
         if (!(yield isDirectory(connectionsDir))) {
@@ -1027,6 +1082,14 @@ function loadConnections(ctx, connectionsDir) {
                 continue;
             }
             const connection = definition;
+            if (Object.hasOwn(connection, "hostOnly")) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, entryPath),
+                    message: "MCP connection `hostOnly` was removed. Files under `agent/mcp-connections/` are always visible to the model. Put privileged servers in `agent/host-connections/` so only host tools can call them.",
+                });
+                continue;
+            }
             if (isInlineStdioConnection(connection) &&
                 connectionHasSpawnOrRemote(connection)) {
                 ctx.diagnostics.push({
@@ -1062,20 +1125,30 @@ function loadConnections(ctx, connectionsDir) {
                 });
                 continue;
             }
-            if (connection.advertiseTools === true &&
-                isInlineStdioConnection(connection)) {
+            const parsedEffects = parseConnectionEffects(connection.effects);
+            if (!parsedEffects.ok) {
                 ctx.diagnostics.push({
                     severity: "error",
                     path: displayPath(ctx, entryPath),
-                    message: "MCP connection `advertiseTools` is not supported on inline `tools` connections — author those as agent/tools/ server tools instead.",
+                    message: 'MCP connection `effects` must be "read", "write", or a non-empty array of those.',
                 });
                 continue;
             }
-            if (connection.advertiseTools === true && connection.hostOnly === true) {
+            if (parsedEffects.value !== undefined &&
+                connection.advertiseTools !== true) {
                 ctx.diagnostics.push({
                     severity: "error",
                     path: displayPath(ctx, entryPath),
-                    message: "MCP connection `advertiseTools` puts the connection's tools in the model's toolset, which contradicts `hostOnly` (off the model entirely). Drop one of them.",
+                    message: "MCP connection `effects` filters advertised tools; set `advertiseTools: true` or drop `effects`.",
+                });
+                continue;
+            }
+            if (connection.advertiseTools === true &&
+                isInlineStdioConnection(connection)) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, entryPath),
+                    message: "MCP connection `advertiseTools` is not supported on inline `tools` connections — author those as agent/tools/ server tools instead.",
                 });
                 continue;
             }
@@ -1149,9 +1222,9 @@ function loadConnections(ctx, connectionsDir) {
                 name,
                 transport,
                 description: connection.description,
-                hostOnly: connection.hostOnly,
                 auth: connection.auth,
                 advertiseTools: connection.advertiseTools,
+                effects: parsedEffects.value,
             });
         }
         return connections;
@@ -1207,7 +1280,6 @@ function loadInlineStdioConnection(ctx, name, entryPath, connection) {
                 name,
                 transport,
                 description: connection.description,
-                hostOnly: connection.hostOnly,
             };
         }
         catch (error) {
@@ -1253,6 +1325,7 @@ function warnUnsupportedSubagentSlots(ctx, subagentDir) {
             ["tools", "tools"],
             ["skills", "skills"],
             ["mcp-connections", "MCP connections"],
+            ["host-connections", "host MCP connections"],
             ["connections", "MCP connections"],
             ["subagents", "nested subagents"],
             ["channels", "channels"],
@@ -1331,7 +1404,7 @@ function checkGrokBotRuntimeLimitations(ctx, agentDir, counts) {
         error(displayPath(ctx, join(agentDir, "tools")), 'Server tools (execution: "server", including opted-in builtinTools) are not reachable from grokbot turns yet. Remove them or run the agent on the local runtime.');
     }
     if (counts.connections > 0) {
-        error(displayPath(ctx, join(agentDir, "mcp-connections")), "MCP connections are not wired into grokbot turns yet. Remove them or run the agent on the local runtime.");
+        error(displayPath(ctx, agentDir), "MCP connections (agent/mcp-connections/ or agent/host-connections/) are not wired into grokbot turns yet. Remove them or run the agent on the local runtime.");
     }
     if (counts.subagents > 0) {
         error(displayPath(ctx, join(agentDir, "subagents")), "Authored subagents are not available on grokbot turns (the Grok Bot harness runs its own subagent set). Remove them or run the agent on the local runtime.");
@@ -1655,12 +1728,32 @@ function loadABConfig(ctx, agentDir) {
 // ============================================================================
 // Storage (agent/storage.ts)
 // ============================================================================
-function loadStorage(ctx, agentDir) {
+function loadStorage(ctx, agentDir, architecture) {
     return __awaiter(this, void 0, void 0, function* () {
         const path = yield findModuleFile(agentDir, "storage");
         if (path === undefined) {
             return undefined;
         }
+        if (architecture === "v2") {
+            // Storage is a hosting-mode decision on v2, made by
+            // framework-storage-selection.ts: the state root when self-hosted,
+            // Cursor-managed storage on Cursor hosting. Fail early (error
+            // diagnostics refuse serve and deploy) rather than silently running
+            // with storage the author believes they configured. Not imported.
+            ctx.diagnostics.push({
+                severity: "error",
+                path: displayPath(ctx, path),
+                message: 'agent/storage.ts is not supported on architecture "v2": the platform selects storage (the local state root when self-hosted; Cursor-managed storage on Cursor hosting). Delete the file.',
+            });
+            return undefined;
+        }
+        // v1 keeps loading the authored sink, with notice: defineStorage is going
+        // away with the v1 control plane.
+        ctx.diagnostics.push({
+            severity: "warning",
+            path: displayPath(ctx, path),
+            message: 'agent/storage.ts (defineStorage) is deprecated and going away: architecture "v2" selects storage automatically (the local state root when self-hosted; Cursor-managed storage on Cursor hosting). Still honored on v1.',
+        });
         const definition = yield importDefault(ctx, path, "storage");
         return definition;
     });
@@ -1814,6 +1907,7 @@ export function projectInfo(project) {
             description: tool.description,
             execution: tool.execution,
             needsApproval: tool.needsApproval,
+            effect: tool.effect,
             inputSchema: tool.inputSchema,
         })), skills: agent.skills.map((skill) => ({
             name: skill.name,
@@ -1821,8 +1915,8 @@ export function projectInfo(project) {
         })), connections: agent.connections.map((connection) => { var _a; return ({
             name: connection.name,
             transport: connectionTransportLabel(connection.transport),
-            hostOnly: connection.hostOnly,
             advertiseTools: connection.advertiseTools,
+            effects: connection.effects,
             cursorAccountServers: "cursorAccount" in connection.transport
                 ? ((_a = connection.transport.servers) !== null && _a !== void 0 ? _a : "*")
                 : undefined,
@@ -1954,6 +2048,7 @@ function warnUnknownSlots(ctx, agentDir) {
             "tools",
             "skills",
             "mcp-connections",
+            "host-connections",
             // Legacy slot name; resolveMcpConnectionsDir warns and still loads it.
             "connections",
             "subagents",
@@ -1963,7 +2058,7 @@ function warnUnknownSlots(ctx, agentDir) {
             "ab",
             "sandbox",
             "lib",
-            // Vite playground custom tool chips (examples/*/agent/playground/tools).
+            // Vite playground custom tool chips (agent/playground/tools).
             "playground",
         ]);
         for (const entry of yield sortedEntries(agentDir)) {

package/dist/internal/framework-storage-selection.d.ts

@@ -2,36 +2,52 @@
  * Which backend framework session state is mirrored to.
  *
  * Framework state — session records, event chunks, the continuation index —
- * is how a session outlives the process that served it. Today that mirror
- * exists only when the agent author wrote `agent/storage.ts`, which makes
- * platform durability an agent-level decision: of the first-party agents,
- * some choose `cursorHostedStorage()` and some choose `fileKv()` (pod-local
- * disk, lost on pod replacement), and one selects between them at runtime by
- * reading the deployment-id environment variable itself.
+ * is how a session outlives the process that served it. On architecture v1
+ * that mirror exists only when the agent author wrote `agent/storage.ts`,
+ * which makes platform durability an agent-level decision: of the
+ * first-party agents, some choose `cursorHostedStorage()` and some choose
+ * `fileKv()` (pod-local disk, lost on pod replacement), and one selects
+ * between them at runtime by reading the deployment-id environment variable
+ * itself.
  *
- * That selection is a hosting-mode question, not an authoring question, and
- * this module is where it will move. It deliberately reproduces today's
- * behavior exactly for now — authored definition or nothing — so the change
- * that makes framework durability automatic is a change to
- * {@link selectFrameworkStorageDefinition} alone, reviewable on its own and
- * revertable without touching the engine.
+ * That selection is a hosting-mode question, not an authoring question.
+ * Architecture v2 moves it here: `agent/storage.ts` is rejected at
+ * discovery (error diagnostic, so serve and deploy fail early), and the
+ * platform picks the default —
+ *
+ * - **Cursor-managed hosting** (the deployment-generation environment
+ *   variable is set, same signal that registers `GET /v1/manifest`):
+ *   the Cursor-hosted backend, so session records, event chunks, `host.kv`,
+ *   eval runs, and A/B samples land in the control plane and survive pod
+ *   replacement. The API key resolves through the full credential chain on
+ *   every call because hosted freeze snapshots listen unsigned and the
+ *   binder drops the key file after restore.
+ * - **Self-hosted**: no mirror. `--state-root` is the durable copy, which
+ *   is correct when the operator owns the disk.
+ *
+ * v1 keeps the authored definition (or nothing) so existing deployments are
+ * untouched while they run.
  *
  * Local disk is not part of this decision. `<stateRoot>/sessions/<id>/`
  * already holds `session.json` and `events.ndjson` unconditionally, through
  * the session store; what this selects is the durable mirror *beyond* the
  * pod's filesystem.
  */
-import type { StorageDefinition } from "../storage.js";
+import { type StorageDefinition } from "../storage.js";
+import type { AgentArchitecture } from "../types.js";
 export interface FrameworkStorageSelectionInput {
-    /** `agent/storage.ts`, when the author wrote one. */
+    /** `agent/storage.ts`, when the author wrote one (v1 only: discovery rejects it on v2). */
     readonly authored: StorageDefinition | undefined;
+    /** {@link AgentConfig.architecture}; omitted means v1. */
+    readonly architecture?: AgentArchitecture | undefined;
+    /** Environment override for tests; defaults to `process.env`. */
+    readonly env?: Record<string, string | undefined>;
 }
 /**
  * Pick the backend for framework session state.
  *
  * Returns `undefined` when there is no mirror, in which case the pod's local
- * disk is the only copy — the condition F0 exists to remove for hosted
- * deployments.
+ * disk is the only copy.
  */
 export declare function selectFrameworkStorageDefinition(input: FrameworkStorageSelectionInput): StorageDefinition | undefined;
 //# sourceMappingURL=framework-storage-selection.d.ts.map

package/dist/internal/framework-storage-selection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-storage-selection.d.ts","sourceRoot":"","sources":["../../src/internal/framework-storage-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,WAAW,8BAA8B;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,8BAA8B,GACpC,iBAAiB,GAAG,SAAS,CAI/B"}
+{"version":3,"file":"framework-storage-selection.d.ts","sourceRoot":"","sources":["../../src/internal/framework-storage-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIrD,MAAM,WAAW,8BAA8B;IAC7C,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACjD,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtD,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,8BAA8B,GACpC,iBAAiB,GAAG,SAAS,CA2B/B"}

package/dist/internal/framework-storage-selection.js

@@ -2,34 +2,68 @@
  * Which backend framework session state is mirrored to.
  *
  * Framework state — session records, event chunks, the continuation index —
- * is how a session outlives the process that served it. Today that mirror
- * exists only when the agent author wrote `agent/storage.ts`, which makes
- * platform durability an agent-level decision: of the first-party agents,
- * some choose `cursorHostedStorage()` and some choose `fileKv()` (pod-local
- * disk, lost on pod replacement), and one selects between them at runtime by
- * reading the deployment-id environment variable itself.
+ * is how a session outlives the process that served it. On architecture v1
+ * that mirror exists only when the agent author wrote `agent/storage.ts`,
+ * which makes platform durability an agent-level decision: of the
+ * first-party agents, some choose `cursorHostedStorage()` and some choose
+ * `fileKv()` (pod-local disk, lost on pod replacement), and one selects
+ * between them at runtime by reading the deployment-id environment variable
+ * itself.
  *
- * That selection is a hosting-mode question, not an authoring question, and
- * this module is where it will move. It deliberately reproduces today's
- * behavior exactly for now — authored definition or nothing — so the change
- * that makes framework durability automatic is a change to
- * {@link selectFrameworkStorageDefinition} alone, reviewable on its own and
- * revertable without touching the engine.
+ * That selection is a hosting-mode question, not an authoring question.
+ * Architecture v2 moves it here: `agent/storage.ts` is rejected at
+ * discovery (error diagnostic, so serve and deploy fail early), and the
+ * platform picks the default —
+ *
+ * - **Cursor-managed hosting** (the deployment-generation environment
+ *   variable is set, same signal that registers `GET /v1/manifest`):
+ *   the Cursor-hosted backend, so session records, event chunks, `host.kv`,
+ *   eval runs, and A/B samples land in the control plane and survive pod
+ *   replacement. The API key resolves through the full credential chain on
+ *   every call because hosted freeze snapshots listen unsigned and the
+ *   binder drops the key file after restore.
+ * - **Self-hosted**: no mirror. `--state-root` is the durable copy, which
+ *   is correct when the operator owns the disk.
+ *
+ * v1 keeps the authored definition (or nothing) so existing deployments are
+ * untouched while they run.
  *
  * Local disk is not part of this decision. `<stateRoot>/sessions/<id>/`
  * already holds `session.json` and `events.ndjson` unconditionally, through
  * the session store; what this selects is the durable mirror *beyond* the
  * pod's filesystem.
  */
+import { defineStorage } from "../storage.js";
+import { cursorHostedStorage } from "../storage-backends/cursor-hosted.js";
+import { resolveApiKeySync } from "./cursor/credentials.js";
+import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
 /**
  * Pick the backend for framework session state.
  *
  * Returns `undefined` when there is no mirror, in which case the pod's local
- * disk is the only copy — the condition F0 exists to remove for hosted
- * deployments.
+ * disk is the only copy.
  */
 export function selectFrameworkStorageDefinition(input) {
-    // Today: the author decides, or there is no mirror. Hosting-mode selection
-    // replaces this body; every caller already routes through here.
-    return input.authored;
+    var _a;
+    if (input.architecture !== "v2") {
+        // v1: the author decides, or there is no mirror.
+        return input.authored;
+    }
+    if (input.authored !== undefined) {
+        // Discovery rejects agent/storage.ts on v2 before an engine is built;
+        // an authored definition reaching this point is a wiring bug. Raise
+        // rather than silently discard what the author believes is configured.
+        throw new Error('defineStorage (agent/storage.ts) is not supported on architecture "v2": storage is platform-selected. Delete the file.');
+    }
+    const env = (_a = input.env) !== null && _a !== void 0 ? _a : process.env;
+    if (env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined) {
+        // Self-hosted v2: the state root is the durable copy.
+        return undefined;
+    }
+    return defineStorage(Object.assign({ name: "cursor-hosted" }, cursorHostedStorage({
+        // Full chain (env → key file → stored login): frozen engines listen
+        // unsigned and bind CURSOR_API_KEY_FILE at task time, after this
+        // definition is constructed.
+        apiKey: () => { var _a; return (_a = resolveApiKeySync()) === null || _a === void 0 ? void 0 : _a.apiKey; },
+    })));
 }

package/dist/internal/hosted-admission-context.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A `send()` captured outside the delivery (typically at channel `onStart`,
+ * which binds directly to the engine) reached the engine during a hosted
+ * admission window. Running it would start a local July session on a
+ * sessionless pod — invisible to the control plane, destroyed with the pod —
+ * so it fails loudly instead. This is a deterministic authored bug and is
+ * surfaced as a non-retryable 422 by the admission route.
+ */
+export declare class HostedAdmissionLocalSendError extends Error {
+    constructor();
+}
+/**
+ * Run `work` inside the hosted admission window. The context follows the
+ * async graph, including `waitUntil` task bodies scheduled during dispatch,
+ * so the engine can refuse local sends that bypass the capture stub.
+ */
+export declare function runDuringHostedAdmission<T>(work: () => T): T;
+/** True while executing inside a hosted admission window. */
+export declare function isDuringHostedAdmission(): boolean;
+//# sourceMappingURL=hosted-admission-context.d.ts.map

package/dist/internal/hosted-admission-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-admission-context.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-admission-context.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,cAQC;CACF;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAE5D;AAED,6DAA6D;AAC7D,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD"}

package/dist/internal/hosted-admission-context.js

@@ -0,0 +1,31 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+/**
+ * A `send()` captured outside the delivery (typically at channel `onStart`,
+ * which binds directly to the engine) reached the engine during a hosted
+ * admission window. Running it would start a local July session on a
+ * sessionless pod — invisible to the control plane, destroyed with the pod —
+ * so it fails loudly instead. This is a deterministic authored bug and is
+ * surfaced as a non-retryable 422 by the admission route.
+ */
+export class HostedAdmissionLocalSendError extends Error {
+    constructor() {
+        super("send() reached the local engine during hosted admission. A send " +
+            "captured at channel startup (onStart) bypasses hosted capture and " +
+            "would run an invisible local session on a sessionless pod. Use the " +
+            "per-delivery send passed to the task callback " +
+            "(task: (args) => args.send(…)) instead.");
+    }
+}
+const admissionWindow = new AsyncLocalStorage();
+/**
+ * Run `work` inside the hosted admission window. The context follows the
+ * async graph, including `waitUntil` task bodies scheduled during dispatch,
+ * so the engine can refuse local sends that bypass the capture stub.
+ */
+export function runDuringHostedAdmission(work) {
+    return admissionWindow.run(true, work);
+}
+/** True while executing inside a hosted admission window. */
+export function isDuringHostedAdmission() {
+    return admissionWindow.getStore() === true;
+}

package/dist/internal/hosted-delivery-protocol.d.ts

@@ -2,6 +2,10 @@ export declare const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
 export declare const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
 export declare const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
 export declare const HOSTED_EXECUTION_PATH = "/v1/internal/hosted-execution";
+export type HostedAdmissionManagedAutomation = {
+    automationUuid: string;
+    mcpServerNames: string[];
+};
 export type HostedAdmission = {
     v: 2;
     channelId: string;
@@ -11,6 +15,7 @@ export type HostedAdmission = {
     sessionMode: "event" | "continuation";
     mailboxContinuationKey: string;
     payload: unknown;
+    managedAutomation?: HostedAdmissionManagedAutomation;
 };
 export type HostedAdmissionOutcome = {
     ok: true;

package/dist/internal/hosted-delivery-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-delivery-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery-protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,QAAQ,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,GAAG,cAAc,CAAC;IACtC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAkBF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,eAAe,GAAG,SAAS,CAsB7B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,eAAe,GAAG,SAAS,CAe7B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAkBpC"}
+{"version":3,"file":"hosted-delivery-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery-protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE,MAAM,MAAM,gCAAgC,GAAG;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,QAAQ,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,GAAG,cAAc,CAAC;IACtC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,gCAAgC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAsDF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,eAAe,GAAG,SAAS,CAuB7B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,eAAe,GAAG,SAAS,CAe7B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAkBpC"}

package/dist/internal/hosted-delivery-protocol.js

@@ -11,11 +11,42 @@ const DELIVERY_KEYS = new Set([
     "sessionMode",
     "mailboxContinuationKey",
     "payload",
+    "managedAutomation",
 ]);
+const MANAGED_AUTOMATION_KEYS = new Set(["automationUuid", "mcpServerNames"]);
+/** More names than any real automation configures is a malformed envelope. */
+const MANAGED_AUTOMATION_MAX_SERVERS = 64;
 const EXECUTION_KEYS = new Set(["v", "admissionToken", "sessionPublicId"]);
 function boundedString(value, max) {
     return typeof value === "string" && value.length > 0 && value.length <= max;
 }
+/**
+ * Parse the optional managed-automation slice. Absent → valid (undefined);
+ * present-but-malformed → invalid (the whole admission fails closed, the
+ * strict posture the rest of the envelope already takes).
+ */
+function parseManagedAutomation(value) {
+    if (value === undefined) {
+        return {};
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const body = value;
+    if (Object.keys(body).some((key) => !MANAGED_AUTOMATION_KEYS.has(key)) ||
+        !boundedString(body.automationUuid, 128) ||
+        !Array.isArray(body.mcpServerNames) ||
+        body.mcpServerNames.length > MANAGED_AUTOMATION_MAX_SERVERS ||
+        !body.mcpServerNames.every((name) => boundedString(name, 256))) {
+        return undefined;
+    }
+    return {
+        managedAutomation: {
+            automationUuid: body.automationUuid,
+            mcpServerNames: body.mcpServerNames,
+        },
+    };
+}
 export function parseHostedAdmission(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return undefined;
@@ -29,7 +60,8 @@ export function parseHostedAdmission(value) {
         !boundedString(body.eventType, 128) ||
         !boundedString(body.deliveryId, 256) ||
         (body.sessionMode !== "event" && body.sessionMode !== "continuation") ||
-        !boundedString(body.mailboxContinuationKey, 512)) {
+        !boundedString(body.mailboxContinuationKey, 512) ||
+        parseManagedAutomation(body.managedAutomation) === undefined) {
         return undefined;
     }
     const prefix = body.sessionMode === "event" ? "evt:" : "cont:";

package/dist/internal/hosted-delivery.d.ts

@@ -18,8 +18,10 @@ type AdmissionDispatch = {
 };
 /**
  * Run authored admission without creating a framework session. V1 GitHub
- * `task` callbacks execute as sessionless work; `send` is captured and
- * resumed only after the control plane allocates `ses_…`.
+ * `task` callbacks execute as sessionless work; the first `send` is captured
+ * and executed only after the control plane allocates `ses_…`. Capturing
+ * does not terminate the caller — `send` returns an inert deferred handle so
+ * a task body runs to completion before the admission response is computed.
  */
 export declare function dispatchHostedAdmission(input: DispatchInput): Promise<AdmissionDispatch>;
 export declare function registerHostedDeliveryRoute(input: {

package/dist/internal/hosted-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-delivery.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,eAAe,EAGrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAgBF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA2G5B;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,GACvB,kBAAkB,CAAC;CACvB,GAAG,IAAI,CAkJP"}
+{"version":3,"file":"hosted-delivery.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AASrB,OAAO,EAKL,KAAK,eAAe,EAGrB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AA6DF;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AA2GD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,GACvB,kBAAkB,CAAC;CACvB,GAAG,IAAI,CAsKP"}