@cursor/july 0.1.93 → 0.1.95

package/src/internal/hosted-delivery.ts

@@ -10,6 +10,14 @@ import type {
   ChannelHandlerArgs,
   SendMessageOptions,
 } from "../types.js";
+import {
+  createDeferredChannelSession,
+  DeferredChannelSessionError,
+} from "./deferred-channel-session.js";
+import {
+  HostedAdmissionLocalSendError,
+  runDuringHostedAdmission,
+} from "./hosted-admission-context.js";
 import {
   HOSTED_ADMISSION_PATH,
   HOSTED_DELIVERY_HEADER,
@@ -19,6 +27,7 @@ import {
   parseHostedAdmission,
   parseHostedExecution,
 } from "./hosted-delivery-protocol.js";
+import { recordHostedManagedAutomation } from "./hosted-managed-automation.js";
 import { errorResponse, readJsonObject } from "./http-channel.js";
 import type { Router } from "./router.js";
 
@@ -45,19 +54,66 @@ type ExecutionReply = {
   body: Record<string, unknown>;
 };
 
-class HostedSendAdmitted extends Error {
-  constructor(
-    readonly prompt: string,
-    readonly options: SendMessageOptions
-  ) {
-    super("hosted channel admitted a send");
+/**
+ * A second `send()` in one delivery is a deterministic authored bug — the
+ * wire protocol carries exactly one pending send per delivery — so it must
+ * fail the delivery exactly once. It surfaces as a 422 because the control
+ * plane retries 5xx admissions (fresh pod, side effects re-run, identical
+ * failure, up to the Temporal attempt cap); a non-5xx/408/429 status makes
+ * it reject the delivery non-retryably instead.
+ */
+class HostedSendLimitExceeded extends Error {
+  constructor() {
+    super(
+      "The hosted delivery protocol carries exactly one pending send per " +
+        "delivery, and this delivery already captured one. Combine both " +
+        "messages into a single send(), or split the work across deliveries."
+    );
   }
 }
 
+// Authored/task-derived text stays bounded on this internal response path
+// (and is never persisted to Temporal history by the control plane).
+const MAX_ERROR_MESSAGE_LENGTH = 1024;
+
+function boundedMessage(text: string): string {
+  return text.length > MAX_ERROR_MESSAGE_LENGTH
+    ? `${text.slice(0, MAX_ERROR_MESSAGE_LENGTH)}…`
+    : text;
+}
+
+/**
+ * Classify deterministic authored protocol violations as non-retryable 422
+ * admissions. Anything else returns `undefined` so callers fall through to
+ * the existing (retryable or rethrow) handling.
+ */
+function nonRetryableRejection(error: unknown): AdmissionDispatch | undefined {
+  const code =
+    error instanceof HostedSendLimitExceeded
+      ? "hosted_send_limit_exceeded"
+      : error instanceof DeferredChannelSessionError
+        ? "hosted_deferred_session_unusable"
+        : error instanceof HostedAdmissionLocalSendError
+          ? "hosted_local_send_rejected"
+          : undefined;
+  if (code === undefined) {
+    return undefined;
+  }
+  return {
+    response: errorResponse(
+      422,
+      code,
+      boundedMessage((error as Error).message)
+    ),
+  };
+}
+
 /**
  * Run authored admission without creating a framework session. V1 GitHub
- * `task` callbacks execute as sessionless work; `send` is captured and
- * resumed only after the control plane allocates `ses_…`.
+ * `task` callbacks execute as sessionless work; the first `send` is captured
+ * and executed only after the control plane allocates `ses_…`. Capturing
+ * does not terminate the caller — `send` returns an inert deferred handle so
+ * a task body runs to completion before the admission response is computed.
  */
 export async function dispatchHostedAdmission(
   input: DispatchInput
@@ -71,24 +127,28 @@ export async function dispatchHostedAdmission(
       ),
     };
   }
+  // The admission window marker follows the async graph into task bodies so
+  // the engine can refuse local sends that would bypass the capture stub.
+  return runDuringHostedAdmission(() => runAdmission(input, github));
+}
 
+async function runAdmission(
+  input: DispatchInput,
+  github: NonNullable<ReturnType<typeof getGitHubChannelOptions>>
+): Promise<AdmissionDispatch> {
   const background: Promise<unknown>[] = [];
-  let deferredSend: HostedSendAdmitted | undefined;
+  let captured: { message: string; options: SendMessageOptions } | undefined;
   const args = withPropagatingGitHubBackgroundErrors({
     ...input.args,
     send: async (message, options = {}) => {
-      throw new HostedSendAdmitted(message, options);
+      if (captured !== undefined) {
+        throw new HostedSendLimitExceeded();
+      }
+      captured = { message, options };
+      return createDeferredChannelSession();
     },
     waitUntil: (promise) => {
-      background.push(
-        promise.catch((error: unknown) => {
-          if (error instanceof HostedSendAdmitted) {
-            deferredSend = error;
-            return;
-          }
-          throw error;
-        })
-      );
+      background.push(promise);
     },
   });
   let dispatched: Response;
@@ -101,20 +161,9 @@ export async function dispatchHostedAdmission(
       args,
     });
   } catch (error) {
-    if (error instanceof HostedSendAdmitted) {
-      return {
-        response: Response.json({
-          ok: true,
-          v: HOSTED_DELIVERY_PROTOCOL_VERSION,
-          outcome: "send",
-        }),
-        pendingSend: {
-          channelId: input.delivery.channelId,
-          message: error.prompt,
-          options: error.options,
-          mailboxContinuationKey: input.delivery.mailboxContinuationKey,
-        },
-      };
+    const rejected = nonRetryableRejection(error);
+    if (rejected !== undefined) {
+      return rejected;
     }
     throw error;
   }
@@ -129,15 +178,20 @@ export async function dispatchHostedAdmission(
 
   try {
     await Promise.all(background);
-  } catch {
+  } catch (error) {
+    const rejected = nonRetryableRejection(error);
+    if (rejected !== undefined) {
+      return rejected;
+    }
     return {
-      response: Response.json(
-        { ok: false, error: "background_dispatch_failed" },
-        { status: 503 }
+      response: errorResponse(
+        503,
+        "background_dispatch_failed",
+        boundedMessage(error instanceof Error ? error.message : String(error))
       ),
     };
   }
-  if (deferredSend !== undefined) {
+  if (captured !== undefined) {
     return {
       response: Response.json({
         ok: true,
@@ -146,8 +200,8 @@ export async function dispatchHostedAdmission(
       }),
       pendingSend: {
         channelId: input.delivery.channelId,
-        message: deferredSend.prompt,
-        options: deferredSend.options,
+        message: captured.message,
+        options: captured.options,
         mailboxContinuationKey: input.delivery.mailboxContinuationKey,
       },
     };
@@ -170,6 +224,19 @@ export async function dispatchHostedAdmission(
   };
 }
 
+function withServerTiming(response: Response, durationMs: number): Response {
+  const headers = new Headers(response.headers);
+  headers.set(
+    "Server-Timing",
+    `agent_sdk;desc="hosted";dur=${Math.max(0, durationMs).toFixed(1)}`
+  );
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
 export function registerHostedDeliveryRoute(input: {
   router: Router;
   base: string;
@@ -215,22 +282,30 @@ export function registerHostedDeliveryRoute(input: {
     pattern: `${input.base}${HOSTED_ADMISSION_PATH}`,
     auth: [auth],
     handler: async (request) => {
+      const startedAt = performance.now();
+      const finish = (response: Response) =>
+        withServerTiming(response, performance.now() - startedAt);
       const delivery = parseHostedAdmission(await readJsonObject(request));
       if (delivery === undefined) {
-        return errorResponse(
-          400,
-          "invalid_hosted_admission",
-          "Expected a supported Agent SDK hosted-admission envelope."
+        return finish(
+          errorResponse(
+            400,
+            "invalid_hosted_admission",
+            "Expected a supported Agent SDK hosted-admission envelope."
+          )
         );
       }
+      recordHostedManagedAutomation(delivery);
       const channel = input.channels.find(
         (candidate) => candidate.id === delivery.channelId
       );
       if (channel === undefined) {
-        return errorResponse(
-          404,
-          "channel_not_found",
-          `No channel named "${delivery.channelId}" is mounted.`
+        return finish(
+          errorResponse(
+            404,
+            "channel_not_found",
+            `No channel named "${delivery.channelId}" is mounted.`
+          )
         );
       }
       const admitted = await dispatchHostedAdmission({
@@ -239,7 +314,7 @@ export function registerHostedDeliveryRoute(input: {
         args: input.buildHandlerArgs(delivery.channelId),
       });
       if (admitted.pendingSend === undefined) {
-        return admitted.response;
+        return finish(admitted.response);
       }
       pruneExpired();
       const admissionToken = randomBytes(24).toString("hex");
@@ -247,12 +322,14 @@ export function registerHostedDeliveryRoute(input: {
         send: admitted.pendingSend,
         expiresAt: Date.now() + pendingTtlMs,
       });
-      return Response.json({
-        ok: true,
-        v: HOSTED_DELIVERY_PROTOCOL_VERSION,
-        outcome: "send",
-        admissionToken,
-      });
+      return finish(
+        Response.json({
+          ok: true,
+          v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+          outcome: "send",
+          admissionToken,
+        })
+      );
     },
   });
   input.router.add({
@@ -260,31 +337,41 @@ export function registerHostedDeliveryRoute(input: {
     pattern: `${input.base}${HOSTED_EXECUTION_PATH}`,
     auth: [auth],
     handler: async (request) => {
+      const startedAt = performance.now();
+      const finish = (response: Response) =>
+        withServerTiming(response, performance.now() - startedAt);
+
       const execution = parseHostedExecution(await readJsonObject(request));
       if (execution === undefined) {
-        return errorResponse(
-          400,
-          "invalid_hosted_execution",
-          "Expected a supported Agent SDK hosted-execution envelope."
+        return finish(
+          errorResponse(
+            400,
+            "invalid_hosted_execution",
+            "Expected a supported Agent SDK hosted-execution envelope."
+          )
         );
       }
       pruneExpired();
       const admitted = pending.get(execution.admissionToken);
       if (admitted === undefined) {
-        return errorResponse(
-          409,
-          "hosted_admission_unavailable",
-          "The hosted admission token is missing or expired."
+        return finish(
+          errorResponse(
+            409,
+            "hosted_admission_unavailable",
+            "The hosted admission token is missing or expired."
+          )
         );
       }
       if (
         admitted.sessionPublicId !== undefined &&
         admitted.sessionPublicId !== execution.sessionPublicId
       ) {
-        return errorResponse(
-          409,
-          "hosted_admission_session_mismatch",
-          "The hosted admission token is already bound to another session."
+        return finish(
+          errorResponse(
+            409,
+            "hosted_admission_session_mismatch",
+            "The hosted admission token is already bound to another session."
+          )
         );
       }
       admitted.sessionPublicId = execution.sessionPublicId;
@@ -321,7 +408,7 @@ export function registerHostedDeliveryRoute(input: {
         };
       })();
       const reply = await admitted.execution;
-      return Response.json(reply.body, { status: reply.status });
+      return finish(Response.json(reply.body, { status: reply.status }));
     },
   });
 }

package/src/internal/hosted-managed-automation.ts

@@ -0,0 +1,72 @@
+/**
+ * Managed-automation envelope slices by provider delivery id (plan 0002
+ * G2), recorded at hosted admission so channel code running the delivery's
+ * task (or session turn) can attach the customer's MCP servers through the
+ * control-plane relay. In-memory and TTL-bounded like the hosted pending-
+ * send table: the envelope slice carries names only (never credentials)
+ * and evaporates with the process.
+ *
+ * A leaf module (protocol type import only) so product channels can read
+ * it without pulling the hosted-delivery route — and its session-engine
+ * dependency graph — into their bundles.
+ *
+ * INTERNAL: first-party multi-tenant deployment plumbing. Deliberately
+ * excluded from the published `@cursor/july` npm package (see the `files`
+ * whitelist); consumed by internal deployments via relative source imports.
+ */
+
+import type { HostedAdmissionManagedAutomation } from "./hosted-delivery-protocol.js";
+
+const managedAutomationByDelivery = new Map<
+  string,
+  { managedAutomation: HostedAdmissionManagedAutomation; expiresAt: number }
+>();
+/** Long enough to outlive a slow review run kicked off by the delivery. */
+const MANAGED_AUTOMATION_TTL_MS = 60 * 60_000;
+const MANAGED_AUTOMATION_MAX_ENTRIES = 10_000;
+
+export function recordHostedManagedAutomation(delivery: {
+  deliveryId: string;
+  managedAutomation?: HostedAdmissionManagedAutomation;
+}): void {
+  if (delivery.managedAutomation === undefined) {
+    return;
+  }
+  const now = Date.now();
+  for (const [key, entry] of managedAutomationByDelivery) {
+    if (entry.expiresAt <= now) {
+      managedAutomationByDelivery.delete(key);
+    }
+  }
+  if (managedAutomationByDelivery.size >= MANAGED_AUTOMATION_MAX_ENTRIES) {
+    managedAutomationByDelivery.clear();
+  }
+  managedAutomationByDelivery.set(delivery.deliveryId, {
+    managedAutomation: delivery.managedAutomation,
+    expiresAt: now + MANAGED_AUTOMATION_TTL_MS,
+  });
+}
+
+/**
+ * The managed automation the control plane attributed to a hosted delivery,
+ * when the envelope carried one. Undefined for non-managed deliveries,
+ * expired entries, and non-hosted (webhook/stream) dispatch paths.
+ */
+export function getHostedManagedAutomation(
+  deliveryId: string
+): HostedAdmissionManagedAutomation | undefined {
+  const entry = managedAutomationByDelivery.get(deliveryId);
+  if (entry === undefined) {
+    return undefined;
+  }
+  if (entry.expiresAt <= Date.now()) {
+    managedAutomationByDelivery.delete(deliveryId);
+    return undefined;
+  }
+  return entry.managedAutomation;
+}
+
+/** Drop recorded managed-automation slices (tests only). */
+export function resetHostedManagedAutomationForTest(): void {
+  managedAutomationByDelivery.clear();
+}

package/src/internal/mcp-endpoint.ts

@@ -252,9 +252,9 @@ function buildToolMcpServer(
  * travels in the turn's MCP config or lands on the VM.
  *
  * The engine gates access twice, mirroring the authored server-tool path:
- * only bridgeable names (`isCloudBridgedConnection`) — `hostOnly`
- * connections and unknown names stay unreachable from a VM even with a
- * valid endpoint credential — and only while the bound session has a turn
+ * only bridgeable names (`isCloudBridgedConnection`) — unknown names
+ * stay unreachable from a VM even with a valid endpoint credential —
+ * and only while the bound session has a turn
  * in flight (`hasActiveTurn`), so a credential that persists on a VM after
  * its turn cannot keep calling host connectors. Listing forwards per
  * request, so a server that adds tools mid-session (`tools/list_changed`,

package/src/internal/mcp-host.ts

@@ -1,12 +1,13 @@
 /**
- * Host-side MCP clients for authored `agent/mcp-connections/*`.
+ * Host-side MCP clients for authored `agent/mcp-connections/*` and
+ * `agent/host-connections/*`.
  *
- * Every connection is always available in three places:
- * - the Cursor agent, via SDK `mcpServers` (local harness or cloud)
- * - the agent-serve host, for in-process server tools through
- *   {@link HostMcpRegistry} on {@link ToolContext.host}.mcp
- * - channel / webhook route handlers through
- *   {@link HostMcpRegistry} on {@link ChannelHandlerArgs.host}.mcp
+ * Model-visible connections (`mcp-connections/`) are available in three
+ * places: SDK `mcpServers`, in-process server tools through
+ * {@link HostMcpRegistry} on {@link ToolContext.host}.mcp, and channel /
+ * webhook handlers through {@link HostMcpRegistry} on
+ * {@link ChannelHandlerArgs.host}.mcp. Host connections skip the model
+ * and stay on `host.mcp` plus `mcp oauth`.
  */
 
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";

package/src/internal/peer-connections.ts

@@ -37,7 +37,10 @@ export function collectPeerConnections(
   const bySlug = new Map<string, PeerConnectionRef[]>();
   for (const { slug, project } of mounts) {
     const refs: PeerConnectionRef[] = [];
-    for (const connection of project.agent.connections) {
+    for (const connection of [
+      ...project.agent.connections,
+      ...(project.agent.hostConnections ?? []),
+    ]) {
       if (!isPeerConnectionTransport(connection.transport)) {
         continue;
       }

package/src/internal/playground/static.ts

@@ -96,9 +96,7 @@ export function renderPlaygroundAsset(file: string): Response {
 }
 
 /** Slack surface summary for the host home / `GET /v1/agents`. */
-export type AgentIndexSlack =
-  | { kind: "cursor-account"; handle: string }
-  | { kind: "socket" };
+export type AgentIndexSlack = { kind: "socket" };
 
 /** One row on the host home page and `GET /v1/agents`. */
 export interface AgentIndexEntry {

package/src/internal/resolved-connections.ts

@@ -46,13 +46,13 @@ export function validateMountConnectionsConfig(args: {
     return;
   }
   const label = args.slug === "" ? args.project.name : args.slug;
-  const hostOnlyNames = new Set(
-    agent.connections
-      .filter((connection) => connection.hostOnly === true)
-      .map((connection) => connection.name)
+  const hostConnectionNames = new Set(
+    (args.project.agent.hostConnections ?? []).map(
+      (connection) => connection.name
+    )
   );
   const filteredRefs = args.accountRefs.filter(
-    (ref) => ref.servers !== undefined && !hostOnlyNames.has(ref.name)
+    (ref) => ref.servers !== undefined && !hostConnectionNames.has(ref.name)
   );
   if (filteredRefs.length === 0) {
     return;
@@ -140,10 +140,8 @@ export function resolveMountConnections(args: {
 
   if (cloudCapable) {
     const hostOauthNames = agent.connections
-      .filter(
-        (connection) =>
-          connection.hostOnly !== true &&
-          isHostOauthConnectionTransport(connection.transport)
+      .filter((connection) =>
+        isHostOauthConnectionTransport(connection.transport)
       )
       .map((connection) => connection.name);
     if (hostOauthNames.length > 0) {
@@ -154,7 +152,7 @@ export function resolveMountConnections(args: {
             )}) reach cloud turns through the host connection bridge; their tokens stay on this serve host.`
           : `[agent-sdk] warning: agent "${label}" has host-OAuth MCP connections (${hostOauthNames.join(
               ", "
-            )}) whose tokens live on this serve host; cloud-runtime turns omit them. Mark them \`hostOnly: true\` and call them from host tools, or drop \`oauth\` and authorize the server another way.`
+            )}) whose tokens live on this serve host; cloud-runtime turns omit them. Serve with a cloud tools URL so they reach turns through the host connection bridge, or drop \`oauth\` and authorize the server another way.`
       );
     }
   }

package/src/internal/review-comments.ts

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import type { HostGitHubClient } from "../types.js";
+import { parsePrUrl } from "./scm/pr-url.js";
 
 export type ReviewCommentPublisher = "local_gh" | "host_github" | "host_origin";
 
@@ -198,8 +199,15 @@ export type ReviewThreadResolverImplementation = {
 export function resolveScmReviewTarget(
   prUrl: string
 ): ScmReviewTarget | undefined {
-  const parsed = parseReviewPrUrl(prUrl);
-  return parsed.kind === "valid" ? parsed.value : undefined;
+  const parsed = parsePrUrl(prUrl);
+  if (parsed === undefined) {
+    return undefined;
+  }
+  return {
+    provider: parsed.provider,
+    repo: `${parsed.owner}/${parsed.repo}`,
+    prNumber: parsed.number,
+  };
 }
 
 /**
@@ -1243,117 +1251,6 @@ function skippedResolve(detail: string): ResolveReviewThreadsResult {
   };
 }
 
-const ORIGIN_PR_PAGE_HOST_PATTERN = /^origin(-[a-z0-9]+)?\.cursor\.com$/i;
-
-/**
- * Provider-neutral PR URL parse. GitHub.com plus the Origin page shapes
- * `parsePrTarget` in security-review-lib accepts. Duplicated here so
- * agent-serve does not import that package.
- */
-function parseReviewPrUrl(
-  prUrl: string
-):
-  | { kind: "valid"; value: ScmReviewTarget }
-  | { kind: "invalid"; detail: string } {
-  let url: URL;
-  try {
-    url = new URL(prUrl);
-  } catch (error) {
-    return {
-      kind: "invalid",
-      detail: `unparseable PR URL: ${error instanceof Error ? error.message : String(error)}`,
-    };
-  }
-
-  const parts = url.pathname.split("/").filter(Boolean);
-  const hostname = url.hostname;
-
-  if (hostname === "github.com" && parts.length >= 4 && parts[2] === "pull") {
-    const prNumber = Number(parts[3]);
-    if (Number.isInteger(prNumber) && prNumber > 0) {
-      return {
-        kind: "valid",
-        value: {
-          provider: "github",
-          repo: `${parts[0]}/${parts[1]}`,
-          prNumber,
-        },
-      };
-    }
-  }
-
-  if (
-    ORIGIN_PR_PAGE_HOST_PATTERN.test(hostname) &&
-    parts.length >= 4 &&
-    parts[2] === "github"
-  ) {
-    const prNumber = Number(parts[3]);
-    if (Number.isInteger(prNumber) && prNumber > 0) {
-      return {
-        kind: "valid",
-        value: {
-          provider: "origin",
-          repo: `${parts[0]}/${parts[1]}`,
-          prNumber,
-        },
-      };
-    }
-  }
-
-  if (
-    /^(www\.)?cursor\.com$/i.test(hostname) &&
-    parts[0] === "codebase" &&
-    parts.length >= 5 &&
-    parts[3] === "pull"
-  ) {
-    const prNumber = Number(parts[4]);
-    if (Number.isInteger(prNumber) && prNumber > 0) {
-      return {
-        kind: "valid",
-        value: {
-          provider: "origin",
-          repo: `${parts[1]}/${parts[2]}`,
-          prNumber,
-        },
-      };
-    }
-  }
-
-  if (hostname === "review.cursor.com" && parts[0] === "pr") {
-    if (parts.length >= 5 && parts[3] === "github") {
-      const prNumber = Number(parts[4]);
-      if (Number.isInteger(prNumber) && prNumber > 0) {
-        return {
-          kind: "valid",
-          value: {
-            provider: "origin",
-            repo: `${parts[1]}/${parts[2]}`,
-            prNumber,
-          },
-        };
-      }
-    }
-    if (parts.length >= 4) {
-      const prNumber = Number(parts[3]);
-      if (Number.isInteger(prNumber) && prNumber > 0) {
-        return {
-          kind: "valid",
-          value: {
-            provider: "origin",
-            repo: `${parts[1]}/${parts[2]}`,
-            prNumber,
-          },
-        };
-      }
-    }
-  }
-
-  return {
-    kind: "invalid",
-    detail: "unparseable PR URL: not a GitHub or Origin pull request",
-  };
-}
-
 function parseGithubPrUrl(
   prUrl: string
 ):