@cursor/july 0.1.93 → 0.1.95

package/src/types.ts

@@ -553,8 +553,9 @@ export interface SlackNudgeHostApi {
  */
 export interface HostContext {
   /**
-   * Authored MCP connections (`agent/mcp-connections/*`). Call a specific MCP
-   * tool deterministically without going through the agent loop.
+   * Authored MCP connections (`agent/mcp-connections/*` and
+   * `agent/host-connections/*`). Call a specific MCP tool deterministically
+   * without going through the agent loop.
    */
   mcp: HostMcpRegistry;
   /**
@@ -921,6 +922,33 @@ export type ToolNeedsApproval<TInput> =
  */
 export type ToolEffect = "read" | "write";
 
+/** Authored `defineConnection({ effects })` — one effect or a set. */
+export type ConnectionEffects = ToolEffect | readonly ToolEffect[];
+
+const TOOL_EFFECTS: readonly ToolEffect[] = ["read", "write"];
+
+export function isToolEffect(value: unknown): value is ToolEffect {
+  return value === "read" || value === "write";
+}
+
+/**
+ * Normalize authored {@link ConnectionConfig.effects} to a unique list.
+ * Invalid values are left for discovery to reject — this only collapses
+ * `"read"` / `["read"]` / duplicates.
+ */
+export function normalizeConnectionEffects(
+  effects: ConnectionEffects
+): ToolEffect[] {
+  const list = typeof effects === "string" ? [effects] : [...effects];
+  const unique: ToolEffect[] = [];
+  for (const effect of TOOL_EFFECTS) {
+    if (list.includes(effect)) {
+      unique.push(effect);
+    }
+  }
+  return unique;
+}
+
 /**
  * A tool's declared {@link ToolEffect} — fixed, or decided per call from
  * validated input for tools that read or write depending on their arguments
@@ -1185,12 +1213,6 @@ export type ConnectionConfig = (
 ) & {
   /** Documentation only; shown in `info` output. */
   description?: string;
-  /**
-   * Omit from SDK `mcpServers` (model never sees it). Still available on
-   * `host.mcp` for server tools / channel handlers. Does not affect
-   * cloud-native account connectors provisioned by the platform.
-   */
-  hostOnly?: boolean;
   /**
    * Per-session auth: called at turn-build time with the session's
    * {@link SessionInfo}, returning headers merged over the transport's
@@ -1239,12 +1261,27 @@ export type ConnectionConfig = (
    * fails the turn — a turn never silently runs with a shrunken toolset.
    * Local runtime only, like all server tools: a `runtime: "cloud"` agent
    * fails discovery, and hybrid per-send cloud sessions refuse the turn.
-   * Not combinable with {@link hostOnly} (advertising puts the tools in
-   * the model's toolset; hostOnly means off the model — discovery rejects
-   * the pair). The listing runs once per turn; point this at endpoints
-   * that can answer `tools/list` cheaply.
+   * The listing runs once per turn; point this at endpoints that can
+   * answer `tools/list` cheaply.
    */
   advertiseTools?: boolean;
+  /**
+   * Intended effects of tools this connection serves. When set, only
+   * tools whose classified effect is in this set are advertised — a
+   * connection that wants reads never puts a write, or a tool nothing
+   * classified, in the model's toolset.
+   *
+   * Classification is the same fail-closed read of MCP annotations the
+   * dry-run gate uses (`readOnlyHint` / `destructiveHint`). A tool the
+   * server does not classify is omitted, not guessed. Servers that leave
+   * tools unannotated stay empty here until they annotate or a trusted
+   * listing injects a known-read hint.
+   *
+   * Requires {@link advertiseTools}: this filters the named passthroughs
+   * the model sees. A single value (`"read"`) and an array (`["read"]`)
+   * are the same.
+   */
+  effects?: ConnectionEffects;
 };
 
 /**
@@ -1266,15 +1303,13 @@ export function isInlineStdioConnection(
   connection: ConnectionConfig
 ): connection is InlineStdioConnectionConfig & {
   description?: string;
-  hostOnly?: boolean;
 } {
   return "tools" in connection && connection.tools !== undefined;
 }
 
 /**
  * An MCP connection is available to the agent (SDK `mcpServers`), host
- * (`ctx.host.mcp`), and channel/schedule handlers — unless `hostOnly`,
- * which keeps it off the model surface only.
+ * (`ctx.host.mcp`), and channel/schedule handlers.
  */
 export type ConnectionDefinition = ConnectionConfig &
   BrandedDefinition<"connection">;
@@ -1847,6 +1882,19 @@ export const DIRECT_TOOL_CALL_CHANNEL_ID = "direct";
 export interface CallToolOptions {
   /** Who is calling; becomes the tool context's session auth. */
   auth?: AuthContext | null;
+  /**
+   * Address the session by its wire continuation token
+   * (`<channelId>:<key>`, as `/v1/sessions` lists it). A token that maps
+   * to a live (or restorable) session behaves exactly like passing that
+   * session's {@link sessionId} — ownership check, turn serialization, and
+   * event recording included. A token with no session behind it runs the
+   * call scratch-bound with the token's channel id and continuation key as
+   * the call's session identity, so deployments whose tools resolve state
+   * from the continuation key (e.g. VFS mounts rebuilt by a binding
+   * resolver) can serve it with no live session. Mutually exclusive with
+   * {@link sessionId}.
+   */
+  continuationToken?: string;
   /**
    * Run the tool inside an existing session: the tool sees that session's
    * info and materialized workspace, and the call is recorded on the
@@ -1878,6 +1926,14 @@ export interface ToolCallOutcome {
   durationMs: number;
   /** Present when the call ran inside an existing session. */
   sessionId?: string;
+  /**
+   * Present (true) when a session-bound call could not materialize the
+   * session's harness cwd and ran in a scratch workspace instead. The
+   * session identity still applied (read-effect calls only get here), but
+   * `ctx.workspaceDir` was not the session workspace — callers rendering
+   * results as session state should surface this.
+   */
+  scratchWorkspace?: true;
 }
 
 /**
@@ -2172,12 +2228,6 @@ export interface ChannelMeta {
    * by `info` so watched channels are auditable.
    */
   slackChannelPosts?: readonly string[];
-  /**
-   * For Slack packs riding the signed-in Cursor account's Slack connection
-   * (`slackChannel({ cursorAccount: true })`): inbound relays from
-   * `/v0/slack-events` instead of Socket Mode.
-   */
-  slackCursorAccount?: boolean;
 }
 
 export interface ChannelConfig<TState = JsonValue> {
@@ -2648,6 +2698,8 @@ export interface DiscoveredTool {
    * refused — see `decideToolCall`.
    */
   advertised?: true;
+  /** Name of the advertising connection an advertised tool came from. */
+  connection?: string;
   /**
    * Agent tools: script body materialized under
    * `.agent-serve/tools/<name>.sh`.
@@ -2672,11 +2724,15 @@ export interface DiscoveredConnection {
   name: string;
   transport: ConnectionTransport;
   description?: string;
-  hostOnly?: boolean;
   /** Per-session auth from {@link ConnectionConfig.auth} (http/sse only). */
   auth?: ConnectionAuthProvider;
   /** Advertise-by-name from {@link ConnectionConfig.advertiseTools}. */
   advertiseTools?: boolean;
+  /**
+   * Normalized intended effects from {@link ConnectionConfig.effects}.
+   * Absent means every listed tool is advertised.
+   */
+  effects?: readonly ToolEffect[];
 }
 
 export interface DiscoveredChannel {
@@ -2749,6 +2805,11 @@ export interface ResolvedAgent {
   tools: DiscoveredTool[];
   skills: DiscoveredSkill[];
   connections: DiscoveredConnection[];
+  /**
+   * MCP connections from `agent/host-connections/`. Host tools and
+   * `mcp oauth` see them; the model does not.
+   */
+  hostConnections?: DiscoveredConnection[];
   subagents: ResolvedAgent[];
   seedFiles: SeedFile[];
 }
@@ -2816,14 +2877,20 @@ export interface AgentProjectInfo {
     description: string;
     execution: ToolExecution;
     needsApproval: boolean;
+    /**
+     * The tool's declared {@link ToolEffect} when static, `"dynamic"` when
+     * declared as a predicate. Absent when the author declared nothing —
+     * "unknown", not "mutates".
+     */
+    effect?: ToolEffect | "dynamic";
     inputSchema: JsonSchemaObject;
   }>;
   skills: Array<{ name: string; description: string }>;
   connections: Array<{
     name: string;
     transport: string;
-    hostOnly?: boolean;
     advertiseTools?: boolean;
+    effects?: readonly ToolEffect[];
     /**
      * Present only for `cursorAccount` connections: the connector-name
      * allowlist, or `"*"` for every connected server. Structured twin of the

package/templates/agentic-owners/README.md

@@ -58,7 +58,7 @@ policy only) opts paths out entirely.
 - One model turn per PR head assesses the diff against the base rubric
   (`agent/lib/owners/prompts/base-review.md`) plus matched rule prompts.
 - The model records a verdict with `record_review`; the host recomputes
-  the policy and applies the deterministic decision — approve, or request
+  the policy and applies the deterministic decision: approve, or request
   the policy owners (max 2, never the author) and leave one comment it
   keeps updated.
 - The model never writes to GitHub. Broken policy files fail closed with

package/templates/agentic-owners/agent/agent.ts

@@ -1,18 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
   tools: ["read", "grep", "glob", "ls"],
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "agentic-owners"),
   },
 });

package/templates/agentic-owners/agent/channels/github.ts

@@ -22,10 +22,8 @@ const REVIEW_ACTIONS = new Set([
 let log: (line: string) => void = () => {};
 
 export default githubChannel({
-  // With repos configured, the signed-in Cursor account supplies both the
-  // PR event stream and a repo-scoped GitHub credential — no webhook or
-  // GitHub App setup. Empty repos boots without the binding so a fresh
-  // scaffold's `dev` / `eval` run; use `agent-sdk github replay` there.
+  // Empty `repos` skips the Cursor GitHub binding so `dev` / `eval` boot
+  // on a fresh scaffold.
   cursorAccount: config.repos.length > 0 ? { repos: config.repos } : undefined,
   // The model never writes to GitHub; record_review actuates host-side.
   deliverReplies: false,
@@ -33,9 +31,7 @@ export default githubChannel({
     log = (line) => args.logger(`[agentic-owners] ${line}`);
   },
   onPullRequest: async (ctx, pr) => {
-    // A base retarget re-resolves the policy against the new base: the diff
-    // and the governing policy files both changed, so the old verdict — and
-    // any approval it produced — no longer covers this PR. The fresh
+    // A base retarget re-resolves policy against the new base. The fresh
     // actuation dismisses a leftover approve when the new decision holds.
     const baseRetargeted =
       pr.action === "edited" && pr.baseRefChangedFrom !== undefined;
@@ -54,9 +50,8 @@ export default githubChannel({
     try {
       const state = await loadReviewState(forge, log);
       if (!state.enrolled) {
-        // Enrollment can end while an agent approval is live (base retarget,
-        // owned files dropped); dismiss it instead of leaving it counting
-        // toward branch protection under a policy that never granted it.
+        // Enrollment can end while an agent approval is live; dismiss it
+        // instead of leaving it counting toward branch protection.
         return {
           task: () =>
             dismissStaleApprovals(
@@ -69,14 +64,10 @@ export default githubChannel({
         auth: defaultGitHubAuth(ctx),
         message: renderReviewWake(state),
         title: `Review ${ctx.repository.fullName}#${pr.number}`,
-        // Freeze the assessed head host-side: record_review reads this file
-        // instead of trusting a model-supplied SHA, so a mid-turn push (or a
-        // prompt-injected SHA) can never line up with the live head.
         workspaceFiles: { "pr/head.sha": state.pr.headSha },
       };
     } catch (error) {
       if (error instanceof AgenticOwnersConfigValidationError) {
-        // Fail closed but visibly: comment the issues, review nothing.
         return { task: () => reportPolicyError(forge, error) };
       }
       throw error;

package/templates/agentic-owners/agent/lib/config.ts

@@ -1,11 +1,3 @@
-/**
- * The one file to edit: which GitHub repositories the agent reviews.
- *
- * Setting it streams PR events and a repo-scoped GitHub credential through
- * your signed-in Cursor account (`agent-sdk login`) — no webhook or GitHub
- * App setup. While empty, the agent still runs locally against replayed
- * PRs (`agent-sdk github replay <pr-url>`).
- */
 const config = {
   repos: [] as string[], // e.g. ["acme/api"]
 };

package/templates/agentic-owners/agent/lib/review.ts

@@ -1,8 +1,5 @@
-// Policy resolution and actuation over the GitHub API — no repo checkout.
-// Every trusted input (policy files, rule prompts) is read from the PR's
-// **base ref**, so a PR cannot exempt itself by editing its own governance
-// files. Mirrors the Agentic Owners pipeline's `resolvePolicyForPr`, minus
-// the linguist-generated partition and content caching.
+// Policy files and rule prompts are read from the PR's base ref so a PR
+// cannot exempt itself by editing its own governance files.
 
 import {
   decideApproval,
@@ -297,12 +294,6 @@ export async function loadReviewState(
   };
 }
 
-/**
- * The model turn's wake message: composed rubric, PR context, and the
- * host-fetched diff. Fenced so author-controlled patch bytes cannot escape
- * into the trusted markdown (the fence outruns any backtick run inside the
- * patch).
- */
 /**
  * Filenames are author-controlled and render outside the diff fence: strip
  * control characters and backticks so a hostile path cannot fabricate
@@ -648,9 +639,6 @@ export async function actuateReview(input: {
   }).filter(
     (handle) => normalizeHandle(handle) !== normalizeHandle(pr.authorLogin ?? "")
   );
-  // The full decision — policy verdict plus the governance / evidence
-  // fail-closes — is computed in one place; from here on this function
-  // only writes.
   const decision = decideApproval({
     matchedRules: state.matchedRules,
     riskLevel: verdict.riskLevel,
@@ -742,7 +730,6 @@ export async function actuateReview(input: {
   const alreadyRequested = new Set(
     pr.requestedReviewers.map(normalizeHandle)
   );
-  // Adds fill only the remaining slots under the max-of-two rule.
   const newReviewers = decision.requestReviewers
     .filter((handle) => !alreadyRequested.has(normalizeHandle(handle)))
     .slice(

package/templates/agentic-owners/agent/tools/record_review.ts

@@ -41,10 +41,8 @@ export default defineTool({
           "not a GitHub pull-request session — reviews start from the github channel (agent-sdk github replay <pr-url> to test locally)",
       };
     }
-    // The channel wake froze the assessed head into the session workspace.
-    // Reading it here (instead of accepting a model-supplied SHA) means a
-    // mid-turn push can never line up with the live head: the actuation
-    // compares wake-observed against live and skips on any mismatch.
+    // Wake froze the assessed head into the session workspace. A model-supplied
+    // SHA is never trusted.
     let assessedHeadSha: string;
     try {
       assessedHeadSha = (

package/templates/demo/agent/agent.ts

@@ -1,18 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
   tools: ["read", "grep"],
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "demo"),
   },
 });

package/templates/pr-autofixer/README.md

@@ -34,8 +34,6 @@ enables auto-merge, or force-pushes.
 GitHub wakes (`cursorAccount`) resume an already-driven PR on comment,
 review, and failing CI. They do not start a session on `pull_request.opened`.
 
-Affinity and the webhook buffer live in `host.kv` (`agent/storage.ts`).
-
 ## Files to edit
 
 - `agent/lib/repos.ts`: repos Cursor relays SCM events for

package/templates/pr-autofixer/agent/agent.ts

@@ -1,19 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
-  runtime: "local",
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "pr-autofixer"),
   },
   cloud: {
     env: { type: "cloud" },

package/templates/pr-autofixer/agent/channels/slack.ts

@@ -1,8 +1,7 @@
 import { slackChannel } from "@cursor/july/channels/slack";
 
 export default slackChannel({
-  cursorAccount: true,
-  agentName: "PrAutofixer",
+  envPrefix: "PR_AUTOFIXER",
   suggestedPromptsTitle: "Try asking",
   suggestedPrompts: [
     {

package/templates/pr-autofixer/agent/lib/pr-state.ts

@@ -9,37 +9,25 @@ const PR_STATE_QUERY = `
   }
 `;
 
-export async function queryPullRequest<T>(input: {
+export async function fetchPrState(input: {
   github: HostGitHubClient;
   pr: GithubPrRef;
-  query: string;
-}): Promise<T | undefined> {
+}): Promise<string | undefined> {
   try {
     const octokit = await input.github.getOctokit();
     const data = await octokit.graphql<{
-      repository?: { pullRequest?: T | null } | null;
-    }>(input.query, {
+      repository?: { pullRequest?: { state?: string } | null } | null;
+    }>(PR_STATE_QUERY, {
       owner: input.pr.owner,
       repo: input.pr.repo,
       number: input.pr.number,
     });
-    return data.repository?.pullRequest ?? undefined;
+    return data.repository?.pullRequest?.state;
   } catch {
     return undefined;
   }
 }
 
-export async function fetchPrState(input: {
-  github: HostGitHubClient;
-  pr: GithubPrRef;
-}): Promise<string | undefined> {
-  const node = await queryPullRequest<{ state?: string }>({
-    ...input,
-    query: PR_STATE_QUERY,
-  });
-  return node?.state;
-}
-
 export function isTerminalPrState(
   state: string | undefined
 ): state is "CLOSED" | "MERGED" {

package/templates/pr-autofixer/agent/lib/repos.ts

@@ -1,4 +1,3 @@
-/** Repos Cursor relays SCM events for. Replace with your `owner/repo` list. */
 export const GITHUB_REPOS: readonly string[] = ["owner/repo"];
 
 export function githubRepos(): readonly string[] {

package/templates/security-help/README.md

@@ -1,6 +1,6 @@
 # Security help
 
-Answers security questions in Slack from your FAQ files and takes a first
+Answers security questions in Slack from your skills and takes a first
 look when someone pastes a GitHub pull request.
 
 ```bash
@@ -27,7 +27,7 @@ one in the playground.
 
 - `agent/lib/repos.ts`: repos it may read
 - `agent/channels/slack.ts`: channel ids to watch (`watch`)
-- `agent/knowledge/faq/`: answers for your company
+- `agent/skills/faq.md`: answers for your company
 - `agent/skills/`: how to look at a PR, a leak, or an access ask
 - `agent/instructions.md`: routing
 

package/templates/security-help/agent/agent.ts

@@ -2,8 +2,7 @@ import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
   name: "Security Help",
-  description:
-    "Answers security questions in Slack and takes a first look at a GitHub pull request.",
+  // Not DEFAULT_MODEL (grok-4.5).
   model: {
     id: "grok-4.6",
     params: [

package/templates/security-help/agent/channels/slack.ts

@@ -56,9 +56,6 @@ const handleSlack: SlackMessageHandler = async (ctx, message) => {
 
 export default slackChannel({
   envPrefix: "SECURITY_HELP",
-  policy: {
-    blockExternals: true,
-  },
   engagement: {
     channelPosts:
       watch.length === 0

package/templates/security-help/agent/instructions.md

@@ -1,20 +1,19 @@
 # Security help
 
-Answer security questions in Slack from the FAQ and skills.
+Answer security questions in Slack from the skills.
 If you do not know, say so and ask a human.
 
-Open the skill or FAQ for the ask. Those files are under `agent/skills/` and `agent/knowledge/faq/`.
+Open the skill for the ask.
 
-| If the ask is about | Open |
+| If the ask is about | Skill |
 | --- | --- |
-| A GitHub pull request | `agent/skills/security-pr-first-pass.md` |
-| An access request | `agent/skills/access-request.md` |
-| A leak, alert, or incident | `agent/skills/security-playbooks.md` |
-| Who can approve, privacy, or policy | `agent/knowledge/faq/approvals.md` |
-| Phishing text, email, or a call | `agent/knowledge/faq/phishing.md` |
-| Which team or channel owns a request | `agent/knowledge/faq/channels.md` |
-| Another security question | `agent/skills/security-first-pass.md` |
+| A GitHub pull request | security-pr-first-pass |
+| An access request | access-request |
+| A leak, alert, or incident | security-playbooks |
+| Who can approve, privacy, phishing, or which channel | faq |
 
 A pull request earlier in the thread is not this one.
 
+If this looks like production secrets out, an exploit, customer data out, malware, or an account takeover, they should stop it now and wait for a human.
+
 If you say an incident is over or a system is safe, show why. Looking at a pull request is not that.

package/templates/security-help/agent/skills/access-request.md

@@ -4,7 +4,7 @@ description: use when Slack has an access request or request number
 
 # Access request
 
-This skill is the access request. SaaS or identity-group asks go to the team named in `agent/knowledge/faq/channels.md`.
+This skill is the access request. SaaS or identity-group asks go to the team named in faq.
 
 Say what they asked for, why, and how long it lasts, from the request.
 Do not invent a grant that is not on the request.

package/templates/security-help/agent/skills/faq.md

@@ -0,0 +1,31 @@
+---
+description: use for company answers on approvals, phishing, and which channel owns a request
+---
+
+# Company FAQ
+
+If a section does not name an owner or team, say you do not know and ask a human.
+
+## Approvals
+
+Who can say yes depends on the request. If this file does not name an owner, ask a human for that topic.
+
+Privacy questions (training, retention, where prompts sit) go to a privacy or security person.
+
+## Channels
+
+`#security` is for security questions and phishing reports.
+
+Name the channel that owns SaaS access, identity groups, laptops, and billing.
+Until you do, say you do not know which team owns that request.
+
+## Phishing
+
+`#security` is where phishing and unexpected texts, emails, or calls go.
+If the thread is already about that, keep it there.
+
+Leave the original message alone. Do not reply, click, or send a 2FA code on it.
+Confirm unknown texts or calls over Slack or in person before acting.
+
+If an account looks compromised, they should lock it now and wait for a human.
+If security already gave a verdict in-thread, follow that.

package/templates/security-help/agent/skills/security-playbooks.md

@@ -6,7 +6,7 @@ description: use when Slack looks like a leak, alert, access, privacy, or incide
 
 If a production secret is already out, revoke or rotate it at the place that issued it, or turn it off there.
 
-For other alerts, follow the FAQ or runbook under `agent/knowledge/`.
+For other alerts, follow faq.
 Do not call it safe without a human.
 
 If you cannot see who is affected, skip that.

package/templates/security-help/package.json

@@ -8,8 +8,7 @@
     "dev": "agent-sdk dev"
   },
   "dependencies": {
-    "@cursor/july": "latest",
-    "zod": "^3.25.0"
+    "@cursor/july": "latest"
   },
   "devDependencies": {
     "@types/node": "^22.14.0",

package/templates/security-reviewer/agent/agent.ts

@@ -1,18 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
   tools: ["read", "grep"],
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "security-reviewer"),
   },
 });

package/templates/triage/README.md

@@ -43,4 +43,5 @@ on both issues. `agent-sdk eval` classifies and skips tracker writes.
 - `agent/instructions.md`: procedure around the rubric
 - `evals/triage.eval.ts`: three smoke cases
 
-`agent/lib/actuate.ts` talks to the tracker. The connection is host-only.
+`agent/lib/actuate.ts` talks to the tracker. Writes go through
+`record_triage` so the host owns comments, priority, and duplicate links.

package/templates/triage/agent/agent.ts

@@ -1,18 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
   tools: ["read", "grep", "glob", "ls"],
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "triage"),
   },
 });