@cursor/july 0.1.94 → 0.1.95

package/templates/pr-autofixer/agent/lib/pr-state.ts

@@ -9,37 +9,25 @@ const PR_STATE_QUERY = `
   }
 `;
 
-export async function queryPullRequest<T>(input: {
+export async function fetchPrState(input: {
   github: HostGitHubClient;
   pr: GithubPrRef;
-  query: string;
-}): Promise<T | undefined> {
+}): Promise<string | undefined> {
   try {
     const octokit = await input.github.getOctokit();
     const data = await octokit.graphql<{
-      repository?: { pullRequest?: T | null } | null;
-    }>(input.query, {
+      repository?: { pullRequest?: { state?: string } | null } | null;
+    }>(PR_STATE_QUERY, {
       owner: input.pr.owner,
       repo: input.pr.repo,
       number: input.pr.number,
     });
-    return data.repository?.pullRequest ?? undefined;
+    return data.repository?.pullRequest?.state;
   } catch {
     return undefined;
   }
 }
 
-export async function fetchPrState(input: {
-  github: HostGitHubClient;
-  pr: GithubPrRef;
-}): Promise<string | undefined> {
-  const node = await queryPullRequest<{ state?: string }>({
-    ...input,
-    query: PR_STATE_QUERY,
-  });
-  return node?.state;
-}
-
 export function isTerminalPrState(
   state: string | undefined
 ): state is "CLOSED" | "MERGED" {

package/templates/pr-autofixer/agent/lib/repos.ts

@@ -1,4 +1,3 @@
-/** Repos Cursor relays SCM events for. Replace with your `owner/repo` list. */
 export const GITHUB_REPOS: readonly string[] = ["owner/repo"];
 
 export function githubRepos(): readonly string[] {

package/templates/security-help/README.md

@@ -1,6 +1,6 @@
 # Security help
 
-Answers security questions in Slack from your FAQ files and takes a first
+Answers security questions in Slack from your skills and takes a first
 look when someone pastes a GitHub pull request.
 
 ```bash
@@ -27,7 +27,7 @@ one in the playground.
 
 - `agent/lib/repos.ts`: repos it may read
 - `agent/channels/slack.ts`: channel ids to watch (`watch`)
-- `agent/knowledge/faq/`: answers for your company
+- `agent/skills/faq.md`: answers for your company
 - `agent/skills/`: how to look at a PR, a leak, or an access ask
 - `agent/instructions.md`: routing
 

package/templates/security-help/agent/agent.ts

@@ -2,8 +2,7 @@ import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
   name: "Security Help",
-  description:
-    "Answers security questions in Slack and takes a first look at a GitHub pull request.",
+  // Not DEFAULT_MODEL (grok-4.5).
   model: {
     id: "grok-4.6",
     params: [

package/templates/security-help/agent/channels/slack.ts

@@ -56,9 +56,6 @@ const handleSlack: SlackMessageHandler = async (ctx, message) => {
 
 export default slackChannel({
   envPrefix: "SECURITY_HELP",
-  policy: {
-    blockExternals: true,
-  },
   engagement: {
     channelPosts:
       watch.length === 0

package/templates/security-help/agent/instructions.md

@@ -1,20 +1,19 @@
 # Security help
 
-Answer security questions in Slack from the FAQ and skills.
+Answer security questions in Slack from the skills.
 If you do not know, say so and ask a human.
 
-Open the skill or FAQ for the ask. Those files are under `agent/skills/` and `agent/knowledge/faq/`.
+Open the skill for the ask.
 
-| If the ask is about | Open |
+| If the ask is about | Skill |
 | --- | --- |
-| A GitHub pull request | `agent/skills/security-pr-first-pass.md` |
-| An access request | `agent/skills/access-request.md` |
-| A leak, alert, or incident | `agent/skills/security-playbooks.md` |
-| Who can approve, privacy, or policy | `agent/knowledge/faq/approvals.md` |
-| Phishing text, email, or a call | `agent/knowledge/faq/phishing.md` |
-| Which team or channel owns a request | `agent/knowledge/faq/channels.md` |
-| Another security question | `agent/skills/security-first-pass.md` |
+| A GitHub pull request | security-pr-first-pass |
+| An access request | access-request |
+| A leak, alert, or incident | security-playbooks |
+| Who can approve, privacy, phishing, or which channel | faq |
 
 A pull request earlier in the thread is not this one.
 
+If this looks like production secrets out, an exploit, customer data out, malware, or an account takeover, they should stop it now and wait for a human.
+
 If you say an incident is over or a system is safe, show why. Looking at a pull request is not that.

package/templates/security-help/agent/skills/access-request.md

@@ -4,7 +4,7 @@ description: use when Slack has an access request or request number
 
 # Access request
 
-This skill is the access request. SaaS or identity-group asks go to the team named in `agent/knowledge/faq/channels.md`.
+This skill is the access request. SaaS or identity-group asks go to the team named in faq.
 
 Say what they asked for, why, and how long it lasts, from the request.
 Do not invent a grant that is not on the request.

package/templates/security-help/agent/skills/faq.md

@@ -0,0 +1,31 @@
+---
+description: use for company answers on approvals, phishing, and which channel owns a request
+---
+
+# Company FAQ
+
+If a section does not name an owner or team, say you do not know and ask a human.
+
+## Approvals
+
+Who can say yes depends on the request. If this file does not name an owner, ask a human for that topic.
+
+Privacy questions (training, retention, where prompts sit) go to a privacy or security person.
+
+## Channels
+
+`#security` is for security questions and phishing reports.
+
+Name the channel that owns SaaS access, identity groups, laptops, and billing.
+Until you do, say you do not know which team owns that request.
+
+## Phishing
+
+`#security` is where phishing and unexpected texts, emails, or calls go.
+If the thread is already about that, keep it there.
+
+Leave the original message alone. Do not reply, click, or send a 2FA code on it.
+Confirm unknown texts or calls over Slack or in person before acting.
+
+If an account looks compromised, they should lock it now and wait for a human.
+If security already gave a verdict in-thread, follow that.

package/templates/security-help/agent/skills/security-playbooks.md

@@ -6,7 +6,7 @@ description: use when Slack looks like a leak, alert, access, privacy, or incide
 
 If a production secret is already out, revoke or rotate it at the place that issued it, or turn it off there.
 
-For other alerts, follow the FAQ or runbook under `agent/knowledge/`.
+For other alerts, follow faq.
 Do not call it safe without a human.
 
 If you cannot see who is affected, skip that.

package/templates/security-help/package.json

@@ -8,8 +8,7 @@
     "dev": "agent-sdk dev"
   },
   "dependencies": {
-    "@cursor/july": "latest",
-    "zod": "^3.25.0"
+    "@cursor/july": "latest"
   },
   "devDependencies": {
     "@types/node": "^22.14.0",

package/templates/security-reviewer/agent/agent.ts

@@ -1,18 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
   tools: ["read", "grep"],
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "security-reviewer"),
   },
 });

package/templates/triage/agent/agent.ts

@@ -1,18 +1,8 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { defineAgent } from "@cursor/july";
 
 export default defineAgent({
-  model: {
-    id: "grok-4.5",
-    params: [
-      { id: "effort", value: "high" },
-      { id: "fast", value: "true" },
-    ],
-  },
   tools: ["read", "grep", "glob", "ls"],
   local: {
     sandbox: true,
-    cwd: join(homedir(), ".cache", "agent-serve", "triage"),
   },
 });

package/templates/triage/agent/channels/queue.ts

@@ -25,7 +25,7 @@ export default defineChannel({
         const options = {
           continuationToken: parsed.issue.identifier,
           admission: "coalesce" as const,
-          ...(parsed.issue.title === "" ? {} : { title: parsed.issue.title }),
+          title: parsed.issue.title === "" ? undefined : parsed.issue.title,
         };
         const prompt = formatQueuePrompt(parsed.issue);
         if (isTrackerWebhook(body)) {

package/templates/triage/agent/channels/webhook.ts

@@ -35,9 +35,7 @@ export default defineChannel({
           send(formatQueuePrompt(parsed.issue), {
             continuationToken: parsed.issue.identifier,
             admission: "coalesce",
-            ...(parsed.issue.title === ""
-              ? {}
-              : { title: parsed.issue.title }),
+            title: parsed.issue.title === "" ? undefined : parsed.issue.title,
           })
         );
         return Response.json({