@cursor/july 0.1.94 → 0.1.96

package/AGENTS.md

@@ -33,9 +33,9 @@ built-in read/grep fail and sends models into retry loops.
 Before scaffolding, wiring channels, writing evals, or deploying, **read the
 matching skill under `skills/<task>/SKILL.md`** (paths
 below are relative to this package). Those files ship with `@cursor/july`.
-Cloud agents get the same published skills (except `operate`) via
-`GetManagedSkills`, which reads these files. Open them directly — there
-are no `.cursor/skills/` stubs for authoring.
+Cloud agents get the same published skills via `GetManagedSkills`,
+which reads these files. Open them directly. There are no
+`.cursor/skills/` stubs for authoring.
 
 | Skill | Read it when |
 | --- | --- |
@@ -49,7 +49,6 @@ are no `.cursor/skills/` stubs for authoring.
 | `skills/setup-slack/SKILL.md` | Slack wiring and Slack tool approvals |
 | `skills/mcp-auth/SKILL.md` | Host MCP OAuth (`mcp oauth`, `--store`, `advertiseTools`, `host-connections/`) |
 | `skills/debug/SKILL.md` | Something misbehaving locally (symptom → cause) |
-| `skills/operate/SKILL.md` | Dogfood host, corp ECS, hosted-platform map |
 
 Hosted-platform debug (stopped / slow start / health-fail, Datadog
 `cursor.agent_serve.*`) is the monorepo skill

package/dist/channels/deployments/types.d.ts

@@ -2,7 +2,7 @@ import type { ContinuationIdentity } from "../../continuation.js";
 import type { ChannelDefinition, ChannelHandlerArgs } from "../../types.js";
 /** {@link ChannelMeta.kind} value used by {@link deploymentsChannel}. */
 export declare const DEPLOYMENTS_CHANNEL_KIND = "deployments";
-export declare const DEPLOYMENT_EVENT_TYPES: readonly ["deployment.created", "deployment.succeeded"];
+export declare const DEPLOYMENT_EVENT_TYPES: readonly ["deployment.created", "deployment.succeeded", "deployment.failed"];
 export type DeploymentEventType = (typeof DEPLOYMENT_EVENT_TYPES)[number];
 export type DeploymentStatus = "pending" | "in_progress" | "success" | "failed";
 /** One deployment event, as the control plane records it. */

package/dist/channels/deployments/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/deployments/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,YACjC,oBAAoB,EACpB,sBAAsB,CACd,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,6EAA6E;IAC7E,OAAO,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAChC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/deployments/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,YACjC,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,CACX,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,6EAA6E;IAC7E,OAAO,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAChC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC"}

package/dist/channels/deployments/types.js

@@ -3,4 +3,5 @@ export const DEPLOYMENTS_CHANNEL_KIND = "deployments";
 export const DEPLOYMENT_EVENT_TYPES = [
     "deployment.created",
     "deployment.succeeded",
+    "deployment.failed",
 ];

package/dist/channels/github/github-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/github/github-channel.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAGV,WAAW,EACX,iBAAiB,EAEjB,kBAAkB,EAGnB,MAAM,gBAAgB,CAAC;AAiBxB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,oBAAoB,EAKpB,aAAa,EAEb,qBAAqB,EAErB,kBAAkB,EAGlB,sBAAsB,EAMtB,kBAAkB,EAClB,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,IAAI,CAC7B,kBAAkB,EAClB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CACvD,CAAC;AAqFF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CA2BvE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GACV,oBAAoB,GAAG,SAAS,CAUlC;AAED,wDAAwD;AACxD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,GACvB,MAAM,CAER;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,qDAAqD;AACrD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,mBAAmB,GACvB,MAAM,CAER;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAeR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,kBAAkB,GAAG,IAAI,CAW3B;AAQD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAUV;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYlC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAA;CAAE,GAAG,IAAI,CAiD3E;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAC,CAc5E;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAe7D,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,QAAQ,GACjB,qBAAqB,GAAG,SAAS,CAEnC;AAQD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,kBAAkB,GACvB,kBAAkB,CAEpB;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpB;AA2GD;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2CpB;AAQD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,oBAAoB,GAAG,SAAS,CAElC;AAED,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CA8GvC;AAk5BD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAeT"}
+{"version":3,"file":"github-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/github/github-channel.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAGV,WAAW,EACX,iBAAiB,EAEjB,kBAAkB,EAGnB,MAAM,gBAAgB,CAAC;AAiBxB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,oBAAoB,EAKpB,aAAa,EAEb,qBAAqB,EAErB,kBAAkB,EAGlB,sBAAsB,EAMtB,kBAAkB,EAClB,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,IAAI,CAC7B,kBAAkB,EAClB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CACvD,CAAC;AAqFF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CA2BvE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GACV,oBAAoB,GAAG,SAAS,CAUlC;AAED,wDAAwD;AACxD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,GACvB,MAAM,CAER;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,qDAAqD;AACrD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,mBAAmB,GACvB,MAAM,CAER;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAeR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,kBAAkB,GAAG,IAAI,CAW3B;AAQD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAUV;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYlC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAA;CAAE,GAAG,IAAI,CAiD3E;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAC,CAc5E;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAe7D,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,QAAQ,GACjB,qBAAqB,GAAG,SAAS,CAEnC;AAQD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,kBAAkB,GACvB,kBAAkB,CAEpB;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpB;AA2GD;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2CpB;AAQD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,oBAAoB,GAAG,SAAS,CAElC;AAED,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CA8GvC;AAg6BD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAeT"}

package/dist/channels/github/github-channel.js

@@ -11,6 +11,7 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 import { z } from "zod";
 import { allowAll, defineChannel, localDevStrict, loopbackGitHubDev, POST, } from "../../channels.js";
 import { continuationSource, normalizeIdentity, } from "../../internal/continuation-identity.js";
+import { isDeferredChannelSession } from "../../internal/deferred-channel-session.js";
 import { isDevMode } from "../../internal/dev-mode.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
 import { resolveCredentialValue } from "./auth.js";
@@ -1195,9 +1196,14 @@ function startTurn(input) {
             scheduleAfterAck(input.args, () => __awaiter(this, void 0, void 0, function* () {
                 yield sendTurn();
             }));
-            return withDispatchOutcome(Response.json({ ok: true, dispatched: true, mode: "turn" }, { status: 202 }), "send");
+            return acknowledgeTurn();
         }
         const session = yield sendTurn();
+        if (isDeferredChannelSession(session)) {
+            // Hosted admission captured the send; the control plane allocates the
+            // session after acknowledgement, so there is nothing to report yet.
+            return acknowledgeTurn();
+        }
         return withDispatchOutcome(Response.json({
             ok: true,
             sessionId: session.id,
@@ -1229,8 +1235,14 @@ function scheduleAfterAck(args, work) {
         });
     }));
 }
+/** 202 ack for a turn whose send completes after the response flushes. */
+function acknowledgeTurn() {
+    return withDispatchOutcome(Response.json({ ok: true, dispatched: true, mode: "turn" }, { status: 202 }), "send");
+}
 function acknowledgeTask(args, dispatch, extra) {
-    scheduleAfterAck(args, dispatch.task);
+    // Hand the task the per-delivery send/waitUntil so hosted admission can
+    // capture task-initiated sends; startup-captured sends bypass capture.
+    scheduleAfterAck(args, () => dispatch.task({ send: args.send, waitUntil: args.waitUntil }));
     return withDispatchOutcome(Response.json(Object.assign({ ok: true, dispatched: true, mode: "task" }, extra), { status: 202 }), "task");
 }
 function skipped(reason, extra = {}) {

package/dist/channels/github/types.d.ts

@@ -1,5 +1,5 @@
 import type { ContinuationIdentity } from "../../continuation.js";
-import type { AgentCloudOptions, ArtifactsApi, AuthContext, AuthPolicy, ChannelEventHandlers, ChannelStartArgs, HostContext, SendMessageOptions } from "../../types.js";
+import type { AgentCloudOptions, ArtifactsApi, AuthContext, AuthPolicy, ChannelEventHandlers, ChannelStartArgs, HostContext, SendMessageFn, SendMessageOptions } from "../../types.js";
 import type { GitHubApiOptions } from "./api.js";
 import type { GitHubHandle, GitHubThread } from "./binding.js";
 import type { GitHubProgressConfig } from "./progress.js";
@@ -303,13 +303,28 @@ export interface GitHubTurnDispatch {
      */
     workspaceFiles?: GitHubWorkspaceFiles | (() => GitHubWorkspaceFiles | undefined | Promise<GitHubWorkspaceFiles | undefined>);
 }
+/** Bound per-delivery helpers passed to a {@link GitHubTaskDispatch.task}. */
+export interface GitHubTaskArgs {
+    /**
+     * Start (or resume) a session for this delivery. Locally this runs a real
+     * turn and returns the live session. In hosted admission it captures the
+     * send for the control plane to execute after `ses_…` is allocated and
+     * returns an inert deferred handle, so the task body keeps running.
+     * Always use this over a send captured at `onStart` — a startup-captured
+     * send bypasses hosted capture and is rejected during hosted admission.
+     */
+    send: SendMessageFn;
+    /** Extend the delivery's background window past the task promise. */
+    waitUntil: (promise: Promise<unknown>) => void;
+}
 /**
  * Run a host-side handler for the event instead of a model turn. The task
  * runs in the background (`waitUntil`) after the webhook is acknowledged
- * with a 202, so it can outlive GitHub's ~10s delivery timeout.
+ * with a 202, so it can outlive GitHub's ~10s delivery timeout. The callback
+ * receives {@link GitHubTaskArgs}; zero-argument tasks remain valid.
  */
 export interface GitHubTaskDispatch {
-    task: () => void | Promise<void>;
+    task: (args: GitHubTaskArgs) => void | Promise<void>;
 }
 export type GitHubDispatchResult = GitHubDispatch | null | Promise<GitHubDispatch | null>;
 /**

package/dist/channels/github/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/github/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,MAAM,MAAM,qBAAqB,GAC7B,MAAM,GACN,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C,mFAAmF;IACnF,KAAK,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACvC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,GACR,UAAU,GACV,aAAa,GACb,kBAAkB,GAClB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,WAAW,GACX,UAAU,GACV,YAAY,GACZ,kBAAkB,GAClB,wBAAwB,GACxB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,SAAS,GACT,WAAW,GACX,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,cAAc,GAAG,eAAe,CAAC;AAEhF,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,WAAW,GACX,aAAa,GACb,kBAAkB,CAAC;AAEvB,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,GACX,WAAW,GACX,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,IAAI,CAAC;AAET,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,aAAa,GACb,WAAW,GACX,SAAS,GACT,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,cAAc,GAAG,MAAM,CAAC;CACjD;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE;QACV,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5B,CAAC;IACF,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,yEAAyE;QACzE,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,IAAI,CAAC;QACT,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;QACF,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC;YACZ,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;KACpC,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;IACT,YAAY,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACtC,kEAAkE;IAClE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,cAAc,CAAC;IACpB,YAAY,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IACzD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,mBAAmB,CAAC;IAChC,6CAA6C;IAC7C,YAAY,EAAE;QACZ,IAAI,EAAE,sBAAsB,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,MAAM,EAAE,YAAY,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,iFAAiF;IACjF,IAAI,EAAE,WAAW,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,YAAY,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAErE,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAC5C,kBAAkB,CAAC,gBAAgB,CAAC,CACrC,CAAC;AAEF,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,cAAc,CAAC,EACX,oBAAoB,GACpB,CAAC,MACG,oBAAoB,GACpB,SAAS,GACT,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,IAAI,GACJ,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,sBAAsB,KAChC,oBAAoB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,kBAAkB,EACvB,OAAO,EAAE,aAAa,KACnB,oBAAoB,CAAC;AAE1B,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,gBAAgB,KACpB,oBAAoB,CAAC;AAE1B,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,kBAAkB,EACvB,UAAU,EAAE,qBAAqB,KAC9B,oBAAoB,CAAC;AAE1B,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,mBAAmB,KAC1B,oBAAoB,CAAC;AAE1B,+DAA+D;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,sBAAsB,KAChC,oBAAoB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,iBAAiB,KACtB,oBAAoB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,cAAc,KAClB,oBAAoB,CAAC;AAE1B,MAAM,MAAM,0BAA0B,GAAG,CACvC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,sBAAsB,KAChC,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;;;OAMG;IACH,aAAa,CAAC,EACV,OAAO,GACP;QACE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QACzB;;;;;WAKG;QACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;KACtD,CAAC;IACN,uEAAuE;IACvE,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,iEAAiE;IACjE,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,kEAAkE;IAClE,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,iBAAiB,GAAG,0BAA0B,CAAC;IACjE,uDAAuD;IACvD,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/github/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,MAAM,MAAM,qBAAqB,GAC7B,MAAM,GACN,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;;OAIG;IACH,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C,mFAAmF;IACnF,KAAK,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACvC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC;AAED,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,MAAM,MAAM,uBAAuB,GAC/B,QAAQ,GACR,UAAU,GACV,aAAa,GACb,kBAAkB,GAClB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,WAAW,GACX,UAAU,GACV,YAAY,GACZ,kBAAkB,GAClB,wBAAwB,GACxB,oBAAoB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,SAAS,GACT,WAAW,GACX,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,cAAc,GAAG,eAAe,CAAC;AAEhF,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,WAAW,GACX,aAAa,GACb,kBAAkB,CAAC;AAEvB,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,SAAS,GACT,SAAS,GACT,WAAW,GACX,WAAW,GACX,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,IAAI,CAAC;AAET,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,aAAa,GACb,WAAW,GACX,SAAS,GACT,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,cAAc,GAAG,MAAM,CAAC;CACjD;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE;QACV,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5B,CAAC;IACF,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,yEAAyE;QACzE,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE;YACL,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,IAAI,CAAC;QACT,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;QACF,IAAI,EAAE;YACJ,GAAG,EAAE,MAAM,CAAC;YACZ,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;KACpC,GAAG,IAAI,CAAC;IACT,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,IAAI,CAAC;IACT,YAAY,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACtC,kEAAkE;IAClE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,cAAc,CAAC;IACpB,YAAY,EAAE,sBAAsB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IACzD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,mBAAmB,CAAC;IAChC,6CAA6C;IAC7C,YAAY,EAAE;QACZ,IAAI,EAAE,sBAAsB,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,MAAM,EAAE,YAAY,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,iFAAiF;IACjF,IAAI,EAAE,WAAW,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,YAAY,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAErE,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAC5C,kBAAkB,CAAC,gBAAgB,CAAC,CACrC,CAAC;AAEF,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,cAAc,CAAC,EACX,oBAAoB,GACpB,CAAC,MACG,oBAAoB,GACpB,SAAS,GACT,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC,CAAC;CACpD;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,IAAI,EAAE,aAAa,CAAC;IACpB,qEAAqE;IACrE,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,IAAI,GACJ,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,sBAAsB,KAChC,oBAAoB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,kBAAkB,EACvB,OAAO,EAAE,aAAa,KACnB,oBAAoB,CAAC;AAE1B,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,gBAAgB,KACpB,oBAAoB,CAAC;AAE1B,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,kBAAkB,EACvB,UAAU,EAAE,qBAAqB,KAC9B,oBAAoB,CAAC;AAE1B,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,mBAAmB,KAC1B,oBAAoB,CAAC;AAE1B,+DAA+D;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,sBAAsB,KAChC,oBAAoB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,iBAAiB,KACtB,oBAAoB,CAAC;AAE1B;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,cAAc,KAClB,oBAAoB,CAAC;AAE1B,MAAM,MAAM,0BAA0B,GAAG,CACvC,GAAG,EAAE,kBAAkB,EACvB,WAAW,EAAE,sBAAsB,KAChC,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;;;OAMG;IACH,aAAa,CAAC,EACV,OAAO,GACP;QACE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QACzB;;;;;WAKG;QACH,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;KACtD,CAAC;IACN,uEAAuE;IACvE,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;OAGG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,iEAAiE;IACjE,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,kEAAkE;IAClE,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,iBAAiB,GAAG,0BAA0B,CAAC;IACjE,uDAAuD;IACvD,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/channels/origin/api.d.ts

@@ -1,18 +1,24 @@
 /**
  * Origin public REST helpers (`https://api.cursor.com/v1/origin/...`).
  *
- * Origin writes such as CI check runs are installation-only: they need an
- * `oit_…` installation token minted from Origin app credentials (EdDSA app
- * JWT → `/v1/origin/app/installations/{id}/access_tokens`). This module
- * consolidates that flow so agents configure credentials once and call
- * {@link createOriginClient} — the GitHub-channel analogue of
+ * This module consolidates Origin auth so agents configure credentials once
+ * and call {@link createOriginClient} — the GitHub-channel analogue of
  * `createGitHubOctokit`.
  *
- * Credentials resolve from options first, then the environment:
- * `ORIGIN_APP_ID` (or `AGENT_SERVE_ORIGIN_APP_ID`),
- * `ORIGIN_APP_INSTALLATION_ID`, `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the
- * app's Ed25519 key; literal `\n` sequences are normalized), and
- * `ORIGIN_API_BASE_URL` for the public REST base.
+ * Self-configured channels with their own Origin app resolve credentials
+ * from options first, then the environment: `ORIGIN_APP_ID` (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`), `ORIGIN_APP_INSTALLATION_ID`,
+ * `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the app's Ed25519 key; literal
+ * `\n` sequences are normalized), and `ORIGIN_API_BASE_URL` for the public
+ * REST base.
+ *
+ * Hosted v2 forks configure none of that: their only credential is the
+ * deployment service account's `CURSOR_API_KEY`, exchanged for a Cursor
+ * session ({@link cursorSessionTokenProvider}, `POST
+ * /auth/exchange_user_api_key`) and sent as the Origin bearer. Reads and
+ * writes both run as the deployment **service-account principal**; Origin's
+ * `agent-serve` allowlist grants team-namespace read/write, so there is no
+ * app-installation token exchange for managed deployments.
  */
 /**
  * Public Origin REST base (check runs, installation tokens). Distinct from
@@ -34,7 +40,10 @@ export declare class OriginApiError extends Error {
         status: number;
     });
 }
-/** Yields a bearer for Origin REST calls (usually a short-lived `oit_…`). */
+/**
+ * Yields a bearer for Origin REST calls (a short-lived `oit_…` for app
+ * channels, or a Cursor session token for service-account access).
+ */
 export type OriginTokenProvider = () => Promise<string>;
 export interface OriginAppCredentials {
     /** Origin app id (`app_<typeid>`). */
@@ -54,6 +63,30 @@ export declare function resolveOriginAppCredentialParts(env?: NodeJS.ProcessEnv)
 export declare function resolveOriginAppCredentials(env?: NodeJS.ProcessEnv): OriginAppCredentials | undefined;
 /** Public Origin REST base. Trailing slashes are stripped for path joins. */
 export declare function originPublicApiBaseUrl(env?: NodeJS.ProcessEnv): string;
+/**
+ * Exchange endpoint for Cursor-account session tokens. Override with
+ * `AGENT_SERVE_CURSOR_SESSION_EXCHANGE_URL`; defaults to the Cursor backend.
+ */
+export declare function resolveCursorSessionExchangeUrl(): string;
+/**
+ * A session-backed Origin token provider: {@link OriginTokenProvider} plus
+ * an `invalidate` hook `createOriginClient` calls when Origin rejects the
+ * bearer (401), so the next mint re-exchanges instead of serving the
+ * rejected session until its local renewal deadline.
+ */
+export type CursorSessionTokenProvider = OriginTokenProvider & {
+    invalidate: (token: string) => void;
+};
+/** Test-only: drop the process-wide exchanged-session cache. */
+export declare function _clearCursorSessionTokenCacheForTesting(): void;
+export declare function cursorSessionTokenProvider(input?: {
+    /** Cursor API key source. Defaults to the standard host resolution. */
+    getApiKey?: () => string | undefined;
+    /** Exchange endpoint. Defaults to {@link resolveCursorSessionExchangeUrl}. */
+    exchangeUrl?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): CursorSessionTokenProvider;
 /**
  * A cached per-use token provider for one set of app credentials. Every call
  * inside the reuse window returns the same `oit_…`; the first call after it
@@ -77,6 +110,16 @@ export interface OriginClientOptions {
     apiBaseUrl?: string;
     /** Injectable fetch for tests. */
     fetch?: typeof fetch;
+    /**
+     * Cursor-account session exchange fallback (hosted v2 deployment SAs and
+     * local personal keys). `true` (default) engages when no explicit token
+     * or app credentials resolve and a Cursor credential is present; `false`
+     * disables it; an object injects the key source / endpoint.
+     */
+    cursorAccountExchange?: boolean | {
+        getApiKey?: () => string | undefined;
+        exchangeUrl?: string;
+    };
 }
 /** Minimal authenticated Origin REST client (the `Octokit` analogue). */
 export interface OriginClient {
@@ -93,8 +136,11 @@ export interface OriginClient {
 }
 /**
  * Build an authenticated Origin REST client. Auth resolution: explicit
- * token/provider, then app credentials (options or environment). Missing
- * auth fails at the first request with a clear message.
+ * token/provider, then app credentials (options or environment, for
+ * channels with their own Origin app), then the Cursor-account session
+ * exchange (hosted v2 deployment SAs — reads and writes both run as the
+ * deployment service-account principal). Missing auth fails at the first
+ * request with a clear message.
  */
 export declare function createOriginClient(options?: OriginClientOptions): OriginClient;
 //# sourceMappingURL=api.d.ts.map

package/dist/channels/origin/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAS3E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1E,sEAAsE;AACtE,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,EASA;CACF;AAED,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,GAAG,SAAS,CAWlC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AA8DD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,mBAAmB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACrC;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAoEd"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAS3E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1E,sEAAsE;AACtE,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,EASA;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,GAAG,SAAS,CAWlC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AA8DD;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,CAMxD;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG;IAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AA4BF,gEAAgE;AAChE,wBAAgB,uCAAuC,IAAI,IAAI,CAG9D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE;IACjD,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACrC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,0BAA0B,CA8E7B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,mBAAmB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACrC;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;OAKG;IACH,qBAAqB,CAAC,EAClB,OAAO,GACP;QACE,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACP;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,YAAY,CA0Gd"}

package/dist/channels/origin/api.js

@@ -1,18 +1,24 @@
 /**
  * Origin public REST helpers (`https://api.cursor.com/v1/origin/...`).
  *
- * Origin writes such as CI check runs are installation-only: they need an
- * `oit_…` installation token minted from Origin app credentials (EdDSA app
- * JWT → `/v1/origin/app/installations/{id}/access_tokens`). This module
- * consolidates that flow so agents configure credentials once and call
- * {@link createOriginClient} — the GitHub-channel analogue of
+ * This module consolidates Origin auth so agents configure credentials once
+ * and call {@link createOriginClient} — the GitHub-channel analogue of
  * `createGitHubOctokit`.
  *
- * Credentials resolve from options first, then the environment:
- * `ORIGIN_APP_ID` (or `AGENT_SERVE_ORIGIN_APP_ID`),
- * `ORIGIN_APP_INSTALLATION_ID`, `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the
- * app's Ed25519 key; literal `\n` sequences are normalized), and
- * `ORIGIN_API_BASE_URL` for the public REST base.
+ * Self-configured channels with their own Origin app resolve credentials
+ * from options first, then the environment: `ORIGIN_APP_ID` (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`), `ORIGIN_APP_INSTALLATION_ID`,
+ * `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the app's Ed25519 key; literal
+ * `\n` sequences are normalized), and `ORIGIN_API_BASE_URL` for the public
+ * REST base.
+ *
+ * Hosted v2 forks configure none of that: their only credential is the
+ * deployment service account's `CURSOR_API_KEY`, exchanged for a Cursor
+ * session ({@link cursorSessionTokenProvider}, `POST
+ * /auth/exchange_user_api_key`) and sent as the Origin bearer. Reads and
+ * writes both run as the deployment **service-account principal**; Origin's
+ * `agent-serve` allowlist grants team-namespace read/write, so there is no
+ * app-installation token exchange for managed deployments.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -25,6 +31,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { Buffer } from "node:buffer";
 import { createPrivateKey, sign } from "node:crypto";
+import { cursorBackendUrl, resolveApiKeySync, } from "../../internal/cursor/credentials.js";
+import { CURSOR_SESSION_EXCHANGE_PATH, exchangeCursorApiKeyForSession, SESSION_TOKEN_EXPIRY_LEEWAY_MS, } from "../../internal/cursor/session-token.js";
 /**
  * Public Origin REST base (check runs, installation tokens). Distinct from
  * the webhook JWKS base (`DEFAULT_ORIGIN_API_BASE_URL` in
@@ -132,6 +140,109 @@ function mintOriginInstallationToken(input) {
         return token;
     });
 }
+/**
+ * Exchange endpoint for Cursor-account session tokens. Override with
+ * `AGENT_SERVE_CURSOR_SESSION_EXCHANGE_URL`; defaults to the Cursor backend.
+ */
+export function resolveCursorSessionExchangeUrl() {
+    const override = process.env.AGENT_SERVE_CURSOR_SESSION_EXCHANGE_URL;
+    if (override !== undefined && override.trim() !== "") {
+        return override.trim().replace(/\/+$/, "");
+    }
+    return `${cursorBackendUrl()}${CURSOR_SESSION_EXCHANGE_PATH}`;
+}
+/**
+ * Token provider backed by the shared Cursor session exchange
+ * (`exchangeCursorApiKeyForSession`, `POST /auth/exchange_user_api_key` —
+ * the same primitive `CursorBackendClient` mints through).
+ *
+ * Hosted v2 forks hold exactly one credential — the deployment service
+ * account's `CURSOR_API_KEY` — and Origin authenticates the exchanged
+ * session directly: reads and writes run as the deployment
+ * **service-account principal**, confined server-side to namespaces owned
+ * by the deployment's team (`agent-serve` allowlist). Local runs work the
+ * same way with a personal key: Origin authorizes the user principal.
+ *
+ * The API key is re-read on every mint so Bind can drop
+ * `CURSOR_API_KEY_FILE` onto a listening process; sessions are cached until
+ * shortly before their JWT expiry. The cache is **process-wide**, keyed by
+ * (endpoint, API key): hosted channels build a fresh `createOriginClient()`
+ * per event, so a per-provider cache would re-exchange on every read/write
+ * and concurrent first calls would race. In-flight exchanges are deduped
+ * for the same reason.
+ */
+const cursorSessionTokenCache = new Map();
+const cursorSessionTokenInFlight = new Map();
+/** Test-only: drop the process-wide exchanged-session cache. */
+export function _clearCursorSessionTokenCacheForTesting() {
+    cursorSessionTokenCache.clear();
+    cursorSessionTokenInFlight.clear();
+}
+export function cursorSessionTokenProvider(input) {
+    var _a, _b, _c;
+    const getApiKey = (_a = input === null || input === void 0 ? void 0 : input.getApiKey) !== null && _a !== void 0 ? _a : (() => { var _a; return (_a = resolveApiKeySync()) === null || _a === void 0 ? void 0 : _a.apiKey; });
+    const fetchImpl = (_b = input === null || input === void 0 ? void 0 : input.fetch) !== null && _b !== void 0 ? _b : fetch;
+    const now = (_c = input === null || input === void 0 ? void 0 : input.now) !== null && _c !== void 0 ? _c : Date.now;
+    const cacheKey = (url, apiKey) => `${url}\u0000${apiKey}`;
+    const resolveUrl = () => { var _a; return (_a = input === null || input === void 0 ? void 0 : input.exchangeUrl) !== null && _a !== void 0 ? _a : resolveCursorSessionExchangeUrl(); };
+    const mint = (url, apiKey) => __awaiter(this, void 0, void 0, function* () {
+        const nowMs = now();
+        let session;
+        try {
+            session = yield exchangeCursorApiKeyForSession({
+                exchangeUrl: url,
+                apiKey,
+                fetchImpl,
+                nowMs,
+            });
+        }
+        catch (error) {
+            throw new Error(`originClient: ${error instanceof Error ? error.message : String(error)} Check CURSOR_API_KEY / CURSOR_API_KEY_FILE, or pass an explicit token.`);
+        }
+        const renewAtMs = Math.max(nowMs + 1000, session.expiresAtMs - SESSION_TOKEN_EXPIRY_LEEWAY_MS);
+        cursorSessionTokenCache.set(cacheKey(url, apiKey), {
+            token: session.token,
+            renewAtMs,
+        });
+        return session.token;
+    });
+    const provider = () => __awaiter(this, void 0, void 0, function* () {
+        const apiKey = getApiKey();
+        if (apiKey === undefined || apiKey === "") {
+            throw new Error("originClient: no Cursor credential available for the session exchange (set CURSOR_API_KEY or CURSOR_API_KEY_FILE).");
+        }
+        const url = resolveUrl();
+        const key = cacheKey(url, apiKey);
+        const cached = cursorSessionTokenCache.get(key);
+        if (cached !== undefined && now() < cached.renewAtMs) {
+            return cached.token;
+        }
+        // Dedupe concurrent first calls: one exchange per (endpoint, key).
+        const inFlight = cursorSessionTokenInFlight.get(key);
+        if (inFlight !== undefined) {
+            return yield inFlight;
+        }
+        const pending = mint(url, apiKey).finally(() => {
+            cursorSessionTokenInFlight.delete(key);
+        });
+        cursorSessionTokenInFlight.set(key, pending);
+        return yield pending;
+    });
+    // Origin answered 401 for this bearer: drop it (unless a newer session
+    // already replaced it) so the next call re-exchanges immediately.
+    const invalidate = (token) => {
+        var _a;
+        const apiKey = getApiKey();
+        if (apiKey === undefined || apiKey === "") {
+            return;
+        }
+        const key = cacheKey(resolveUrl(), apiKey);
+        if (((_a = cursorSessionTokenCache.get(key)) === null || _a === void 0 ? void 0 : _a.token) === token) {
+            cursorSessionTokenCache.delete(key);
+        }
+    };
+    return Object.assign(provider, { invalidate });
+}
 /**
  * A cached per-use token provider for one set of app credentials. Every call
  * inside the reuse window returns the same `oit_…`; the first call after it
@@ -160,16 +271,23 @@ export function originAppTokenProvider(input) {
 }
 /**
  * Build an authenticated Origin REST client. Auth resolution: explicit
- * token/provider, then app credentials (options or environment). Missing
- * auth fails at the first request with a clear message.
+ * token/provider, then app credentials (options or environment, for
+ * channels with their own Origin app), then the Cursor-account session
+ * exchange (hosted v2 deployment SAs — reads and writes both run as the
+ * deployment service-account principal). Missing auth fails at the first
+ * request with a clear message.
  */
 export function createOriginClient(options = {}) {
     var _a, _b;
     const apiBaseUrl = ((_a = options.apiBaseUrl) !== null && _a !== void 0 ? _a : originPublicApiBaseUrl()).replace(/\/+$/, "");
     const fetchImpl = (_b = options.fetch) !== null && _b !== void 0 ? _b : fetch;
     let tokenProvider;
+    // Set when the session-exchange fallback is engaged: a 401 from Origin
+    // invalidates the cached session and retries once with a fresh one, the
+    // `CursorBackendClient` re-exchange behavior.
+    let sessionProvider;
     const getToken = () => __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b, _c, _d;
         if (typeof options.token === "string") {
             return options.token;
         }
@@ -178,30 +296,53 @@ export function createOriginClient(options = {}) {
         }
         if (tokenProvider === undefined) {
             const credentials = (_a = options.credentials) !== null && _a !== void 0 ? _a : resolveOriginAppCredentials();
-            if (credentials === undefined) {
-                throw new Error("originClient: no Origin credential available (pass token / credentials, or set ORIGIN_APP_ID + ORIGIN_APP_INSTALLATION_ID + ORIGIN_APP_PRIVATE_KEY).");
+            const exchange = (_b = options.cursorAccountExchange) !== null && _b !== void 0 ? _b : true;
+            const exchangeOptions = exchange === false ? undefined : exchange === true ? {} : exchange;
+            const getExchangeApiKey = (_c = exchangeOptions === null || exchangeOptions === void 0 ? void 0 : exchangeOptions.getApiKey) !== null && _c !== void 0 ? _c : (() => { var _a; return (_a = resolveApiKeySync()) === null || _a === void 0 ? void 0 : _a.apiKey; });
+            if (credentials !== undefined) {
+                tokenProvider = originAppTokenProvider({
+                    credentials,
+                    apiBaseUrl,
+                    fetch: fetchImpl,
+                });
+            }
+            else if (exchangeOptions !== undefined &&
+                ((_d = getExchangeApiKey()) !== null && _d !== void 0 ? _d : "") !== "") {
+                sessionProvider = cursorSessionTokenProvider(Object.assign({ fetch: fetchImpl, getApiKey: getExchangeApiKey }, (exchangeOptions.exchangeUrl === undefined
+                    ? {}
+                    : { exchangeUrl: exchangeOptions.exchangeUrl })));
+                tokenProvider = sessionProvider;
+            }
+            else {
+                throw new Error("originClient: no Origin credential available (pass token / credentials, set ORIGIN_APP_ID + ORIGIN_APP_INSTALLATION_ID + ORIGIN_APP_PRIVATE_KEY, or sign in with a Cursor credential for the session exchange).");
             }
-            tokenProvider = originAppTokenProvider({
-                credentials,
-                apiBaseUrl,
-                fetch: fetchImpl,
-            });
         }
         return yield tokenProvider();
     });
+    const send = (input, path, token) => __awaiter(this, void 0, void 0, function* () {
+        return yield fetchImpl(`${apiBaseUrl}${path}`, {
+            method: input.method,
+            headers: Object.assign({ authorization: `Bearer ${token}` }, (input.body === undefined
+                ? {}
+                : { "content-type": "application/json" })),
+            body: input.body === undefined ? undefined : JSON.stringify(input.body),
+        });
+    });
     return {
         apiBaseUrl,
         request(input) {
             return __awaiter(this, void 0, void 0, function* () {
                 const path = input.path.startsWith("/") ? input.path : `/${input.path}`;
                 const token = yield getToken();
-                const response = yield fetchImpl(`${apiBaseUrl}${path}`, {
-                    method: input.method,
-                    headers: Object.assign({ authorization: `Bearer ${token}` }, (input.body === undefined
-                        ? {}
-                        : { "content-type": "application/json" })),
-                    body: input.body === undefined ? undefined : JSON.stringify(input.body),
-                });
+                let response = yield send(input, path, token);
+                if (response.status === 401 && sessionProvider !== undefined) {
+                    // The session aged out server-side. Drop it — unless a concurrent
+                    // retry already minted a newer one — and retry once.
+                    yield response.text().catch(() => undefined);
+                    sessionProvider.invalidate(token);
+                    const retryToken = yield getToken();
+                    response = yield send(input, path, retryToken);
+                }
                 const text = yield response.text();
                 let parsed;
                 try {

package/dist/channels/origin/binding.d.ts

@@ -27,8 +27,8 @@ export interface OriginHandle {
     }): Promise<T>;
     /**
      * Open a CI check run on `sha` and get a handle for updating and
-     * concluding it. Needs an app installation with
-     * `repository:checks:write` — Origin check writes are installation-only.
+     * concluding it. Needs `repository:checks:write` — via an app
+     * installation, or the deployment service account on hosted v2 forks.
      */
     createCheck(input: Omit<OriginCheckCreateInput, "origin" | "owner" | "repo">): Promise<OriginCheck>;
 }

package/dist/channels/origin/checks.d.ts

@@ -7,12 +7,12 @@
  * fresh `externalUpdatedAt`, and `resumeOriginCheck` needs only those
  * identity fields (no server id) to rebuild a handle after a restart.
  *
- * Posting needs `repository:checks:write` and is installation-only: the
- * client must authenticate with an `oit_…` installation token (see
- * `createOriginClient` / `originAppTokenProvider` in `api.js`). Works with
- * any client exposing `request()` (`ctx.origin`, `createOriginClient()`),
- * and is also reachable as `ctx.origin.createCheck(...)`. API failures throw
- * `OriginApiError`.
+ * Posting needs `repository:checks:write`: an `oit_…` installation token for
+ * app channels, or a deployment service-account session (hosted v2 forks —
+ * the `agent-serve` allowlist grants checks:write on team-owned namespaces).
+ * See `createOriginClient` in `api.js`. Works with any client exposing
+ * `request()` (`ctx.origin`, `createOriginClient()`), and is also reachable
+ * as `ctx.origin.createCheck(...)`. API failures throw `OriginApiError`.
  */
 import { type CiCheck, type CiCheckConcludeInput, type CiCheckConclusion, type CiCheckCreateInput, type CiCheckOutput, type CiCheckRef, type CiCheckStatus, type CiChecksClient, type CiCheckUpdateInput } from "../checks.js";
 import type { OriginApiMethod } from "./api.js";

package/dist/channels/origin/checks.js

@@ -7,12 +7,12 @@
  * fresh `externalUpdatedAt`, and `resumeOriginCheck` needs only those
  * identity fields (no server id) to rebuild a handle after a restart.
  *
- * Posting needs `repository:checks:write` and is installation-only: the
- * client must authenticate with an `oit_…` installation token (see
- * `createOriginClient` / `originAppTokenProvider` in `api.js`). Works with
- * any client exposing `request()` (`ctx.origin`, `createOriginClient()`),
- * and is also reachable as `ctx.origin.createCheck(...)`. API failures throw
- * `OriginApiError`.
+ * Posting needs `repository:checks:write`: an `oit_…` installation token for
+ * app channels, or a deployment service-account session (hosted v2 forks —
+ * the `agent-serve` allowlist grants checks:write on team-owned namespaces).
+ * See `createOriginClient` in `api.js`. Works with any client exposing
+ * `request()` (`ctx.origin`, `createOriginClient()`), and is also reachable
+ * as `ctx.origin.createCheck(...)`. API failures throw `OriginApiError`.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }