@cursor/july 0.1.95 → 0.1.96

package/src/channels/slack/nudge-carrier.ts

@@ -3,13 +3,15 @@
  * the durable Slack nudge store at tool boundaries (MCP / builtin tools).
  */
 
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 export const SLACK_NUDGE_ROOT_REL = ".agent-serve/slack-nudge-root";
 export const SLACK_NUDGE_CONTINUATION_REL =
   ".agent-serve/slack-nudge-continuation";
 export const SLACK_NUDGE_CARRIER_REL = ".agent-serve/slack-nudge-carrier.mjs";
+/** Conversation allowed to claim nudges; subagents share the cwd and would otherwise take the parent's. */
+export const SLACK_NUDGE_OWNER_REL = ".agent-serve/slack-nudge-owner";
 
 /** Carrier script body — reads nudge-root + continuation, drains pending. */
 export const SLACK_NUDGE_CARRIER_SCRIPT: string = `#!/usr/bin/env node
@@ -40,7 +42,46 @@ async function readText(rel) {
   }
 }
 
+async function readStdin() {
+  const chunks = [];
+  const read = (async () => {
+    for await (const chunk of process.stdin) chunks.push(chunk);
+  })().catch(() => {});
+  await Promise.race([
+    read,
+    new Promise((resolve) => setTimeout(resolve, 250).unref?.()),
+  ]);
+  process.stdin.destroy();
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+/** First caller pins ownership; a subagent cannot call a tool before its parent's Task call. */
+async function ownsStore(caller) {
+  if (caller === "") return true;
+  const ownerPath = join(workspace, ${JSON.stringify(SLACK_NUDGE_OWNER_REL)});
+  try {
+    // wx is O_CREAT|O_EXCL, so creating the file is the claim: concurrent hooks cannot both win.
+    await writeFile(ownerPath, caller + "\\n", { encoding: "utf8", flag: "wx" });
+    return true;
+  } catch (error) {
+    if (error && error.code !== "EEXIST") return false;
+  }
+  // Claimed already — the only question left is whether we are the claimant.
+  const owner = await readText(${JSON.stringify(SLACK_NUDGE_OWNER_REL)});
+  return owner === "" || owner === caller;
+}
+
 async function main() {
+  const raw = await readStdin();
+  let caller = "";
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.conversation_id === "string") {
+      caller = parsed.conversation_id.trim();
+    }
+  } catch {
+    // Fail open: an unparseable payload must not strand the follow-up.
+  }
   const root = await readText(${JSON.stringify(SLACK_NUDGE_ROOT_REL)});
   const continuation = await readText(
     ${JSON.stringify(SLACK_NUDGE_CONTINUATION_REL)}
@@ -49,6 +90,11 @@ async function main() {
     process.stdout.write("{}\\n");
     return;
   }
+  // Not ours: leave it pending for the parent or the turn-boundary drain.
+  if (!(await ownsStore(caller))) {
+    process.stdout.write("{}\\n");
+    return;
+  }
   const pendingDir = join(root, safeKey(continuation), "pending");
   const deliveredDir = join(root, safeKey(continuation), "delivered");
   let names = [];
@@ -157,6 +203,7 @@ export async function materializeSlackNudgeCarrier(args: {
     SLACK_NUDGE_CARRIER_SCRIPT,
     "utf8"
   );
+  await rm(join(args.harnessCwd, SLACK_NUDGE_OWNER_REL), { force: true });
 
   const hooksPath = join(args.harnessCwd, ".cursor", "hooks.json");
   let existing: HooksConfig = { version: 1, hooks: {} };

package/src/channels/slack/slack-channel.ts

@@ -238,6 +238,8 @@ export function slackChannel(
         : { interruptContinuation: args.interruptContinuation }),
       ...(channelWatch === undefined ? {} : { channelWatch }),
       ...(botMentionGate === undefined ? {} : { botMentionGate }),
+      suggestedPrompts: options.suggestedPrompts,
+      suggestedPromptsTitle: options.suggestedPromptsTitle,
     };
   }
 

package/src/files-backends/cursor-hosted.ts

@@ -71,6 +71,19 @@ const AGENT_SERVE_FILES_PATH = "/v0/agent-serve-files";
 export const AGENT_SERVE_STORE_SOURCE_ID_ENV_VAR =
   "AGENT_SERVE_STORE_SOURCE_ID";
 
+/**
+ * The deployment's **framework-level** file store, distinct from the
+ * user-level store above. The user store carries author-facing bytes
+ * (`ctx.host.files`, skills, memory, artifacts) and is browsable and
+ * mountable; the framework store carries engine-owned session state —
+ * session records, event transcripts, continuation index, and the SDK
+ * conversation mirror — and is never exposed to authors or models.
+ * Provisioned by the v2 deploy pipeline alongside the user store; v1
+ * deployments have only the user store.
+ */
+export const AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_ENV_VAR =
+  "AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID";
+
 /** Cap on the per-process etag cache; a miss costs a lookup, not correctness. */
 const MAX_REMEMBERED_ETAGS = 1_000;
 
@@ -101,6 +114,20 @@ export function isCursorHostedFilesAvailable(
   return sourceId !== undefined && sourceId !== "";
 }
 
+/**
+ * The framework-level store's source id, or `undefined` when the deployment
+ * has none (v1, self-hosted, or a v2 deploy predating framework-store
+ * provisioning). Same detection posture as
+ * {@link isCursorHostedFilesAvailable}: keyed on the id alone — a missing
+ * credential must fail loudly at use, not silently deselect the store.
+ */
+export function cursorFrameworkStoreSourceId(
+  env: NodeJS.ProcessEnv = process.env
+): string | undefined {
+  const sourceId = env[AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_ENV_VAR]?.trim();
+  return sourceId === undefined || sourceId === "" ? undefined : sourceId;
+}
+
 /**
  * Local `serve`/`run` with a personal `CURSOR_API_KEY` can address
  * `/v0/agent-serve-files/user`. Hosted deployments have a store source id
@@ -125,12 +152,15 @@ export function isCursorUserStoreFilesAvailable(
 export interface CursorHostedFilesOptions {
   /** Control-plane base URL (default: `CURSOR_API_BASE_URL`, else api.cursor.com). */
   baseUrl?: string;
+  /** Bearer credential (default: `CURSOR_API_KEY`). */
+  apiKey?: string;
   /**
-   * Bearer credential (default: `CURSOR_API_KEY`). A function is re-resolved
-   * on every call — hosted freeze snapshots listen unsigned and bind the key
-   * file after serve start.
+   * Lazy credential, re-resolved on every call and preferred over
+   * {@link apiKey} — hosted freeze snapshots listen unsigned and bind the
+   * key file after serve start. Kept separate so `apiKey` stays a plain
+   * string.
    */
-  apiKey?: string | (() => string | undefined);
+  resolveApiKey?: () => string | undefined;
   /** File store to address (default: `AGENT_SERVE_STORE_SOURCE_ID`). */
   storeSourceId?: string;
   /** Test seam; defaults to global fetch. */
@@ -253,7 +283,11 @@ export function cursorHostedFiles(
           }
           out.push(toEntry(file, file.path));
         }
-        return out;
+        // The FileSink contract promises key order, and transcript-chunk
+        // consumers depend on it (chunk keys are zero-padded so key order
+        // is append order). The server happens to scan in order today; do
+        // not let that be the only thing holding the contract.
+        return out.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
       }
       // The unscoped listing was truncated (`complete: false`) and has no
       // continuation to follow. `list()` promises the whole scope, so rather
@@ -626,8 +660,7 @@ function resolveStoreSourceId(options: CursorHostedFilesOptions): string {
 }
 
 function resolveApiKey(options: CursorHostedFilesOptions): string {
-  const configured =
-    typeof options.apiKey === "function" ? options.apiKey() : options.apiKey;
+  const configured = options.resolveApiKey?.() ?? options.apiKey;
   const key = (configured ?? process.env.CURSOR_API_KEY)?.trim();
   if (key === undefined || key === "") {
     throw new Error(

package/src/internal/advertise-tools.ts

@@ -27,6 +27,8 @@
  * `defineConnection({ effects })` filters the listing before names are
  * assigned: only tools whose MCP annotations classify as an intended
  * effect are advertised. Unclassified tools are omitted, not guessed.
+ * Tools whose `annotations.title` is `do-not-call` are dropped as well
+ * (vendor host-UI / MCP Apps helpers that still carry `readOnlyHint`).
  */
 
 import type {
@@ -134,8 +136,10 @@ export async function resolveAdvertisedTools(args: {
         { cause: error }
       );
     }
-    const intended = listed.filter((info) =>
-      matchesIntendedEffects(info.annotations, connection.effects)
+    const intended = listed.filter(
+      (info) =>
+        !isDoNotCallTool(info.annotations) &&
+        matchesIntendedEffects(info.annotations, connection.effects)
     );
     const exposed = exposeListedTools(intended, claimed);
     for (const { info, exposedName } of exposed) {
@@ -232,6 +236,18 @@ function exposeListedTools(
   }));
 }
 
+/**
+ * Vendors (Datadog MCP Apps) stamp host-UI-only helpers with this title.
+ * They still look like reads (`readOnlyHint: true`), so the effects
+ * filter would keep them. The model and agsh should not see them; the
+ * raw MCP listing stays intact for the host.
+ */
+const DO_NOT_CALL_TITLE = "do-not-call";
+
+function isDoNotCallTool(annotations: McpToolAnnotations | undefined): boolean {
+  return annotations?.title?.trim() === DO_NOT_CALL_TITLE;
+}
+
 function matchesIntendedEffects(
   annotations: McpToolAnnotations | undefined,
   effects: readonly ToolEffect[] | undefined

package/src/internal/bounded.ts

@@ -0,0 +1,28 @@
+/**
+ * Bounded-concurrency map, in input order. Local rather than
+ * `@anysphere/utils`: this published package cannot depend on monorepo
+ * internals.
+ */
+export async function mapBounded<T, R>(
+  items: readonly T[],
+  max: number,
+  run: (item: T) => Promise<R>
+): Promise<R[]> {
+  const out = new Array<R>(items.length);
+  let nextIndex = 0;
+  const workers = Array.from(
+    { length: Math.min(max, items.length) },
+    async () => {
+      for (;;) {
+        const index = nextIndex;
+        nextIndex += 1;
+        if (index >= items.length) {
+          return;
+        }
+        out[index] = await run(items[index] as T);
+      }
+    }
+  );
+  await Promise.all(workers);
+  return out;
+}

package/src/internal/cli-deploy.ts

@@ -49,6 +49,8 @@ import {
 import { type GitRunner, inferDeployGitSource } from "./deploy-source.js";
 import {
   type ChildAgentDir,
+  formatDiagnostics,
+  hasErrorDiagnostics,
   isAgentProjectDir,
   listChildAgentDirs,
   loadAgentProject,
@@ -1135,6 +1137,16 @@ interface DeployManifest {
  */
 async function readDeployManifest(dir: string): Promise<DeployManifest> {
   const project = await loadAgentProject(dir);
+  // Fail here, before anything is dispatched: a project with error
+  // diagnostics (e.g. agent/storage.ts on architecture v2) would only be
+  // refused later by `serve` inside the hosted build, wasting a bake.
+  if (hasErrorDiagnostics(project)) {
+    throw new Error(
+      `Refusing to deploy ${project.name} — it has errors:\n${formatDiagnostics(
+        project.diagnostics.filter((d) => d.severity === "error")
+      )}`
+    );
+  }
   return {
     hosting: project.agent.hosting,
     architecture: project.agent.architecture,

package/src/internal/conversation-mirror.ts

@@ -12,12 +12,13 @@
  * This module mirrors the conversation through the SDK's own store APIs —
  * the agent document (which carries `sdkMetadata.blobEncryptionKey`, without
  * which the checkpoint blobs cannot be decrypted) plus its content-addressed
- * checkpoint blobs — into the deployment's shared file storage. On
- * Cursor-managed hosting that is the Agent Store reached over
- * `/v0/agent-serve-files` presigned URLs: the store is **not mounted** as a
- * filesystem in the engine VM (the FUSE mount at
- * {@link DEPLOYMENT_STORE_MOUNT_PATH} exists only on cloud-runtime VMs), so
- * the mirror moves bytes through the {@link FileSink} contract instead.
+ * checkpoint blobs — into the deployment's **framework-level** file store
+ * (`AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID`), alongside session records and
+ * transcripts and apart from the author-facing user store. The store is an
+ * Agent Store reached over `/v0/agent-serve-files` presigned URLs — **not
+ * mounted** as a filesystem in the engine VM (the FUSE mount at
+ * {@link DEPLOYMENT_STORE_MOUNT_PATH} exists only on cloud-runtime VMs) —
+ * so the mirror moves bytes through the {@link FileSink} contract instead.
  *
  * Going through the store APIs rather than copying `store.db` files sidesteps
  * WAL consistency and the shared `index.db` (per-session raw copies would
@@ -38,10 +39,11 @@
 import type { LocalAgentDocument, LocalAgentStore } from "@cursor/sdk";
 import { agentStoreKeys, type FileSink } from "../files.js";
 import {
+  cursorFrameworkStoreSourceId,
   cursorHostedFiles,
-  isCursorHostedFilesAvailable,
 } from "../files-backends/cursor-hosted.js";
 import type { AgentProject } from "../types.js";
+import { mapBounded } from "./bounded.js";
 import { resolveApiKeySync } from "./cursor/credentials.js";
 import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
 import { describeError } from "./describe-error.js";
@@ -91,21 +93,44 @@ export function createConversationMirror(
 ): ConversationMirror {
   const { sink, agentName } = options;
   const logger = options.logger ?? (() => {});
-  /** Blob ids known to be in the sink, per SDK agent id (upload dedupe). */
+  /**
+   * Blob ids known to be in the sink, per SDK agent id (upload dedupe).
+   * Bounded oldest-out like the files backend's etag cache: a resident
+   * engine touches an unbounded number of conversations over its lifetime,
+   * and a miss costs one manifest read, never correctness.
+   */
   const mirrored = new Map<string, Set<string>>();
+  const rememberMirrored = (sdkAgentId: string, blobIds: Set<string>): void => {
+    if (
+      !mirrored.has(sdkAgentId) &&
+      mirrored.size >= MAX_TRACKED_CONVERSATIONS
+    ) {
+      const oldest = mirrored.keys().next();
+      if (!oldest.done) {
+        mirrored.delete(oldest.value);
+      }
+    }
+    mirrored.set(sdkAgentId, blobIds);
+  };
   /**
    * Per-conversation serialization so a persist cannot interleave with a
-   * hydrate (or another persist) for the same conversation.
+   * hydrate (or another persist) for the same conversation. Entries are
+   * removed once their chain settles as the tail, so the map tracks only
+   * conversations with work in flight.
    */
   const chains = new Map<string, Promise<unknown>>();
 
   function serialize<T>(sdkAgentId: string, run: () => Promise<T>): Promise<T> {
     const previous = chains.get(sdkAgentId) ?? Promise.resolve();
     const next = previous.then(run, run);
-    chains.set(
-      sdkAgentId,
-      next.catch(() => {})
-    );
+    const stored = next
+      .catch(() => {})
+      .then(() => {
+        if (chains.get(sdkAgentId) === stored) {
+          chains.delete(sdkAgentId);
+        }
+      });
+    chains.set(sdkAgentId, stored);
     return next;
   }
 
@@ -115,20 +140,22 @@ export function createConversationMirror(
       return cached;
     }
     // Seed from the previous manifest so a fresh pod does not re-upload the
-    // whole history on its first persist. A miss (or parse failure) seeds
-    // empty — re-uploading is wasteful, never wrong.
+    // whole history on its first persist. A miss, an unusable manifest, or
+    // a failed read seeds empty — re-uploading is wasteful, never wrong.
     const seeded = new Set<string>();
     try {
-      const manifest = await readManifest(sink, agentName, sdkAgentId);
-      for (const blobId of manifest?.blobIds ?? []) {
-        seeded.add(blobId);
+      const read = await readManifest(sink, agentName, sdkAgentId);
+      if (read.outcome === "found") {
+        for (const blobId of read.manifest.blobIds) {
+          seeded.add(blobId);
+        }
       }
     } catch (error) {
       logger(
         `[agent-sdk] conversation mirror: could not read the prior manifest for ${sdkAgentId} (${describeError(error)}); re-uploading blobs`
       );
     }
-    mirrored.set(sdkAgentId, seeded);
+    rememberMirrored(sdkAgentId, seeded);
     return seeded;
   }
 
@@ -182,57 +209,77 @@ export function createConversationMirror(
         if (existing !== null) {
           return false;
         }
-        const manifest = await readManifest(sink, agentName, sdkAgentId);
-        if (manifest === undefined) {
+        const read = await readManifest(sink, agentName, sdkAgentId);
+        if (read.outcome === "miss") {
           return false;
         }
+        if (read.outcome === "unusable") {
+          // Definitive, non-transient state (a future manifest version
+          // during a rolling redeploy, or corruption): retrying would fail
+          // identically forever, so fall through to the caller's
+          // fresh-conversation path instead of wedging the session.
+          logger(
+            `[agent-sdk] conversation mirror: the manifest for ${sdkAgentId} is unusable (${read.reason}); treating the conversation as unrestorable`
+          );
+          return false;
+        }
+        const manifest = read.manifest;
         const rootBlobId = manifest.agent.latestCheckpoint?.rootBlobId;
-        const restored = new Set<string>();
-        for (const blobId of manifest.blobIds) {
-          const body = await sink.get(
-            agentStoreKeys.conversationBlob(agentName, sdkAgentId, blobId)
+        if (
+          rootBlobId === undefined ||
+          !manifest.blobIds.includes(rootBlobId)
+        ) {
+          logger(
+            `[agent-sdk] conversation mirror: the manifest for ${sdkAgentId} does not list its root checkpoint blob; treating the conversation as unrestorable`
           );
-          const bytes =
-            body === undefined
-              ? undefined
-              : body instanceof Uint8Array
-                ? body
-                : body.body;
-          if (bytes === undefined) {
-            // Definitive absence (never uploaded, or deleted). A missing
-            // root blob makes the conversation unrestorable — fall through
-            // to the caller's fresh-conversation path rather than creating
-            // an agent row whose checkpoint cannot load.
-            if (blobId === rootBlobId) {
-              logger(
-                `[agent-sdk] conversation mirror: the root checkpoint blob for ${sdkAgentId} is missing from the sink; treating the conversation as unrestorable`
-              );
-              return false;
-            }
-            continue;
-          }
+          return false;
+        }
+        // Bounded-parallel downloads: this sits on the resume critical path
+        // (a presign plus an object GET per blob against the hosted sink).
+        const bodies = await mapBounded(
+          manifest.blobIds,
+          HYDRATE_DOWNLOAD_CONCURRENCY,
+          async (blobId) => ({
+            blobId,
+            body: await sink.get(
+              agentStoreKeys.conversationBlob(agentName, sdkAgentId, blobId)
+            ),
+          })
+        );
+        const missing = bodies.filter((entry) => entry.body === undefined);
+        if (missing.length > 0) {
+          // The manifest lists exactly what a previous persist uploaded, so
+          // any definitive absence is store loss — and the checkpoint graph
+          // may reach any listed blob, not just the root. Restoring a
+          // partial graph would create an agent row whose resume succeeds
+          // and whose checkpoint walk then fails unrecoverably.
+          logger(
+            `[agent-sdk] conversation mirror: ${missing.length} checkpoint blob(s) for ${sdkAgentId} are missing from the sink; treating the conversation as unrestorable`
+          );
+          return false;
+        }
+        const restored = new Set<string>();
+        for (const entry of bodies) {
+          const body = entry.body as NonNullable<typeof entry.body>;
+          const bytes = body instanceof Uint8Array ? body : body.body;
           if (
-            (await store.checkpoints.get({ agentId: sdkAgentId, blobId })) ===
-            null
+            (await store.checkpoints.get({
+              agentId: sdkAgentId,
+              blobId: entry.blobId,
+            })) === null
           ) {
             await store.checkpoints.create({
               agentId: sdkAgentId,
-              blobId,
+              blobId: entry.blobId,
               data: bytes,
             });
           }
-          restored.add(blobId);
-        }
-        if (rootBlobId !== undefined && !restored.has(rootBlobId)) {
-          logger(
-            `[agent-sdk] conversation mirror: the manifest for ${sdkAgentId} does not list its root checkpoint blob; treating the conversation as unrestorable`
-          );
-          return false;
+          restored.add(entry.blobId);
         }
         await store.agents.create({
           agent: { ...manifest.agent, activeRunId: null },
         });
-        mirrored.set(sdkAgentId, restored);
+        rememberMirrored(sdkAgentId, restored);
         logger(
           `[agent-sdk] conversation mirror: restored the conversation for ${sdkAgentId} (${restored.size} checkpoint blob(s))`
         );
@@ -242,27 +289,52 @@ export function createConversationMirror(
   };
 }
 
+/** Oldest-out cap on the per-conversation upload-dedupe cache. */
+const MAX_TRACKED_CONVERSATIONS = 1_000;
+
+/** Parallel blob downloads during hydrate (resume critical path). */
+const HYDRATE_DOWNLOAD_CONCURRENCY = 8;
+
+type ManifestRead =
+  /** No manifest was ever persisted (definitive miss). */
+  | { outcome: "miss" }
+  /**
+   * A manifest exists but cannot be used (future version, corruption,
+   * wrong agent). Definitive and non-transient — callers must not retry,
+   * and must not treat it as a sink outage.
+   */
+  | { outcome: "unusable"; reason: string }
+  | { outcome: "found"; manifest: ConversationManifestV1 };
+
+/**
+ * Read the persisted manifest. Sink transport failures propagate (an
+ * outage must fail the follow-up, not fork the thread); everything the
+ * bytes themselves can be wrong about is reported as `unusable`.
+ */
 async function readManifest(
   sink: FileSink,
   agentName: string,
   sdkAgentId: string
-): Promise<ConversationManifestV1 | undefined> {
+): Promise<ManifestRead> {
   const body = await sink.get(
     agentStoreKeys.conversationManifest(agentName, sdkAgentId)
   );
   if (body === undefined) {
-    return undefined;
+    return { outcome: "miss" };
   }
   const bytes = body instanceof Uint8Array ? body : body.body;
-  const parsed: unknown = JSON.parse(new TextDecoder().decode(bytes));
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return { outcome: "unusable", reason: "not JSON" };
+  }
   if (
     parsed === null ||
     typeof parsed !== "object" ||
     (parsed as { v?: unknown }).v !== 1
   ) {
-    throw new Error(
-      `conversation mirror: unsupported manifest for ${sdkAgentId}`
-    );
+    return { outcome: "unusable", reason: "unsupported manifest version" };
   }
   const manifest = parsed as ConversationManifestV1;
   if (
@@ -271,11 +343,9 @@ async function readManifest(
     manifest.agent.agentId !== sdkAgentId ||
     !Array.isArray(manifest.blobIds)
   ) {
-    throw new Error(
-      `conversation mirror: malformed manifest for ${sdkAgentId}`
-    );
+    return { outcome: "unusable", reason: "malformed manifest" };
   }
-  return manifest;
+  return { outcome: "found", manifest };
 }
 
 async function listCheckpointBlobIds(
@@ -299,8 +369,10 @@ async function listCheckpointBlobIds(
  *
  * Selected for architecture-v2 agents on Cursor-managed hosting — the same
  * generation signal as framework-storage-selection.ts, plus a provisioned
- * deployment file store. Self-hosted v2 keeps everything on the state root
- * (the operator owns the disk), and v1 keeps today's behavior while it runs.
+ * **framework-level** file store: conversation state is engine-owned, so it
+ * lives with session records and transcripts, never on the author-facing
+ * user store. Self-hosted v2 keeps everything on the state root (the
+ * operator owns the disk), and v1 keeps today's behavior while it runs.
  */
 export function selectConversationMirror(input: {
   project: AgentProject;
@@ -311,18 +383,22 @@ export function selectConversationMirror(input: {
     return undefined;
   }
   const env = input.env ?? process.env;
+  const frameworkStoreId = cursorFrameworkStoreSourceId(
+    env as NodeJS.ProcessEnv
+  );
   if (
     env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined ||
-    !isCursorHostedFilesAvailable(env as NodeJS.ProcessEnv)
+    frameworkStoreId === undefined
   ) {
     return undefined;
   }
   return createConversationMirror({
     sink: cursorHostedFiles({
+      storeSourceId: frameworkStoreId,
       // Full chain (env → key file → stored login): frozen engines listen
       // unsigned and bind CURSOR_API_KEY_FILE at task time, after this sink
       // is constructed.
-      apiKey: () => resolveApiKeySync()?.apiKey,
+      resolveApiKey: () => resolveApiKeySync()?.apiKey,
     }),
     agentName: input.project.name,
     logger: input.logger,