@cursor/july 0.1.95 → 0.1.97

package/dist/internal/hosted-execution-diag.js

@@ -0,0 +1,150 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, rename, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { HOSTED_EXECUTION_DIAG_FILENAME } from "./hosted-delivery-protocol.js";
+export const HOSTED_EXECUTION_DIAG_VERSION = 1;
+/** Cap so a runaway message cannot fill the guest disk or the host log. */
+export const HOSTED_EXECUTION_DIAG_MAX_BYTES = 4096;
+/**
+ * Correlate the on-disk record with the execution that produced it. One pod
+ * serves many deliveries of a continuation session, and the file lives at a
+ * single fixed path, so without this the host can read a *previous*
+ * delivery's terminal record whenever July never reaches its own write —
+ * the 9-minute host POST timeout, a 409 on an expired admission token, or a
+ * replayed token that short-circuits on the memoized reply.
+ *
+ * Derived from the admission token (which both sides already hold) rather
+ * than carried on the wire. The digest is one-way, so the token itself never
+ * reaches the guest disk or the host logs.
+ */
+export function hostedExecutionDiagId(admissionToken) {
+    return createHash("sha256").update(admissionToken).digest("hex").slice(0, 16);
+}
+/** Written before the turn starts so a stalled execution still has a record. */
+export const HOSTED_EXECUTION_DIAG_RUNNING_STATUS = "running";
+const DIAG_KEYS = new Set([
+    "v",
+    "executionId",
+    "writtenAt",
+    "sessionPublicId",
+    "sessionId",
+    "turnStatus",
+    "durationMs",
+    "message",
+    "signalAborted",
+    "requestId",
+    "abortReason",
+]);
+const ABORT_REASONS = new Set([
+    "signal_abort",
+    "runner_cancelled",
+    "runner_error",
+    "execute_throw",
+]);
+function boundedOptionalString(value, max) {
+    return typeof value === "string" && value.length > 0
+        ? value.length > max
+            ? `${value.slice(0, max)}…`
+            : value
+        : undefined;
+}
+export function hostedExecutionDiagPath(stateRoot) {
+    return join(stateRoot, HOSTED_EXECUTION_DIAG_FILENAME);
+}
+export function abortReasonFromTurnStatus(status, message) {
+    if (status === "finished") {
+        return undefined;
+    }
+    if (status === "cancelled") {
+        return message !== undefined && /abort/i.test(message)
+            ? "signal_abort"
+            : "runner_cancelled";
+    }
+    return "runner_error";
+}
+export function parseHostedExecutionDiag(raw) {
+    if (raw.length === 0 || raw.length > HOSTED_EXECUTION_DIAG_MAX_BYTES) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (_a) {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const body = parsed;
+    if (Object.keys(body).some((key) => !DIAG_KEYS.has(key))) {
+        return undefined;
+    }
+    if (body.v !== HOSTED_EXECUTION_DIAG_VERSION ||
+        typeof body.executionId !== "string" ||
+        body.executionId.length === 0 ||
+        body.executionId.length > 64 ||
+        typeof body.writtenAt !== "string" ||
+        body.writtenAt.length === 0 ||
+        body.writtenAt.length > 64 ||
+        typeof body.sessionPublicId !== "string" ||
+        body.sessionPublicId.length === 0 ||
+        body.sessionPublicId.length > 128 ||
+        typeof body.sessionId !== "string" ||
+        body.sessionId.length > 128 ||
+        typeof body.turnStatus !== "string" ||
+        body.turnStatus.length === 0 ||
+        body.turnStatus.length > 64 ||
+        typeof body.durationMs !== "number" ||
+        !Number.isFinite(body.durationMs) ||
+        body.durationMs < 0) {
+        return undefined;
+    }
+    const message = boundedOptionalString(body.message, 1024);
+    const requestId = boundedOptionalString(body.requestId, 128);
+    const abortReason = body.abortReason === undefined
+        ? undefined
+        : typeof body.abortReason === "string" &&
+            ABORT_REASONS.has(body.abortReason)
+            ? body.abortReason
+            : undefined;
+    if (body.abortReason !== undefined && abortReason === undefined) {
+        return undefined;
+    }
+    if (body.signalAborted !== undefined &&
+        typeof body.signalAborted !== "boolean") {
+        return undefined;
+    }
+    return Object.assign(Object.assign(Object.assign(Object.assign({ v: HOSTED_EXECUTION_DIAG_VERSION, executionId: body.executionId, writtenAt: body.writtenAt, sessionPublicId: body.sessionPublicId, sessionId: body.sessionId, turnStatus: body.turnStatus, durationMs: body.durationMs }, (message === undefined ? {} : { message })), (body.signalAborted === true ? { signalAborted: true } : {})), (requestId === undefined ? {} : { requestId })), (abortReason === undefined ? {} : { abortReason }));
+}
+/**
+ * Overwrite the per-execution diag file. Soft-fail: a write error must not
+ * change the hosted-execution HTTP reply.
+ */
+export function writeHostedExecutionDiag(stateRoot, diag) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const path = hostedExecutionDiagPath(stateRoot);
+        const tmp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+        try {
+            yield mkdir(stateRoot, { recursive: true });
+            const serialized = JSON.stringify(diag);
+            const body = serialized.length > HOSTED_EXECUTION_DIAG_MAX_BYTES
+                ? JSON.stringify(Object.assign(Object.assign({}, diag), { message: boundedOptionalString(diag.message, 256) }))
+                : serialized;
+            yield writeFile(tmp, body, "utf8");
+            yield rename(tmp, path);
+        }
+        catch (_a) {
+            yield unlink(tmp).catch(() => undefined);
+        }
+    });
+}

package/dist/internal/http-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-channel.d.ts","sourceRoot":"","sources":["../../src/internal/http-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAQ7B,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,WAAW,EAAE,CAkZhB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GACA,QAAQ,GAAG,SAAS,CAiBtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC/D,QAAQ,CAQV;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,QAAQ,CAEV;AAoGD,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAc9C"}
+{"version":3,"file":"http-channel.d.ts","sourceRoot":"","sources":["../../src/internal/http-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAQ7B,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,WAAW,EAAE,CAmfhB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GACA,QAAQ,GAAG,SAAS,CAiBtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC/D,QAAQ,CAQV;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,QAAQ,CAEV;AAoGD,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAc9C"}

package/dist/internal/http-channel.js

@@ -22,7 +22,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 import { samePrincipal } from "./auth.js";
 import { formatContinuationToken, parseContinuationToken } from "./ids.js";
 import { isLoopbackAddress } from "./net.js";
-import { ApprovalInterruptedError, ApprovalNotFoundError, HTTP_CHANNEL_ID, SessionAuthError, } from "./session-engine.js";
+import { ApprovalInterruptedError, ApprovalNotFoundError, AuthInterruptedError, AuthNotFoundError, HTTP_CHANNEL_ID, SessionAuthError, } from "./session-engine.js";
 import { eventsUrlForSession, playgroundUrlForSession, } from "./session-urls.js";
 const SESSION_ID_HEADER = "x-agent-serve-session-id";
 export function buildHttpChannelRoutes(args) {
@@ -324,6 +324,84 @@ export function buildHttpChannelRoutes(args) {
             return jsonResponse({ ok: true, interrupted }, { headers: { [SESSION_ID_HEADER]: sessionId } });
         }),
     };
+    const listAuths = {
+        method: "GET",
+        pattern: `${base}/v1/session/:sessionId/auths`,
+        auth,
+        handler: (_request, ctx) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const sessionId = (_a = ctx.params.sessionId) !== null && _a !== void 0 ? _a : "";
+            const record = yield engine.getOrRestoreSession(sessionId);
+            if (record === undefined) {
+                return errorResponse(404, "session_not_found", `Unknown session ${sessionId}.`);
+            }
+            const ownership = requireSessionOwner(record, ctx.auth, {
+                relax: relaxSessionReadAuth,
+                beyondLoopback: relaxSessionReadAuthBeyondLoopback,
+                requestIp: ctx.requestIp,
+            });
+            if (ownership !== undefined) {
+                return ownership;
+            }
+            const pending = yield engine.listPendingAuths(sessionId);
+            return jsonResponse({ ok: true, sessionId, pending });
+        }),
+    };
+    const resolveAuth = {
+        method: "POST",
+        pattern: `${base}/v1/session/:sessionId/auths/:callId`,
+        auth,
+        handler: (request, ctx) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            var _b, _c;
+            const sessionId = (_b = ctx.params.sessionId) !== null && _b !== void 0 ? _b : "";
+            const callId = (_c = ctx.params.callId) !== null && _c !== void 0 ? _c : "";
+            const record = yield engine.getOrRestoreSession(sessionId);
+            if (record === undefined) {
+                return errorResponse(404, "session_not_found", `Unknown session ${sessionId}.`);
+            }
+            const bridgeSlackAuth = relaxSessionApprovalAuth === true &&
+                ((_a = record.auth) === null || _a === void 0 ? void 0 : _a.authenticator) === "slack" &&
+                (relaxSessionReadAuthBeyondLoopback === true ||
+                    (typeof ctx.requestIp === "string" &&
+                        isLoopbackAddress(ctx.requestIp)));
+            const ownership = requireSessionOwner(record, ctx.auth, {
+                relax: bridgeSlackAuth,
+                beyondLoopback: relaxSessionReadAuthBeyondLoopback,
+                requestIp: ctx.requestIp,
+            });
+            if (ownership !== undefined) {
+                return ownership;
+            }
+            const body = yield readJsonObject(request);
+            const decision = body === null || body === void 0 ? void 0 : body.decision;
+            if (decision !== "approve" && decision !== "deny") {
+                return errorResponse(400, "invalid_request", 'Expected a JSON body with `decision`: "approve" | "deny".');
+            }
+            try {
+                const pending = yield engine.resolveAuth(sessionId, callId, decision, ctx.auth, bridgeSlackAuth ? { asSessionOwner: true } : undefined);
+                return jsonResponse({
+                    ok: true,
+                    sessionId,
+                    callId,
+                    decision,
+                    connection: pending.connection,
+                });
+            }
+            catch (error) {
+                if (error instanceof AuthNotFoundError) {
+                    return errorResponse(404, "auth_not_found", error.message);
+                }
+                if (error instanceof AuthInterruptedError) {
+                    return errorResponse(409, "auth_interrupted", error.message);
+                }
+                if (error instanceof SessionAuthError) {
+                    return errorResponse(403, "forbidden", error.message);
+                }
+                throw error;
+            }
+        }),
+    };
     return [
         createSession,
         followUp,
@@ -333,6 +411,8 @@ export function buildHttpChannelRoutes(args) {
         cost,
         listApprovals,
         resolveApproval,
+        listAuths,
+        resolveAuth,
     ];
 }
 export function requireSessionOwner(record, caller, options) {

package/dist/internal/init-project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-project.d.ts","sourceRoot":"","sources":["../../src/internal/init-project.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAiBD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAyBhE;AAWD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,CAgCjB;AAUD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAwDD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAWD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,iCAAiC,CAAC,CAW5C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gEAAgE;IAChE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAwHD,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GACzD,oBAAoB,CAAC;AAMvB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAgBzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,EAAE,CAEX;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAiCrC"}
+{"version":3,"file":"init-project.d.ts","sourceRoot":"","sources":["../../src/internal/init-project.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAmBD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAyBhE;AAWD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,CAgCjB;AAUD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAwDD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAWD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,iCAAiC,CAAC,CAW5C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gEAAgE;IAChE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAwHD,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GACzD,oBAAoB,CAAC;AAMvB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAgBzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,EAAE,CAEX;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAmCrC"}

package/dist/internal/init-project.js

@@ -22,6 +22,8 @@ import { agentsMd, GITIGNORE, writeDefaultScaffold } from "./init-scaffold.js";
 import { makePalette, stdoutPalette, } from "./terminal-style.js";
 const TEMPLATES = {
     "agentic-owners": { dir: "agentic-owners" },
+    "agents-md": { dir: "agents-md" },
+    "code-wiki": { dir: "code-wiki" },
     demo: { dir: "demo" },
     "pr-autofixer": { dir: "pr-autofixer" },
     "security-help": { dir: "security-help" },
@@ -497,6 +499,8 @@ export function printInitGuide() {
 Scaffold a project, then open the playground:
   npx ${PACKAGE_NAME} init ./my-agent   # installs deps + links agent-sdk onto PATH
   npx ${PACKAGE_NAME} init ./my-demo --template demo              # record a PR walkthrough
+  npx ${PACKAGE_NAME} init ./code-wiki --template code-wiki       # keep wiki pages current after merge
+  npx ${PACKAGE_NAME} init ./agents-md --template agents-md       # keep AGENTS.md current from last week's PRs and Slack
   npx ${PACKAGE_NAME} init ./my-reviewer --template security-reviewer   # review PRs for security bugs
   npx ${PACKAGE_NAME} init ./security-help --template security-help   # answer security questions in Slack
   npx ${PACKAGE_NAME} init ./my-triage --template triage-linear   # comment on Linear issues

package/dist/internal/install-cursor-skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-cursor-skills.d.ts","sourceRoot":"","sources":["../../src/internal/install-cursor-skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAsBH,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,qDAAqD;AACrD,eAAO,MAAM,kCAAkC,mCACb,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED,8CAA8C;AAC9C,wBAAgB,6BAA6B,CAC3C,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACpC,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,GAAE,MAAyB,GACrC,OAAO,CAAC,YAAY,EAAE,CAAC,CA6BzB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAY1B;AAED,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kEAAkE;IAClE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kEAAkE;IAClE,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,UAAU,GAAE,MAA2B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;AAiED;;;GAGG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc5E;AAiCD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,wEAAwE;AACxE,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAcR;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEN,MAAM,WAAW,uCAAuC;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,GAAE,uCAA4C,GACpD,OAAO,CAAC,6BAA6B,CAAC,CAgCxC;AAED,MAAM,WAAW,+BAA+B;IAC9C,4CAA4C;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAsB9B"}
+{"version":3,"file":"install-cursor-skills.d.ts","sourceRoot":"","sources":["../../src/internal/install-cursor-skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmBH,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,qDAAqD;AACrD,eAAO,MAAM,kCAAkC,mCACb,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAStD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED,8CAA8C;AAC9C,wBAAgB,6BAA6B,CAC3C,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EACpC,UAAU,GAAE,MAA2B,GACtC,MAAM,CAER;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,GAAE,MAAyB,GACrC,OAAO,CAAC,YAAY,EAAE,CAAC,CA6BzB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAY1B;AAED,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kEAAkE;IAClE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kEAAkE;IAClE,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,UAAU,GAAE,MAA2B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;AAiED;;;GAGG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc5E;AAiCD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+EAA+E;IAC/E,YAAY,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,wEAAwE;AACxE,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuB5B;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,kBAAkB,GACzB,MAAM,CAcR;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/D;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;CAC5D,CAAC;AAEN,MAAM,WAAW,uCAAuC;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,GAAE,uCAA4C,GACpD,OAAO,CAAC,6BAA6B,CAAC,CAgCxC;AAED,MAAM,WAAW,+BAA+B;IAC9C,4CAA4C;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAsB9B"}

package/dist/internal/install-cursor-skills.js

@@ -28,8 +28,6 @@ import { join } from "node:path";
 import { CLI_COMMAND_NAME, packageRootDir } from "./distribution.js";
 import { parseFrontmatter } from "./frontmatter.js";
 import { stdoutPalette } from "./terminal-style.js";
-/** Monorepo-only skill; excluded from the published package. */
-const SKIP_SKILL_DIRS = new Set(["operate"]);
 /** Category folder under ~/.cursor/skills (Cursor discovers nested skills). */
 export const CURSOR_SKILLS_NAMESPACE = "agentsdk";
 /** Pre-rename install folder. Install deletes this so `/agentkit-*` rows disappear. */
@@ -91,7 +89,7 @@ export function listShippedPackageSkills() {
         }
         const skills = [];
         for (const entry of entries) {
-            if (!entry.isDirectory() || SKIP_SKILL_DIRS.has(entry.name)) {
+            if (!entry.isDirectory()) {
                 continue;
             }
             const sourceDir = join(skillsRoot, entry.name);

package/dist/internal/logs-client.d.ts

@@ -26,6 +26,11 @@ export declare function sanitizeCustomerError(message: string): string;
 /**
  * One-line label for `agent-sdk deploy` polling (TTY spinner / non-TTY
  * transitions). Uses statusMessage → progress → raw status.
+ *
+ * Deliberately does NOT include `lastError`. The spinner redraws with
+ * `\r\x1b[2K`, which clears one physical row, so a reason long enough to
+ * soft-wrap would leave the earlier rows on screen. Callers print the
+ * reason once on the final line instead.
  */
 export declare function deployProgressLabel(detail: {
     status: string;

package/dist/internal/logs-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs-client.d.ts","sourceRoot":"","sources":["../../src/internal/logs-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAiBf;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAuBR;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAiBT;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}
+{"version":3,"file":"logs-client.d.ts","sourceRoot":"","sources":["../../src/internal/logs-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAiBf;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAuBR;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAiBT;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}

package/dist/internal/logs-client.js

@@ -78,6 +78,11 @@ export function sanitizeCustomerError(message) {
 /**
  * One-line label for `agent-sdk deploy` polling (TTY spinner / non-TTY
  * transitions). Uses statusMessage → progress → raw status.
+ *
+ * Deliberately does NOT include `lastError`. The spinner redraws with
+ * `\r\x1b[2K`, which clears one physical row, so a reason long enough to
+ * soft-wrap would leave the earlier rows on screen. Callers print the
+ * reason once on the final line instead.
  */
 export function deployProgressLabel(detail) {
     if (detail.statusMessage !== null &&

package/dist/internal/managed-delivery.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Envelope-carried installation config for managed-product deliveries
+ * (plan 0002 Stack H1; envelope shape from Stack B1).
+ *
+ * On the v2 architecture a managed product (security-reviewer, …) is many
+ * single-tenant deployments: the pre-signal trigger gate matches the
+ * customer's automation trigger before a workflow starts and stamps the
+ * matched automation uuid + an opaque installation-config reference on the
+ * attributed session envelope. The delivery activity forwards the matched
+ * installation-config document to the fork **inside the webhook payload it
+ * POSTs to the channel**, under {@link MANAGED_DELIVERY_PAYLOAD_KEY} — the
+ * same embed-in-payload pattern the legacy deployment event stream used
+ * for its source marker.
+ *
+ * This module is the one contract both sides share: the control-plane
+ * delivery path embeds with {@link withManagedDeliveryConfig}; the agent's
+ * channels detect and read with {@link parseManagedDeliveryConfig}. The
+ * document mirrors the sync layer's `ManagedAutomationConfigDoc` **policy**
+ * fields that "ride the delivery envelope to the fork" (posting mode,
+ * managed config, trigger snapshots for the channel's staleness guard);
+ * readers ignore unknown fields so a newer sync can add material without
+ * breaking older forks. The automation's MCP server refs deliberately do
+ * NOT ride here: they travel on the hosted-admission envelope's
+ * `managedAutomation` slice (plan 0002 G2, `hosted-delivery-protocol.ts` /
+ * `hosted-managed-automation.ts`) so one mechanism owns MCP attach.
+ *
+ * INTERNAL: first-party host plumbing shared by agents in `factory/*`,
+ * consumed via relative source imports. Deliberately excluded from the
+ * published `@cursor/july` npm package (see the `files` whitelist).
+ */
+/**
+ * Key inside the delivered webhook payload under which the delivery
+ * activity embeds the matched installation config. Chosen to never
+ * collide with a provider webhook field (GitHub and Origin payloads have
+ * no `cursor*` keys).
+ */
+export declare const MANAGED_DELIVERY_PAYLOAD_KEY: "cursorManagedDelivery";
+/**
+ * The matched installation-config document as it rides the delivery to
+ * the fork. Required: the matched automation uuid (B1 attribution).
+ * Everything else is optional; absent fields keep the channel's default
+ * posture (post, all modules enabled, no staleness guard).
+ */
+export interface ManagedDeliveryInstallationConfig {
+    /** Source managed automation uuid the pre-signal gate matched. */
+    matchedAutomationUuid: string;
+    /** Opaque `<installationId>@<resourceVersion>` config reference. */
+    installationConfigRef?: string;
+    managedType?: string;
+    name?: string;
+    /**
+     * Whether product output (PR comments, …) posts for this installation,
+     * or the run stays check/shadow-only. Channels post only on `"post"`
+     * (or when the field is absent) — any other value fails closed to
+     * shadow, so a newer mode name never posts by accident.
+     */
+    postingMode?: string;
+    managedConfig?: Record<string, unknown>;
+    /**
+     * The automation's git triggers as `GitTrigger.toJson()` snapshots.
+     * The channel re-checks the delivery against them (staleness guard:
+     * the config may have changed between admission and delivery).
+     */
+    triggerSnapshots?: unknown[];
+}
+/**
+ * Read the embedded installation config out of a delivered webhook
+ * payload. Returns undefined for payloads without the key (legacy
+ * deliveries, host relay, fixtures) and for documents missing the
+ * required matched automation uuid — the channel then runs its legacy
+ * path unchanged. Malformed optional fields are dropped, not fatal.
+ */
+export declare function parseManagedDeliveryConfig(payload: unknown): ManagedDeliveryInstallationConfig | undefined;
+/**
+ * Embed one matched installation config into the webhook payload the
+ * delivery activity POSTs to the channel. Pure; used by the control-plane
+ * delivery path and by channel tests building fixture envelopes.
+ */
+export declare function withManagedDeliveryConfig(payload: Record<string, unknown>, config: ManagedDeliveryInstallationConfig): Record<string, unknown>;
+//# sourceMappingURL=managed-delivery.d.ts.map

package/dist/internal/managed-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-delivery.d.ts","sourceRoot":"","sources":["../../src/internal/managed-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAG,uBAAgC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,kEAAkE;IAClE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;CAC9B;AAcD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,GACf,iCAAiC,GAAG,SAAS,CAuB/C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,MAAM,EAAE,iCAAiC,GACxC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB"}

package/dist/internal/managed-delivery.js

@@ -0,0 +1,86 @@
+/**
+ * Envelope-carried installation config for managed-product deliveries
+ * (plan 0002 Stack H1; envelope shape from Stack B1).
+ *
+ * On the v2 architecture a managed product (security-reviewer, …) is many
+ * single-tenant deployments: the pre-signal trigger gate matches the
+ * customer's automation trigger before a workflow starts and stamps the
+ * matched automation uuid + an opaque installation-config reference on the
+ * attributed session envelope. The delivery activity forwards the matched
+ * installation-config document to the fork **inside the webhook payload it
+ * POSTs to the channel**, under {@link MANAGED_DELIVERY_PAYLOAD_KEY} — the
+ * same embed-in-payload pattern the legacy deployment event stream used
+ * for its source marker.
+ *
+ * This module is the one contract both sides share: the control-plane
+ * delivery path embeds with {@link withManagedDeliveryConfig}; the agent's
+ * channels detect and read with {@link parseManagedDeliveryConfig}. The
+ * document mirrors the sync layer's `ManagedAutomationConfigDoc` **policy**
+ * fields that "ride the delivery envelope to the fork" (posting mode,
+ * managed config, trigger snapshots for the channel's staleness guard);
+ * readers ignore unknown fields so a newer sync can add material without
+ * breaking older forks. The automation's MCP server refs deliberately do
+ * NOT ride here: they travel on the hosted-admission envelope's
+ * `managedAutomation` slice (plan 0002 G2, `hosted-delivery-protocol.ts` /
+ * `hosted-managed-automation.ts`) so one mechanism owns MCP attach.
+ *
+ * INTERNAL: first-party host plumbing shared by agents in `factory/*`,
+ * consumed via relative source imports. Deliberately excluded from the
+ * published `@cursor/july` npm package (see the `files` whitelist).
+ */
+/**
+ * Key inside the delivered webhook payload under which the delivery
+ * activity embeds the matched installation config. Chosen to never
+ * collide with a provider webhook field (GitHub and Origin payloads have
+ * no `cursor*` keys).
+ */
+export const MANAGED_DELIVERY_PAYLOAD_KEY = "cursorManagedDelivery";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed === "" ? undefined : trimmed;
+}
+/**
+ * Read the embedded installation config out of a delivered webhook
+ * payload. Returns undefined for payloads without the key (legacy
+ * deliveries, host relay, fixtures) and for documents missing the
+ * required matched automation uuid — the channel then runs its legacy
+ * path unchanged. Malformed optional fields are dropped, not fatal.
+ */
+export function parseManagedDeliveryConfig(payload) {
+    if (!isRecord(payload)) {
+        return undefined;
+    }
+    const doc = payload[MANAGED_DELIVERY_PAYLOAD_KEY];
+    if (!isRecord(doc)) {
+        return undefined;
+    }
+    const matchedAutomationUuid = nonEmptyString(doc.matchedAutomationUuid);
+    if (matchedAutomationUuid === undefined) {
+        return undefined;
+    }
+    return {
+        matchedAutomationUuid,
+        installationConfigRef: nonEmptyString(doc.installationConfigRef),
+        managedType: nonEmptyString(doc.managedType),
+        name: nonEmptyString(doc.name),
+        postingMode: nonEmptyString(doc.postingMode),
+        managedConfig: isRecord(doc.managedConfig) ? doc.managedConfig : undefined,
+        triggerSnapshots: Array.isArray(doc.triggerSnapshots)
+            ? doc.triggerSnapshots
+            : undefined,
+    };
+}
+/**
+ * Embed one matched installation config into the webhook payload the
+ * delivery activity POSTs to the channel. Pure; used by the control-plane
+ * delivery path and by channel tests building fixture envelopes.
+ */
+export function withManagedDeliveryConfig(payload, config) {
+    return Object.assign(Object.assign({}, payload), { [MANAGED_DELIVERY_PAYLOAD_KEY]: config });
+}

package/dist/internal/mcp-endpoint.js

@@ -200,7 +200,7 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
         if (reason !== undefined) {
             throw new Error(reason);
         }
-        const tools = yield engine.host.mcp.listTools(connectionName);
+        const tools = yield engine.runWithMcpPark(sessionId !== null && sessionId !== void 0 ? sessionId : "", "tools/list", () => engine.host.mcp.listTools(connectionName));
         return {
             tools: tools.map((tool) => { var _a; return (Object.assign(Object.assign(Object.assign(Object.assign({ name: tool.name }, (tool.description === undefined
                 ? {}
@@ -212,7 +212,6 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
         };
     }));
     server.setRequestHandler(CallToolRequestSchema, (request) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
         const reason = rejected();
         if (reason !== undefined) {
             return errorResult(reason);
@@ -228,7 +227,7 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
             return sdkResultToMcpResult(answer.result);
         }
         try {
-            const result = yield engine.host.mcp.callTool(connectionName, request.params.name, (_a = request.params.arguments) !== null && _a !== void 0 ? _a : {});
+            const result = yield engine.runWithMcpPark(sessionId !== null && sessionId !== void 0 ? sessionId : "", request.params.name, () => { var _a; return engine.host.mcp.callTool(connectionName, request.params.name, (_a = request.params.arguments) !== null && _a !== void 0 ? _a : {}); });
             return Object.assign(Object.assign({ 
                 // The host client already speaks MCP, so the content array is valid
                 // CallToolResult content; HostMcpCallResult just types the tail of

package/dist/internal/mcp-host.d.ts

@@ -10,6 +10,12 @@
  * and stay on `host.mcp` plus `mcp oauth`.
  */
 import type { DiscoveredConnection, HostMcpCallResult, HostMcpRegistry, HostMcpToolInfo, McpToolAnnotations } from "../types.js";
+export declare class McpNeedsAuthError extends Error {
+    readonly connection: string;
+    constructor(connection: string, cause?: unknown);
+}
+export declare function isMcpNeedsAuthError(error: unknown): error is McpNeedsAuthError;
+export declare function hostMcpCallNeedsAuth(result: HostMcpCallResult): boolean;
 /**
  * A non-caching view of one connection: every operation opens a fresh
  * client and closes it afterwards. See {@link McpHost.oneOff}.
@@ -21,7 +27,10 @@ export interface HostMcpOneOff {
 export declare class McpHost implements HostMcpRegistry {
     private readonly byName;
     private readonly clients;
+    private oauthRedirectUrl;
     constructor(connections: DiscoveredConnection[]);
+    /** Public serve callback for host OAuth (not the CLI loopback port on pods). */
+    setOAuthRedirectUrl(url: string): void;
     /**
      * Register a connection after construction (serve-time resolved peers).
      * Clients open lazily on first use, so adding before first call is safe.
@@ -40,6 +49,7 @@ export declare class McpHost implements HostMcpRegistry {
      */
     oneOff(connection: DiscoveredConnection): HostMcpOneOff;
     callTool(connectionName: string, toolName: string, args?: Record<string, unknown>): Promise<HostMcpCallResult>;
+    dropClient(name: string): Promise<void>;
     close(): Promise<void>;
     /**
      * Run against a cached host MCP client, reconnecting once when the remote

package/dist/internal/mcp-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AASrB;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA0BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}
+{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAIrB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,YAAY,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAS9C;CACF;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAE5B;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAQvE;AAiBD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,gBAAgB,CAAqB;IAE7C,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED,gFAAgF;IAChF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAErC;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA8BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5C;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}