@cursor/july 0.1.96 → 0.1.97

package/dist/docs/troubleshooting.md

@@ -37,7 +37,7 @@ not on `PATH`, use `npx @cursor/july`.
 | What you see | What to do |
 | --- | --- |
 | `409` on a follow-up message | Refresh the `continuationToken` or confirm the session is a chat session. Task sessions do not accept follow-ups. |
-| `409 session_busy` on `call --session` | Wait for the model turn to finish, or omit `--session` for a one-off call. |
+| `409 session_busy` on `call --session` | The tool is a write (or declares no effect) and a model turn is running. Wait for the turn to finish, omit `--session` for a one-off call, or declare `effect: "read"` on a tool that only reads so it runs alongside turns. |
 | `403` on stream or follow-up | Use the same auth identity that created the session. Off localhost, pass `--bearer-token` and send it on every request. |
 | Works on localhost; blocked through a tunnel or LAN | Default auth allows only direct loopback callers. Share the host with `--bearer-token <secret>` (or authored `bearerAuth`). Use `--allow-anonymous` only on a trusted private network. |
 | A channel route fails to compile with a schema type error | `GET` routes need a Zod `querySchema`. `POST` / `PUT` / `PATCH` need a Zod `bodySchema`. Use `z.object({})` or `z.unknown()` for open shapes. |
@@ -65,7 +65,7 @@ not on `PATH`, use `npx @cursor/july`.
 | What you see | What to do |
 | --- | --- |
 | `must be defineConnection({ url, oauth: true })` | The connection file needs `oauth: true`, or you passed the wrong connection name to `agent-sdk mcp oauth`. |
-| Local auth works; hosted calls unauthorized | Run `agent-sdk mcp oauth <name> --store`, confirm names with `agent-sdk secrets list <slug>`, then redeploy. |
+| Local auth works; hosted calls unauthorized | Finish Connect on the hosted engine, or run `agent-sdk mcp oauth <name> --store`. Confirm names with `agent-sdk secrets list <slug>`, then redeploy. |
 | Model asks for `mcp_auth` or IDE MCP for a connector it already has | Attached MCP is behind meta-tools. Set `advertiseTools: true` for named tools on local turns, or call it from a host tool via `ctx.host.mcp`. |
 
 See [Host MCP OAuth](/docs/guides/mcp-oauth.md) and

package/dist/evals/run-facts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-facts.d.ts","sourceRoot":"","sources":["../../src/evals/run-facts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oCAAoC;IACpC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,yDAAyD;IACzD,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,CAgM5E"}
+{"version":3,"file":"run-facts.d.ts","sourceRoot":"","sources":["../../src/evals/run-facts.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oCAAoC;IACpC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACtC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,yDAAyD;IACzD,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;IAC7C,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,eAAe,EAAE,gBAAgB,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,CAgO5E"}

package/dist/evals/run-facts.js

@@ -95,6 +95,33 @@ export function deriveRunFacts(events) {
                 }
                 break;
             }
+            case "action.auth_requested": {
+                const request = {
+                    callId: event.data.callId,
+                    toolName: event.data.toolName,
+                    args: {
+                        connection: event.data.connection,
+                        authUrl: event.data.authUrl,
+                    },
+                    resolved: false,
+                };
+                inputRequests.push(request);
+                inputRequestsByCallId.set(event.data.callId, request);
+                break;
+            }
+            case "action.auth_resolved": {
+                const request = inputRequestsByCallId.get(event.data.callId);
+                if (request !== undefined) {
+                    request.resolved = true;
+                    request.decision = event.data.decision;
+                }
+                const fact = ensureCall(event.data.callId, event.data.toolName, event.turnId, event.data.parentCallId);
+                fact.approvalDecision = event.data.decision;
+                if (event.data.decision === "deny") {
+                    fact.status = "rejected";
+                }
+                break;
+            }
             case "subagent.called": {
                 const existing = subagentsByCallId.get(event.data.callId);
                 if (existing === undefined) {

package/dist/internal/advertise-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advertise-tools.d.ts","sourceRoot":"","sources":["../../src/internal/advertise-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAGf,aAAa,EACb,WAAW,EAGZ,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,QAAQ,CACN,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CAAC;CACzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAiC,CAAC;AAO7E,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,CACV,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAsC5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAsHD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAkBR"}
+{"version":3,"file":"advertise-tools.d.ts","sourceRoot":"","sources":["../../src/internal/advertise-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAGf,aAAa,EACb,WAAW,EAGZ,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,QAAQ,CACN,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CAAC;CACzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAiC,CAAC;AAO7E,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,CACV,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA2D5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAsHD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAkBR"}

package/dist/internal/advertise-tools.js

@@ -66,22 +66,28 @@ export function resolveAdvertisedTools(args) {
             return [];
         }
         const sourceFor = (_a = args.sourceFor) !== null && _a !== void 0 ? _a : sourceForConnection;
-        const claimed = new Set(args.agent.tools.map((tool) => tool.name));
-        const resolved = [];
-        for (const connection of advertising) {
-            let listed;
-            let source;
+        const listings = yield Promise.all(advertising.map((connection) => __awaiter(this, void 0, void 0, function* () {
             try {
-                source = yield sourceFor(connection, args.session, args.hostMcp);
-                listed = yield source.listTools();
+                const source = yield sourceFor(connection, args.session, args.hostMcp);
+                const listed = yield source.listTools();
+                return { connection, ok: true, source, listed };
             }
             catch (error) {
+                return { connection, ok: false, error };
+            }
+        })));
+        const claimed = new Set(args.agent.tools.map((tool) => tool.name));
+        const resolved = [];
+        for (const listing of listings) {
+            const { connection } = listing;
+            if (!listing.ok) {
                 if (args.onConnectionError !== undefined) {
-                    args.onConnectionError(connection.name, error);
+                    args.onConnectionError(connection.name, listing.error);
                     continue;
                 }
-                throw new Error(`Failed to list tools on advertised connection "${connection.name}": ${describeError(error)}`, { cause: error });
+                throw new Error(`Failed to list tools on advertised connection "${connection.name}": ${describeError(listing.error)}`, { cause: listing.error });
             }
+            const { source, listed } = listing;
             const intended = listed.filter((info) => !isDoNotCallTool(info.annotations) &&
                 matchesIntendedEffects(info.annotations, connection.effects));
             const exposed = exposeListedTools(intended, claimed);

package/dist/internal/approval-gate.d.ts

@@ -1,31 +1,30 @@
 /**
- * In-memory gate for human-in-the-loop tool approvals. The session
- * engine parks inside a server-tool `execute` by awaiting
- * {@link ApprovalGate.wait}; HTTP (or the playground) unblocks via
- * {@link ApprovalGate.resolve}.
+ * In-memory gate for human-in-the-loop parks. The session engine parks
+ * inside a server-tool `execute` by awaiting {@link ApprovalGate.wait};
+ * HTTP (or the playground) unblocks via {@link ApprovalGate.resolve}.
  *
- * Pending approvals are also mirrored onto {@link SessionRecord} for
- * durability of the *list* across reloads. After a process restart the
- * in-flight SDK tool callback is gone, so resolve returns false and
- * the host treats the approval as interrupted.
+ * Used for `needsApproval` and MCP on-demand auth. Pending rows are also
+ * mirrored onto {@link SessionRecord} for durability of the *list* across
+ * reloads. After a process restart the in-flight SDK tool callback is gone,
+ * so resolve returns false and the host treats the park as interrupted.
  */
 import type { ApprovalDecision, PendingApproval } from "../types.js";
 export interface ApprovalResolution {
     decision: ApprovalDecision;
     by?: string;
 }
-export declare class ApprovalGate {
+export declare class ApprovalGate<T extends {
+    callId: string;
+} = PendingApproval> {
     private readonly waiters;
-    wait(meta: PendingApproval & {
-        sessionId: string;
-    }): Promise<ApprovalResolution>;
+    wait(sessionId: string, meta: T): Promise<ApprovalResolution>;
     /**
      * Unblock a waiter. Returns false when there is no live waiter (e.g. the
      * host restarted while the tool call was parked).
      */
     resolve(sessionId: string, callId: string, decision: ApprovalDecision, resolvedBy?: string): boolean;
     has(sessionId: string, callId: string): boolean;
-    list(sessionId: string): PendingApproval[];
+    list(sessionId: string): T[];
     /** Drop waiters for a session (e.g. turn already failed). */
     cancelSession(sessionId: string, decision?: ApprovalDecision): void;
     /** Unblock every live waiter (e.g. engine shutdown). */

package/dist/internal/approval-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-gate.d.ts","sourceRoot":"","sources":["../../src/internal/approval-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAMrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAOD,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,IAAI,CACF,IAAI,EAAE,eAAe,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,kBAAkB,CAAC,CAoB7B;IAED;;;OAGG;IACH,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAcT;IAED,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9C;IAED,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE,CASzC;IAED,6DAA6D;IAC7D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,GAAE,gBAAyB,GAAG,IAAI,CAS1E;IAED,wDAAwD;IACxD,SAAS,CAAC,QAAQ,GAAE,gBAAyB,GAAG,IAAI,CAKnD;CACF"}
+{"version":3,"file":"approval-gate.d.ts","sourceRoot":"","sources":["../../src/internal/approval-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAMrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAOD,qBAAa,YAAY,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe;IACtE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAc5D;IAED;;;OAGG;IACH,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAcT;IAED,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9C;IAED,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,EAAE,CAS3B;IAED,6DAA6D;IAC7D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,GAAE,gBAAyB,GAAG,IAAI,CAS1E;IAED,wDAAwD;IACxD,SAAS,CAAC,QAAQ,GAAE,gBAAyB,GAAG,IAAI,CAKnD;CACF"}

package/dist/internal/approval-gate.js

@@ -1,13 +1,12 @@
 /**
- * In-memory gate for human-in-the-loop tool approvals. The session
- * engine parks inside a server-tool `execute` by awaiting
- * {@link ApprovalGate.wait}; HTTP (or the playground) unblocks via
- * {@link ApprovalGate.resolve}.
+ * In-memory gate for human-in-the-loop parks. The session engine parks
+ * inside a server-tool `execute` by awaiting {@link ApprovalGate.wait};
+ * HTTP (or the playground) unblocks via {@link ApprovalGate.resolve}.
  *
- * Pending approvals are also mirrored onto {@link SessionRecord} for
- * durability of the *list* across reloads. After a process restart the
- * in-flight SDK tool callback is gone, so resolve returns false and
- * the host treats the approval as interrupted.
+ * Used for `needsApproval` and MCP on-demand auth. Pending rows are also
+ * mirrored onto {@link SessionRecord} for durability of the *list* across
+ * reloads. After a process restart the in-flight SDK tool callback is gone,
+ * so resolve returns false and the host treats the park as interrupted.
  */
 function approvalKey(sessionId, callId) {
     return `${sessionId}\0${callId}`;
@@ -16,21 +15,15 @@ export class ApprovalGate {
     constructor() {
         this.waiters = new Map();
     }
-    wait(meta) {
-        const key = approvalKey(meta.sessionId, meta.callId);
+    wait(sessionId, meta) {
+        const key = approvalKey(sessionId, meta.callId);
         const existing = this.waiters.get(key);
         if (existing !== undefined) {
-            throw new Error(`Approval already pending for session ${meta.sessionId} call ${meta.callId}`);
+            throw new Error(`Approval already pending for session ${sessionId} call ${meta.callId}`);
         }
         return new Promise((resolveDecision) => {
             this.waiters.set(key, {
-                meta: {
-                    callId: meta.callId,
-                    turnId: meta.turnId,
-                    toolName: meta.toolName,
-                    args: meta.args,
-                    requestedAt: meta.requestedAt,
-                },
+                meta,
                 resolve: resolveDecision,
             });
         });
@@ -46,9 +39,11 @@ export class ApprovalGate {
             return false;
         }
         this.waiters.delete(key);
-        waiter.resolve(Object.assign({ decision }, (resolvedBy === undefined || resolvedBy === ""
-            ? {}
-            : { by: resolvedBy })));
+        const by = resolvedBy === undefined || resolvedBy === "" ? undefined : resolvedBy;
+        waiter.resolve({
+            decision,
+            by,
+        });
         return true;
     }
     has(sessionId, callId) {

package/dist/internal/chat-client.js

@@ -364,6 +364,16 @@ function streamTurn(args) {
                     write(`    ${mark} ${c.bold(event.data.toolName)} ${c.dim(event.data.decision === "approve" ? "approved" : "denied")}\n`);
                     continue;
                 }
+                if (event.type === "action.auth_requested") {
+                    closeAssistant();
+                    write(`    ${c.yellow("⏸")} ${c.bold(event.data.connection)} ${c.dim("awaiting MCP authorization")}\n`);
+                    continue;
+                }
+                if (event.type === "action.auth_resolved") {
+                    const mark = event.data.decision === "approve" ? c.green("✓") : c.red("✗");
+                    write(`    ${mark} ${c.bold(event.data.connection)} ${c.dim(event.data.decision === "approve" ? "connected" : "denied")}\n`);
+                    continue;
+                }
                 if (event.type === "action.result") {
                     if (event.data.toolName === "task" &&
                         event.data.parentCallId === undefined) {

package/dist/internal/cli-deploy.d.ts

@@ -53,6 +53,11 @@ export interface DeployCliOptions {
     cursorEventsRepos?: string[];
     /** deploy `--allow-domain <domain>` (repeatable; unioned with the manifest). */
     allowDomains?: string[];
+    /**
+     * deploy `--multi-tenant`: add a release to an existing Cursor-managed
+     * (multi-tenant) product. Cannot create a new multi-tenant application.
+     */
+    multiTenant?: boolean;
     /** Test seams. */
     fetchImpl?: typeof fetch;
     /** Inject the connector-auth browser opener (tests; also forces interactive). */

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAaxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4E1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAwkBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqGjB;AAMD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAaxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8E1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAgnBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqGjB;AAMD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -152,7 +152,9 @@ export function cmdDeploy(options) {
             manifests.push(yield readDeployManifest(target.dir));
         }
         if (manifests.every((manifest) => manifest.architecture === "v2")) {
-            return deployAgentsdkApplication(ctx, options, targets);
+            return deployAgentsdkApplication(ctx, options, targets, {
+                hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+            });
         }
         if (!ctx.json &&
             manifests.some((manifest) => manifest.architecture === "v2")) {
@@ -488,8 +490,14 @@ function deployOne(ctx, options, target, extras) {
                 gitRef,
                 agentPath,
                 repositories: options.cursorEventsRepos,
+                hasScmChannels: manifest.hasScmChannels,
+                multiTenant: options.multiTenant === true,
             });
         }
+        if (options.multiTenant === true) {
+            ctx.err("--multi-tenant is only valid for architecture: v2 deploys (Cursor-managed products).\n");
+            return 1;
+        }
         // Today's only source shape: the control plane builds from a git ref.
         // See DeploySource for the artifact seam.
         const source = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ kind: "git-ref", gitRepoUrl }, (gitRef === undefined ? {} : { gitRef })), (agentPath === undefined ? {} : { agentPath })), (options.cursorEventsRepos === undefined ||
@@ -546,10 +554,7 @@ function deployOne(ctx, options, target, extras) {
             return detail.status === "running" ? 0 : 1;
         }
         if (detail.status !== "running") {
-            const errorDetail = detail.lastError === null || detail.lastError === undefined
-                ? ""
-                : `: ${sanitizeCustomerError(detail.lastError)}`;
-            ctx.err(`Deployment ${slug} ended ${detail.status}${errorDetail}\n`);
+            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
         const deployedPublicRoutes = (_h = detail.publicRoutePaths) !== null && _h !== void 0 ? _h : [];
@@ -580,7 +585,7 @@ function deployOne(ctx, options, target, extras) {
  * key is the child's slug and its path is the child directory relative to
  * the repo root (a shared --path names the parent's directory in the repo).
  */
-function deployAgentsdkApplication(ctx, options, targets) {
+function deployAgentsdkApplication(ctx, options, targets, declarations) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c, _d, _e;
         const parentDir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
@@ -640,6 +645,8 @@ function deployAgentsdkApplication(ctx, options, targets) {
             agentPath: undefined,
             components,
             repositories: options.cursorEventsRepos,
+            hasScmChannels: declarations.hasScmChannels,
+            multiTenant: options.multiTenant === true,
         });
     });
 }
@@ -650,23 +657,19 @@ function deployAgentsdkApplication(ctx, options, targets) {
  */
 function deployOneAgentsdk(ctx, extras, args) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { slug } = args;
         const componentsLine = args.components === undefined
             ? ""
             : `  components:  ${args.components
                 .map((component) => component.componentKey)
                 .join(", ")}\n`;
+        if (args.multiTenant && !ctx.json) {
+            ctx.err("  multi-tenant: existing product\n");
+        }
         let accepted;
         try {
-            accepted = yield ctx.client.deployAgentkit({
-                teamId: ctx.teamId,
-                slug,
-                gitRepoUrl: args.gitRepoUrl,
-                gitRef: args.gitRef,
-                agentPath: args.agentPath,
-                components: args.components,
-                repositories: args.repositories,
-            });
+            accepted = yield ctx.client.deployAgentkit(Object.assign({ teamId: ctx.teamId, slug, gitRepoUrl: args.gitRepoUrl, gitRef: args.gitRef, agentPath: args.agentPath, components: args.components, repositories: args.repositories }, (args.multiTenant ? { multiTenant: true } : {})));
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -702,7 +705,7 @@ function deployOneAgentsdk(ctx, extras, args) {
             return detail.status === "running" ? 0 : 1;
         }
         if (detail.status !== "running") {
-            ctx.err(`Deployment ${slug} ended ${detail.status}\n`);
+            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
         ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
@@ -714,7 +717,16 @@ function deployOneAgentsdk(ctx, extras, args) {
                 ? ""
                 : `  components:   ${args.components
                     .map((component) => component.componentKey)
-                    .join(", ")}\n`));
+                    .join(", ")}\n`) +
+            (detail.repositories === undefined || !args.hasScmChannels
+                ? ""
+                : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`));
+        // An agent with GitHub/Origin channels bound to no repository scope gets
+        // no deliveries at all, which is otherwise invisible in this output.
+        if (args.hasScmChannels && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
+            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin channels receive no events.\n` +
+                `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
+        }
         return 0;
     });
 }
@@ -806,6 +818,11 @@ function readDeployManifest(dir) {
                 .filter((channel) => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
                 .map((channel) => channel.id),
             httpChannelPublicEndpoint: ((_a = project.httpChannel.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy),
+            hasScmChannels: project.channels.some((channel) => {
+                var _a;
+                const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
+                return kind === "github" || kind === "origin";
+            }),
         };
     });
 }
@@ -1462,9 +1479,25 @@ function aliasTokenBlock(aliasToken) {
         `  or paste it into the hosted playground (<alias>/playground) sign-in gate.\n` +
         `  Lost tokens: \`${CLI} rotate-token <slug>\` mints a replacement.\n\n`);
 }
+/**
+ * `: <reason>` suffix for a deploy that ended in a non-running state, or
+ * empty when the control plane recorded no reason.
+ */
+function deployFailureDetail(lastError) {
+    if (lastError === null ||
+        lastError === undefined ||
+        lastError.trim() === "") {
+        return "";
+    }
+    return `: ${sanitizeCustomerError(lastError.trim())}`;
+}
 function renderApiError(error, err) {
     if (error instanceof DeployApiError) {
         err(`${error.message}\n`);
+        if (error.status === 409 &&
+            error.message.includes("application multiTenant does not match")) {
+            err("This slug is a Cursor-managed (multi-tenant) product. Redeploy it with --multi-tenant.\n");
+        }
         return 1;
     }
     throw error;

package/dist/internal/cli-mcp-oauth.js

@@ -27,7 +27,8 @@ import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import { deploymentServiceAccountId } from "./deploy-client.js";
 import { loadAgentProject } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
-import { createHostMcpOAuthProvider, MCP_OAUTH_CALLBACK_URL, mcpOauthSecretNames, openBrowser, waitForMcpOAuthCallback, } from "./mcp-oauth.js";
+import { createHostMcpOAuthProvider, MCP_OAUTH_CALLBACK_URL, openBrowser, waitForMcpOAuthCallback, } from "./mcp-oauth.js";
+import { upsertHostMcpOauthSecrets } from "./mcp-oauth-persist.js";
 import { resolveProdSlug } from "./resolve-prod-target.js";
 function describe(error) {
     if (!(error instanceof Error)) {
@@ -287,25 +288,14 @@ function storeOauthSecrets(args) {
         if (typeof auth === "number") {
             return auth;
         }
-        const names = mcpOauthSecretNames(args.connection);
-        const secrets = [
-            { name: names.accessToken, value: tokens.access_token },
-        ];
-        if (tokens.refresh_token !== undefined &&
-            tokens.refresh_token.trim() !== "") {
-            secrets.push({ name: names.refreshToken, value: tokens.refresh_token });
-        }
-        if (args.clientId !== undefined && args.clientId.trim() !== "") {
-            secrets.push({ name: names.clientId, value: args.clientId });
-        }
         try {
-            const secretNames = yield auth.client.setSecrets({
-                teamId: auth.teamId,
-                slug,
-                secrets,
+            const secretNames = yield upsertHostMcpOauthSecrets({
+                connection: args.connection,
+                tokens,
+                clientId: args.clientId,
+                target: { client: auth.client, teamId: auth.teamId, slug },
             });
-            args.out(`${LOG_PREFIX} Stored on ${slug}: ${secrets.map((s) => s.name).join(", ")}.\n` +
-                `${LOG_PREFIX} Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`);
+            args.out(`${LOG_PREFIX} Stored on ${slug}. Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`);
             return 0;
         }
         catch (error) {

package/dist/internal/cli-slack-manual.d.ts

@@ -1,6 +1,8 @@
 /**
- * `slack init --manual` and `slack manifest` — DIY paste-at-api.slack.com.
- * Create/destroy/icon stay in `cli-slack.ts`.
+ * `slack init --manual` and `slack manifest` — unmanaged Slack app.
+ * Slack CLI create+install when `~/.slack/bin/slack` is present;
+ * paste-at-api.slack.com is the fallback. Create/destroy/icon stay
+ * in `cli-slack.ts`.
  */
 export interface SlackManualCliOptions {
     dir: string;
@@ -12,9 +14,29 @@ export interface SlackManualCliOptions {
     channelPosts?: boolean;
     /** Gate for `slack init`; ignored by `slack manifest`. */
     manual?: boolean;
+    /** Require Slack CLI install (fail if missing or install fails). */
+    install?: boolean;
+    /** Skip Slack CLI install even when the CLI is present. */
+    noInstall?: boolean;
+    slackTeam?: string;
+    prod?: boolean;
+    detectSlackCli?: () => string | undefined;
+    runSlackCli?: SlackCliExec;
     out?: (text: string) => void;
     err?: (text: string) => void;
 }
+export interface SlackCliExecRequest {
+    bin: string;
+    argv: string[];
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+}
+export interface SlackCliExecResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type SlackCliExec = (request: SlackCliExecRequest) => Promise<SlackCliExecResult>;
 export declare function cmdSlackInit(options: SlackManualCliOptions): Promise<number>;
 export declare function runSlackManifest(options: SlackManualCliOptions): Promise<number>;
 //# sourceMappingURL=cli-slack-manual.d.ts.map

package/dist/internal/cli-slack-manual.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-slack-manual.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack-manual.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAMD,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAgCjB"}
+{"version":3,"file":"cli-slack-manual.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack-manual.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAoGjC,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAgCjB"}