@cursor/july 0.1.96 → 0.1.97

package/src/internal/deploy-client.ts

@@ -260,6 +260,13 @@ export interface AgentkitDeployStatus {
   status: AgentkitCustomerStatus;
   progress: AgentkitDeployProgress;
   statusMessage: string | null;
+  /** Why the bake failed. Null/absent unless `status` is `failed`. */
+  lastError?: string | null;
+  /**
+   * `owner/name` scopes the deployment's GitHub/Origin channels watch.
+   * Absent on control planes that predate the field.
+   */
+  repositories?: string[];
 }
 
 export const TERMINAL_AGENTKIT_DEPLOY_STATUSES: ReadonlySet<AgentkitCustomerStatus> =
@@ -350,6 +357,8 @@ const agentkitDeployStatusSchema = z
       "stopped",
     ]),
     statusMessage: z.string().nullable(),
+    // Optional: backends that predate the v2 bake-failure column omit it.
+    lastError: z.string().nullable().optional(),
   })
   .passthrough();
 
@@ -598,6 +607,8 @@ export class AgentServeDeployClient {
     agentPath?: string;
     components?: AgentkitDeployComponent[];
     repositories?: string[];
+    /** Redeploy an existing Cursor-managed (multi-tenant) product. */
+    multiTenant?: boolean;
   }): Promise<AgentkitDeployAccepted> {
     const slugError = validateDeploymentSlug(args.slug);
     if (slugError !== undefined) {
@@ -626,6 +637,7 @@ export class AgentServeDeployClient {
           args.repositories !== undefined && args.repositories.length > 0
             ? args.repositories
             : undefined,
+        ...(args.multiTenant === true ? { multiTenant: true } : {}),
       },
       context: { verb: "deploy", slug: args.slug },
     });
@@ -890,6 +902,37 @@ export class AgentServeDeployClient {
   }
 }
 
+const MCP_GATEWAY_PATH =
+  /^\/internal\/agent-serve\/mcp\/(\d+)\/([^/]+)(?:\/tools)?\/?$/;
+
+/**
+ * Inverse of {@link AgentServeDeployClient.mcpGatewayUrl}. Also accepts
+ * the hosted `--cloud-tools-url` form (`…/tools`).
+ */
+export function parseAgentServeMcpGatewayUrl(
+  url: string
+): { teamId: number; slug: string } | undefined {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return undefined;
+  }
+  const match = MCP_GATEWAY_PATH.exec(parsed.pathname);
+  if (match === null) {
+    return undefined;
+  }
+  const teamId = Number.parseInt(match[1]!, 10);
+  if (!Number.isInteger(teamId) || teamId <= 0) {
+    return undefined;
+  }
+  const slug = decodeURIComponent(match[2]!);
+  if (validateDeploymentSlug(slug) !== undefined) {
+    return undefined;
+  }
+  return { teamId, slug };
+}
+
 // ============================================================================
 // Error mapping (HTTP → actionable human messages)
 // ============================================================================

package/src/internal/env-file.ts

@@ -0,0 +1,84 @@
+/**
+ * Shared `.env` / `.env.local` writers for CLI commands that mint tokens.
+ */
+
+import { chmod, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+function isErrnoException(error: unknown): error is NodeJS.ErrnoException {
+  return error instanceof Error && "code" in error;
+}
+
+async function readOptionalFile(path: string): Promise<string> {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (isErrnoException(error) && error.code === "ENOENT") {
+      return "";
+    }
+    throw error;
+  }
+}
+
+/**
+ * Append `KEY=value` lines to an env file, replacing every existing line
+ * for the same key instead of appending duplicates. Creates the file when
+ * missing.
+ */
+export async function upsertEnvFile(
+  path: string,
+  entries: Array<{ key: string; value: string }>
+): Promise<void> {
+  const existing = await readOptionalFile(path);
+  const lines =
+    existing === "" ? [] : existing.replace(/\r?\n$/, "").split(/\r?\n/);
+  // A stale `export KEY=…` line would shadow or duplicate the bare line
+  // under some loaders; treat both spellings as the same entry.
+  const matchesKey = (line: string, key: string): boolean =>
+    line.startsWith(`${key}=`) || line.startsWith(`export ${key}=`);
+  for (const { key, value } of entries) {
+    const next = `${key}=${value}`;
+    let replaced = false;
+    for (let i = 0; i < lines.length; ) {
+      if (!matchesKey(lines[i] ?? "", key)) {
+        i += 1;
+        continue;
+      }
+      if (replaced) {
+        lines.splice(i, 1);
+        continue;
+      }
+      lines[i] = next;
+      replaced = true;
+      i += 1;
+    }
+    if (!replaced) {
+      lines.push(next);
+    }
+  }
+  // writeFile's mode only applies on create; clamp pre-existing files too.
+  await writeFile(path, `${lines.join("\n")}\n`, { mode: 0o600 });
+  await chmod(path, 0o600);
+}
+
+/**
+ * Ensure the agent directory's .gitignore covers .env.local (create or
+ * append). A bare `.env` line does not count — that pattern matches only
+ * the file literally named .env.
+ */
+export async function ensureEnvLocalGitignored(dir: string): Promise<boolean> {
+  const path = join(dir, ".gitignore");
+  const existing = await readOptionalFile(path);
+  const covered = existing
+    .split(/\r?\n/)
+    .some((line) => /^\.env(\.local\*?|\.\*|\*)$/.test(line.trim()));
+  if (covered) {
+    return false;
+  }
+  const next =
+    existing === "" || existing.endsWith("\n")
+      ? `${existing}.env.local\n`
+      : `${existing}\n.env.local\n`;
+  await writeFile(path, next);
+  return true;
+}

package/src/internal/framework-file-storage.ts

@@ -171,7 +171,7 @@ function decodeDocument(key: string, bytes: Uint8Array): JsonValue {
 export function composeFrameworkStorage(input: {
   kv: FileSinkStorageCore;
   files: FileSinkStorageCore;
-}): FileSinkStorageCore {
+}): FileSinkStorageCore & Pick<StorageConfig, "listNewest"> {
   const route = (key: string): FileSinkStorageCore =>
     isFrameworkFileKey(key) ? input.files : input.kv;
   return {
@@ -179,6 +179,12 @@ export function composeFrameworkStorage(input: {
     get: (key, ctx) => route(key).get(key, ctx),
     delete: (key, ctx) => route(key).delete(key, ctx),
     list: (prefix, ctx) => route(prefix).list(prefix, ctx),
+    // Session records — the only `listNewest` consumer — are framework file
+    // keys, and the file store has no write-time ordering. Spreading the KV
+    // backend's `listNewest` through would query rows that live elsewhere
+    // (stale KV leftovers, or nothing), so the composed core explicitly has
+    // none and the engine falls back to the routed `list`.
+    listNewest: undefined,
   };
 }
 

package/src/internal/hosted-delivery-protocol.ts

@@ -2,6 +2,13 @@ export const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
 export const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
 export const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
 export const HOSTED_EXECUTION_PATH = "/v1/internal/hosted-execution";
+/**
+ * Filename under the serve `--state-root` (not the per-slug SessionEngine
+ * dir). Hosted freeze uses `/workspace/.agent-serve`; the Temporal host
+ * reads this path after hosted-execution and logs it on the activity span.
+ * Must match `AGENT_SERVE_ENGINE_HOSTED_EXECUTION_DIAG_PATH` basename.
+ */
+export const HOSTED_EXECUTION_DIAG_FILENAME = "hosted-execution.json";
 
 export type HostedAdmissionManagedAutomation = {
   automationUuid: string;

package/src/internal/hosted-delivery.ts

@@ -27,6 +27,12 @@ import {
   parseHostedAdmission,
   parseHostedExecution,
 } from "./hosted-delivery-protocol.js";
+import {
+  abortReasonFromTurnStatus,
+  HOSTED_EXECUTION_DIAG_RUNNING_STATUS,
+  hostedExecutionDiagId,
+  writeHostedExecutionDiag,
+} from "./hosted-execution-diag.js";
 import { recordHostedManagedAutomation } from "./hosted-managed-automation.js";
 import { errorResponse, readJsonObject } from "./http-channel.js";
 import type { Router } from "./router.js";
@@ -252,6 +258,12 @@ export function registerHostedDeliveryRoute(input: {
    * the conversation on the next wake.
    */
   drainSessionDurability?(sessionId: string): Promise<void>;
+  /**
+   * Serve `--state-root` (not the per-slug SessionEngine dir). Hosted
+   * freeze is `/workspace/.agent-serve`; the Temporal host reads
+   * `hosted-execution.json` from that path after the POST returns.
+   */
+  stateRoot?: string;
 }): void {
   const pending = new Map<
     string,
@@ -383,39 +395,100 @@ export function registerHostedDeliveryRoute(input: {
       }
       admitted.sessionPublicId = execution.sessionPublicId;
       admitted.execution ??= (async (): Promise<ExecutionReply> => {
-        const args = input.buildHandlerArgs(
-          admitted.send.channelId,
-          execution.sessionPublicId
-        );
-        const session = await args.send(admitted.send.message, {
-          ...admitted.send.options,
-          mailboxContinuation: {
-            key: admitted.send.mailboxContinuationKey,
-          },
+        const startedAt = performance.now();
+        const executionId = hostedExecutionDiagId(execution.admissionToken);
+        const writeDiag = async (fields: {
+          sessionId: string;
+          turnStatus: string;
+          message?: string;
+          abortReason?:
+            | ReturnType<typeof abortReasonFromTurnStatus>
+            | "execute_throw";
+        }): Promise<void> => {
+          if (input.stateRoot === undefined) {
+            return;
+          }
+          const message =
+            fields.message === undefined
+              ? undefined
+              : boundedMessage(fields.message);
+          await writeHostedExecutionDiag(input.stateRoot, {
+            v: 1,
+            executionId,
+            writtenAt: new Date().toISOString(),
+            sessionPublicId: execution.sessionPublicId,
+            sessionId: fields.sessionId,
+            turnStatus: fields.turnStatus,
+            durationMs: Math.max(0, Math.round(performance.now() - startedAt)),
+            ...(message === undefined ? {} : { message }),
+            ...(message !== undefined && /abort/i.test(message)
+              ? { signalAborted: true }
+              : {}),
+            ...(fields.abortReason === undefined
+              ? {}
+              : { abortReason: fields.abortReason }),
+          });
+        };
+        // Claim the file before the turn runs. The host reads it after its
+        // own POST returns, which for a 9-minute timeout is while this turn
+        // is still going; without this marker that read would surface the
+        // PREVIOUS delivery's terminal record as if it were this one's.
+        await writeDiag({
+          sessionId: "",
+          turnStatus: HOSTED_EXECUTION_DIAG_RUNNING_STATUS,
         });
-        const outcome = await session.waitForCompletion();
-        // Failed turns drain too: their record/continuation updates must
-        // survive the park just like a finished turn's.
-        await input.drainSessionDurability?.(session.id);
-        if (outcome.status !== "finished") {
+        try {
+          const args = input.buildHandlerArgs(
+            admitted.send.channelId,
+            execution.sessionPublicId
+          );
+          const session = await args.send(admitted.send.message, {
+            ...admitted.send.options,
+            mailboxContinuation: {
+              key: admitted.send.mailboxContinuationKey,
+            },
+          });
+          const outcome = await session.waitForCompletion();
+          // Failed turns drain too: their record/continuation updates must
+          // survive the park just like a finished turn's.
+          await input.drainSessionDurability?.(session.id);
+          await writeDiag({
+            sessionId: session.id,
+            turnStatus: outcome.status,
+            message: outcome.errorMessage,
+            abortReason: abortReasonFromTurnStatus(
+              outcome.status,
+              outcome.errorMessage
+            ),
+          });
+          if (outcome.status !== "finished") {
+            return {
+              status: 503,
+              body: {
+                ok: false,
+                error: "turn_failed",
+                turnStatus: outcome.status,
+                message: outcome.errorMessage,
+              },
+            };
+          }
           return {
-            status: 503,
+            status: 200,
             body: {
-              ok: false,
-              error: "turn_failed",
-              turnStatus: outcome.status,
-              message: outcome.errorMessage,
+              ok: true,
+              v: HOSTED_DELIVERY_PROTOCOL_VERSION,
+              outcome: "send",
             },
           };
+        } catch (error) {
+          await writeDiag({
+            sessionId: "",
+            turnStatus: "error",
+            message: error instanceof Error ? error.message : String(error),
+            abortReason: "execute_throw",
+          });
+          throw error;
         }
-        return {
-          status: 200,
-          body: {
-            ok: true,
-            v: HOSTED_DELIVERY_PROTOCOL_VERSION,
-            outcome: "send",
-          },
-        };
       })();
       const reply = await admitted.execution;
       return finish(Response.json(reply.body, { status: reply.status }));

package/src/internal/hosted-execution-diag.ts

@@ -0,0 +1,207 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, rename, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+import { HOSTED_EXECUTION_DIAG_FILENAME } from "./hosted-delivery-protocol.js";
+
+export const HOSTED_EXECUTION_DIAG_VERSION = 1;
+/** Cap so a runaway message cannot fill the guest disk or the host log. */
+export const HOSTED_EXECUTION_DIAG_MAX_BYTES = 4096;
+
+/**
+ * Correlate the on-disk record with the execution that produced it. One pod
+ * serves many deliveries of a continuation session, and the file lives at a
+ * single fixed path, so without this the host can read a *previous*
+ * delivery's terminal record whenever July never reaches its own write —
+ * the 9-minute host POST timeout, a 409 on an expired admission token, or a
+ * replayed token that short-circuits on the memoized reply.
+ *
+ * Derived from the admission token (which both sides already hold) rather
+ * than carried on the wire. The digest is one-way, so the token itself never
+ * reaches the guest disk or the host logs.
+ */
+export function hostedExecutionDiagId(admissionToken: string): string {
+  return createHash("sha256").update(admissionToken).digest("hex").slice(0, 16);
+}
+
+export type HostedExecutionDiagAbortReason =
+  | "signal_abort"
+  | "runner_cancelled"
+  | "runner_error"
+  | "execute_throw";
+
+/**
+ * Bounded guest-side record of one hosted-execution attempt. No prompt,
+ * tool content, or API key — the host copies known keys onto the Temporal
+ * activity span for Datadog.
+ */
+export type HostedExecutionDiag = {
+  v: typeof HOSTED_EXECUTION_DIAG_VERSION;
+  /** {@link hostedExecutionDiagId} of the execution that wrote this record. */
+  executionId: string;
+  writtenAt: string;
+  sessionPublicId: string;
+  sessionId: string;
+  /** Terminal {@link TurnOutcome} status, or `running` before the turn ends. */
+  turnStatus: string;
+  durationMs: number;
+  message?: string;
+  signalAborted?: boolean;
+  requestId?: string;
+  abortReason?: HostedExecutionDiagAbortReason;
+};
+
+/** Written before the turn starts so a stalled execution still has a record. */
+export const HOSTED_EXECUTION_DIAG_RUNNING_STATUS = "running";
+
+const DIAG_KEYS = new Set([
+  "v",
+  "executionId",
+  "writtenAt",
+  "sessionPublicId",
+  "sessionId",
+  "turnStatus",
+  "durationMs",
+  "message",
+  "signalAborted",
+  "requestId",
+  "abortReason",
+]);
+
+const ABORT_REASONS = new Set<HostedExecutionDiagAbortReason>([
+  "signal_abort",
+  "runner_cancelled",
+  "runner_error",
+  "execute_throw",
+]);
+
+function boundedOptionalString(
+  value: unknown,
+  max: number
+): string | undefined {
+  return typeof value === "string" && value.length > 0
+    ? value.length > max
+      ? `${value.slice(0, max)}…`
+      : value
+    : undefined;
+}
+
+export function hostedExecutionDiagPath(stateRoot: string): string {
+  return join(stateRoot, HOSTED_EXECUTION_DIAG_FILENAME);
+}
+
+export function abortReasonFromTurnStatus(
+  status: string,
+  message: string | undefined
+): HostedExecutionDiagAbortReason | undefined {
+  if (status === "finished") {
+    return undefined;
+  }
+  if (status === "cancelled") {
+    return message !== undefined && /abort/i.test(message)
+      ? "signal_abort"
+      : "runner_cancelled";
+  }
+  return "runner_error";
+}
+
+export function parseHostedExecutionDiag(
+  raw: string
+): HostedExecutionDiag | undefined {
+  if (raw.length === 0 || raw.length > HOSTED_EXECUTION_DIAG_MAX_BYTES) {
+    return undefined;
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return undefined;
+  }
+  const body = parsed as Record<string, unknown>;
+  if (Object.keys(body).some((key) => !DIAG_KEYS.has(key))) {
+    return undefined;
+  }
+  if (
+    body.v !== HOSTED_EXECUTION_DIAG_VERSION ||
+    typeof body.executionId !== "string" ||
+    body.executionId.length === 0 ||
+    body.executionId.length > 64 ||
+    typeof body.writtenAt !== "string" ||
+    body.writtenAt.length === 0 ||
+    body.writtenAt.length > 64 ||
+    typeof body.sessionPublicId !== "string" ||
+    body.sessionPublicId.length === 0 ||
+    body.sessionPublicId.length > 128 ||
+    typeof body.sessionId !== "string" ||
+    body.sessionId.length > 128 ||
+    typeof body.turnStatus !== "string" ||
+    body.turnStatus.length === 0 ||
+    body.turnStatus.length > 64 ||
+    typeof body.durationMs !== "number" ||
+    !Number.isFinite(body.durationMs) ||
+    body.durationMs < 0
+  ) {
+    return undefined;
+  }
+  const message = boundedOptionalString(body.message, 1024);
+  const requestId = boundedOptionalString(body.requestId, 128);
+  const abortReason =
+    body.abortReason === undefined
+      ? undefined
+      : typeof body.abortReason === "string" &&
+          ABORT_REASONS.has(body.abortReason as HostedExecutionDiagAbortReason)
+        ? (body.abortReason as HostedExecutionDiagAbortReason)
+        : undefined;
+  if (body.abortReason !== undefined && abortReason === undefined) {
+    return undefined;
+  }
+  if (
+    body.signalAborted !== undefined &&
+    typeof body.signalAborted !== "boolean"
+  ) {
+    return undefined;
+  }
+  return {
+    v: HOSTED_EXECUTION_DIAG_VERSION,
+    executionId: body.executionId,
+    writtenAt: body.writtenAt,
+    sessionPublicId: body.sessionPublicId,
+    sessionId: body.sessionId,
+    turnStatus: body.turnStatus,
+    durationMs: body.durationMs,
+    ...(message === undefined ? {} : { message }),
+    ...(body.signalAborted === true ? { signalAborted: true } : {}),
+    ...(requestId === undefined ? {} : { requestId }),
+    ...(abortReason === undefined ? {} : { abortReason }),
+  };
+}
+
+/**
+ * Overwrite the per-execution diag file. Soft-fail: a write error must not
+ * change the hosted-execution HTTP reply.
+ */
+export async function writeHostedExecutionDiag(
+  stateRoot: string,
+  diag: HostedExecutionDiag
+): Promise<void> {
+  const path = hostedExecutionDiagPath(stateRoot);
+  const tmp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  try {
+    await mkdir(stateRoot, { recursive: true });
+    const serialized = JSON.stringify(diag);
+    const body =
+      serialized.length > HOSTED_EXECUTION_DIAG_MAX_BYTES
+        ? JSON.stringify({
+            ...diag,
+            message: boundedOptionalString(diag.message, 256),
+          })
+        : serialized;
+    await writeFile(tmp, body, "utf8");
+    await rename(tmp, path);
+  } catch {
+    await unlink(tmp).catch(() => undefined);
+  }
+}

package/src/internal/http-channel.ts

@@ -25,6 +25,8 @@ import type { ServerRoute } from "./router.js";
 import {
   ApprovalInterruptedError,
   ApprovalNotFoundError,
+  AuthInterruptedError,
+  AuthNotFoundError,
   HTTP_CHANNEL_ID,
   SessionAuthError,
   type SessionEngine,
@@ -454,6 +456,101 @@ export function buildHttpChannelRoutes(args: {
     },
   };
 
+  const listAuths: ServerRoute = {
+    method: "GET",
+    pattern: `${base}/v1/session/:sessionId/auths`,
+    auth,
+    handler: async (_request, ctx) => {
+      const sessionId = ctx.params.sessionId ?? "";
+      const record = await engine.getOrRestoreSession(sessionId);
+      if (record === undefined) {
+        return errorResponse(
+          404,
+          "session_not_found",
+          `Unknown session ${sessionId}.`
+        );
+      }
+      const ownership = requireSessionOwner(record, ctx.auth, {
+        relax: relaxSessionReadAuth,
+        beyondLoopback: relaxSessionReadAuthBeyondLoopback,
+        requestIp: ctx.requestIp,
+      });
+      if (ownership !== undefined) {
+        return ownership;
+      }
+      const pending = await engine.listPendingAuths(sessionId);
+      return jsonResponse({ ok: true, sessionId, pending });
+    },
+  };
+
+  const resolveAuth: ServerRoute = {
+    method: "POST",
+    pattern: `${base}/v1/session/:sessionId/auths/:callId`,
+    auth,
+    handler: async (request, ctx) => {
+      const sessionId = ctx.params.sessionId ?? "";
+      const callId = ctx.params.callId ?? "";
+      const record = await engine.getOrRestoreSession(sessionId);
+      if (record === undefined) {
+        return errorResponse(
+          404,
+          "session_not_found",
+          `Unknown session ${sessionId}.`
+        );
+      }
+      const bridgeSlackAuth =
+        relaxSessionApprovalAuth === true &&
+        record.auth?.authenticator === "slack" &&
+        (relaxSessionReadAuthBeyondLoopback === true ||
+          (typeof ctx.requestIp === "string" &&
+            isLoopbackAddress(ctx.requestIp)));
+      const ownership = requireSessionOwner(record, ctx.auth, {
+        relax: bridgeSlackAuth,
+        beyondLoopback: relaxSessionReadAuthBeyondLoopback,
+        requestIp: ctx.requestIp,
+      });
+      if (ownership !== undefined) {
+        return ownership;
+      }
+      const body = await readJsonObject(request);
+      const decision = body?.decision;
+      if (decision !== "approve" && decision !== "deny") {
+        return errorResponse(
+          400,
+          "invalid_request",
+          'Expected a JSON body with `decision`: "approve" | "deny".'
+        );
+      }
+      try {
+        const pending = await engine.resolveAuth(
+          sessionId,
+          callId,
+          decision,
+          ctx.auth,
+          bridgeSlackAuth ? { asSessionOwner: true } : undefined
+        );
+        return jsonResponse({
+          ok: true,
+          sessionId,
+          callId,
+          decision,
+          connection: pending.connection,
+        });
+      } catch (error) {
+        if (error instanceof AuthNotFoundError) {
+          return errorResponse(404, "auth_not_found", error.message);
+        }
+        if (error instanceof AuthInterruptedError) {
+          return errorResponse(409, "auth_interrupted", error.message);
+        }
+        if (error instanceof SessionAuthError) {
+          return errorResponse(403, "forbidden", error.message);
+        }
+        throw error;
+      }
+    },
+  };
+
   return [
     createSession,
     followUp,
@@ -463,6 +560,8 @@ export function buildHttpChannelRoutes(args: {
     cost,
     listApprovals,
     resolveApproval,
+    listAuths,
+    resolveAuth,
   ];
 }
 

package/src/internal/init-project.ts

@@ -74,6 +74,7 @@ type TemplateEntry = {
 
 const TEMPLATES: Readonly<Record<TemplateName, TemplateEntry>> = {
   "agentic-owners": { dir: "agentic-owners" },
+  "agents-md": { dir: "agents-md" },
   "code-wiki": { dir: "code-wiki" },
   demo: { dir: "demo" },
   "pr-autofixer": { dir: "pr-autofixer" },
@@ -711,6 +712,7 @@ Scaffold a project, then open the playground:
   npx ${PACKAGE_NAME} init ./my-agent   # installs deps + links agent-sdk onto PATH
   npx ${PACKAGE_NAME} init ./my-demo --template demo              # record a PR walkthrough
   npx ${PACKAGE_NAME} init ./code-wiki --template code-wiki       # keep wiki pages current after merge
+  npx ${PACKAGE_NAME} init ./agents-md --template agents-md       # keep AGENTS.md current from last week's PRs and Slack
   npx ${PACKAGE_NAME} init ./my-reviewer --template security-reviewer   # review PRs for security bugs
   npx ${PACKAGE_NAME} init ./security-help --template security-help   # answer security questions in Slack
   npx ${PACKAGE_NAME} init ./my-triage --template triage-linear   # comment on Linear issues